data-infra icon indicating copy to clipboard operation
data-infra copied to clipboard

Analyst sees that GTFS-RT feeds are updated via workflows

Open ohrite opened this issue 2 months ago • 6 comments

Description

This PR introduces a Google Workflow based GTFS-RT archiver implementation

Resolves #4488

Type of change

  • [ ] Bug fix (non-breaking change which fixes an issue)
  • [x] New feature
  • [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • [ ] Documentation

How has this been tested?

terraform plan

Post-merge follow-ups

  • [ ] No action required
  • [x] Actions required (specified below)

Monitor terraform apply

ohrite avatar Nov 08 '25 09:11 ohrite

Terraform plan in iac/cal-itp-data-infra-staging/iam/us

Plan: 0 to add, 0 to change, 3 to destroy. Changes to Outputs.
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
-   destroy

Terraform will perform the following actions:

  # google_project_iam_member.metabase-service-account["roles/cloudsql.client"] will be destroyed
  # (because google_project_iam_member.metabase-service-account is not in configuration)
-   resource "google_project_iam_member" "metabase-service-account" {
-       etag    = "BwZDRdshb3Y=" -> null
-       id      = "cal-itp-data-infra-staging/roles/cloudsql.client/serviceAccount:metabase-service-account@cal-itp-data-infra-staging.iam.gserviceaccount.com" -> null
-       member  = "serviceAccount:metabase-service-account@cal-itp-data-infra-staging.iam.gserviceaccount.com" -> null
-       project = "cal-itp-data-infra-staging" -> null
-       role    = "roles/cloudsql.client" -> null
    }

  # google_project_iam_member.metabase-service-account["roles/secretmanager.secretAccessor"] will be destroyed
  # (because google_project_iam_member.metabase-service-account is not in configuration)
-   resource "google_project_iam_member" "metabase-service-account" {
-       etag    = "BwZDRdshb3Y=" -> null
-       id      = "cal-itp-data-infra-staging/roles/secretmanager.secretAccessor/serviceAccount:metabase-service-account@cal-itp-data-infra-staging.iam.gserviceaccount.com" -> null
-       member  = "serviceAccount:metabase-service-account@cal-itp-data-infra-staging.iam.gserviceaccount.com" -> null
-       project = "cal-itp-data-infra-staging" -> null
-       role    = "roles/secretmanager.secretAccessor" -> null
    }

  # google_service_account.metabase-service-account will be destroyed
  # (because google_service_account.metabase-service-account is not in configuration)
-   resource "google_service_account" "metabase-service-account" {
-       account_id   = "metabase-service-account" -> null
-       description  = "Service account for Metabase" -> null
-       disabled     = false -> null
-       display_name = "metabase" -> null
-       email        = "metabase-service-account@cal-itp-data-infra-staging.iam.gserviceaccount.com" -> null
-       id           = "projects/cal-itp-data-infra-staging/serviceAccounts/metabase-service-account@cal-itp-data-infra-staging.iam.gserviceaccount.com" -> null
-       member       = "serviceAccount:metabase-service-account@cal-itp-data-infra-staging.iam.gserviceaccount.com" -> null
-       name         = "projects/cal-itp-data-infra-staging/serviceAccounts/metabase-service-account@cal-itp-data-infra-staging.iam.gserviceaccount.com" -> null
-       project      = "cal-itp-data-infra-staging" -> null
-       unique_id    = "100330331667526073297" -> null
    }

Plan: 0 to add, 0 to change, 3 to destroy.

