Fix inconsistent final plan when labels are added to resources

[kunzese]

Users reported an issue creating buckets with labels via google_storage_bucket since #6518 was merged. Creation failed with the following error message:

Error: Provider produced inconsistent final plan

When expanding the plan for google_storage_bucket.test_bucket to include new values learned so far during apply, provider
"registry.terraform.io/hashicorp/google" produced an invalid new value for .labels: was null, but now
cty.MapVal(map[string]cty.Value{"one":cty.StringVal("bla"), "two":cty.StringVal("qny")}).

This is a bug in the provider, which should be reported in the provider's own issue tracker.

I am by far no Terraform expert but i looked at the other resources which had a DiffSuppressFunc set on their labels property and all of them had computed: true EXCEPT google_dataflow_job. So i ran a small test with

resource "google_dataflow_job" "big_data_job" {
  name              = "dataflow-job"
  template_gcs_path = "gs://my-bucket/templates/template_file"
  temp_gcs_location = "gs://my-bucket/tmp_dir"
  parameters = {
    foo = "bar"
    baz = "qux"
  }
  labels = {
    for = "bar"
  }
}

and it seems that this resource has the same problem as google_storage_bucket:

Error: Provider produced inconsistent final plan
 
When expanding the plan for google_dataflow_job.big_data_job to include new values learned so far during apply, provider
"registry.terraform.io/hashicorp/google" produced an invalid new value for .labels: was null, but now
cty.MapVal(map[string]cty.Value{"one":cty.StringVal("foo"), "two":cty.StringVal("bar")}).

This is a bug in the provider, which should be reported in the provider's own issue tracker.

Setting both properties to computed: true in alignment with the others fixed the problem on both resources. But please don't ask me why 😁

@prauc FYI

Fixes hashicorp/terraform-provider-google#12804

If this PR is for Terraform, I acknowledge that I have:

• Searched through the issue tracker for an open issue that this either resolves or contributes to, commented on it to claim it, and written "fixes {url}" or "part of {url}" in this PR description. If there were no relevant open issues, I opened one and commented that I would like to work on it (not necessary for very small changes).
• Ensured that all new fields I added that can be set by a user appear in at least one example (for generated resources) or third_party test (for handwritten resources or update tests).
• Generated Terraform providers, and ran make test and make lint in the generated providers to ensure it passes unit and linter tests.
• Ran relevant acceptance tests using my own Google Cloud project and credentials (If the acceptance tests do not yet pass or you are unable to run them, please let your reviewer know).
• Read the Release Notes Guide before writing my release note below.

Release Note Template for Downstream PRs (will be copied)

storage: fixed inconsistent final plan when labels are added to `google_storage_bucket`

dataflow: fixed inconsistent final plan when labels are added to `google_dataflow_job`

[modular-magician]

Oops! It looks like you're using an unknown release-note type in your changelog entries:

• REPLACEME

Please only use the types listed in https://github.com/GoogleCloudPlatform/magic-modules/blob/master/.ci/RELEASE_NOTES_GUIDE.md.

[modular-magician]

Hello! I am a robot who works on Magic Modules PRs.

I've detected that you're a community contributor. @slevenick, a repository maintainer, has been assigned to assist you and help review your changes.

❓ First time contributing? Click here for more details

---

Your assigned reviewer will help review your code by:

• Ensuring it's backwards compatible, covers common error cases, etc.
• Summarizing the change into a user-facing changelog note.
• Passes tests, either our "VCR" suite, a set of presubmit tests, or with manual test runs.

You can help make sure that review is quick by running local tests and ensuring they're passing in between each push you make to your PR's branch. Also, try to leave a comment with each push you make, as pushes generally don't generate emails.

If your reviewer doesn't get back to you within a week after your most recent change, please feel free to leave a comment on the issue asking them to take a look! In the absence of a dedicated review dashboard most maintainers manage their pending reviews through email, and those will sometimes get lost in their inbox.

---

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

Terraform GA: Diff ( 2 files changed, 2 insertions(+))
Terraform Beta: Diff ( 2 files changed, 2 insertions(+))
TF Conversion: Diff ( 2 files changed, 3 insertions(+), 3 deletions(-))

[modular-magician]

Tests analytics

Total tests: 2729
Passed tests 2443
Skipped tests: 278
Affected tests: 8

Action taken

Found 8 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

TestAccStorageBucket_labels|TestAccDataSourceGoogleFirebaseAndroidAppConfig|TestAccComputeFirewallPolicyRule_multipleRules|TestAccApigeeKeystoresAliasesPkcs12_ApigeeKeystoresAliasesPkcs12Example|TestAccAlloydbBackup_missingLocation|TestAccAlloydbCluster_missingLocation|TestAccApigeeKeystoresAliasesKeyCertFile_apigeeKeystoresAliasesKeyCertFileTestExample|TestAccDataSourceAlloydbLocations_basic

