GKE cluster gets destroyed on update if using workload identity without node_metadata

[martinmaly]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v0.12.26

• provider.google-beta v3.26.0

Affected Resource(s)

• google_container_cluster

Terraform Configuration Files

provider "google-beta" {
    credentials = file("service-account.json")
    project = var.project
}

resource "google_container_cluster" "test" {
    provider = google-beta
    name     = "test"
    location = var.zone
    initial_node_count = 3
    min_master_version = "1.16.9-gke.6"

    network = "projects/${var.project}/global/networks/default"

    master_auth {
        username = ""
        password = ""

        client_certificate_config {
            issue_client_certificate = false
        }
    }

    addons_config {
        config_connector_config {
            enabled = true
        }
    }

    node_config {
        machine_type = "n1-standard-4"
        disk_size_gb = 100
        image_type  = "COS"
        oauth_scopes = [
            "https://www.googleapis.com/auth/devstorage.read_only",
            "https://www.googleapis.com/auth/logging.write",
            "https://www.googleapis.com/auth/monitoring",
            "https://www.googleapis.com/auth/servicecontrol",
            "https://www.googleapis.com/auth/service.management.readonly",
            "https://www.googleapis.com/auth/trace.append",
        ]

 /* - uncommenting this resolves the issue. Theory: GKE sets this value by default and TF thinks it is being reset to empty.
      workload_metadata_config {
            node_metadata = "GKE_METADATA_SERVER"
        }
*/
    }

    workload_identity_config {
        identity_namespace = "${var.project}.svc.id.goog"
    }

    cluster_telemetry {
        type = "ENABLED"
    }
}

Debug Output

          - workload_metadata_config { # forces replacement
              - node_metadata = "GKE_METADATA_SERVER" -> null
            }

Expected Behavior

Terraform doesn't attempt to destroy my cluster.

Actual Behavior

on terraform apply TF attempted to destroy and recreate my cluster even though I made no change to the config.

Steps to Reproduce

1. terraform apply

Important Factoids

Trying to set up a Beta feature - workload identity

References

[edwardmedia]

Keep showing Plan: 1 to add, 0 to change, 1 to destroy. even no changes are added

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!