Changes to Outputs:
-   google_service_account_metabase-service-account_email                                                                                                                                                = "metabase-service-account@cal-itp-data-infra-staging.iam.gserviceaccount.com" -> null
-   google_service_account_metabase-service-account_id                                                                                                                                                   = "projects/cal-itp-data-infra-staging/serviceAccounts/metabase-service-account@cal-itp-data-infra-staging.iam.gserviceaccount.com" -> null
-   google_service_account_metabase-service-account_name                                                                                                                                                 = "projects/cal-itp-data-infra-staging/serviceAccounts/metabase-service-account@cal-itp-data-infra-staging.iam.gserviceaccount.com" -> null
-   google_service_account_workflow-service-account_id                                                                                                                                                   = "projects/cal-itp-data-infra-staging/serviceAccounts/workflow-service-account@cal-itp-data-infra-staging.iam.gserviceaccount.com" -> null
-   google_service_account_workflow-service-account_name                                                                                                                                                 = "projects/cal-itp-data-infra-staging/serviceAccounts/workflow-service-account@cal-itp-data-infra-staging.iam.gserviceaccount.com" -> null

:memo: Plan generated in Terraform Plan #672

github-actions[bot] avatar Nov 08 '25 09:11 github-actions[bot]

Terraform plan in iac/cal-itp-data-infra-staging/gtfs-rt-archiver/us

Plan: 0 to add, 1 to change, 0 to destroy.
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place

Terraform will perform the following actions:

  # google_workflows_workflow.gtfs-rt-feed-archiver will be updated in-place
!~  resource "google_workflows_workflow" "gtfs-rt-feed-archiver" {
        id                      = "projects/cal-itp-data-infra-staging/locations/us-west2/workflows/gtfs-rt-feed-archiver"
        name                    = "gtfs-rt-feed-archiver"
!~      source_contents         = <<-EOT
            main:
              params: [event]
              steps:
                - init:
                    assign:
                      - projectId: ${sys.get_env("GOOGLE_CLOUD_PROJECT_ID")}
                      - bucket: ${sys.get_env("CALITP_BUCKET__GTFS_RT_RAW")}
                      - arguments: ${json.decode(base64.decode(event.data.message.data))}
                      - fetchDate: ${text.split(arguments.startAt, "T")[0]}
                      - fetchTime: ${text.split(arguments.startAt, "T")[1]}
                      - fetchHour: ${text.split(fetchTime, ":")[0]}
                      - fetchMinute: ${text.split(fetchTime, ":")[1]}
          -           - headers: {}
          +           - fetchSecond: ${if(arguments.fetchSecond == 0, "00", arguments.fetchSecond)}
          -           - query: {}
          +           - headers: {}
          -           - userAgentHeaders:
          +           - query: {}
          -               User-Agent: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36'
          +           - userAgentHeaders:
          -               priority: 'u=0, i'
          +               User-Agent: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36'
          -               sec-ch-ua: '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"'
          +               priority: 'u=0, i'
          -               sec-ch-ua-mobile: '?0'
          +               sec-ch-ua: '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"'
          -               sec-ch-ua-platform: '"macOS"'
          +               sec-ch-ua-mobile: '?0'
          - 
          +               sec-ch-ua-platform: '"macOS"'
                - applySecrets:
                    switch:
                      - condition: ${arguments.headerSecretKeyName != null}
                        steps:
                          - headerSecret:
                              call: googleapis.secretmanager.v1.projects.secrets.versions.accessString
                              args:
                                project_id: ${projectId}
                                secret_id: ${arguments.headerSecretKeyName}
                              result: headerSecret
                          - assignHeaders:
                              assign:
                                - headers:
                                    ${arguments.authorizationHeaderParameterName}: ${headerSecret}
                      - condition: ${arguments.urlSecretKeyName != null}
                        steps:
                          - querySecret:
                              call: googleapis.secretmanager.v1.projects.secrets.versions.accessString
                              args:
                                project_id: ${projectId}
                                secret_id: ${arguments.urlSecretKeyName}
                              result: querySecret
                          - assignQuery:
                              assign:
                                - query:
                                    ${arguments.authorizationUrlParameterName}: ${querySecret}
                - fetchUrl:
                    call: http.get
                    args:
                      url: ${arguments.pipelineUrl}
                      timeout: 20
                      headers: ${map.merge(userAgentHeaders, headers)}
                      query: ${query}
                    result: result
                - writeResult:
                    call: http.post
                    args:
                      url: ${"https://storage.googleapis.com/upload/storage/v1/b/" + bucket + "/o"}
                      auth:
                        type: OAuth2
                      query:
                        name: ${
                          arguments.type +
                          "/dt=" + fetchDate +
                          "/hour=" + fetchDate + "T" + fetchHour + ":00:00+00:00" +
          -               "/ts=" + fetchDate + "T" + fetchHour + ":" + fetchMinute + ":" + if(arguments.fetchSecond == 0, "00", arguments.fetchSecond) + "+00:00" +
          +               "/ts=" + fetchDate + "T" + fetchHour + ":" + fetchMinute + ":" + fetchSecond + "+00:00" +
                          "/base64_url=" + arguments.base64Url +
                          "/feed"
                          }
                      body: ${result.body}
        EOT
#        (16 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

