hashicorp/terraform-provider-google v8.9.0

on GitHub

NOTES:

• compute: updated google_compute_disk, google_compute_region_disk, and google_compute_snapshot to fail at plan time instead of recreating the resource when removing the KMS key, or changing it while kms_key_service_account is set (#30059)

DEPRECATIONS:

• container: deprecated addons_config.parallelstore_csi_driver_config on google_container_cluster. Use addons_config.lustre_csi_driver_config instead (#30328)
• container: deprecated remove_default_node_pool on google_container_cluster in favor of omitting initial_node_count and node_config (or setting initial_node_count = 0). When this is set to true and the default node pool was not created, this will do a noop. (#30375)
• parallelstore: deprecated google_parallelstore_instance. Use google_lustre_instance instead (#30328)

FEATURES:

• New Data Source: google_agent_identity_auth_provider_iam_policy (#30327)
• New Resource: google_agent_identity_auth_provider_iam_binding (#30327)
• New Resource: google_agent_identity_auth_provider_iam_member (#30327)
• New Resource: google_agent_identity_auth_provider_iam_policy (#30327)
• New Resource: google_bigtable_memory_layer (#30314)
• New Resource: google_dataflow_flex_template_job (#30318)
• New Resource: google_network_services_service_lb_policies (#30223)
• New Resource: google_resource_manager_boundary (#30257)
• New Resource: google_resource_manager_boundary_config (#30257)
• New Resource: google_vertex_ai_custom_job (#30220)
• New Resource: google_vertex_ai_pipeline_job (#30201)
• New Resource: google_vertex_ai_rag_file (#30272)

IMPROVEMENTS:

• agenticapplications: added artifacts_config.audit_trail_export_options field to google_agentic_applications_analyst_agent_persona resource (#30227)
• bigqueryconnection: added salesforce_data_cloud field to google_bigquery_connection resource (#30356)
• bigqueryreservation: added scheduling_policy field to google_bigquery_reservation and google_bigquery_reservation_assignment resources (#30065)
• bigtable: added standard_isolation.memory_config field to google_bigtable_app_profile resource (#30368)
• cloudbuild: added worker_config.worker_release field to google_cloudbuild_worker_pool resource (#30315)
• cloudbuild: increased default create, update, and delete timeouts for google_cloudbuild_worker_pool from 20 minutes to 120 minutes (#30079)
• colab: added workbench_runtime.custom_container_image and kernel_name fields to google_colab_notebook_execution resource (#30219)
• compute: added address_id attribute for google_compute_address data source (#30316)
• compute: added FORCE deletion_policy support to google_compute_instance_group_manager and google_compute_region_instance_group_manager (#30058)
• compute: added IDPF and SUSPEND_SAFE_FPR to guest_os_features.type in google_compute_region_disk and SUSPEND_SAFE_FPR in google_compute_image (#30047)
• compute: added ipv6_address field to google_compute_network_endpoint (#30317)
• compute: added ipv6_address field to google_compute_network_endpoints (#30371)
• compute: added params.resource_manager_tags field to google_compute_network_edge_security_service resource (#30218)
• compute: added in-place updates when adding disk_encryption_key.kms_key_self_link to google_compute_disk, disk_encryption_key.kms_key_name to google_compute_region_disk, and snapshot_encryption_key.kms_key_self_link to google_compute_snapshot when the resource has no key (#30059)
• compute: added server generated id as firewall_id to google_compute_firewall (#30367)
• compute: added server generated id as router_id to google_compute_router (#30367)
• compute: added server generated id as service_attachment_id to google_compute_service_attachment (#30367)
• compute: allowed updating provisioned_iops and provisioned_throughput in place on google_compute_instance hyperdisk boot disks instead of recreating the instance (#30334)
• compute: promoted instance_flexibility_policy.instance_selections.min_cpu_platform and instance_flexibility_policy.instance_selections.disks to GA in google_compute_region_instance_group_manager (#30162)
