google_compute_region_backend_service gets destroyed when updating locality_lb_policy

[cynful]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v0.12.24
+ provider.google v3.13.0
+ provider.google-beta v3.13.0
+ provider.null v2.1.2

Affected Resource(s)

• google_compute_region_backend_service

Terraform Configuration Files

resource "google_compute_region_backend_service" "default" {
  provider = google-beta

  region = "us-central1"
  name = "region-service"
  health_checks = ["${google_compute_health_check.health_check.self_link}"]
  protocol = "HTTP"
  load_balancing_scheme = "INTERNAL_MANAGED"
  locality_lb_policy = "ROUND_ROBIN"
  # locality_lb_policy = "MAGLEV"
}

resource "google_compute_health_check" "health_check" {
  provider = google-beta

  name               = "rbs-health-check"
  http_health_check {
    port = 80
  }
}

Debug Output

Panic Output

Expected Behavior

When doing this change manually via GCP console, this updates the backend service's load balancing mode non-disruptively.
The expected behavior of a Terraform plan/apply should be a single change to the backend service.

Actual Behavior

Terraform will perform the following actions:

  # google_compute_region_backend_service.default must be replaced
-/+ resource "google_compute_region_backend_service" "default" {
      - affinity_cookie_ttl_sec         = 0 -> null
        connection_draining_timeout_sec = 0
      ~ creation_timestamp              = "2020-04-24T20:43:09.463-07:00" -> (known after apply)
      ~ fingerprint                     = "9HpKDuQLDCU=" -> (known after apply)
        health_checks                   = [
            "https://www.googleapis.com/compute/v1/projects/foo/global/healthChecks/rbs-health-check",
        ]
      ~ id                              = "projects/foo/regions/us-central1/backendServices/region-service" -> (known after apply)
        load_balancing_scheme           = "INTERNAL_MANAGED"
      ~ locality_lb_policy              = "MAGLEV" -> "ROUND_ROBIN" # forces replacement
        name                            = "region-service"
      ~ project                         = "foo" -> (known after apply)
        protocol                        = "HTTP"
        region                          = "us-central1"
      ~ self_link                       = "https://www.googleapis.com/compute/v1/projects/foo/regions/us-central1/backendServices/region-service" -> (known after apply)
      ~ session_affinity                = "NONE" -> (known after apply)
      ~ timeout_sec                     = 30 -> (known after apply)
    }

Plan: 1 to add, 0 to change, 1 to destroy.

------------------------------------------------------------------------

Terraform will destroy the google_compute_region_backend_service and replace with a new backend service.

This is not desired behavior, as backend_services are usually tied to url_maps and load balancers. Meaning this single destroy has cascading changes meant for the entire load balancer and will definitely result in down time.

Steps to Reproduce

1. Create a google_compute_region_backend_service with its locality_lb_policy attribute assigned to "MAGLEV".
2. terraform apply -auto-approve
3. Edit the locality_lb_policy, switch from "MAGLEV" to "ROUND_ROBIN".
4. terraform apply

Important Factoids

References

[edwardmedia]

I can repro this issue.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!