:memo: Plan generated in Terraform Plan #672

github-actions[bot] avatar Nov 08 '25 10:11 github-actions[bot]

This is a low-code solution for GTFS-RT archiving, using:

There are two workflows:

  1. Gather URLs and secret settings from BigQuery and push PubSub events every 20 seconds
  2. Pull secrets, make an HTTP request, and store the result in Cloud Storage

ohrite avatar Nov 09 '25 06:11 ohrite

Terraform plan in iac/cal-itp-data-infra-staging/gke/us

Plan: 1 to add, 0 to change, 1 to destroy. Changes to Outputs.
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # google_container_cluster.sftp-endpoints must be replaced
-/+ resource "google_container_cluster" "sftp-endpoints" {
!~      cluster_ipv4_cidr                        = "10.89.128.0/17" -> (known after apply)
!~      datapath_provider                        = "ADVANCED_DATAPATH" -> (known after apply)
!~      default_max_pods_per_node                = 110 -> (known after apply)
-       enable_tpu                               = false -> null
!~      endpoint                                 = "35.236.23.139" -> (known after apply)
!~      id                                       = "******************************************************************************" -> (known after apply)
-       initial_node_count                       = 0 -> null
!~      label_fingerprint                        = "78cdf2f6" -> (known after apply)
!~      logging_service                          = "logging.googleapis.com/kubernetes" -> (known after apply)
!~      master_version                           = "1.33.5-gke.1201000" -> (known after apply)
!~      monitoring_service                       = "monitoring.googleapis.com/kubernetes" -> (known after apply)
        name                                     = "sftp-endpoints"
!~      network                                  = "projects/cal-itp-data-infra-staging/global/networks/default" -> "https://www.googleapis.com/compute/v1/projects/cal-itp-data-infra-staging/global/networks/default"
!~      node_locations                           = [
-           "us-west2-a",
-           "us-west2-b",
-           "us-west2-c",
        ] -> (known after apply)
!~      node_version                             = "1.33.5-gke.1201000" -> (known after apply)
+       operation                                = (known after apply)
+       private_ipv6_google_access               = (known after apply)
-       resource_labels                          = {} -> null
!~      self_link                                = "https://container.googleapis.com/v1/projects/cal-itp-data-infra-staging/locations/us-west2/clusters/sftp-endpoints" -> (known after apply)
!~      services_ipv4_cidr                       = "34.118.224.0/20" -> (known after apply)
!~      subnetwork                               = "projects/cal-itp-data-infra-staging/regions/us-west2/subnetworks/default" -> (known after apply)
+       tpu_ipv4_cidr_block                      = (known after apply)
#        (18 unchanged attributes hidden)

