When expanding the plan for XXX to include new values learned so far during apply, provider "registry.terraform.io/hashicorp/google" produced an invalid new value for

[Maarc-D]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Terraform Version & Provider Version(s)

Terraform v1.10.5
on

• provider registry.terraform.io/hashicorp/google v6.24.0
• provider registry.terraform.io/hashicorp/google-beta v6.24.0

Affected Resource(s)

• google_compute_forwarding_rule
• google_dns_managed_zone

Terraform Configuration

module call :

module "gsn-consumer" {
  source     = "git::https://XXX.git?ref=2.0.0"
  apis       = module.service-agents.apis
  subnetwork = google_compute_subnetwork.gsn
  project    = local.project_id
  psc-filter-urls = local.gsn-services-to-consume
}

resource "google_compute_subnetwork" "gsn" {
  name                     = lower(replace("subnet-gsn-${local.application_service_prefix}-${var.project}-${terraform.workspace}", "_", "-"))
  ip_cidr_range            = local.gsn_address_space
  region                   = local.gsn-region-selected
  network                  = google_compute_network.this.id
  private_ip_google_access = true
}

concerned module code :

resource "google_compute_forwarding_rule" "this" {
  for_each                = google_compute_address.psc_ilb_consumer_address
  name                    = local.gsn-sa-map[each.key].name
  region                  = var.subnetwork.region
  project                 = var.project
  load_balancing_scheme   = "" # need to override EXTERNAL default when target is a service attachment
  network                 = var.subnetwork.network
  allow_psc_global_access = true
  subnetwork              = var.subnetwork.id
  target                  = local.gsn-sa-map[each.key].id
  ip_address              = each.value.id
}

Debug Output

No response

Expected Behavior

everything running good

Actual Behavior

│ Error: Provider produced inconsistent final plan
│ 
│ When expanding the plan for
│ module.gsn-consumer.google_compute_forwarding_rule.this["kcp.giservices.io"]
│ to include new values learned so far during apply, provider
│ "registry.terraform.io/hashicorp/google" produced an invalid new value for
│ .network: was
│ cty.StringVal("projects/che-pass-ci-dev/global/networks/vpc-pass-ci-dev-passci-dev"),
│ but now
│ cty.StringVal("https://www.googleapis.com/compute/v1/projects/che-pass-ci-dev/global/networks/vpc-pass-ci-dev-passci-dev").
│ 
│ This is a bug in the provider, which should be reported in the provider's
│ own issue tracker.
╵
╷
│ Error: Provider produced inconsistent final plan
│ 
│ When expanding the plan for
│ module.gsn-consumer.google_dns_managed_zone.gsn-psc["sonarqube.kazan.myworldline.com"]
│ to include new values learned so far during apply, provider
│ "registry.terraform.io/hashicorp/google" produced an invalid new value for
│ .private_visibility_config[0].networks: planned set element
│ cty.ObjectVal(map[string]cty.Value{"network_url":cty.StringVal("projects/che-pass-ci-dev/global/networks/vpc-pass-ci-dev-passci-dev")})
│ does not correlate with any element in actual.
│ 
│ This is a bug in the provider, which should be reported in the provider's
│ own issue tracker.
╵

Steps to reproduce

1. terraform apply

Important Factoids

No response

References

No response

b/413059323
b/413060293

[ggtisc]

Hi @Maarc-D we can't reproduce the same issue you are reporting, could you please share with us more information about this situation? what are you targeting for the google_compute_forwarding_rule.target? Could you share the code of this resource and all other involved resources? Example:

resource "google_compute_network" "vpc_21837" {
  name                    = "vpc-21837"
  auto_create_subnetworks = false
}

resource "google_compute_subnetwork" "subnet_21837" {
  name                     = "subnet-21837"
  ip_cidr_range            = "10.0.0.0/16"
  region                   = "europe-west1"
  network                  = google_compute_network.vpc_21837.id
  private_ip_google_access = true
}

resource "google_compute_firewall" "firewall_21837" {
  provider      = google-beta
  name          = "firewall-21837"
  network       = google_compute_network.vpc_21837.id
  source_ranges = ["10.1.2.0/24"]

  allow {
    protocol = "tcp"
  }

  allow {
    protocol = "udp"
  }

  allow {
    protocol = "icmp"
  }

  direction = "INGRESS"
}

resource "google_compute_region_health_check" "healthcheck_21837" {
  depends_on  = [google_compute_firewall.firewall_21837]
  provider    = google-beta
  region      = "europe-west1"
  name        = "healthcheck-21837"

