Fix immutable field validation error when a sub-schema is not Pydantic

src/_nebari/stages/terraform_state/__init__.py

@@ -6,7 +6,7 @@
 import re
 from typing import Any, Dict, List, Optional, Tuple, Type
 
-from pydantic import field_validator
+from pydantic import field_validator, BaseModel
 
 from _nebari import utils
 from _nebari.provider import terraform
@@ -275,9 +275,15 @@ def check_immutable_fields(self):
                             bottom_level_schema = bottom_level_schema[key]
                         else:
                             raise e
-            extra_field_schema = schema.ExtraFieldSchema(
-                **bottom_level_schema.model_fields[keys[-1]].json_schema_extra or {}
-            )
+
+            # Return a default (mutable) extra field schema if bottom level is not a Pydantic model (such as a free-form 'overrides' block)
+            if isinstance(bottom_level_schema, BaseModel):                
+                extra_field_schema = schema.ExtraFieldSchema(
+                    **bottom_level_schema.model_fields[keys[-1]].json_schema_extra or {}
+                )
+            else:
+                extra_field_schema = schema.ExtraFieldSchema()
+
             if extra_field_schema.immutable:
                 key_path = ".".join(keys)
                 raise ValueError(

tests/tests_unit/cli_validate/local.happy.yaml

@@ -23,3 +23,8 @@ theme:
 certificate:
   type: lets-encrypt
   acme_email: [email protected]
+jupyterhub:
+  overrides:
+    singleuser:
+      extraEnv:
+        TEST_ENV: "my_env"

tests/tests_unit/test_stages.py

@@ -103,3 +103,15 @@ def test_check_immutable_fields_old_nebari_version(
 
     # This should not raise an exception
     terraform_state_stage.check_immutable_fields()
+
+@patch.object(TerraformStateStage, "get_nebari_config_state")
+def test_check_immutable_fields_change_dict_any(
+    mock_get_state, terraform_state_stage, mock_config
+):
+    old_config = mock_config.model_copy(deep=True).model_dump()
+    # Change the value of a config deep in 'overrides' block
+    old_config["jupyterhub"]["overrides"]["singleuser"]["extraEnv"]["TEST_ENV"] = "new_value"
+    mock_get_state.return_value = old_config
+
+    # This should not raise an exception
+    terraform_state_stage.check_immutable_fields()