google_container_cluster istio_config.auth no auth or AUTH_NONE Options Not Supported

[bantonj]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment
• If an issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to "hashibot", a community member has claimed the issue already.

Terraform Version

Terraform v0.11.13

• provider.google v2.8.0
• provider.google-beta v2.8.0
• provider.local v1.2.2
• provider.random v2.1.2

Affected Resource(s)

• google_container_cluster

Terraform Configuration Files

resource "google_container_cluster" "gke_cluster" {
  provider           = "google-beta"
  name               = "${var.cluster_name}"
  location           = "${var.location}"
  network            = "${var.network}"
  subnetwork         = "${var.subnetwork}"
  min_master_version = "${var.min_master_version}"

  initial_node_count       = 1
  remove_default_node_pool = true

  network_policy {
    enabled = "${var.private_network}"
  }

  ip_allocation_policy {
    use_ip_aliases          = "true"
    cluster_ipv4_cidr_block = "${var.cluster_ipv4_cidr_block}"
  }

  # Setting an empty username and password explicitly disables basic auth
  master_auth {
    username = ""
    password = ""

    client_certificate_config {
      issue_client_certificate = false
    }
  }

  addons_config {
    istio_config {
      disabled = "${var.istio_disabled}"
      auth     = "${var.istio_auth}"
      # OR no auth
    }
  }

  resource_labels {
    team        = "${var.team}"
    environment = "${var.environment}"
  }
}

Debug Output

Panic Output

Expected Behavior

Terraform should do nothing for already created GKE clusters with Istio enabled, but auth not configured, or should support setting auth to AUTH_NONE.

Actual Behavior

Terraform wants to addons_config.0.istio_config.0.auth: "" => "AUTH_NONE" and after applying terraform again wants to make that change. After setting auth to AUTH_NONE, terraform complains that AUTH_NONE doesn't match AUTH_MUTUAL_TLS.

Steps to Reproduce

1. Create a GKE cluster with istio enabled, but no auth specified with google-beta provider 2.7.0.
2. Upgrade to google-beta provider 2.8.0
3. terraform apply

or

1. Create a GKE cluster with istio enabled and auth set to AUTH_NONE
2. terraform apply
3. Terraform complains that AUTH_NONE is not supported

Important Factoids

References

• https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1beta1/projects.locations.clusters#Cluster.IstioConfig

[rileykarson]

This should be resolved in our next release, likely 2.9.0 next week. In the meantime, you can set lifecycle.ignore_changes on the field as the values are effectively equivalent.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!