cloud router import fails for bgp.0.asn == 0

[samveen]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v1.5.3
on linux_arm64
+ provider registry.terraform.io/hashicorp/google v4.73.1

Affected Resource(s)

• google_compute_router

Terraform Configuration Files

resource "google_compute_router" "myvpc-router" {
  bgp {
    advertise_mode = "CUSTOM"
    advertised_ip_ranges {
      range = "10.161.0.0/16"
    }
    asn                = "0"
    keepalive_interval = "20"
  }

  encrypted_interconnect_router = "false"
  name                          = "myvpc-router"
  network                       = data.terraform_remote_state.common.outputs.network_myvpc_link
  project                       = var.project
  region                        = var.region
}

Output

╷
│ Error: expected "bgp.0.asn" to be a RFC6996-compliant Local ASN:
│ must be either in the private ASN ranges: [64512..65534], [4200000000..4294967294];
│ or be the value of [16550], got 0
│ 
│   with module.routers.google_compute_router.myvpc-router,
│   on google/routers/compute_router.tf line 9, in resource "google_compute_router" "myvpc-router":
│    9:     asn                = "0"
│ 
╵

Expected Behavior

• tf plan should accept the router definition in the tf code, because the router exists, exactly as described by the TF code:

  samveen@zero2w:~ $ gcloud compute routers describe myvpc-router
  bgp:
    advertiseMode: CUSTOM
    advertisedIpRanges:
    - description: ''
      range: 10.161.0.0/16
    asn: 0
    keepaliveInterval: 20
  creationTimestamp: '2022-01-20T06:18:09.403-08:00'
  description: ''
  encryptedInterconnectRouter: false
  id: '2137032174711656910'
  kind: compute#router
  name:myvpc-router
  nats:
  - enableEndpointIndependentMapping: false
    endpointTypes:
    - ENDPOINT_TYPE_VM
    icmpIdleTimeoutSec: 30
    logConfig:
      enable: false
      filter: ALL
    minPortsPerVm: 64
    name: myvpc
    natIpAllocateOption: MANUAL_ONLY
    natIps:
    - https://www.googleapis.com/compute/v1/projects/gr-eat-69/regions/asia-south1/addresses/myvpc-nat-1
    sourceSubnetworkIpRangesToNat: LIST_OF_SUBNETWORKS
    subnetworks:
    - name: https://www.googleapis.com/compute/v1/projects/gr-eat-69/regions/asia-south1/subnetworks/myvpc-priv-1
      sourceIpRangesToNat:
      - PRIMARY_IP_RANGE
    tcpEstablishedIdleTimeoutSec: 1200
    tcpTransitoryIdleTimeoutSec: 30
    udpIdleTimeoutSec: 30
  network: https://www.googleapis.com/compute/v1/projects/gr-eat-69/global/networks/myvpc
  region: https://www.googleapis.com/compute/v1/projects/gr-eat-69/regions/asia-south1
  selfLink: https://www.googleapis.com/compute/v1/projects/gr-eat-69/regions/asia-south1/routers/myvpc-router
  

Actual Behavior

Terraform throws an error.

Steps to Reproduce

1. Router as described in terraform
2. terraform plan to check against actual definition before terraform import

Important Factoids

• I am using my google account for the actions instead of a service account.

References

• Check for valid google_compute_router.bgp.asn number #5381
• Fix for the issue: #5381 : Check BGP ASN for RFC6996 compliance or be a value of 16550 #5524 - PR that introduced this issue.

[edwardmedia]

@samveen it looks like this is a specific rule that is applied on asn field. How did you create that router? If it is by gcloud, can you share the full command statement?

Local BGP Autonomous System Number (ASN). Must be an [RFC6996](https://www.ietf.org/rfc/rfc6996.txt) private ASN, either 16-bit or 32-bit. The value will be fixed for this router resource. All VPN tunnels that link to this router will have the same local ASN.

[samveen]

@edwardmedia

• The router was created before I joined the organization/project (or even started working on GCP cloud).
• The YAML description of the router as given above.
• As per my understanding/knowledge, this router was created via the web interface.
• Checking the web interface, the ASN shows the router configured to use the "Google ASN" :
  
• From this, I extrapolate that the value 0 is actually the lack of an assigned ASN, in which case the ASN defaults to Google's ASN.
• Further, if I update the TF to use Google's ASN, tf plan gives the following output:

  Terraform will perform the following actions:
  
    # module.routers.google_compute_router.myvpc-router will be updated in-place
    ~ resource "google_compute_router" "arya-prod-mum-router" {
          id                            = "projects/gr-eat-69/regions/asia-south1/routers/myvpc-router"
          name                          = "arya-prod-mum-router"
          # (6 unchanged attributes hidden)
  
        ~ bgp {
            ~ asn                = 0 -> 16550
              # (3 unchanged attributes hidden)
  
              # (1 unchanged block hidden)
          }
      }
  

[edwardmedia]

@samveen I don't understand how asn = 0 was got in for the router as it seems invalid. Are you able to update it to 16550 via the web interface?

I don't think we could make code change such as removing the validation to support your case. I think the validation is valid. You may need to work around it. Can you recreate the router?

[samveen]

@edwardmedia I will check on it with my team. In the meantime, I can confirm that this is valid, as things work as expected. However, I concede that internally a zero value is probably getting corrected to 16550 when being utilized or applied, inside the GCP black box.

Lastly, before you write this off as invalid, would you see if you can create an analogue in your test environment to check if a blank value is accepted by the ASN field or not. (I'm equating 0 to a blank value as can be seen in the screenshot attached above)

[edwardmedia]

@samveen Can you clarify internally a zero value is probably getting corrected to 16550 when being utilized or applied?

Below is from the api doc about bgp.asn. Its value must be an RFC6996 private ASN. In the provider, it is set as required. I think you may need to fix it on your side to match the requirement. Another word, I don't think the provider will make a move to support your case.

Local BGP Autonomous System Number (ASN). Must be an [RFC6996](https://www.ietf.org/rfc/rfc6996.txt) private ASN, either 16-bit or 32-bit. The value will be fixed for this router resource. All VPN tunnels that link to this router will have the same local ASN.

[edwardmedia]

@samveen I think the resource behaves by design. Close this issue now. Feel free to reopen if you see it differently.