hashicorp/terraform-provider-google-beta v8.9.0

on GitHub

NOTES:

• compute: updated google_compute_disk, google_compute_region_disk, and google_compute_snapshot to fail at plan time instead of recreating the resource when removing the KMS key, or changing it while kms_key_service_account is set (#13405)

DEPRECATIONS:

• appengine: deprecated vpc_access.egress_setting in google_app_engine_standard_app_version; use vpc_access.vpc_egress instead (#13483)
• container: deprecated addons_config.parallelstore_csi_driver_config on google_container_cluster. Use addons_config.lustre_csi_driver_config instead (#13523)
• container: deprecated remove_default_node_pool on google_container_cluster in favor of omitting initial_node_count and node_config (or setting initial_node_count = 0). When this is set to true and the default node pool was not created, this will do a noop. (#13547)
• parallelstore: deprecated google_parallelstore_instance. Use google_lustre_instance instead (#13523)

FEATURES:

• New Data Source: google_agent_identity_auth_provider_iam_policy (#13522)
• New Resource: google_agent_identity_auth_provider_iam_binding (#13522)
• New Resource: google_agent_identity_auth_provider_iam_member (#13522)
• New Resource: google_agent_identity_auth_provider_iam_policy (#13522)
• New Resource: google_bigtable_memory_layer (#13509)
• New Resource: google_network_services_cdn_edge_extension (#13400)
• New Resource: google_network_services_telemetry_policy (#13521)
• New Resource: google_resource_manager_boundary (#13491)
• New Resource: google_resource_manager_boundary_config (#13491)
• New Resource: google_vertex_ai_custom_job (#13459)
• New Resource: google_vertex_ai_pipeline_job (#13440)
• New Resource: google_vertex_ai_rag_file (#13506)

IMPROVEMENTS:

• agenticapplications: added artifacts_config.audit_trail_export_options field to google_agentic_applications_analyst_agent_persona resource (#13466)
• appengine: added vpc_access.vpc_egress field to google_app_engine_standard_app_version (#13483)
• bigqueryconnection: added salesforce_data_cloud field to google_bigquery_connection resource (#13530)
• bigqueryreservation: added scheduling_policy field to google_bigquery_reservation and google_bigquery_reservation_assignment resources (#13409)
• bigtable: added standard_isolation.memory_config field to google_bigtable_app_profile resource (#13540)
• cloudbuild: added worker_config.worker_release field to google_cloudbuild_worker_pool resource (#13510)
• cloudbuild: increased default create, update, and delete timeouts for google_cloudbuild_worker_pool from 20 minutes to 120 minutes (#13423)
• colab: added workbench_runtime.custom_container_image and kernel_name fields to google_colab_notebook_execution resource (#13458)
• compute: added address_id attribute for google_compute_address data source (#13511)
• compute: added CUSTOM_HARDWARE_LINK as a supported value for purpose in google_compute_subnetwork resource (#13548)
• compute: added FORCE deletion_policy support to google_compute_instance_group_manager and google_compute_region_instance_group_manager (#13403)
• compute: added IDPF and SUSPEND_SAFE_FPR to guest_os_features.type in google_compute_region_disk and SUSPEND_SAFE_FPR in google_compute_image (#13392)
• compute: added ipv6_address field to google_compute_network_endpoint (#13512)
• compute: added ipv6_address field to google_compute_network_endpoints (#13543)
• compute: added params.resource_manager_tags field to google_compute_network_edge_security_service resource (#13457)
• compute: added in-place updates when adding disk_encryption_key.kms_key_self_link to google_compute_disk, disk_encryption_key.kms_key_name to google_compute_region_disk, and snapshot_encryption_key.kms_key_self_link to google_compute_snapshot when the resource has no key (#13405)
• compute: added server generated id as firewall_id to google_compute_firewall (#13539)
• compute: added server generated id as router_id to google_compute_router (#13539)
• compute: added server generated id as service_attachment_id to google_compute_service_attachment (#13539)
