I have multiple /28s and google_apigee_organization and google_apigee_instance won't let me choose which one to use for support range

[red8888]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Terraform Version & Provider Version(s)

Terraform v1.9.5 on darwin_arm64

• provider registry.terraform.io/hashicorp/google v5.44.0
• provider registry.terraform.io/hashicorp/google-beta v5.44.0
• provider registry.terraform.io/hashicorp/random v3.6.3

Affected Resource(s)

google_apigee_organization google_apigee_instance

Terraform Configuration

Here I can choose the runtime range but not the /28 for support

data "google_client_config" "current" {}

resource "google_compute_network" "apigee_network" { name = "apigee-network" }

resource "google_compute_global_address" "apigee_range" { name = "apigee-range" purpose = "VPC_PEERING" address_type = "INTERNAL" prefix_length = 22 network = google_compute_network.apigee_network.id }

resource "google_service_networking_connection" "apigee_vpc_connection" { network = google_compute_network.apigee_network.id service = "servicenetworking.googleapis.com" reserved_peering_ranges = [google_compute_global_address.apigee_range.name] }

resource "google_apigee_organization" "apigee_org" { analytics_region = "us-central1" project_id = data.google_client_config.current.project authorized_network = google_compute_network.apigee_network.id depends_on = [google_service_networking_connection.apigee_vpc_connection] }

resource "google_apigee_instance" "apigee_instance" { name = "my-instance-name" location = "us-central1" org_id = google_apigee_organization.apigee_org.id ip_range = "10.87.8.0/22" }

Debug Output

NA

Expected Behavior

Note what I can do with the UI

Actual Behavior

I have no option for the /28

Steps to reproduce

1. terraform apply

Important Factoids

This is a problem because many users pre-create ranges. The is the feature of the UI, but missing from the terraform resources.

References

No response

b/369201169

[ScottSuarez]

According the API docs you can send a comma separated value for this field in the terraform config. The service team can create a PR to update the field documentation and potentially an example.

https://cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.instances#:~:text=in%20your%20Environments.-,ipRange,-string

[red8888]

According the API docs you can send a comma separated value for this field in the terraform config. The service team can create a PR to update the field documentation and potentially and example.

https://cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.instances#:~:text=in%20your%20Environments.-,ipRange,-string

That would be great if they could do that. The API field is poorly named it shouldn't be in the singular, but now I have a problem. When I update this field and plan it wants to destroy/recreate. The resource in state doesn't seem to track changes and update with the two values on apply:

  # google_apigee_instance.xxx must be replaced
-/+ resource "google_apigee_instance" "xxx" {
      ~ consumer_accept_list     = [
          - "xxxx",
        ] -> (known after apply)
      ~ host                     = "10.100.100.2" -> (known after apply)
      ~ id                       = "organizations/xxxxx/instances/xxx" -> (known after apply)
      ~ ip_range                 = "10.100.100.0/22" -> "10.100.100.0/22, 10.100.200.32/28" # forces replacement
        name                     = "xxxx"
      ~ peering_cidr_range       = "SLASH_22" -> (known after apply)
      ~ port                     = "443" -> (known after apply)
      ~ service_attachment       = "projects/xxxx-tp/regions/us-central1/serviceAttachments/xxxx" -> (known after apply)
        # (5 unchanged attributes hidden)
    }

If I reimport it will it have the 2nd value in the string? Or is this an API issue where the state of the object in the actual API has only the value it was created with?

[ScottSuarez]

I would try it out in UI and do a get on the resource through the API. Then you can see what the API returns and what you would need to set in terraform. The API docs allow you to do this pretty easily in-web https://cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.instances/get

This field is currently marked as immutable in terraform which is why you are unable to update it without destroying it. https://github.com/GoogleCloudPlatform/magic-modules/blob/main/mmv1/products/apigee/Instance.yaml#L181