Make `health_check` optional to support internet/global NEG backends about terraform-google-lb-http HOT 18 CLOSED

This is fixed - at least for global NEG:
hashicorp/terraform-provider-google#6155

The change is included in v3.32.0 of terraform-providers/terraform-provider-google-beta:
https://github.com/terraform-providers/terraform-provider-google-beta/releases/tag/v3.32.0
https://registry.terraform.io/providers/hashicorp/google-beta/latest

We can now remove the health_check clause from the google_compute_backend_service resource when the backend.group points to an NEG resource.
However, we need to use the google-beta provider for that - so, the resource definition should look like:

resource "google_compute_backend_service" "on_prem" {
    provider    = google-beta
    .....
}

And make sure to define the provider block for google-beta.

from terraform-google-lb-http.

@morgante I will but I do not have bandwith ATM, feel free to open a duplicate PR, or edit this one, if not I will get to it ASAP (few days).

from terraform-google-lb-http.

Thanks! No rush on our end.

from terraform-google-lb-http.

I haven't tested with separate NEGs, but as a workaround I think you could use the dynamic backend submodule and add the NEGs out-of-band.

from terraform-google-lb-http.

I haven't tested with separate NEGs, but as a workaround I think you could use the dynamic backend submodule and add the NEGs out-of-band.

Is it feasible to convert an existing instance of this module into a dynamic backend version of it?

from terraform-google-lb-http.

Both modules use health checks on the backend resource, so i guess it depends on how the GCE API handles it whether it rejects the internet NEG or just ignores the health check configured on the backend when the group is a global/internet NEG.

Try it and see, worst case a PR will be needed to make health checks optional on the backend resource.

from terraform-google-lb-http.

Both modules use health checks on the backend resource, so i guess it depends on how the GCE API handles it whether it rejects the internet NEG or just ignores the health check configured on the backend when the group is a global/internet NEG.

Try it and see, worst case a PR will be needed to make health checks optional on the backend resource.

Thanks, I've tried and:

The given value is not suitable for child module variable "backends" defined
at
.terraform/modules/gce-lb-http/terraform-google-lb-http-4.0.0/variables.tf:69,1-20:
element "on-prem": attribute "health_check" is required.

I'll gladly make a PR to make health checks optional, hopefully we can get it merged quickly 😬

from terraform-google-lb-http.

That's a module requirement blocking it, could you try providing a dummy health check there? Just want to see how TF provider/GCE handles this. But otherwise yes a PR for making it optional will be cleaner for the long term.

health_check = {
        check_interval_sec  = null
        timeout_sec         = null
        healthy_threshold   = null
        unhealthy_threshold = null
        request_path        = "/"
        port                = 443
        host                = null
        logging             = null
      }

from terraform-google-lb-http.

Good question @Dev25 , here:

Error: Invalid function argument

  on .terraform/modules/gce-lb-http/terraform-google-lb-http-4.0.0/main.tf line 137, in resource "google_compute_health_check" "default":
 137:   check_interval_sec  = lookup(each.value["health_check"], "check_interval_sec", 5)
    |----------------
    | each.value["health_check"] is null

Invalid value for "inputMap" parameter: argument must not be null.


Error: Invalid function argument

  on .terraform/modules/gce-lb-http/terraform-google-lb-http-4.0.0/main.tf line 138, in resource "google_compute_health_check" "default":
 138:   timeout_sec         = lookup(each.value["health_check"], "timeout_sec", 5)
    |----------------
    | each.value["health_check"] is null

Invalid value for "inputMap" parameter: argument must not be null.


Error: Invalid function argument

  on .terraform/modules/gce-lb-http/terraform-google-lb-http-4.0.0/main.tf line 139, in resource "google_compute_health_check" "default":
 139:   healthy_threshold   = lookup(each.value["health_check"], "healthy_threshold", 2)
    |----------------
    | each.value["health_check"] is null

Invalid value for "inputMap" parameter: argument must not be null.


