google_workbench_instance: metadata producing diff when setting proxy-mode

[BBBmau]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Terraform Version & Provider Version(s)

on

• provider registry.terraform.io/hashicorp/google v6.20.0

Affected Resource(s)

google_workbench_instance

Terraform Configuration

resource "google_workbench_instance" "instance" {
  name     = "workbench-instance"
  location = "us-central1-a"

  gce_setup {
    machine_type = "n1-standard-1" // cant be e2 because of accelerator
    accelerator_configs {
      type       = "NVIDIA_TESLA_T4"
      core_count = 2
    }

    shielded_instance_config {
      enable_secure_boot          = false
      enable_vtpm                 = true
      enable_integrity_monitoring = true
    }

    disable_public_ip = false

    boot_disk {
      disk_size_gb    = 150
      disk_type       = "PD_BALANCED"
      disk_encryption = "GMEK"
      kms_key         = null
    }

    data_disks {
      disk_size_gb    = 150
      disk_type       = "PD_BALANCED"
      disk_encryption = "GMEK"
      kms_key         = null
    }

    network_interfaces {
      network  = google_compute_network.my_network.id
      subnet   = google_compute_subnetwork.my_subnetwork.id
      nic_type = "GVNIC"
      access_configs {
        external_ip = google_compute_address.static.address
      }
    }

    metadata = {
      terraform                    = "true"
      proxy-mode                 = "service_account"
      disable-swap-binaries      = "true"
      enable-guest-attributes    = "TRUE"
      enable-jupyterlab4-preview = "true"
      enable-oslogin             = "true"
      framework                  = "workbench"
      idle-timeout-seconds       = "10800"
      #
      # QUOTES or WITHOUT QUOTES the result is the same!
      #
      # "proxy-mode"                 = "service_account"
      # "disable-swap-binaries"      = "true"
      # "enable-guest-attributes"    = "TRUE"
      # "enable-jupyterlab4-preview" = "true"
      # "enable-oslogin"             = "true"
      # "framework"                  = "workbench"
      # "idle-timeout-seconds"       = "10800"
    }

    enable_ip_forwarding = true

    tags = ["deeplearning-vm", "notebook-instance"]

  }

  disable_proxy_access = "true"
  labels = {
    k = "val"
  }
  desired_state = "ACTIVE"

  # lifecycle {
  #   ignore_changes = [
  #     gce_setup[0].metadata
  #   ]
  # }
}

Debug Output

No response

Expected Behavior

should produce no changes after seconds apply

Actual Behavior

produces diff on second plan/apply:

# google_workbench_instance.instance will be updated in-place
  ~ resource "google_workbench_instance" "instance" {
        id                   = "projects/hc-c32c3e60098c45de879e4ae74e5/locations/us-central1-a/instances/workbench-instance"
        name                 = "workbench-instance"
        # (15 unchanged attributes hidden)

      ~ gce_setup {
          ~ metadata             = {
              ~ "proxy-mode"                 = "none" -> "service_account"
                # (19 unchanged elements hidden)
            }
            tags                 = [
                "deeplearning-vm",
                "notebook-instance",
            ]
            # (3 unchanged attributes hidden)

            # (6 unchanged blocks hidden)
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Steps to reproduce

1. terraform apply
2. terraform plan

Important Factoids

No response

References

No response