make Firewall Policy Association mutable #9495
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Current result of exploration on this issue: using the
replaceExistingAssociation
parameter, the resource is able to be updated following the expected paradigm i.e. the fine grainedfirewall_policy_association
is not actually updated, but a new association is added to a different firewall policy, and given a flag allowing it to "steal" the attachment target from the existing association to previous firewall policy. If alifecycle.create_before_destroy
flag is set on the firewall policy, and an immutable characteristic is changed, the operations will successfully process for creating a new firewall policy, and updating the association without introducing a gap in policy-association uptime.However there are problems with this straight forward approach:
replaceExistingAssociation
addition fails, the resource breaks within Terraform due to some unseen change in the API end. The "existing association" will no longer be reachable, despite still existing. I was unable to determine why this is the case, but all operations on the resource will fail with the following message: "Error 400: Invalid value for field 'name': '{{name}}'. An association with that name does not exist., invalid". While existing infrastructure is undamaged, this will force the resource to be removed from state.replaceExistingAssociation
operation succeeds, temporarily the existing association persists, which can cause the older firewall policy to fail to delete. this does not cause a critical failure, as the policy can be deleted on a retry soon afterwardThe following config can be used to demo the swapover scenarios, replacing
{{organization}}
with your local test org:https://paste.googleplex.com/4641467795243008
Release Note Template for Downstream PRs (will be copied)
See Write release notes for guidance.
Derived from GoogleCloudPlatform/magic-modules#13078