[Bug] Conflicting configuration arguments on regional HTTPS proxy when cert_management_choice is set

[pbahng]

Bug Description

google_compute_region_target_https_proxy.gemini_enterprise_https_proxy cannot be planned or applied because the resource declares both ssl_certificates and certificate_manager_certificates with empty-list ([]) fallbacks. The provider declares these attributes as mutually exclusive (ConflictsWith), and the Terraform plugin SDK treats [] as "configured". This means that the validator fires regardless of which cert_management_choice is selected. The deployment is unable to proceed in either self_managed or google_managed mode.

Introduced in commit 56f68590 ("Enhances Terraform infrastructure for Gemini Enterprise") which added the Google-managed cert option via Certificate Manager.

Environment and Deployment Context

• Stellar Engine Version/Commit: feat/g4g-deployment-1.2.0 at 814e8e33 (also reproducible on main)
• Deployment Type:
  • FedRAMP High
• FAST Stage (if applicable): N/A. This is a blueprint (blueprints/fedramp-high/gemini-enterprise/gemini-stage-1), not a FAST stage.
• Affected Component: blueprints/fedramp-high/gemini-enterprise/gemini-stage-1/load_balancer.tf (lines 137-138)
• Terraform Version: 1.7.4
• GCP Provider Version: hashicorp/google >= 5.0

Steps to Reproduce

1. Stand up stage-0 of the Gemini Enterprise FedRAMP High blueprint (any deployment_type other than none).
2. cd blueprints/fedramp-high/gemini-enterprise/gemini-stage-1
3. Set cert_management_choice to either self_managed or google_managed in terraform.tfvars.
4. Run terraform init && terraform apply.
5. See the conflict errors during the plan phase.

Expected Behavior

terraform apply proceeds and provisions the regional HTTPS proxy with whichever cert source matches cert_management_choice. The other attribute should be unset.

Actual Behavior

Plan phase aborts. The unused attribute is treated as configured (because [] ≠ unset for ConflictsWith), so the provider rejects the resource with two mirror-image conflict errors.

Relevant Logs and Errors

Error: Conflicting configuration arguments

  with google_compute_region_target_https_proxy.gemini_enterprise_https_proxy[0],
  on load_balancer.tf line 137, in resource "google_compute_region_target_https_proxy" "gemini_enterprise_https_proxy":
 137:   ssl_certificates = var.cert_management_choice == "self_managed" ? [data.google_compute_region_ssl_certificate.gemini_enterprise_cert[0].self_link] : []

"ssl_certificates": conflicts with certificate_manager_certificates

Error: Conflicting configuration arguments

  with google_compute_region_target_https_proxy.gemini_enterprise_https_proxy[0],
  on load_balancer.tf line 138, in resource "google_compute_region_target_https_proxy" "gemini_enterprise_https_proxy":
 138:   certificate_manager_certificates = var.cert_management_choice == "google_managed" ? [google_certificate_manager_certificate.gemini_enterprise_managed_cert[0].id] : []

"certificate_manager_certificates": conflicts with ssl_certificates

Terraform Apply failed!

Additional Context

• Blocks all stage-1 deployments of the Gemini Enterprise FedRAMP High blueprint with load balancers selected until resolved. Affects both self_managed and google_managed cert paths.
• Fix is to replace the [] fallback with null so the unused attribute is genuinely unset, allowing ConflictsWith to pass.

[aghassemlouei]

Thank you for opening this pull request! We'll get our maintainers to take a look at this shortly. Appreciate your patience as we formalize our internal processes.

[pbahng]

Thanks for the prompt follow up! FWIW, I raised this PR to the feat/g4g-deployment-1.2.0 branch as it aligns best with the work I'm doing, but the issue is also present in the main branch. I figured there are internal processes to sync those two together.