google_compute_disk interface always SCSI (beta)

[AlexBMes]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v1.0.5
on linux_amd64
+ provider registry.terraform.io/hashicorp/google v3.80.0
+ provider registry.terraform.io/hashicorp/google-beta v3.80.0
+ provider registry.terraform.io/hashicorp/time v0.7.2

Affected Resource(s)

• google_compute_disk (beta)

Terraform Configuration Files

Managed Instance Group with instance template for confidential VM and persistent disk.

variable project{
  type = string
}

variable nat_ip{
  type = string
}

resource google_compute_disk self {
  provider  = google-beta
  name      = "secure-swarm-a-data"
  zone      = "europe-west2-a"
  project   = var.project
  size      = 100
  interface = "NVME"
  lifecycle {
    create_before_destroy = false
  }
}

resource google_compute_instance_template self {
  provider = google-beta
  name_prefix             = "secure-swarm-a"
  description             = "Secure swarm zone a template"
  project                 = var.project
  machine_type            = "n2d-standard-2"
  can_ip_forward          = false
  region                  = "europe-west2"

  disk {
    auto_delete = true
    boot = true
    disk_size_gb = 100
    disk_type = "pd-standard"
    interface = "NVME"
    source_image = "projects/${var.project}/global/images/family/secure-swarm"
  }

  disk {
    auto_delete = false
    boot = false
    device_name = google_compute_disk.self.name
    disk_name = google_compute_disk.self.name
    disk_size_gb = 100
    disk_type = "pd-standard"
    mode = "READ_WRITE"
    interface = "NVME"
  }
  service_account {
    email = "terraform@${var.project}.iam.gserviceaccount.com"
    scopes = ["cloud-platform"]
  }

  network_interface {
    network            = "default-network"
    subnetwork         = "default-subnet"
    subnetwork_project = var.project
    access_config {
        nat_ip = var.nat_ip
    }
  }

  scheduling {
    preemptible       = false
    automatic_restart = true
    on_host_maintenance = "TERMINATE"
  }

  confidential_instance_config{
    enable_confidential_compute = true 
  }

  shielded_instance_config {
    enable_secure_boot          = true
    enable_vtpm                 = true
    enable_integrity_monitoring = true
  }
}


resource google_compute_instance_group_manager self {
  provider          = google-beta
  base_instance_name = "secure-swarm-a"
  name               = "secure-swarm-a"
  zone               = "europe-west2-a"
  project            = var.project
  wait_for_instances = true
  wait_for_instances_status = "STABLE"
  target_size        = 1

  version {
    name              = "1"
    instance_template = google_compute_instance_template.self.self_link
}

  stateful_disk {
    device_name = google_compute_disk.self.name
    delete_rule = "NEVER"
  }
}

Debug Output

gist

2021-09-01T14:33:29.292+0100 [WARN]  Provider "provider[\"registry.terraform.io/hashicorp/google-beta\"]" produced an unexpected new value for google_compute_disk.self, but we are tolerating it because it is using the legacy plugin SDK.
    The following problems may be the cause of any confusing errors from downstream operations:
      - .provisioned_iops: was null, but now cty.NumberIntVal(0)
      - .interface: was cty.StringVal("NVME"), but now cty.StringVal("SCSI")
      - .multi_writer: was null, but now cty.False
      - .image: was null, but now cty.StringVal("")
      - .snapshot: was null, but now cty.StringVal("")
      - .description: was null, but now cty.StringVal("")

Panic Output

Expected Behavior

Expect google_compute_disk "interface" to be NVME in the state file.

Actual Behavior

Interface for google_compute_disk is SCSI in the state file despite being set to NVME.

