$ the-wire · showcase
Router updates stop eating peer MD5 keys, and Cloud SQL blue/green ordering gets fixed
By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology
1 person shipped this
A pair of Terraform Google provider fixes land in the same window: router updates no longer strip the MD5 authentication keys that google_compute_router_peer attaches, and removing a blue_green_deployment block from google_sql_database_instance no longer blocks a same-apply major version upgrade.
compute: stop google_compute_router from removing google_compute_router_peer MD5 keys hashicorp/terraform-provider-google
Updates to google_compute_router were deleting the MD5 authentication keys that google_compute_router_peer adds to the router; the API requires every entry in Router.md5AuthenticationKeys to be claimed by exactly one BGP peer, so each subsequent router update failed with Error 400: Invalid resource usage, ...'not defined in md5AuthenticationKeys'. The same fix is in the beta provider.
sql: delete blue_green_deployment before instance updates hashicorp/terraform-provider-google
When the blue_green_deployment block is removed from google_sql_database_instance, the deployment is now deleted before any other instance updates, so you can drop the deployment and change database_version in the same apply; the settings version is refreshed afterward so the following update is not rejected as stale with a 412. Acceptance tests now cover instances with read replicas.
discoveryengine: add google_discovery_engine_project_provision resource hashicorp/terraform-provider-google
A create-only google_discovery_engine_project_provision resource wraps Discovery Engine's projects.locations.provision API (ProjectService.ProvisionProject), with accept_data_use_terms, data_use_terms_version, saas_params (is_biz, accept_biz_qos), and a regionalized location defaulting to "global". It ships in GA and beta alike.
compute: add identity_type to workload_identity_config and mark fields computed (beta) hashicorp/terraform-provider-google-beta
compute adds workload_identity_config.identity_type (Optional, Computed, ForceNew) and marks identity and identity_certificate_enabled as Computed across google_compute_instance, google_compute_instance_template, google_compute_region_instance_template and the from_template resources in google-beta. ForceNew means changing identity_type rewrites the instance.
dataflow: add google_dataflow_config_store_setting hashicorp/terraform-provider-google
google_dataflow_config_store_setting manages regional Dataflow Config Store settings at project, folder, or organization scope. Also new on the beta desk: an optional update_mode field on google_vertex_ai_model_development_cluster (USER_ONLY or USER_AND_SERVICE, defaulting to current behavior), and sweepers for google_cloud_ids_endpoint tests in both providers.
Action items
- → Upgrade terraform-provider-google (and -beta) to the release carrying the router MD5 fix before your next plan/apply ... hashicorp/terraform-provider-google [plan]
- → Upgrade terraform-provider-google to the release with the blue_green_deployment delete ordering, then remove the bloc... hashicorp/terraform-provider-google [plan]
