Open adamstrawson opened 7 months ago
edwardmedia
commented
7 months ago @adamstrawson I noticed below error which is from the api. Where did you see it is supported? Can you share the full debug log that contains the requests and responses to the api?
Cloud certificate reference is not supported for TargetHttpsProxy creation., invalid
adamstrawson
commented
7 months ago @adamstrawson I noticed below error which is from the api. Where did you see it is supported? Can you share the full debug log that contains the requests and responses to the api?
Cloud certificate reference is not supported for TargetHttpsProxy creation., invalid
Hi @edwardmedia, Support for Certificate manager is shown within the Google Provider documentation, and has listed examples of its use - See https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_target_https_proxy#example-usage---target-https-proxy-certificate-manager-certificate
From a load balancer perspective, it's also shown here: https://cloud.google.com/load-balancing/docs/ssl-certificates#certificate-summary
Note under Global external Application Load Balancer Certificate Manager is supported for both self-managed and Google-managed`
I'll need to do a small POC to be able to supply debug logs, as these resources are part of a larger module, but I'll get that put together shortly.
edwardmedia
commented
7 months ago @adamstrawson thanks for the info, and preparing the logs. Waiting for that.
adamstrawson
commented
7 months ago Okay, from a bit further digging, this does appear to be an API issue, rather than terraform.
I can recreate the same issue via gcloud, following this documentation https://cloud.google.com/certificate-manager/docs/deploy-google-managed-dns-auth.
Do you know the best way to raise API issues, or should I go through our TAM?
edwardmedia
commented
7 months ago it is mentioned in the doc that below format is accepted.
Accepted format is
From the error below, it seems the format does match what it asks. Forward the issue to the service team for taking a look at its behind
Invalid value for field 'resource.sslCertificates[0]': '//certificatemanager.googleapis.com/projects/{project}/locations/global/certificates/{resource}. Cloud certificate reference is not supported for TargetHttpsProxy creationYeah, I tried both formats as per the docs, both have the same error.
google_certificate_manager_certificate.default.id is the same as projects/{project}/locations/{location}/certificates/{resourceName}
resource "google_compute_target_https_proxy" "default" {
name = "https-proxy"
url_map = google_compute_url_map.default.id # Not included in example
certificate_manager_certificates = [ google_certificate_manager_certificate.default.id ]
}and I tried
resource "google_compute_target_https_proxy" "default" {
name = "https-proxy"
url_map = google_compute_url_map.default.id # Not included in example
certificate_manager_certificates = [ "//certificatemanager.googleapis.com/${google_certificate_manager_certificate.default.id}" ]
}My theory above that it's an API issue, rather than the Terraform provider is because gcloud has the same error, despite this being a documented step in guide for this specific use case (Ref: https://cloud.google.com/certificate-manager/docs/deploy-google-managed-dns-auth#att-cert-target-proxy)
gcloud compute target-https-proxies create foobar \
--url-map=<snip> \
--global \
--certificate-manager-certificates=<snip>ERROR: (gcloud.compute.target-https-proxies.create) Could not fetch resource:
- Invalid value for field 'resource.sslCertificates[0]': 'https://certificatemanager.googleapis.com/v1/projects/<snip>/locations/global/certificates/<snip>'. Cloud certificate reference is not supported for TargetHttpsProxy creation.After some further digging, and chatting with GCP support, the recommended(?) way is to use Certificate Maps instead
resource "google_compute_target_https_proxy" "default" {
name = "https-proxy"
url_map = google_compute_url_map.default.id
certificate_map = "//certificatemanager.googleapis.com/${google_certificate_manager_certificate_map.default.id}"
}It would be great to confirmation if that's the case, and whether the use of the attribute certificate_manager_certificates should be removed in favour of certificate_map? Or if there is a downstream API error and it should be possible to use certificate_manager_certificates
In the mean time, I'm unblocked as I can use certificate_map instead for now.
Daniel-I-Am
commented
5 months ago This issue also affects the google_compute_region_target_https_proxy, which does not have a similar workaround unfortunately as it does not support the use of a certificate_map. Any resolution is greatly appreciated.
pawelJas
commented
3 months ago Without full configuration it is hard to do a proper analysis. At this point certificate_manager_certificates are not supported by Global External Application Load Balancer. certificate_map only works with Global External Application Load Balancer so I can guess that your configuration is not supported yet. google_compute_region_target_https_proxy should not have the same problem as all regional products support certificate_manager_certificates.
