google_compute_network_endpoint produces Error: Provider produced inconsistent result after apply

[philip-harvey]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v1.3.9 Google v4.56.0

Affected Resource(s)

google_compute_network_endpoint

Terraform Configuration Files

resource "google_compute_instance" "test" {
  name                      = "test"
  machine_type              = "f1-micro"
  zone                      = "us-central1-a"
  allow_stopping_for_update = true
  boot_disk {
    initialize_params {
      image = "debian-cloud/debian-11"
    }
  }
  network_interface {
    subnetwork = data.google_compute_subnetwork.shared_vpc_primary_subnet.self_link
  }
}

resource "google_compute_network_endpoint_group" "test-neg" {
  name         = "test-neg"
  network      = data.google_compute_network.shared_vpc.id
  subnetwork   = data.google_compute_subnetwork.shared_vpc_primary_subnet.id
  default_port = "443"
  zone         = "us-central1-a"
}

resource "google_compute_network_endpoint" "test" {
  network_endpoint_group = google_compute_network_endpoint_group.test-neg.name
  instance               = google_compute_instance.test.name
  ip_address             = google_compute_instance.test.network_interface[0].network_ip
  zone                   = var.compute_zones.0
}

Debug Output

google_compute_network_endpoint.test: Creating... google_compute_network_endpoint.test: Still creating... [10s elapsed] ╷ │ Error: Provider produced inconsistent result after apply │ │ When applying changes to google_compute_network_endpoint.test, provider "provider[\"registry.terraform.io/hashicorp/google\"]" produced an unexpected new value: Root resource was present, but now absent. │ │ This is a bug in the provider, which should be reported in the provider's own issue tracker.

Expected Behavior

NE is created

Actual Behavior

NE is created but terraform errors out and doesn't add it to the state file

Steps to Reproduce

1. terraform init
2. terraform apply

Important Factoids

Tested with a shared VPC.

b/317497554

[philip-harvey]

Also tested with an older version of the provider and the same result

[philip-harvey]

Found the trigger for this, in the NE port is listed as optional, but if it's omitted then the provider errors. If you specify the port then it works. e.g.

resource "google_compute_network_endpoint" "test" {
  network_endpoint_group = google_compute_network_endpoint_group.test-neg.name
  instance               = google_compute_instance.test.name
  ip_address             = google_compute_instance.test.network_interface[0].network_ip
  port                   = google_compute_network_endpoint_group.test-neg.default_port
  zone                   = var.compute_zones.0
}

[philip-harvey]

Noticed that Terraform 1.4 came out today, re-tested and same result.

[edwardmedia]

I see where the problem is. This happens when port is not provided in the google_compute_network_endpoint To workaround, please provide port explicitly until a fix is in place

[slevenick]

Looks like port should be required if used with an external network endpoint group, but must not be required if using an internal group per https://github.com/GoogleCloudPlatform/magic-modules/pull/6373

I'll do some testing to verify that, but if it's the case this might be tricky to solve

[philip-harvey]

Looks like port should be required if used with an external network endpoint group, but must not be required if using an internal group per GoogleCloudPlatform/magic-modules#6373

I'll do some testing to verify that, but if it's the case this might be tricky to solve

Thanks for looking into this. I guess a documentation update could at least clarify this

[slevenick]

Unfortunately I don't think there is a good solution here.

I think the right solution may be to have two separate resources, one which requires port and one which does not allow specifying port and each can correspond to an endpoint on a different type of NEG.

I'm marking this as persistent & breaking change because we can't introduce a requirement on the port field at this point, and we can't tell what type the NEG is from within the network endpoint.

If we had access to the NEG we could enforce that port is set when needed, but as separate Terraform resources we can't tell that

[philip-harvey]

Can we at least document that port is required for external NEGs in the documentation? It took several hours to figure that out since the error messages didn't point to the issue