• compute: promoted mirror_percent in request_mirror_policy to GA for google_compute_url_map and google_compute_region_url_map (#30224)
• container: added default_image_type and valid_image_types fields to google_container_engine_versions data source (#30243)
• container: added support for SHORT_LIVED value to node_pool.upgrade_settings.strategy in google_container_cluster and upgrade_settings.strategy in google_container_node_pool (#30322)
• container: promoted schedule_upgrade_config to GA in google_container_cluster (#30254)
• container: updated google_container_cluster to support creating clusters without a default node pool when initial_node_count and node_config are omitted (or initial_node_count is set to 0). When remove_default_node_pool = true and the default node pool was not created, remove_default_node_pool will do a noop. (#30375)
• container: updated initial_node_count on google_container_cluster so it can be removed from config or set to null without creating a diff while still respecting 0 when set in config (#30375)
• dataproc: added cluster_config.master_flexible_config, cluster_config.worker_flexible_config, and cluster_config.secondary_worker_flexible_config fields to google_dataproc_cluster resource (#30372)
• discoveryengine: added model_configs field to google_discovery_engine_search_engine resource (#30319)
• discoveryengine: fixed google_discovery_engine_target_site operations by increasing timeout to 24hrs (#30246)
• dlp: added FILE_STORE_PROFILE as an accepted detail_of_message value in google_data_loss_prevention_discovery_config (#30161)
• geminidataanalytics: added datasource_references.bq.property_graph_references, datasource_references.bq.table_references.schema, datasource_references.looker.explore_references, datasource_references.studio.studio_references, example_queries.parameters, looker_golden_queries, options.model, and user_functions.bq_routines fields to published_context and staging_context in google_gemini_data_analytics_data_agent resource (#30320)
• networksecurity: promoted wildfire_analysis_profile field to GA on google_network_security_security_profile_group resource (#30198)
• networksecurity: promoted wildfire_analysis_profile to GA on google_network_security_security_profile resource (#30198)
• networksecurity: promoted wildfire_settings and endpoint_settings.content_cloud_region, endpoint_settings.http_partial_response_blocked fields to GA on google_network_security_firewall_endpoint resource (#30198)
• networkservices: increased default create, update, and delete timeouts from 20m to 30m for google_network_services_multicast_consumer_association, google_network_services_multicast_domain, google_network_services_multicast_domain_activation, google_network_services_multicast_domain_group, google_network_services_multicast_group_consumer_activation, google_network_services_multicast_group_producer_activation, google_network_services_multicast_group_range, google_network_services_multicast_group_range_activation, and google_network_services_multicast_producer_association (#30066)
• oracledatabase: added in-place update support for labels on google_oracle_database_cloud_exadata_infrastructure, google_oracle_database_cloud_vm_cluster, google_oracle_database_exascale_db_storage_vault, google_oracle_database_db_system, google_oracle_database_odb_subnet, google_oracle_database_goldengate_deployment, google_oracle_database_goldengate_connection, google_oracle_database_goldengate_connection_assignment and google_oracle_database_autonomous_database (#30213)
• oracledatabase: added support for setting properties.scan_listener_port_tcp and properties.scan_listener_port_tcp_ssl on google_oracle_database_cloud_vm_cluster creation (#30202)
• recaptchaenterprise: added express_settings and universal_settings fields to google_recaptcha_enterprise_key resource (#30164)
• vertexai: added metadata.config.algorithm_config.tree_ah_config.fraction_leaf_nodes_to_search field to google_vertex_ai_index resource (#30323)