Daniel-I-Am
commented
3 months ago When I posted my message I had assumed the information above would be sufficient. Here's all the information I would post if I would have opened this as a new report, in case it helps any. This is quite similar to some things above, but for the google_compute_region_target_https_proxy and associated regional resources, instead of global ones.
The documentation mentions certificate_manager_certificates can be configured, but doing so according to the documentation leads to failures from the API.
The documentation mentions two formats being accepted. I attempted both.
pawelJas
commented
3 months ago @Daniel-I-Am I agree that documentation is not clear about the support.
At the moment the certificate_manager_certificates are not supported for:
The latest is a bug/feature gap which should be fixed that year by allowing LoadBalancingScheme to be set in UrlMap (optional field). As for now the workaround is to add a dummy BackendService in a dummy PatchMatcher in the UrlMap. BackendService does not need to have any Backends, just need to show the scheme.
Daniel-I-Am
commented
3 months ago Oh wow. Now I understand the things I was seeing. I have been able to roll it out once for one load balancer, but not any other. The difference being that the one where it succeeded did have backend services configured and others did not, as they were set up quickly for testing with just a default redirect (I did not realize that this could even cause this oddity). I had opened a ticket with Google Cloud support, but they were unable to tell me what was happening.
Thanks for the explanation, clears up a lot for me :)
This does unblock me for the time being, but still leaves the same questions open for this issue.
bahag-klickst
commented
3 months ago @adamstrawson Thanks for bringing up this issue.
@Daniel-I-Am Thanks for contributing with your terraform output and configuration
@pawelJas Thanks for pointing out the unsupported configurations as of now. As I was stumbling across one of these unsupported combinations yesterday and then decided to go with a certificate map (as pointed out by @adamstrawson), I found that the combination is working Terraform and GCP wise, but unfortunately the GCP UI is not showing the certificate properly afterwards when viewing the details of the global Load Balancer, set up via Terraform. Are there any plans on the roadmap to either allow the certificate_manager_certificates for global Load Balancers or to fix the UI not showing the certificate properly issue?
Thanks to all of you and best regards, Tim.
pawelJas
commented
3 months ago Hi @bahag-klickst,
I have reached out to the UI team and I have confirmed that certificate_map is not supported yet. It is possible to view the certificate_map in the TargetHttpsProxy or TargetSslProxy detailed view but not at the Global Load Balancer view.
They are starting to work on that and say that it should be launched by the end of the year.
certificate_manager_certificates for Global External Load Balancer work should also start soon, but might take more time. Probably will be ready some time in 2025.
gemmahou
commented
2 months ago Hey @pawelJas, do we have the different use cases between certificate_manager_certificates and certificate_map documented anywhere in the API/g3 doc? We(Config Connector) also has Cx reporting the same issue. From the log, the error originates from the Google API. Sharing the official API documentation with Cx would be helpful, and we can update our documentation accordingly.
pawelJas
commented
2 months ago Hey @gemmahou. I could not find any dedicated page describing which should be used. What I found is that Public TargetHttpsProxy Resource doc doesn't specify the supported products in the field descriptions. I can fix that. Hamza has corrected Terraform docs already.
pawelJas
commented
1 month ago I have submitted an update for Public TargetHttpsProxy Resource doc, it might take a month before it is out.
re-thc
commented
2 weeks ago @pawelJas does this relate to the scope? I tried creating a certificate with the scope DEFAULT and it works, but not GLOBAL.
pawelJas
commented
2 weeks ago Hey @re-thc, that is a good question. I think the docs should be updated to clarify the Certificate type compatibility.
Regional certificates support only DEFAULT and those work with regional L7 Load Balancers. The only requirement is to be in the same region.
For Global Load Balancers the Certificates Type matters.
Community Note
Terraform Version
1.7.2.
Affected Resource(s)
google_compute_target_https_proxyTerraform Configuration
Debug Output
No response
Expected Behavior
The target proxy is created, with the
example.comcertificate.Actual Behavior
The creation of
google_compute_target_https_proxyfails as the use of managed cloud certificates isn't supported.Steps to reproduce
terraform applyImportant Factoids
Using
googleprovider version5.14.0References
The above terraform configuration is based on the documented example in the provider documentation: https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/compute_target_https_proxy#example-usage---target-https-proxy-certificate-manager-certificate
b/324044382