Dependencies between URL maps and Backend Services not fully being seen

[jeheyer]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

1.4.5

Affected Resource(s)

• google_compute_url_map

Terraform Configuration Files

resource "google_compute_url_map" "https" {
  project          = var.project_id
  name              = "urlmap-https"
  default_service = local.default_service_id
  depends_on      = [google_compute_backend_service.default, google_compute_backend_bucket.default]
}

Debug Output

N/A

Panic Output

N/A

Expected Behavior

Since the URL map must reference at least one backend, the URL map must be replaced if the applicable backend services are replaced. Such a scenario exists when migrating from Classic to non-Classic since load balancer scheme changes and requires a replacement (not just an update).

Actual Behavior

Terraform replaces the backend, but tries to update the URL map in-place, which won't work because the backend will be momentarily destroyed.

Steps to Reproduce

1. terraform plan

Plan will look something like this. Note "replacement" for backend service, but "updated" for URL map:

# google_compute_backend_service.default["backend1"] must be replaced
-/+ resource "google_compute_backend_service" "default" {
 ~ load_balancing_scheme           = "EXTERNAL" -> "EXTERNAL_MANAGED" # forces replacement


 # google_compute_url_map.https[0] will be updated in-place
  ~ resource "google_compute_url_map" "https" {
      ~ default_service    = "https://www.googleapis.com/compute/v1/projects/xxxx/global/backendServices/backend1" -> (known after apply)
    }

2. terraform apply

Error: Error when reading or editing BackendService: googleapi: Error 400: The backend_service resource 'projects/xxxx/global/backendServices/backend' is already being used by 'projects/xxxx/global/urlMaps/test-https', resourceInUseByAnotherResource

Important Factoids

I imagine this would also be triggered when replacing a backend bucket, such as changing locations.

References

• #0000

[edwardmedia]

@jeheyer instead of providing a value directly to default_service, have you tried a reference like below to see if that solve the problem?

resource "google_compute_url_map" "https" {
  project          = var.project_id
  name              = "urlmap-https"
  default_service = local.default_service_id ---> google_compute_backend_service.default.id
  depends_on      = [google_compute_backend_service.default, google_compute_backend_bucket.default]
}

[jeheyer]

Yes, that's what I've got local.default_service_id set to (the resource id). Even if done explicitly:

provider "google" {
  project = "myproject-123456"
}
resource "google_compute_backend_service" "backend1" {
  name                  = "test-backend"
  load_balancing_scheme = "EXTERNAL" -> "EXTERNAL_MANAGED"
}
resource "google_compute_url_map" "https" {
  name            = "test-urlmap-https"
  default_service = google_compute_backend_service.backend1.id
}

Results in same error:

│ Error: Error when reading or editing BackendService: googleapi: Error 400: The backend_service resource 'projects/otl-network-poc/global/backendServices/test-backend' is already being used by 'projects/otl-network-poc/global/urlMaps/test-urlmap-https', resourceInUseByAnotherResource

[edwardmedia]

This comes to the same issue as #4543.

Unfortunately there is no solution available yet. Closing as dup of #4543

[jeheyer]

Thanks, I now remember seeing that a few years ago and will add a note to google on the feature request https://issuetracker.google.com/issues/257459514?pli=1

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.