Get to know how VCR tests work

[modular-magician]

Tests passed during RECORDING mode:
TestAccStorageBucket_labels[Debug log]
TestAccDataSourceGoogleFirebaseAndroidAppConfig[Debug log]
TestAccApigeeKeystoresAliasesPkcs12_ApigeeKeystoresAliasesPkcs12Example[Debug log]
TestAccAlloydbBackup_missingLocation[Debug log]
TestAccAlloydbCluster_missingLocation[Debug log]
TestAccApigeeKeystoresAliasesKeyCertFile_apigeeKeystoresAliasesKeyCertFileTestExample[Debug log]
TestAccDataSourceAlloydbLocations_basic[Debug log]

Tests failed during RECORDING mode:
TestAccComputeFirewallPolicyRule_multipleRules[Error message] [Debug log]

Please fix these to complete your PR
View the build log or the debug log for each test

[slevenick]

This looks fine to me, I guess I'm confused how our tests were passing if this was causing such a problem. Is there an alternative way to create buckets with labels that doesn't hit the inconsistent plan?

[kunzese]

This looks fine to me, I guess I'm confused how our tests were passing if this was causing such a problem. Is there an alternative way to create buckets with labels that doesn't hit the inconsistent plan?

Sadly i'm missing the required Terraform-internal knowledge to give you a helpful answer here, but this bug is kinda strange.

This works with the latest provider (4.64.0):

resource "google_storage_bucket" "bucket" {
  name          = "onion-super-bucket"
  location      = "EU"
  force_destroy = true
  labels = {
    foo = "bar"
  }
}

As soon as you add a label with a derived value it fails since 4.40.0 on the first terraform apply, the second succeeds:

resource "random_string" "this" {
  length  = 3
  upper   = false
  numeric = false
  special = false
}

resource "google_storage_bucket" "bucket" {
  name          = "onion-super-bucket"
  location      = "EU"
  force_destroy = true
  labels = {
    two = random_string.this.result
    foo = "bar"
  }
}

$ terraform apply

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # google_storage_bucket.bucket will be created
  + resource "google_storage_bucket" "bucket" {
      + force_destroy               = true
      + id                          = (known after apply)
      + location                    = "EU"
      + name                        = (known after apply)
      + project                     = "[REDACTED]"
      + public_access_prevention    = (known after apply)
      + self_link                   = (known after apply)
      + storage_class               = "STANDARD"
      + uniform_bucket_level_access = (known after apply)
      + url                         = (known after apply)

      + versioning {
          + enabled = (known after apply)
        }

      + website {
          + main_page_suffix = (known after apply)
          + not_found_page   = (known after apply)
        }
    }

  # random_string.this will be created
  + resource "random_string" "this" {
      + id          = (known after apply)
      + length      = 3
      + lower       = true
      + min_lower   = 0
      + min_numeric = 0
      + min_special = 0
      + min_upper   = 0
      + number      = false
      + numeric     = false
      + result      = (known after apply)
      + special     = false
      + upper       = false
    }

Plan: 2 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

random_string.this: Creating...
random_string.this: Creation complete after 0s [id=msg]
╷
│ Error: Provider produced inconsistent final plan
│ 
│ When expanding the plan for google_storage_bucket.bucket to include new values learned so far during apply, provider "registry.terraform.io/hashicorp/google" produced an
│ invalid new value for .labels: was null, but now cty.MapVal(map[string]cty.Value{"foo":cty.StringVal("bar"), "two":cty.StringVal("msg")}).
│ 
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.

$ terraform apply

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # google_storage_bucket.bucket will be created
  + resource "google_storage_bucket" "bucket" {
      + force_destroy               = true
      + id                          = (known after apply)
      + labels                      = {
          + "foo" = "bar"
        }
      + location                    = "EU"
      + name                        = (known after apply)
      + project                     = "[REDACTED]"
      + public_access_prevention    = (known after apply)
      + self_link                   = (known after apply)
      + storage_class               = "STANDARD"
      + uniform_bucket_level_access = (known after apply)
      + url                         = (known after apply)

      + versioning {
          + enabled = (known after apply)
        }

      + website {
          + main_page_suffix = (known after apply)
          + not_found_page   = (known after apply)
        }
    }

  # random_string.this will be created
  + resource "random_string" "this" {
      + id          = (known after apply)
      + length      = 3
      + lower       = true
      + min_lower   = 0
      + min_numeric = 0
      + min_special = 0
      + min_upper   = 0
      + number      = false
      + numeric     = false
      + result      = (known after apply)
      + special     = false
      + upper       = false
    }

Plan: 2 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

random_string.this: Creating...
random_string.this: Creation complete after 0s [id=ztv]
google_storage_bucket.bucket: Creating...
google_storage_bucket.bucket: Creation complete after 1s [id=onion-super-bucket]