• compute: allowed updating provisioned_iops and provisioned_throughput in place on google_compute_instance hyperdisk boot disks instead of recreating the instance (#13529)
• container: added default_image_type and valid_image_types fields to google_container_engine_versions data source (#13476)
• container: added support for SHORT_LIVED value to node_pool.upgrade_settings.strategy in google_container_cluster and upgrade_settings.strategy in google_container_node_pool (#13517)
• container: updated google_container_cluster to support creating clusters without a default node pool when initial_node_count and node_config are omitted (or initial_node_count is set to 0). When remove_default_node_pool = true and the default node pool was not created, remove_default_node_pool will do a noop. (#13547)
• container: updated initial_node_count on google_container_cluster so it can be removed from config or set to null without creating a diff while still respecting 0 when set in config (#13547)
• dataproc: added cluster_config.master_flexible_config, cluster_config.worker_flexible_config, and cluster_config.secondary_worker_flexible_config fields to google_dataproc_cluster resource (#13544)
• discoveryengine: added model_configs field to google_discovery_engine_search_engine resource (#13514)
• discoveryengine: fixed google_discovery_engine_target_site operations by increasing timeout to 24hrs (#13479)
• dlp: added FILE_STORE_PROFILE as an accepted detail_of_message value in google_data_loss_prevention_discovery_config (#13431)
• geminidataanalytics: added datasource_references.bq.property_graph_references, datasource_references.bq.table_references.schema, datasource_references.looker.explore_references, datasource_references.studio.studio_references, example_queries.parameters, looker_golden_queries, options.model, and user_functions.bq_routines fields to published_context and staging_context in google_gemini_data_analytics_data_agent resource (#13515)
• hypercomputecluster: added compute_resources.config.new_flex_start_instances.network_tags, compute_resources.config.new_on_demand_instances.network_tags, compute_resources.config.new_reserved_instances.network_tags, compute_resources.config.new_spot_instances.network_tags, orchestrator.slurm.login_nodes.network_tags, and storage_resources.config.existing_nfs fields to google_hypercomputecluster_cluster resource (#13478)
• networkservices: increased default create, update, and delete timeouts from 20m to 30m for google_network_services_multicast_consumer_association, google_network_services_multicast_domain, google_network_services_multicast_domain_activation, google_network_services_multicast_domain_group, google_network_services_multicast_group_consumer_activation, google_network_services_multicast_group_producer_activation, google_network_services_multicast_group_range, google_network_services_multicast_group_range_activation, and google_network_services_multicast_producer_association (#13410)
• oracledatabase: added in-place update support for labels on google_oracle_database_cloud_exadata_infrastructure, google_oracle_database_cloud_vm_cluster, google_oracle_database_exascale_db_storage_vault, google_oracle_database_db_system, google_oracle_database_odb_subnet, google_oracle_database_goldengate_deployment, google_oracle_database_goldengate_connection, google_oracle_database_goldengate_connection_assignment and google_oracle_database_autonomous_database (#13452)
• oracledatabase: added support for setting properties.scan_listener_port_tcp and properties.scan_listener_port_tcp_ssl on google_oracle_database_cloud_vm_cluster creation (#13441)
• recaptchaenterprise: added express_settings and universal_settings fields to google_recaptcha_enterprise_key resource (#13433)
• vertexai: added metadata.config.algorithm_config.tree_ah_config.fraction_leaf_nodes_to_search field to google_vertex_ai_index resource (#13518)
• workstations: added host.gce_instance.boost_configs.enable_automatic_failover field to google_workstations_workstation_config resource (#13498)

