master_global_access_config does not apply on existing private cluster

[dansiviter]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v0.14.11
on darwin_amd64
+ provider registry.terraform.io/hashicorp/external v2.1.0
+ provider registry.terraform.io/hashicorp/google v3.90.0
+ provider registry.terraform.io/hashicorp/null v3.1.0

Affected Resource(s)

• google_container_cluster

Terraform Configuration Files

resource "google_container_cluster" "foo" {
  ...
  private_cluster_config {
    enable_private_nodes    = true
    enable_private_endpoint = true
    master_ipv4_cidr_block  = "something/28"

    master_global_access_config {  # first create without this block, then add
      enabled = true
    }
    ...
}

Debug Output

N/A

Panic Output

N/A

Expected Behaviour

When adding the master_global_access_config to the cluster is should update and enable it.

Actual Behaviour

In Plan, TF does know that it needs to update it. However, on apply it doesn't seem to do anything. Subsequent plans continue to identify that this needs needs updating but it never happens. It's confirmed by the Console and gCloud that the flag has not taken effect. On the same cluster I then ran gcloud containers update <name> --enable-master-global-access which successfully applied the flag and this no longer showed up in the terraform plan.

Steps to Reproduce

1. Create a private cluster without master_global_access_config,
2. Modify the cluster by adding master_global_access_config.enabled=true

Important Factoids

This flag does work if building the cluster from scratch. It's only the update that appears to be a problem.

References

• https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#master_global_access_config
• b/298513478

[ScottSuarez]

could you provide the debug logs for this request? potentially scrubbed of any PII

You can do so by enabling TF_LOG=DEBUG and TF_LOG_PATH=path-to-file

[billyfoss]

The update of the cluster is also failing in the reverse. If a cluster is created with global access enabled and then it is manually disabled, Terraform will see the need to update it, and it will "apply" successfully, but no change is made.

The plan will consistently show:

 ~ resource "google_container_cluster" "primary" {
        id                          = "projects/<my-project>/locations/us-east1/clusters/<my-cluster>"
        name                        = "<my-cluster>"
        # (28 unchanged attributes hidden)

      ~ private_cluster_config {
            # (6 unchanged attributes hidden)

          ~ master_global_access_config {
              ~ enabled = false -> true
            }
        }

        # (23 unchanged blocks hidden)
    }

We are using the following versions

$ terraform -v
Terraform v1.2.5
on linux_amd64
+ provider registry.terraform.io/hashicorp/google v4.28.0
+ provider registry.terraform.io/hashicorp/google-beta v4.28.0
+ provider registry.terraform.io/hashicorp/kubernetes v2.12.1
+ provider registry.terraform.io/hashicorp/local v2.2.3
+ provider registry.terraform.io/hashicorp/null v2.1.2
+ provider registry.terraform.io/hashicorp/random v2.3.1
+ provider registry.terraform.io/hashicorp/template v2.2.0

[yiyinglovecoding]

This should already be fixed in GoogleCloudPlatform/magic-modules#6932 and GoogleCloudPlatform/magic-modules#8314

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.