BUG FIXES:

• accesscontextmanager: added plan-time format validation and fixed a crash when perimeter_name, perimeter, access_level, egress_policy_name, or ingress_policy_name is not in the expected accessPolicies/{policy}/... format in google_access_context_manager_access_level_condition, google_access_context_manager_egress_policy, google_access_context_manager_ingress_policy, google_access_context_manager_service_perimeter_dry_run_egress_policy, google_access_context_manager_service_perimeter_dry_run_ingress_policy, google_access_context_manager_service_perimeter_dry_run_resource, google_access_context_manager_service_perimeter_egress_policy, google_access_context_manager_service_perimeter_ingress_policy, and google_access_context_manager_service_perimeter_resource (#30332)
• agenticapplications: fixed a bug where mcp_data_sources.0.api_key and mcp_data_sources.0.client_secret were attempting to read from the API in google_agentic_applications_analyst_agent_persona (#30042)
• alloydb: fixed an issue where google_alloydb_instance operations could fail with a 400 or 409 error when the instance is temporarily undergoing another update operation or unable to queue the operation (#30265)
• apigee: fixed a crash when importing google_apigee_endpoint_attachment (#30330)
• ces: fixed an eventual consistency error when deleting google_ces_app_version immediately after google_ces_deployment (#30331)
• cloudrun: fixed Provider produced inconsistent final plan when metadata.0.labels or metadata.0.annotations contains unknown values in google_cloud_run_service and google_cloud_run_domain_mapping (#30270)
• colab: fixed google_colab_runtime and google_colab_notebook_execution failures when the subnetwork is not ready during operation execution (#30269)
• compute: fixed google_compute_instance boot disk updates not setting the user project header correctly when user_project_override is enabled (#30334)
• compute: fixed google_compute_reservation, data.google_compute_reservation_block, and data.google_compute_reservation_sub_block to respect compute_custom_endpoint when querying reservation blocks and sub-blocks (#30045)
• compute: fixed resourceNotReady errors across Compute Engine resources by retrying HTTP 400 resourceNotReady responses globally (#30215)
• compute: fixed a bug where google_compute_instance_group_manager ignored the PREVENT deletion_policy (#30058)
• compute: increased default create, update, and delete timeouts from 20m to 30m on google_compute_snapshot_settings (#30072)
• compute: updated google_compute_disk, google_compute_region_disk, and google_compute_snapshot to reject a KMS key with a /cryptoKeyVersions/ suffix at plan time instead of recreating the resource on every apply (#30046)
• container: fixed a crash when empty configuration blocks such as node_config {} are specified on google_container_cluster or google_container_node_pool, or blocks with zero values are specified like authenticator_groups_config {} (#30252)
• dataproc: fixed google_dataproc_cluster creation failures when the subnetwork is not ready during cluster provisioning (#30269)
• dataproc: fixed creation and update failures when a referenced Compute Engine resource is not ready yet (#30312)
• datastream: fixed a permadiff on mongodb_profile.secret_manager_stored_password and mongodb_profile.password in google_datastream_connection_profile (#30044)
• firebaseapphosting: fixed spurious diff on google_firebase_app_hosting_domain create by polling until configuration is materialized (#30225)
• gkehub: fixed an issue that prevented spec.workloadidentity and spec.fleetobservability from being set to empty blocks in google_gke_hub_feature (#30244)
• healthcare: fixed an issue where google_healthcare_dataset creation did not wait for the create long-running operation and could fail after 5 minutes with Root object was present, but now absent (#30199)
• networksecurity: increased default create, update, and delete timeouts from 20m to 60m on google_network_security_firewall_endpoint_association (#30071)
• networkservices: increased default create, update, and delete timeouts from 20m to 60m on google_network_services_multicast_domain_activation (#30070)
• provider: fixed a bug where google_apikeys_key, google_assured_workloads_workload, google_cloudbuild_worker_pool, google_clouddeploy_delivery_pipeline, google_clouddeploy_target, google_container_aws_cluster, google_container_aws_node_pool, google_container_azure_client, google_container_azure_cluster, google_container_azure_node_pool, google_dataplex_asset, google_dataplex_lake, google_dataplex_zone, google_dataproc_workflow_template, google_firebaserules_release, google_firebaserules_ruleset, google_gke_hub_feature_membership, and google_recaptcha_enterprise_key were removed from state on read errors (#30258)
• provider: fixed a bug where google_apikeys_key, google_assured_workloads_workload, google_cloudbuild_worker_pool, google_clouddeploy_delivery_pipeline, google_clouddeploy_target, google_container_aws_cluster, google_container_aws_node_pool, google_container_azure_client, google_container_azure_cluster, google_container_azure_node_pool, google_dataplex_asset, google_dataplex_lake, google_dataplex_zone, google_dataproc_workflow_template, google_firebaserules_release, google_firebaserules_ruleset, google_gke_hub_feature_membership, and google_recaptcha_enterprise_key were removed from state when an update or delete failed (#30156)
• provider: fixed a bug where google_compute_firewall_policy_association, google_compute_firewall_policy_rule, google_compute_organization_security_policy_association, google_compute_organization_security_policy_rule, google_endpoints_service, google_logging_billing_account_bucket_config, google_logging_folder_bucket_config, google_logging_organization_bucket_config, google_logging_project_bucket_config, and google_service_networking_vpc_service_controls were removed from state when read, update, or delete operations failed (#30261)
• provider: fixed an unbound retry in IAM writes when hitting API quotas (429 error). Now, IAM read-modify-writes will exponentially backoff, and terminate (#30057)
• provider: removed an extra sleep on IAM writes while several concurrent changes are happening, backoff and terminate for a longer window (90s + grace period) (#30057)
• sql: fixed issue where creating SQL Server Entra ID users (google_sql_user with type = "ENTRAID_USER") failed state refresh due to username domain truncation (#30229)
• vertexai: fixed an issue where GOOGLE_CLOUD_AGENT_ENGINE_ENABLE_TELEMETRY environment variable in google_vertex_ai_reasoning_engine was ignored in state when explicitly configured (#30221)
• workbench: fixed google_workbench_instance creation and update failures when the subnetwork is not ready during operation execution (#30269)