Failed to detect changes to certain options when creating a resource.

[byeongryul-cho]

What happened?

When creating a Subnet in GCP, I created it by adding secondary IP ranges. After that, when I removed the option and applied it again, it did not detect the change.

Example

Create Subnet with Secondary IP Ranges.

subnet = compute.Subnetwork(
    name="test-subnet",
    resource_name="test-subnet",
    network=network.self_link,
    ip_cidr_range="10.0.0.0/24",
    region="asia-northeast3",
    private_ip_google_access=True,
    secondary_ip_ranges=[
        compute.SubnetworkSecondaryIpRangeArgs(
            range_name="pod-range",
            ip_cidr_range="172.16.0.0/20",
        ),
        compute.SubnetworkSecondaryIpRangeArgs(
            range_name="service-range", ip_cidr_range="172.16.16.0/24"
        ),
    ],
)

Create Subnet without Secondary IP Ranges.

subnet = compute.Subnetwork(
    name="test-subnet",
    resource_name="test-subnet",
    network=network.self_link,
    ip_cidr_range="10.0.0.0/24",
    region="asia-northeast3",
    private_ip_google_access=True,
)

Output of pulumi about

❯ pulumi about
CLI
Version 3.122.0
Go Version go1.22.4
Go Compiler gc

Plugins
KIND NAME VERSION
resource gcp 7.32.0
language python unknown

Host
OS darwin
Version 14.5
Arch arm64

Additional context

No response

Contributing

No response

[byeongryul-cho]

I found the cause. It seems that secondary_ip_ranges option is not tracking state because default is None. It works fine when passing empty list. But I don't know if this is the intended behavior of pulumi.

subnet = compute.Subnetwork(
    name="test-subnet",
    resource_name="test-subnet",
    network=network.self_link,
    ip_cidr_range="11.0.0.0/24",
    region="asia-northeast3",
    private_ip_google_access=True,
    secondary_ip_ranges=[],
)

[VenelinMartinov]

Hey @byeongryul-cho, thanks for filing the issue here and glad you figured out the workaround. You are correct that the setting the value to empty is the right way to do this.

Unfortunately this is indeed working as intended even if it awkward. The technical reason for that is that the GCP tf provider, which is being used by pulumi here under the hood defines the resource as an Optional + Comptued: https://github.com/hashicorp/terraform-provider-google/blob/1b0d5f23f66a5e00ba3070e048f17d3e80001955/google/services/compute/resource_compute_subnetwork.go#L243

This means that due to a limitation in TF, when this is set to null/unset, the provider keeps the old value from state: pulumi/pulumi-terraform-bridge#2152.

A detail here is that the TF provider has a note about this behaviour on the property and we seem to have lost it in our docs. I'll file an issue about that.
EDIT: filed #2252