Creation of `google_compute_forwarding_rule` fails if default labels are set at provider level

[wjf3121]

This happens with provider 5.2.0 and when the default labels are defined at provider level and there is no label block in google_compute_forwarding_rule itself:

provider "google" {
  default_labels  = { mylabel = "labelvalue"}
}
resource "google_compute_forwarding_rule" "prisma_fwd" {
  ip_address            = "127.0.0.3"
  name                  = "rule"
  network               = var.project_network
  project               = var.project_id
  region                = var.region
  target                = var.private_service_connect
}

Affected Resource(s)

google_compute_forwarding_rule

Originally posted by @Ziemowit-LH in https://github.com/hashicorp/terraform-provider-google/issues/16255#issuecomment-1773031396

b/327610708

[rileykarson]

I think that PSC forwarding rules can't have labels set, based on https://github.com/hashicorp/terraform-provider-google/issues/16255#issue-1945151168 - we'll need to not apply default labels for forwarding rules of that type.

[eraac]

Does a workaround exist?

[DevoFalcon]

If you create the resource without labels initially, and then update it to include labels, it works correctly (as a workarround). What I did was

1. Comment out provider default_labels
2. Targetted-apply my google_compute_forwarding_rule
3. Uncomment provider default_labels
4. Apply update to google_compute_forwarding_rule to add labels

[Ziemowit-LH]

That's what I've been doing until I got tired of it and just stopped using provider-defined labels. Now I declare/compute a standard set of labels and just apply them to each resource that can take labels. google_compute_forwarding_rule is not one.

[Ziemowit-LH]

I think that PSC forwarding rules can't have labels set, based on #16255 (comment) - we'll need to not apply default labels for forwarding rules of that type.

They can. What is stupid is that the labels can't be set at creation time (GCP API limitation) but only added after the resource already exists.

Is there a way to ignore provider-level labels for a particular resource by some statement?