BUG FIXES:

• accesscontextmanager: added plan-time format validation and fixed a crash when perimeter_name, perimeter, access_level, egress_policy_name, or ingress_policy_name is not in the expected accessPolicies/{policy}/... format in google_access_context_manager_access_level_condition, google_access_context_manager_egress_policy, google_access_context_manager_ingress_policy, google_access_context_manager_service_perimeter_dry_run_egress_policy, google_access_context_manager_service_perimeter_dry_run_ingress_policy, google_access_context_manager_service_perimeter_dry_run_resource, google_access_context_manager_service_perimeter_egress_policy, google_access_context_manager_service_perimeter_ingress_policy, and google_access_context_manager_service_perimeter_resource (#13527)
• agenticapplications: fixed a bug where mcp_data_sources.0.api_key and mcp_data_sources.0.client_secret were attempting to read from the API in google_agentic_applications_analyst_agent_persona (#13387)
• alloydb: fixed an issue where google_alloydb_instance operations could fail with a 400 or 409 error when the instance is temporarily undergoing another update operation or unable to queue the operation (#13499)
• apigee: fixed a crash when importing google_apigee_endpoint_attachment (#13525)
• appengine: fixed diff on API-provided values for vpc_access.network_interfaces.network and vpc_access.network_interfaces.subnetwork in google_app_engine_standard_app_version (#13483)
• ces: fixed an eventual consistency error when deleting google_ces_app_version immediately after google_ces_deployment (#13526)
• cloudrun: fixed Provider produced inconsistent final plan when metadata.0.labels or metadata.0.annotations contains unknown values in google_cloud_run_service and google_cloud_run_domain_mapping (#13504)
• colab: fixed google_colab_runtime and google_colab_notebook_execution failures when the subnetwork is not ready during operation execution (#13503)
• compute: fixed google_compute_instance boot disk updates not setting the user project header correctly when user_project_override is enabled (#13529)
• compute: fixed google_compute_reservation, data.google_compute_reservation_block, and data.google_compute_reservation_sub_block to respect compute_custom_endpoint when querying reservation blocks and sub-blocks (#13390)
• compute: fixed resourceNotReady errors across Compute Engine resources by retrying HTTP 400 resourceNotReady responses globally (#13454)
• compute: fixed a bug where google_compute_instance_group_manager ignored the PREVENT deletion_policy (#13403)
• compute: increased default create, update, and delete timeouts from 20m to 30m on google_compute_snapshot_settings (#13415)
• compute: updated google_compute_disk, google_compute_region_disk, and google_compute_snapshot to reject a KMS key with a /cryptoKeyVersions/ suffix at plan time instead of recreating the resource on every apply (#13391)
• container: fixed a crash when empty configuration blocks such as node_config {} are specified on google_container_cluster or google_container_node_pool, or blocks with zero values are specified like authenticator_groups_config {} (#13485)
• dataproc: fixed google_dataproc_cluster creation failures when the subnetwork is not ready during cluster provisioning (#13503)
• dataproc: fixed creation and update failures when a referenced Compute Engine resource is not ready yet (#13507)
• datastream: fixed a permadiff on mongodb_profile.secret_manager_stored_password and mongodb_profile.password in google_datastream_connection_profile (#13389)
• firebaseapphosting: fixed spurious diff on google_firebase_app_hosting_domain create by polling until configuration is materialized (#13464)
• gkehub: fixed an issue that prevented spec.workloadidentity and spec.fleetobservability from being set to empty blocks in google_gke_hub_feature (#13477)
• healthcare: fixed an issue where google_healthcare_dataset creation did not wait for the create long-running operation and could fail after 5 minutes with Root object was present, but now absent (#13438)
• networksecurity: increased default create, update, and delete timeouts from 20m to 60m on google_network_security_firewall_endpoint_association (#13414)
• networkservices: increased default create, update, and delete timeouts from 20m to 60m on google_network_services_multicast_domain_activation (#13413)
• provider: fixed a bug where google_apikeys_key, google_assured_workloads_workload, google_cloudbuild_worker_pool, google_clouddeploy_delivery_pipeline, google_clouddeploy_target, google_container_aws_cluster, google_container_aws_node_pool, google_container_azure_client, google_container_azure_cluster, google_container_azure_node_pool, google_dataplex_asset, google_dataplex_lake, google_dataplex_zone, google_dataproc_workflow_template, google_firebaserules_release, google_firebaserules_ruleset, google_gke_hub_feature_membership, and google_recaptcha_enterprise_key were removed from state on read errors (#13492)
• provider: fixed a bug where google_apikeys_key, google_assured_workloads_workload, google_cloudbuild_worker_pool, google_clouddeploy_delivery_pipeline, google_clouddeploy_target, google_container_aws_cluster, google_container_aws_node_pool, google_container_azure_client, google_container_azure_cluster, google_container_azure_node_pool, google_dataplex_asset, google_dataplex_lake, google_dataplex_zone, google_dataproc_workflow_template, google_firebaserules_release, google_firebaserules_ruleset, google_gke_hub_feature_membership, and google_recaptcha_enterprise_key were removed from state when an update or delete failed (#13426)
• provider: fixed a bug where google_compute_firewall_policy_association, google_compute_firewall_policy_rule, google_compute_organization_security_policy_association, google_compute_organization_security_policy_rule, google_endpoints_service, google_logging_billing_account_bucket_config, google_logging_folder_bucket_config, google_logging_organization_bucket_config, google_logging_project_bucket_config, and google_service_networking_vpc_service_controls were removed from state when read, update, or delete operations failed (#13495)
• provider: fixed an unbound retry in IAM writes when hitting API quotas (429 error). Now, IAM read-modify-writes will exponentially backoff, and terminate (#13402)
• provider: removed an extra sleep on IAM writes while several concurrent changes are happening, backoff and terminate for a longer window (90s + grace period) (#13402)
• serviceusagev2: fixed parent/name replacement behavior, enable_rules block limit, billing_project propagation on update/LROs, and empty policy payload on destroy for google_service_usage_v2_consumer_policy (#13545)
• sql: fixed issue where creating SQL Server Entra ID users (google_sql_user with type = "ENTRAID_USER") failed state refresh due to username domain truncation (#13468)
• sql: fixed leaking sensitive values and skipped root_password comparison during blue_green_deployment switchover validation on google_sql_database_instance (#13546)
• vertexai: fixed an issue where GOOGLE_CLOUD_AGENT_ENGINE_ENABLE_TELEMETRY environment variable in google_vertex_ai_reasoning_engine was ignored in state when explicitly configured (#13460)
• workbench: fixed google_workbench_instance creation and update failures when the subnetwork is not ready during operation execution (#13503)