Improve handling when enabling/disabling server TLS policy in global target HTTPS proxies #19233
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR implements similar behavior as in GoogleCloudPlatform/magic-modules#11184 but for global target HTTPS proxies.
Prior to this PR, you could enable a server TLS policy on a global HTTPS proxy, but disabling it would not work as removing
server_tls_policy
removes it from thePATCH
payload entirely, so Google simply leaves the server TLS policy as is. What we actually need to do is sendserverTlsPolicy = null
if it's not set, which is what this PR does.We're also adding a note about having to add the
create_before_destroy = true
lifecycle ongoogle_network_security_server_tls_policy
as removing the resource would make Terraform destroy the resource first before creating/updating other resources, and that would result in a "resource already in use" error. This lifecycle rule means Terraform will create/update resources (in this case it would updategoogle_compute_target_https_proxy
first and remove the association with thegoogle_network_security_server_tls_policy
resource) before destroying the resource.I've updated the tests so that it creates the resources without a server TLS policy, then it adds the
server_tls_policy
and related resources, and then it removes them again. This is to ensure that we can successfully enable & disable mTLS.Release Note Template for Downstream PRs (will be copied)
Derived from GoogleCloudPlatform/magic-modules#11496