Terraform doesn't detect when a taint needs to removed from a node pool

[renescheepers]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to the modular-magician user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If an issue is assigned to a user, that user is claiming responsibility for the issue. If an issue is assigned to hashibot, a community member has claimed the issue already.

Terraform Version

Terraform v1.3.6
on darwin_arm64
+ provider registry.terraform.io/hashicorp/google v4.46.0
+ provider registry.terraform.io/hashicorp/google-beta v4.46.0

Affected Resource(s)

• google_container_node_pool

Terraform Configuration Files

provider "google" {
  project = ""
}

provider "google-beta" {
  project = ""
}

resource "google_container_cluster" "primary" {
  name     = "testing-rene"
  location = "us-central1"

  remove_default_node_pool = true
  initial_node_count       = 1
}

resource "google_container_node_pool" "default-node-pool" {
  name       = "default"
  cluster    = google_container_cluster.primary.id
  node_count = 1

  node_config {
    taint { # Remove after applying
      effect = "NO_EXECUTE"
      key    = "some-key"
      value  = "some-value"
    }
  }
}

Expected Behavior

Node pool is recreated without the taint.

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # google_container_node_pool.default-node-pool must be replaced
-/+ resource "google_container_node_pool" "default-node-pool" {
      ~ id                          = "projects/shopify-codelab-and-demos/locations/us-central1/clusters/testing-rene/nodePools/default" -> (known after apply)
      ~ initial_node_count          = 1 -> (known after apply)
        name                        = "default"

      ~ node_config {
          ~ taint             = [
              ~ {
                },
            ]
        }
    }
...

Plan: 1 to add, 0 to change, 1 to destroy.

Actual Behavior

No changes. Your infrastructure matches the configuration.

Steps to Reproduce

1. terraform apply
2. Remove the taint from the node config in google_container_node_pool.default-node-pool
3. terraform plan

References

• b/298502203

[edwardmedia]

@renescheepers I am not clear how to repro the issue. Can you show me the configs for step #1 and step#3?

[renescheepers]

@renescheepers I am not clear how to repro the issue. Can you show me the configs for step #1 and step#3?

@edwardmedia sorry for the late reply, was on holiday. Here is the configuration I used:

Step 1

provider "google" {
  project = ""
}

provider "google-beta" {
  project = ""
}

resource "google_container_cluster" "primary" {
  name     = "testing-rene"
  location = "us-central1"

  remove_default_node_pool = true
  initial_node_count       = 1
}

resource "google_container_node_pool" "default-node-pool" {
  name       = "default"
  cluster    = google_container_cluster.primary.id
  node_count = 1

  node_config {
    taint { # Remove after applying
      effect = "NO_EXECUTE"
      key    = "some-key"
      value  = "some-value"
    }
  }
}

Step 3 commented out taint

provider "google" {
  project = ""
}

provider "google-beta" {
  project = ""
}

resource "google_container_cluster" "primary" {
  name     = "testing-rene"
  location = "us-central1"

  remove_default_node_pool = true
  initial_node_count       = 1
}

resource "google_container_node_pool" "default-node-pool" {
  name       = "default"
  cluster    = google_container_cluster.primary.id
  node_count = 1

  node_config {
    #taint { # Remove after applying
    #  effect = "NO_EXECUTE"
    #  key    = "some-key"
    #  value  = "some-value"
    #}
  }
}

[edwardmedia]

@renescheepers I probably not exactly follow the issue. Can you explain why taint block can be added in the config? Don't you see below error in the plan/apply at the first hand?

Blocks of type "taint" are not expected here.

resource "google_container_node_pool" "default-node-pool" {
  name       = "default"
  cluster    = google_container_cluster.primary.id
  node_count = 1

  node_config {
    taint { # Remove after applying
      effect = "NO_EXECUTE"
      key    = "some-key"
      value  = "some-value"
    }
  }
}

[renescheepers]

@edwardmedia taints are configured in the google_container_node_pool.node_config so that will work. I don't see that error.

  # google_container_node_pool.default-node-pool will be created
  + resource "google_container_node_pool" "default-node-pool" {
      + cluster                     = (known after apply)
      + id                          = (known after apply)
      + initial_node_count          = (known after apply)
      + instance_group_urls         = (known after apply)
      + location                    = (known after apply)
      + managed_instance_group_urls = (known after apply)
      + max_pods_per_node           = (known after apply)
      + name                        = "default"
      + name_prefix                 = (known after apply)
      + node_count                  = 1
      + node_locations              = (known after apply)
      + operation                   = (known after apply)
      + project                     = (known after apply)
      + version                     = (known after apply)

      + node_config {
          + disk_size_gb      = (known after apply)
          + disk_type         = (known after apply)
          + guest_accelerator = (known after apply)
          + image_type        = (known after apply)
          + labels            = (known after apply)
          + local_ssd_count   = (known after apply)
          + logging_variant   = "DEFAULT"
          + machine_type      = (known after apply)
          + metadata          = (known after apply)
          + min_cpu_platform  = (known after apply)
          + oauth_scopes      = (known after apply)
          + preemptible       = false
          + service_account   = (known after apply)
          + spot              = false
          + taint             = [
              + {
                  + effect = "NO_EXECUTE"
                  + key    = "some-key"
                  + value  = "some-value"
                },
            ]
        }
    }

https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/container_cluster#taint

[rileykarson]

I think this is ultimately caused for the same reasons as #7928. We're likely to fix this in a future major release but I'm not sure if much is possible to change outside of that.

[rileykarson]

Closed in GoogleCloudPlatform/magic-modules#9011.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.