!~      addons_config {
!~          cloudrun_config (known after apply)
!~          config_connector_config (known after apply)
!~          dns_cache_config (known after apply)
-           dns_cache_config {
-               enabled = true -> null
            }
!~          gce_persistent_disk_csi_driver_config (known after apply)
-           gce_persistent_disk_csi_driver_config {
-               enabled = true -> null
            }
!~          gcp_filestore_csi_driver_config (known after apply)
-           gcp_filestore_csi_driver_config {
-               enabled = true -> null
            }
!~          gke_backup_agent_config (known after apply)
!~          horizontal_pod_autoscaling (known after apply)
!~          http_load_balancing (known after apply)
!~          lustre_csi_driver_config (known after apply)
!~          network_policy_config (known after apply)
-           network_policy_config {
-               disabled = true -> null
            }
!~          parallelstore_csi_driver_config (known after apply)
-           parallelstore_csi_driver_config {
-               enabled = true -> null
            }
!~          ray_operator_config (known after apply)
!~          stateful_ha_config (known after apply)
-           stateful_ha_config {
-               enabled = true -> null
            }

#            (1 unchanged block hidden)
        }

!~      anonymous_authentication_config (known after apply)
-       anonymous_authentication_config {
-           mode = "ENABLED" -> null
        }

!~      authenticator_groups_config (known after apply)

-       binary_authorization {
-           enabled         = false -> null
#            (1 unchanged attribute hidden)
        }

!~      cluster_autoscaling (known after apply)
-       cluster_autoscaling {
-           auto_provisioning_locations   = [] -> null
-           autoscaling_profile           = "OPTIMIZE_UTILIZATION" -> null
-           default_compute_class_enabled = false -> null
-           enabled                       = true -> null

-           auto_provisioning_defaults {
-               disk_size         = 0 -> null
-               image_type        = "COS_CONTAINERD" -> null
-               oauth_scopes      = [
-                   "https://www.googleapis.com/auth/devstorage.read_only",
-                   "https://www.googleapis.com/auth/logging.write",
-                   "https://www.googleapis.com/auth/monitoring",
-                   "https://www.googleapis.com/auth/service.management.readonly",
-                   "https://www.googleapis.com/auth/servicecontrol",
-                   "https://www.googleapis.com/auth/trace.append",
                ] -> null
-               service_account   = "default" -> null
#                (3 unchanged attributes hidden)

-               management {
-                   auto_repair     = true -> null
-                   auto_upgrade    = true -> null
-                   upgrade_options = [] -> null
                }

-               upgrade_settings {
-                   max_surge       = 1 -> null
-                   max_unavailable = 0 -> null
-                   strategy        = "SURGE" -> null
                }
            }

-           resource_limits {
-               maximum       = 1000000000 -> null
-               minimum       = 0 -> null
-               resource_type = "cpu" -> null
            }
-           resource_limits {
-               maximum       = 1000000000 -> null
-               minimum       = 0 -> null
-               resource_type = "memory" -> null
            }
-           resource_limits {
-               maximum       = 1000000000 -> null
-               minimum       = 0 -> null
-               resource_type = "nvidia-tesla-t4" -> null
            }
-           resource_limits {
-               maximum       = 1000000000 -> null
-               minimum       = 0 -> null
-               resource_type = "nvidia-tesla-a100" -> null
            }
        }

!~      confidential_nodes (known after apply)

!~      control_plane_endpoints_config (known after apply)
-       control_plane_endpoints_config {
-           dns_endpoint_config {
-               allow_external_traffic    = false -> null
-               enable_k8s_certs_via_dns  = false -> null
-               enable_k8s_tokens_via_dns = false -> null
-               endpoint                  = "gke-32f84df295474850ba9c06ce6a3c1aefea89-473674835135.us-west2.gke.goog" -> null
            }
-           ip_endpoints_config {
-               enabled = true -> null
            }
        }

!~      cost_management_config (known after apply)

!~      database_encryption (known after apply)
-       database_encryption {
-           state    = "DECRYPTED" -> null
#            (1 unchanged attribute hidden)
        }

!~      default_snat_status (known after apply)
-       default_snat_status {
-           disabled = false -> null
        }

