Perma-diff in google_app_engine_flexible_app_version

[courteouselk]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

$ terraform -v

Terraform v1.0.4
on darwin_amd64
+ provider registry.terraform.io/hashicorp/google v3.85.0
+ provider registry.terraform.io/hashicorp/google-beta v3.85.0
+ provider registry.terraform.io/hashicorp/null v3.1.0
+ provider registry.terraform.io/hashicorp/random v3.1.0

Affected Resource(s)

• google_app_engine_flexible_app_version

Terraform Configuration Files

resource "google_app_engine_flexible_app_version" "default" {
  project         = "redacted"
  service         = "redacted"
  runtime         = "custom"
  version_id      = "v1-2-3-210920-02468ace"
  noop_on_destroy = true

  deployment {
    container {
      image = "gcr.io/redacted/redacted:v1.2.3"
    }
  }

  # ...
}

Expected Behavior

Once terraform apply had successfuly ran, the ensuing terraform plan should detect zero deltas.

Actual Behavior

Instead, the following plan is generated (after a successful terraform apply):

  ~ resource "google_app_engine_flexible_app_version" "default" {
        id                        = "apps/redacted/services/redacted/versions/v1-2-3-210920-02468ace"
        name                      = "apps/redacted/services/redacted/versions/v1-2-3-210920-02468ace"
        # (10 unchanged attributes hidden)

      ~ deployment {
          ~ container {
              ~ image = "gcr.io/redacted/redacted@sha256:8e616fd712c0a4redacted160555e75730433563bdredacted0ff49113be314e" -> "gcr.io/redacted/redacted:v1.2.3"
            }
        }
        # (6 unchanged blocks hidden)
    }

Steps to Reproduce

1. terraform apply
2. terraform plan

[edwardmedia]

@courteouselk can you share the debug log for the initial apply?

[courteouselk]

hi @edwardmedia, here is it: https://gist.github.com/courteouselk/7a8fc6f2b8d940ad42219b2ea24b6219

[edwardmedia]

@courteouselk instead of :tag, can you try to use by @digest for the image to see what happens? But formats are acceptable for the API request, but it looks like API always sends the @digest back which Terraform does not have much control.

[courteouselk]

@edwardmedia yes, thanks. Indeed, with @digest there is no perma-diff.

However, this sounds more like a workaround rather than an ultimate solution.

Since the API does return the "converted" image like:

  "deployment": {
    "container": {
      "image": "gcr.io/redacted/redacted@sha256:2ae33007ea151192eff852f32cfe30ca7acaaa9f43deb1d3e61d31a195120e43"
    }
  },

... wouldn't it be possible for the provider to save that in the state? So that it does not detect a diff if the image is either the original value (the one with a tag), or the "converted" one (digest as returned from API).

[edwardmedia]

@courteouselk I agreed this is not the best solution. To your suggestion, my guess is not. The diff occurs between what you configured and what is returned from api. We can't change either side. A lot of times we can suppress the diff if there is a pattern between two. But in this case, it is not clear. The best solution is api should return what we send (clearly api accepts both formats) but unfortunately we don't have control over it. I am closing this issue. You may reopen or file another issue if you don't agree.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.