Deploying Resource results in 'inconsistent' error

[davenportjw]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

google provider version: v4.84.0

I believe the TF version is 1.2.3 or 1.2.6

Affected Resource(s)

Appears to be service accounts from prior failures, but this specific example is below

• google_service_account

Expected Behavior

Successful deployment/

Actual Behavior

Cloud Build Logs: https://console.cloud.google.com/cloud-build/builds/435e6b9a-a37b-477b-9c4f-7e46c4cf702c?project=cloud-foundation-cicd&e=13803378&mods=pan_ng2

b/304483428

[edwardmedia]

@davenportjw I did not see the inconsistent error from the Cloud Build log you provided. Or did I miss your point?

[davenportjw]

the automation framework has a retry in it. the inconsistent starts at line 2004

…

On Mon, Oct 9, 2023 at 2:31 PM Edward Sun ***@***.***> wrote: @davenportjw <https://github.com/davenportjw> I did not see the inconsistent error from the Cloud Build log you provided. Or did I miss your point? — Reply to this email directly, view it on GitHub <#16185 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADK7DPW4C6IHWK5O5GOIZB3X6RNJZAVCNFSM6AAAAAA5ZH4MDKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTONJTG42DSMZTHE> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[sbocinec]

The link to the Cloud Build output is not public. Though, we are also frequently (a few times daily) experiencing the following incosistent result issue with google_service_account:

Error: Provider produced inconsistent result after apply
When applying changes to google_service_account.connectors[0], provider "provider[\"registry.terraform.io/hashicorp/google\"]" produced an unexpected new value: Root resource was present, but now absent.
This is a bug in the provider, which should be reported in the provider's own
issue tracker.

In all our cases, the SA is created in GCP, as retrying apply fails with 409:

Error: Error creating service account: googleapi: Error 409: Service account connectors already exists within project projects/connectors-xyz.
Details:
[
  {
    "@type": "type.googleapis.com/google.rpc.ResourceInfo",
    "resourceName": "projects/connectors-xyz/serviceAccounts/connectors@connectors-xyz.iam.gserviceaccount.com"
  }
]
, alreadyExists
  with google_service_account.connectors[0],
  on sa.tf line 9, in resource "google_service_account" "connectors":
   9: resource "google_service_account" "connectors" {

terraform version: 1.2.9
google provider version: 4.83.0

Example code:

resource "google_service_account" "connectors" {
  count        = local.create_connectors_service_account ? 1 : 0
  account_id   = substr(local.cluster_name, 0, 28)
  display_name = "${local.cluster_name} connectors service account"
}

I wonder, can it be related to the recent fix of retrying read after creating the google_service_account if 403 is received GoogleCloudPlatform/magic-modules#8815 , introduced in 4.83.0 ?

[benhxy]

Looks like a dup with #10193. We can consider adding error handling of 409.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.