-       dns_config {
-           cluster_dns                   = "CLOUD_DNS" -> null
-           cluster_dns_domain            = "cluster.local" -> null
-           cluster_dns_scope             = "CLUSTER_SCOPE" -> null
#            (1 unchanged attribute hidden)
        }

!~      enterprise_config (known after apply)
-       enterprise_config {
-           cluster_tier = "STANDARD" -> null
#            (1 unchanged attribute hidden)
        }

!~      gateway_api_config (known after apply)
-       gateway_api_config {
-           channel = "CHANNEL_STANDARD" -> null
        }

!~      gke_auto_upgrade_config (known after apply)

!~      identity_service_config (known after apply)

!~      ip_allocation_policy (known after apply)
-       ip_allocation_policy {
-           cluster_ipv4_cidr_block       = "10.89.128.0/17" -> null
-           cluster_secondary_range_name  = "gke-sftp-endpoints-pods-32f84df2" -> null
-           services_ipv4_cidr_block      = "34.118.224.0/20" -> null
-           stack_type                    = "IPV4" -> null
#            (1 unchanged attribute hidden)

-           network_tier_config {
-               network_tier = "NETWORK_TIER_DEFAULT" -> null
            }

-           pod_cidr_overprovision_config {
-               disabled = false -> null
            }
        }

!~      logging_config (known after apply)
-       logging_config {
-           enable_components = [
-               "SYSTEM_COMPONENTS",
-               "WORKLOADS",
            ] -> null
        }

!~      master_auth (known after apply)
-       master_auth {
-           cluster_ca_certificate = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVMVENDQXBXZ0F3SUJBZ0lSQVBWL1phUXBrRTFmS0djazBlck94bVF3RFFZSktvWklodmNOQVFFTEJRQXcKTHpFdE1Dc0dBMVVFQXhNa1pUQmhNelUxWVRRdFkyTmtOaTAwTm1KakxUaG1NekF0WldFeVlUaGxNbVU1TkRBMgpNQ0FYRFRJMU1Ea3hNakl6TWpNek4xb1lEekl3TlRVd09UQTJNREF5TXpNM1dqQXZNUzB3S3dZRFZRUURFeVJsCk1HRXpOVFZoTkMxalkyUTJMVFEyWW1NdE9HWXpNQzFsWVRKaE9HVXlaVGswTURZd2dnR2lNQTBHQ1NxR1NJYjMKRFFFQkFRVUFBNElCandBd2dnR0tBb0lCZ1FDcjNibW5BRGtjNWxmZ1ZKK2pkNk90MDhXME9VbDFtV2FHYkVpRApKZmNLeGdJV0JEemJIWFhleEEwRUtXZnlyYXlIemlDbTlTYlM5ZDR2a293VEZCbGhYS3A5Q3VGSTRtMjJuQUQwCkhDYTdFcWdnWHMyNm40a3RBSnhzMWljVHJuYy9tTFRQOTdUSkVENFZIcWF0UVYyNmY5SVdwWXhuRk5LOTJJRTgKVkl0ckZ2eUZ4eDczYXBBcE5sOHI4QzJrZnFreXV5ZTI0RlE1QWZ5ZVI3Mk1CREgwY0lzZ0VxQjR0WUd6VndVeApVYjJPSkxWYTc4cU44aGEzWkhIUEthN1pXRHludDR0bjhxM3ptNmp3dytlWHRwZE5xZ3Z4bk1kREY5elVwUnNICjlPZWg5Z0l1Y0NLWGw4cFJzSjFLWUozS3laMUVuN3diQWR6RVNPUUljaEpROWJ1MHdIZHF6UzdzSERJY3ZMRmYKaUFmbkZCcFoyZUgrOTB1Z3hId1dYeW1mMDhrYTR0M0EyRTJwZEZrQ3R3RG5YSWR5ZE93M016MlVFUXduNnNLMgpSeXhIQStNOWY4ZEZob1FXOEhVbk5KYkdkNkIzRm5WSlVxUktwdWhXSkh0Ly9rb00zdVJ2MEJaMjNXZ0l6L1gxCi94bFBqUElIMUNCMEtRY3drUEpIQk1BZ2xOc0NBd0VBQWFOQ01FQXdEZ1lEVlIwUEFRSC9CQVFEQWdJRU1BOEcKQTFVZEV3RUIvd1FGTUFNQkFmOHdIUVlEVlIwT0JCWUVGRlBDNzEzRW5GMlVCeVk4TVdzQ0ozbGNSa0VjTUEwRwpDU3FHU0liM0RRRUJDd1VBQTRJQmdRQVlmUktJM1NJcEplNTlkdWlMVW82RlRCZEhMQ0o0cWFJQ1JWVGlrSmhBCmtKbDY0dTVpRTN2RW9KM2paL1JZd1lNemtuVmlLMkZ3UGFyd2N6VTR1ZnpUc1RNTUprM2M4S3J2NHo4STkrYlcKNktvV1hmNmZ6MnlTOTliUjdLWjlyNkVURy9yK3FWRkg5NlhEcGZIM2J1dUc0ZkM4cm5LUjV5ZU5SL3BhbWR5Ugo2ZzNGUm9VSGRwOWVUQmFEK3VNWE9yWlpKNXBwZ1lrSEFPL0RXcmloWmF4bU9oRXpzTE45Q240YWhrWmhpTkQ3Cm5KakNSOUtzSldUQVRCWU91KzhUVjVFQ2N2RW5PN0ZQajljYVhiaWdjZVNPd25TUzIzWTR4clcrWTErbDJscmoKbHU4eFBkcGphRzZoMnRMSFkvdFdFQVJaR2hWbGRzcU94TlB1c2EvSWorQmRVNyt0S1REMkliOGM3MGpYeVBLOQpzUjg3dGk2SHIrbi8vZ3YzaGNJeUxFdTZVQ0V5QyttQXNWZThKRXA5YlNmYk1CVGVXbml3QlVCTEpkQXpHL3pkCnRDMmx6YmpwZEl5aTM1VS9nRjVoNGNnN0lUTXBZcGJuUVRyV21vUWxnYVVDaUtnbk1qNngrVGZHRVJHcnUwRmEKWVRxZEdwOTd2b0VSWjFVUUwzR014ZmM9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K" -> null
#            (2 unchanged attributes hidden)

