database_encryption forces cluster recreation

[marko7460]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

12:24 $ terraform --version
Terraform v0.12.24
+ provider.google-beta v3.28.0

Affected Resource(s)

• google_container_cluster

Terraform Configuration Files

resource "google_container_cluster" "primary" {
  provider = google-beta
  project = "MY_PROJECT_ID"
  name               = "gke"
  location           = "us-central1"
  initial_node_count = 3


  node_config {
    oauth_scopes = [
      "https://www.googleapis.com/auth/logging.write",
      "https://www.googleapis.com/auth/monitoring",
    ]

    metadata = {
      disable-legacy-endpoints = "true"
    }
    service_account = "gke-sa@MY_PROJECT_ID.iam.gserviceaccount.com"
    disk_size_gb = 100
    disk_type = "pd-standard"
    machine_type = "n1-standard-1"
    shielded_instance_config {
      enable_secure_boot = false
      enable_integrity_monitoring = true
    }
    workload_metadata_config {
      node_metadata = "GKE_METADATA_SERVER"
    }
  }

  ip_allocation_policy {
    services_secondary_range_name = "services"
    cluster_secondary_range_name = "pods"
  }
  network = "vpc"
  subnetwork = "gke"

  private_cluster_config {
    enable_private_nodes = true
    enable_private_endpoint = false
    master_ipv4_cidr_block = "10.10.10.0/28"
  }

  workload_identity_config {
    identity_namespace = "MY_PROJECT_ID.svc.id.goog"
  }

  release_channel {
    channel = "REGULAR"
  }

  vertical_pod_autoscaling {
    enabled = true
  }

  network_policy {
    enabled = true
    provider = "CALICO"
  }

  addons_config {
    horizontal_pod_autoscaling{
      disabled = false
    }
    http_load_balancing {
      disabled = false
    }
  }
 /* Run first without this block and then with this block
  database_encryption {
    state = "ENCRYPTED"
    key_name = "projects/MY_PROJECT_ID/locations/us-central1/keyRings/gke/cryptoKeys/gke"
  }*/
}

Expected Behavior

When database_encryption is added the cluster should not be recreated. According to the documentation (https://cloud.google.com/kubernetes-engine/docs/how-to/encrypting-secrets) it is possible to update the cluster without recreating it.

Actual Behavior

The cluster gets marked for recreation.

      ~ database_encryption {
          + key_name = "projects/sandbox-0001-282116/locations/us-central1/keyRings/gke/cryptoKeys/gke" # forces replacement
          ~ state    = "DECRYPTED" -> "ENCRYPTED" # forces replacement
        }

Steps to Reproduce

1. terraform apply without database_encryption block
2. terraform apply with database_encryption block

Important Factoids

If I run gcloud container clusters update gke --region us-central1 --database-encryption-key projects/MY_PROJECT_ID/locations/us-central1/keyRings/gke/cryptoKeys/gke before doing terraform apply with database_encryption , then there will be no changes in the state file and the cluster will not be recreated.

[edwardmedia]

I see it requires replacement after adding the database_encryption

[marko7460]

I enabled logging for the gcloud command and i see that gcloud sends:

==== request start ====
uri: https://container.googleapis.com/v1/projects/MYPROJECT_ID/locations/us-central1/clusters/cluster-1?alt=json
method: PUT
== headers start ==
b'Authorization': --- Token Redacted ---
b'accept': b'application/json'
b'accept-encoding': b'gzip, deflate'
b'content-length': b'239'
b'content-type': b'application/json'
b'user-agent': b'google-cloud-sdk gcloud/299.0.0 command/gcloud.container.clusters.update invocation-id/c00b9b1c27b7414b9cd8e9246fc20fb9 environment/None environment-version/None interactive/True from-script/False python/3.7.3 term/xterm-256color (Macintosh; Intel Mac OS X 19.5.0)'
== headers end ==
== body start ==
{"name": "projects/MYPROJECT_IDlocations/us-central1/clusters/cluster-1", "update": {"desiredDatabaseEncryption": {"keyName": "projects/MYPROJECT_ID/locations/us-central1/keyRings/gke/cryptoKeys/gke", "state": "ENCRYPTED"}}}

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!