google_artifact_registry_repository inconsistent dynamic upstream

[Djabx]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Terraform Version & Provider Version(s)

Terraform v1.8.3
on x86_64

• provider registry.terraform.io/hashicorp/google v5.29.1
• provider registry.terraform.io/hashicorp/google-beta v5.29.1

Affected Resource(s)

google_artifact_registry_repository

Terraform Configuration

resource "google_artifact_registry_repository" "public" {
  project       = var.project
  location      = var.region
  depends_on    = []
  repository_id = "public"
  description   = "example virtual docker repository"
  format        = "DOCKER"
  mode          = "VIRTUAL_REPOSITORY"

  virtual_repository_config {
    dynamic "upstream_policies" {
      for_each = var.create_proxy_gcr ? [1] : []
      content {
        id         = "proxy-gcr"
        repository = google_artifact_registry_repository.proxy_gcr[0].id
        priority   = 30
      }
    }
    dynamic "upstream_policies" {
      for_each = var.create_proxy_docker ? [1] : []
      content {
        id         = "proxy-docker"
        repository = google_artifact_registry_repository.proxy_docker[0].id
        priority   = 20
      }
    }
}

resource "google_artifact_registry_repository" "proxy_docker" {
  count         = var.create_proxy_docker ? 1 : 0
  [...]
}

resource "google_artifact_registry_repository" "proxy_gcr" {
  count         = var.create_proxy_gcr ? 1 : 0
  [...]
}

Debug Output

No response

Expected Behavior

No response

Actual Behavior

Plan output

  # google_artifact_registry_repository.public will be updated in-place
  ~ resource "google_artifact_registry_repository" "public" {
        id                     = "projects/project/locations/region/repositories/public"
        name                   = "public"
        # (13 unchanged attributes hidden)
      ~ virtual_repository_config {
          ~ upstream_policies {
              ~ id         = "proxy-docker" -> "proxy-gcr"
              ~ priority   = 20 -> 30
              ~ repository = "projects/project/locations/region/repositories/proxy-docker" -> "projects/project/locations/region/repositories/proxy-gcr"
            }
          ~ upstream_policies {
              ~ id         = "proxy-gcr" -> "proxy-docker"
              ~ priority   = 30 -> 20
              ~ repository = "projects/project/locations/region/repositories/proxy-gcr" -> "projects/project/locations/region/repositories/proxy-docker"
            }
            # (2 unchanged blocks hidden)
        }
    }

During apply

error: Provider produced inconsistent final plan
│ 
│ When expanding the plan for google_artifact_registry_repository.public to
│ include new values learned so far during apply, provider
│ "registry.terraform.io/hashicorp/google" produced an invalid new value for
│ .virtual_repository_config[0].upstream_policies[2].id: was
│ cty.StringVal("proxy-gcr"), but now cty.StringVal("proxy-docker").
│ 
│ This is a bug in the provider, which should be reported in the provider's
│ own issue tracker.

Steps to reproduce

The issue is not consistent.
Sometime it work without any issue.
But the same pipeline / same commit, when nothing have change on the registry, may fail but could work again after.

1. terraform apply

Important Factoids

No response

References

No response

[ggtisc]

Hi @Djabx!

I tried to replicate this issue but after creating the resources with a terraform apply everything works without errors. I suggest you to follow this terraform registry configuration and read the documentation and argument reference.

This is the used code:

variables.tf:

variable "create_proxy_gcr" {
    type = bool
    default = true
}

variable "create_proxy_docker" {
    type = bool
    default = true
}

main.tf:

provider "google" {}

terraform {
  required_providers {
    google = {
      source  = "hashicorp/google-beta"
      version = "5.29.1"
    }
  }
}

resource "google_artifact_registry_repository" "proxy_docker_repository_18143" {
  location      = "us-central1"
  repository_id = "proxy-docker-repository-18143"
  description   = "something"
  format        = "DOCKER"
  count         = var.create_proxy_docker ? 1 : 0
}

resource "google_artifact_registry_repository" "proxy_gcr_repository_18143" {
  location      = "us-central1"
  repository_id = "proxy-gcr-repository-18143"
  description   = "something"
  format        = "DOCKER"
  count         = var.create_proxy_gcr ? 1 : 0
}

resource "google_artifact_registry_repository" "artifact_registry_repository_18143" {
  depends_on    = []
  location      = "us-central1"
  repository_id = "artifact-registry-repository-18143"
  description   = "something"
  format        = "DOCKER"
  mode          = "VIRTUAL_REPOSITORY"

  virtual_repository_config {
    dynamic "upstream_policies" {
      for_each = var.create_proxy_gcr ? [1] : []
      content {
        id         = "proxy-gcr"
        repository = google_artifact_registry_repository.proxy_gcr_repository_18143[0].id
        priority   = 30
      }
    }
    dynamic "upstream_policies" {
      for_each = var.create_proxy_docker ? [1] : []
      content {
        id         = "proxy-docker"
        repository = google_artifact_registry_repository.proxy_docker_repository_18143[0].id
        priority   = 20
      }
    }
  }
}