PSA for those foolish enough to use Google Cloud and try to use private service connect: If you want to change the serviceAttachment your private service connect forwarding rule points at, you must delete the forwarding rule and create a new one. Updates are not supported. I've done that in the past via terraform, but lately encountered strange errors like this:
Error updating ForwardingRule: googleapi: Error 400: Invalid value for field 'target.target':
'<https://www.googleapis.com/compute/v1/projects/mydumbproject/regions/europe-west1/serviceAttachments/
k8s1-sa-xyz-abc>'. Unexpected resource collection 'serviceAttachments'., invalid
Worked around that with the help of terrraform_data
and lifecycle
:
resource "terraform_data" "replacement" {
input = var.gcp_psc_data["target"]
}
resource "google_compute_forwarding_rule" "this" {
count = length(var.gcp_psc_data["target"]) > 0 ? 1 : 0
name = "${var.gcp_psc_name}-psc"
region = var.gcp_region
project = var.gcp_project
target = var.gcp_psc_data["target"]
load_balancing_scheme = "" # need to override EXTERNAL default when target is a service attachment
network = var.gcp_network
ip_address = google_compute_address.this.id
lifecycle {
replace_triggered_by = [
terraform_data.replacement
]
}
}
See also terraform data for replace_triggered_by.