Error: Invalid function argument

  on .terraform/modules/gce-lb-http/terraform-google-lb-http-4.0.0/main.tf line 140, in resource "google_compute_health_check" "default":
 140:   unhealthy_threshold = lookup(each.value["health_check"], "unhealthy_threshold", 2)
    |----------------
    | each.value["health_check"] is null

Invalid value for "inputMap" parameter: argument must not be null.


Error: Invalid function argument

  on .terraform/modules/gce-lb-http/terraform-google-lb-http-4.0.0/main.tf line 161, in resource "google_compute_health_check" "default":
 161:         host         = lookup(each.value["health_check"], "host", null)
    |----------------
    | each.value["health_check"] is null

Invalid value for "inputMap" parameter: argument must not be null.


Error: Invalid function argument

  on .terraform/modules/gce-lb-http/terraform-google-lb-http-4.0.0/main.tf line 162, in resource "google_compute_health_check" "default":
 162:         request_path = lookup(each.value["health_check"], "request_path", null)
    |----------------
    | each.value["health_check"] is null

Invalid value for "inputMap" parameter: argument must not be null.


Error: Invalid function argument

  on .terraform/modules/gce-lb-http/terraform-google-lb-http-4.0.0/main.tf line 163, in resource "google_compute_health_check" "default":
 163:         port         = lookup(each.value["health_check"], "port", null)
    |----------------
    | each.value["health_check"] is null

I'll work on the healthcheck being optional now, please stay tuned.

from terraform-google-lb-http.

After importing the compute_backend_service resource for a manually created global NEG backend service it appears an empty array can be passed to the resource...

    health_checks                   = []

edit: it appears the passing a null value is what's desired rather than an []

from terraform-google-lb-http.

Do either of you know of a way to filter out var.backends for backends that have a health_check that is not null ?

from terraform-google-lb-http.

You should be able to use a for expression.

from terraform-google-lb-http.

for_each = [for backend in var.backends : backend if backend["health_check"] != null]

as so?

from terraform-google-lb-http.

Yeah I think something like that should work?

from terraform-google-lb-http.

After importing the compute_backend_service resource for a manually created global NEG backend service it appears an empty array can be passed to the resource...

    health_checks                   = []

We have a problem, although imported compute backend services that are Global/Internet NEGs have an empty array for hc, we cannot subsequently re-apply, or create from scratch with an empty array hc... i'll file an issue with the gcp provider.

error:

Error: health_checks: attribute supports 1 item as a minimum, config has 0 declared

  on global-lb.tf line 286, in resource "google_compute_backend_service" "on_prem":
 286: resource google_compute_backend_service "on_prem" {

An issue was created a while ago ... hashicorp/terraform-provider-google#6155 ...please thumbs it up as to encourage it's resolution by the provider maintainers.

from terraform-google-lb-http.

@naseemkullah Do you want to update #106 to accommodate this? I'm looking forward to merging.

from terraform-google-lb-http.

Realized a lot of the work had been done, bumped to 3.32.0 as per @kunal-g's recommendation.

from terraform-google-lb-http.

How should I be able to disable the health checks and use the internet-neg? Didn't find documentation on this.

I'm facing the same issue as in this message: e0ea139#commitcomment-53028721

╷
│ Error: ExactlyOne
│ 
│   with module.cdn.module.my-lb.google_compute_firewall.default-hc[0],
│   on .terraform/modules/cdn.my-lb/main.tf line 284, in resource "google_compute_firewall" "default-hc":
│  284: resource "google_compute_firewall" "default-hc" {
│ 
│ "allow": one of `allow,deny` must be specified
╵
╷
│ Error: ExactlyOne
│ 
│   with module.cdn.module.my-lb.google_compute_firewall.default-hc[0],
│   on .terraform/modules/cdn.my-lb/main.tf line 284, in resource "google_compute_firewall" "default-hc":
│  284: resource "google_compute_firewall" "default-hc" {
│ 
│ "deny": one of `allow,deny` must be specified

from terraform-google-lb-http.