# google_compute_disk.self:
resource "google_compute_disk" "self" {
    creation_timestamp        = "2021-09-01T06:33:18.594-07:00"
    id                        = "projects/project-name/zones/europe-west2-a/disks/secure-swarm-a-data"
    interface                 = "SCSI"
    label_fingerprint         = "42WmSpB8rSM="
    multi_writer              = false
    name                      = "secure-swarm-a-data"
    physical_block_size_bytes = 4096
    project                   = "project-name"
    provisioned_iops          = 0
    resource_policies         = []
    self_link                 = "https://www.googleapis.com/compute/v1/projects/project-name/zones/europe-west2-a/disks/secure-swarm-a-data"
    size                      = 100
    type                      = "pd-standard"
    users                     = []
    zone                      = "europe-west2-a"
}

This results in the next plan/apply attempting to replace the disk, which will cause errors in this use case.

# google_compute_disk.self must be replaced
-/+ resource "google_compute_disk" "self" {
      ~ creation_timestamp        = "2021-09-01T06:33:18.594-07:00" -> (known after apply)
      ~ id                        = "projects/test-secure-swarm/zones/europe-west2-a/disks/secure-swarm-a-data" -> (known after apply)
      ~ interface                 = "SCSI" -> "NVME" # forces replacement
      ~ label_fingerprint         = "42WmSpB8rSM=" -> (known after apply)
      - labels                    = {} -> null
      ~ last_attach_timestamp     = "2021-09-01T06:34:02.468-07:00" -> (known after apply)
      + last_detach_timestamp     = (known after apply)
      - multi_writer              = false -> null
        name                      = "secure-swarm-a-data"
      ~ physical_block_size_bytes = 4096 -> (known after apply)
      - provisioned_iops          = 0 -> null
      ~ resource_policies         = [] -> (known after apply)
      ~ self_link                 = "https://www.googleapis.com/compute/v1/projects/test-secure-swarm/zones/europe-west2-a/disks/secure-swarm-a-data" -> (known after apply)
      + source_image_id           = (known after apply)
      + source_snapshot_id        = (known after apply)
      ~ users                     = [
          - "https://www.googleapis.com/compute/v1/projects/test-secure-swarm/zones/europe-west2-a/instances/secure-swarm-a-lb4r",
        ] -> (known after apply)
        # (4 unchanged attributes hidden)
    }

It sems to change back to the default seems to be because the google API does not return an interface value.

---[ REQUEST ]---------------------------------------
GET /compute/beta/projects/project-name/zones/europe-west2-a/disks/secure-swarm-a-data?alt=json HTTP/1.1
Host: compute.googleapis.com
User-Agent: Terraform/1.0.5 (+https://www.terraform.io) Terraform-Plugin-SDK/2.5.0 terraform-provider-google-beta/3.82.0
...
---[ RESPONSE ]--------------------------------------
HTTP/2.0 200 OK
...
{
  "id": "675444942641971185",
  "creationTimestamp": "2021-09-01T06:33:18.594-07:00",
  "name": "secure-swarm-a-data",
  "sizeGb": "100",
  "zone": "https://www.googleapis.com/compute/beta/projects/project-name/zones/europe-west2-a",
  "status": "READY",
  "selfLink": "https://www.googleapis.com/compute/beta/projects/project-name/europe-west2-a/disks/secure-swarm-a-data",
  "type": "https://www.googleapis.com/compute/beta/projects/project-namezones/europe-west2-a/diskTypes/pd-standard",
  "labelFingerprint": "42WmSpB8rSM=",
  "physicalBlockSizeBytes": "4096",
  "multiWriter": false,
  "locked": false,
  "kind": "compute#disk"
}

1. terraform apply
2. terraform apply

Important Factoids

References

• Failing test(s): TestAccComputeRegionDisk_interface & TestAccComputeDisk_interface (permadiff, beta) #9993
• https://cloud.google.com/compute/docs/reference/rest/beta/disks/get

[slevenick]

Looks like this was an API-side change that caused this. I believe it should be rolled back soon and we can figure out how to move forward from there

[melinath]

Related: #9993

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.