无配置变更时Terraform每次apply重建GKE资源求助

环境信息 #

• Terraform v1.5.7
• provider.google v4.83.0
• GKE版本：1.27.4-gke.900

受影响资源 #

• google_container_cluster
• google_container_node_pool

Terraform配置文件 #

// Create a Google Compute VPC Network

resource "google_compute_network" "vpc_network" {
  name    = var.vpc_name
  project = var.project_id

  auto_create_subnetworks                   = false
  network_firewall_policy_enforcement_order = "AFTER_CLASSIC_FIREWALL"
}

// Define subnetworks within the VPC Network
resource "google_compute_subnetwork" "subnetwork" {
  count         = length(var.regions)
  name          = "${var.vpc_name}-subnet-${var.regions[count.index]}"
  ip_cidr_range = var.ip_cidr_range[count.index]
  region        = var.regions[count.index]
  network       = google_compute_network.vpc_network.self_link

  secondary_ip_range {
    range_name    = "k8s-pod-range"
    ip_cidr_range = "10.2.0.0/16"
  }

  secondary_ip_range {
    range_name    = "k8s-svc-range"
    ip_cidr_range = "10.3.0.0/16"
  }

  log_config {
    aggregation_interval = "INTERVAL_10_MIN"
    flow_sampling        = 0.5
    metadata             = "INCLUDE_ALL_METADATA"
  }

  private_ip_google_access = true
  // private_ipv6_google_access = "ENABLE_OUTBOUND_VM_ACCESS_TO_GOOGLE" // Changed from "DISABLE_GOOGLE_ACCESS
}

// Define a firewall rule for the VPC Network
resource "google_compute_firewall" "firewall" {
  name    = "${var.vpc_name}-firewall"
  network = google_compute_network.vpc_network.self_link

  allow {
    protocol = "tcp"
    ports    = ["80"]
  }

  source_ranges = [
    "130.211.0.0/22",
    "35.191.0.0/16"
  ]
}

# Define a Google Cloud router for each subnetwork
resource "google_compute_router" "cloud_nat_router" {
  // Create one router for each subnetwork
  count   = length(google_compute_subnetwork.subnetwork)
  name    = "cloud-nat-router-${google_compute_subnetwork.subnetwork[count.index].name}"
  region  = google_compute_subnetwork.subnetwork[count.index].region
  network = google_compute_network.vpc_network.self_link

  // Define BGP settings (note that ASN is hard-coded here)
  bgp {
    asn = 64514
  }
}

# Define a NAT configuration for each router
resource "google_compute_router_nat" "nat" {
  // Create one NAT config for each router
  count  = length(google_compute_subnetwork.subnetwork)
  name   = google_compute_router.cloud_nat_router[count.index].name
  router = google_compute_router.cloud_nat_router[count.index].name
  region = google_compute_router.cloud_nat_router[count.index].region

  // Automatically allocate NAT IPs
  nat_ip_allocate_option             = "AUTO_ONLY"
  source_subnetwork_ip_ranges_to_nat = "ALL_SUBNETWORKS_ALL_IP_RANGES"

  // Log configuration (logging is disabled, only errors are logged)
  log_config {
    enable = false
    filter = "ERRORS_ONLY"
  }
}

// Output variables for the VPC Network module

output "vpc_network" {
  value       = google_compute_network.vpc_network.self_link
  description = "The self-link of the created VPC network."
}

output "vpc_network_name" {
  value       = google_compute_network.vpc_network.name
  description = "The name of the created VPC network."
}

output "subnetworks_name" {
  value       = google_compute_subnetwork.subnetwork[*].name
  description = "The self-links of the created subnetworks within the VPC network."
}

// Create a Google Container Cluster (GKE) in the specified VPC

resource "google_container_cluster" "cluster" {
  name               = var.cluster_name
  project            = var.project_id
  location           = var.location
  min_master_version = var.master_version

  resource_labels = {
    "provider" = "gcp"
    "tier"     = "free"
  }

  // We can't create a cluster with no node pool defined, but we want to only use
  // separately managed node pools. So we create the smallest possible default
  // node pool and immediately delete it.
  remove_default_node_pool = true
  initial_node_count       = 1

  release_channel {
    channel = "STABLE"
  }

  network    = var.network
  subnetwork = var.subnetwork

//  enable_l4_ilb_subsetting = false

  binary_authorization {
    evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE"
  }

  master_auth {
    client_certificate_config {
      issue_client_certificate = false
    }
  }

  default_max_pods_per_node = 16

  ip_allocation_policy {
    cluster_secondary_range_name  = "k8s-pod-range"
    services_secondary_range_name = "k8s-svc-range"
  }

  network_policy {
    enabled  = true
    provider = "PROVIDER_UNSPECIFIED" // Consider setting the value to "CALICO"
  }

  enable_intranode_visibility = true

  private_cluster_config {
    enable_private_nodes    = false
    enable_private_endpoint = false
    master_ipv4_cidr_block  = var.master_ipv4_cidr_block
  }

  workload_identity_config {
    workload_pool = "${var.project_id}.svc.id.goog"
  }

  node_config {
    shielded_instance_config {
      enable_integrity_monitoring = true
      enable_secure_boot          = true
    }

    workload_metadata_config {
      mode = "GCE_METADATA"
    }
  }

  depends_on = [google_project_service.compute, google_project_service.container]
}

复现步骤 #

• 执行terraform apply，GKE资源正常创建。
• 不修改任何配置文件，再次执行terraform apply。

每次执行terraform apply时，即使没有任何配置变更，Terraform都会触发google_container_cluster和google_container_node_pool的重建操作，执行过程无报错，不符合预期。有没有人遇到过相同问题并找到了解决方案？

内容的提问来源于stack exchange，提问作者dkargatzis