Failing test(s): TestAccComputeInstance_confidentialHyperDiskBootDisk

hashicorp / terraform-provider-google

Terraform Provider for Google Cloud Platform

https://registry.terraform.io/providers/hashicorp/google/latest/docs

Mozilla Public License 2.0

2.29k stars 1.72k forks source link

Failing test(s): TestAccComputeInstance_confidentialHyperDiskBootDisk #19014

Closed melinath closed 2 days ago

melinath commented 1 month ago

Impacted tests

TestAccComputeInstance_confidentialHyperDiskBootDisk

Affected Resource(s)

google_compute_instance

Failure rates

100% since 2024-07-28

Message(s)

vcr_utils.go:152: Step 1/4 error: Error running apply: exit status 1
        Error: Error creating instance: googleapi: Error 400: Cannot attach confidential disks to non-confidential VM., badRequest
          with google_compute_instance.foobar,
          on terraform_plugin_test.tf line 15, in resource "google_compute_instance" "foobar":
          15: resource "google_compute_instance" "foobar" {

Nightly build test history

https://hashicorp.teamcity.com/test/-5465441705731221331?currentProjectId=TerraformProviders_GoogleCloud_GOOGLE_NIGHTLYTESTS&expandTestHistoryChartSection=true

b/357955051

melinath commented 1 month ago

I split this off of https://github.com/hashicorp/terraform-provider-google/issues/18948 since it's compute-related rather than GKE-related.

rileykarson commented 1 month ago

@melinath to fix metadata (this references the wrong test)

melinath commented 1 month ago

Done

karolgorc commented 2 weeks ago

I think there were some new constraints added on the API side causing this to fail:

the instance in the test doesn't have confidential_instance_config set causing the first error
After adding that we can see that the n2 machine_type is not supported in confidential computing
Changing it to n2d requires min_cpu_platform to be set to AMD Milan according to this doc
There are also some permissions missing for the Compute Engine Service Agent that cause a fail on operation useOnEncrypt when using the kms_key_self_link field
After this the test will pass

Will add new tests for catching all of these exceptions and fix the one that's currently failing. I think there should also be a link to this in our docs