GCP: terraform plan for updating lbs cert/key sets SESSION_AFFINITY to blank string

[genevieve]

Creating load balancers then updating those load balancers with new cert/key fails during terraform apply trying to delete the target pool before deleting the forwarding rule bound to it.

Terraform Version

0.9.4 or 0.9.5

Affected Resource(s)

• google_compute_target_pool
• google_compute_forwarding_rule

Terraform Configuration Files

resource "google_compute_target_pool" "target-pool" {
  name = "${var.env_id}-concourse"
}

resource "google_compute_forwarding_rule" "ssh-forwarding-rule" {
  name        = "${var.env_id}-concourse-ssh"
  target      = "${google_compute_target_pool.target-pool.self_link}"
  port_range  = "2222"
  ip_protocol = "TCP"
  ip_address  = "${google_compute_address.concourse-address.address}"
}

resource "google_compute_forwarding_rule" "https-forwarding-rule" {
  name        = "${var.env_id}-concourse-https"
  target      = "${google_compute_target_pool.target-pool.self_link}"
  port_range  = "443"
  ip_protocol = "TCP"
  ip_address  = "${google_compute_address.concourse-address.address}"
}

Debug Output

The target_pool resource cannot be deleted because it is already being used by the forwarding rule (resourceInUseByAnotherResource).

Expected Behavior

The terraform apply should have successfully completed updating the load balancers with the new cert/key.

The expected terraform plan for updating load balancers

~ google_compute_firewall.firewall-concourse
    source_ranges.#:          "1" => "0"
    source_ranges.1080289694: "0.0.0.0/0" => ""

Actual Behavior

It failed with resourceInUseByAnotherResource. This has been happening for the past 2-3 days.

The breaking terraform plan to update load balancers

~ google_compute_firewall.firewall-concourse
    source_ranges.#:          "1" => "0"
    source_ranges.1080289694: "0.0.0.0/0" => ""

~ google_compute_forwarding_rule.https-forwarding-rule
    target: "URL/targetPools/g-concourse" => "${google_compute_target_pool.target-pool.self_link}"

~ google_compute_forwarding_rule.ssh-forwarding-rule
    target: "URL/targetPools/g-concourse" => "${google_compute_target_pool.target-pool.self_link}"

-/+ google_compute_target_pool.target-pool
    instances.#:      "0" => "<computed>"
    name:             "g-concourse" => "g-concourse"
    project:          "g" => "<computed>"
    region:           "us-east1" => "<computed>"
    self_link:        "URL/targetPools/g-concourse" => "<computed>"
    session_affinity: "NONE" => "" (forces new resource)

It looks like the session_affinity is being set to a blank string and forcing a new resource

The successful terraform plan to delete load balancers

- google_compute_address.concourse-address

- google_compute_firewall.firewall-concourse

- google_compute_forwarding_rule.https-forwarding-rule

- google_compute_forwarding_rule.ssh-forwarding-rule

- google_compute_target_pool.target-pool

Summary:

If I create the load balancers then update the load balancers, it tries to recreate the target pool resource instead of updating the firewall resource because SESSION_AFFINITY gets set to a blank string.

[alexandr-f-boyko]

Same issue on 0.8.7. Looks like something changed on GCP API side.

[danawillow]

Fixed in #14807

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.