Writing a dynamic test for this scenario is a bit difficult with the current TF SDK. A dynamic acceptance test would require the test code to set up a secret/auth engine mount within Vault without running a plan or apply, which currently does not seem possible in the SDK. I was able to test the fix manually with the steps mentioned in the PR description with different cases for the TF state, and can dig into more dynamic tests using the SDK in the future if they are a possibility.

@vinay-gopalan RE: writing a test for this scenario

I wonder if we could make use of the Vault API client (provider.GetClient) to set up a secret/auth engine mount within Vault? I think that should allow us to bypass the plan/apply in the SDK?

@vinay-gopalan RE: writing a test for this scenario

I wonder if we could make use of the Vault API client (provider.GetClient) to set up a secret/auth engine mount within Vault? I think that should allow us to bypass the plan/apply in the SDK?

@fairclothjm good question! I actually tried something very similar to what you were pointing at, and it doesn't look like the SDK allows an Import step to be the first step in a testcase 🤔

func TestAccProvider_ImportNamespace(t *testing.T) {
	// need to short circuit the test
	// in case these are unset
	testutil.TestEntPreCheck(t)
	testutil.SkipTestEnvUnset(t, consts.EnvVarVaultNamespaceImport)

	mountPath := acctest.RandomWithPrefix("tf-pki-mount")
	resourceName := "vault_mount.pki"
	ns := os.Getenv(consts.EnvVarVaultNamespaceImport)

	// create mount in namespace for the test
	client := testProvider.Meta().(*provider.ProviderMeta).GetClient()
	client.SetNamespace(ns)
	err := client.Sys().Mount(mountPath, &api.MountInput{
		Type:        "pki",
		Description: "Mount for testing namespace imports",
	})
	if err != nil {
		t.Fatalf(fmt.Sprintf("error mounting pki engine; err=%s", err))
	}

	resource.Test(t, resource.TestCase{
		Providers: testProviders,
		Steps: []resource.TestStep{
			testutil.GetImportTestStep(resourceName, false, nil),
		},
	})
}

func testNamespaceImportConfig(path string) string {
	return fmt.Sprintf(`
resource "vault_mount" "pki" {
  path    = "%s"
  type    = "pki"
}
`, path)
}

Error returned because no such resource exists in the state (state non-existent):

Resource specified by ResourceName couldn't be found: vault_mount.pki

The test above also requires some prior set up to the Vault server (setting up the namespaces etc.) before it can be run, which might make it more of a local-only test. I'll dig into it a bit more to see if I can find a better solution, but for now we might have to resort to manual testing

@vinay-gopalan I found ExternalProviders and it seems like that should allow us to do an import step as the first step. But I couldn't get it to work so maybe I am misunderstanding that field.

I agree that manual tests should be ok for now since this will likely take a bit of work to figure out. (If it is even possible at all)