  http_health_check {
    port_specification = "USE_SERVING_PORT"
  }
}

data "google_compute_image" "debian_image" {
  provider = google-beta
  family   = "debian-11"
  project  = "debian-cloud"
}

resource "google_compute_instance_template" "instance_template_21837" {
  provider     = google-beta
  name         = "instance-template-21837"
  machine_type = "e2-medium"

  network_interface {
    network     = google_compute_network.vpc_21837.id
    subnetwork  = google_compute_subnetwork.subnet_21837.id
  }

  disk {
    source_image = data.google_compute_image.debian_image.self_link
    auto_delete  = true
    boot         = true
  }
}

resource "google_compute_region_instance_group_manager" "instance_group_manager_21837" {
  provider = google-beta
  region   = "europe-west1"
  name     = "instance-group-manager-21837"

  version {
    instance_template = google_compute_instance_template.instance_template_21837.id
    name              = "primary"
  }
  base_instance_name = "internal-glb"
  target_size        = 1
}

resource "google_compute_region_backend_service" "backend_service_21837" {
  provider              = google-beta
  load_balancing_scheme = "EXTERNAL_MANAGED"
  region                = "europe-west1"
  name                  = "backend-service-21837"
  protocol              = "HTTP"
  timeout_sec           = 10
  health_checks         = [google_compute_region_health_check.healthcheck_21837.id]

  backend {
    group           = google_compute_region_instance_group_manager.instance_group_manager_21837.instance_group
    balancing_mode  = "UTILIZATION"
    capacity_scaler = 1.0
  }
}

resource "google_compute_region_url_map" "url_map_21837" {
  provider        = google-beta
  region          = "europe-west1"
  name            = "url-map-21837"
  default_service = google_compute_region_backend_service.backend_service_21837.id
}

resource "google_compute_region_target_http_proxy" "proxy_21837" {
  provider  = google-beta
  region    = "europe-west1"
  name      = "proxy-21837"
  url_map   = google_compute_region_url_map.url_map_21837.id
}

resource "google_compute_address" "compute_address_21837" {
  name          = "compute-address-21837"
  provider      = google-beta
  region        = "europe-west1"
  network_tier  = "STANDARD"
}

resource "google_compute_forwarding_rule" "forwarding_rule_21837" {
  name                    = "forwarding-rule-21837"
  region                  = "europe-west1"
  project                 = "my-project"
  load_balancing_scheme   = "" # need to override EXTERNAL default when target is a service attachment
  network                 = google_compute_network.vpc_21837.id
  allow_psc_global_access = true
  subnetwork              = google_compute_subnetwork.subnet_21837.id
  target                  = google_compute_region_target_http_proxy.proxy_21837.id
  ip_address              = google_compute_address.compute_address_21837.address
}

[aprohorov-callsign]

faced with the same. I have the next dependencies in the code:

resource "google_compute_global_forwarding_rule" "ingress" {
  project               = var.project_id
  name                  = "ingress"
  network               = var.network_name
  ip_protocol           = "TCP"
  load_balancing_scheme = "INTERNAL_MANAGED"
  port_range            = "443"
  target                = google_compute_target_https_proxy.target.id
  ip_address            = google_compute_address.ingress.id
}

resource "google_compute_network_endpoint_group" "lb_neg" {
  for_each              = toset(data.google_compute_zones.available.names)
  name                  = "name-neg-${each.value}"
  network               = google_compute_global_forwarding_rule.ingress.network
  default_port          = "443"
  zone                  = each.value
  network_endpoint_type = "NON_GCP_PRIVATE_IP_PORT"
}

While planning provider instantly return network as my-vpc-name, but once google_compute_global_forwarding_rule created (while applying) it return network as URL "https://www.googleapis.com/compute/v1/projects/my-project/global/networks/my-vpc-name.

My solution is remove dependency:

resource "google_compute_global_forwarding_rule" "ingress" {
  project               = var.project_id
  name                  = "ingress"
  network               = var.network_name
  ip_protocol           = "TCP"
  load_balancing_scheme = "INTERNAL_MANAGED"
  port_range            = "443"
  target                = google_compute_target_https_proxy.target.id
  ip_address            = google_compute_address.ingress.id
}

resource "google_compute_network_endpoint_group" "lb_neg" {
  for_each              = toset(data.google_compute_zones.available.names)
  name                  = "name-neg-${each.value}"
  network               = var.network_name
  default_port          = "443"
  zone                  = each.value
  network_endpoint_type = "NON_GCP_PRIVATE_IP_PORT"
}

[ggtisc]

After trying with the 2nd code it didn't return any errors. I'm forwarding this issue for a depth review because it looks like many users are facing the same situation