-           client_certificate_config {
-               issue_client_certificate = false -> null
            }
        }

!~      master_authorized_networks_config (known after apply)

!~      mesh_certificates (known after apply)

!~      monitoring_config (known after apply)
-       monitoring_config {
-           enable_components = [
-               "SYSTEM_COMPONENTS",
-               "STORAGE",
-               "HPA",
-               "POD",
-               "DAEMONSET",
-               "DEPLOYMENT",
-               "STATEFULSET",
-               "JOBSET",
-               "CADVISOR",
-               "KUBELET",
-               "DCGM",
            ] -> null

-           advanced_datapath_observability_config {
-               enable_metrics = true -> null
-               enable_relay   = false -> null
            }

-           managed_prometheus {
-               enabled = true -> null
            }
        }

-       network_policy {
-           enabled  = false -> null
-           provider = "PROVIDER_UNSPECIFIED" -> null
        }

!~      node_config {
!~          disk_size_gb                = 100 -> (known after apply)
!~          disk_type                   = "pd-balanced" -> (known after apply)
!~          effective_taints            = [
-               {
-                   effect = "NO_SCHEDULE"
-                   key    = "cloud.google.com/gke-quick-remove"
-                   value  = "true"
                },
            ] -> (known after apply)
-           enable_confidential_storage = false -> null
-           flex_start                  = false -> null
!~          image_type                  = "COS_CONTAINERD" -> (known after apply)
!~          labels                      = {} -> (known after apply)
!~          local_ssd_count             = 0 -> (known after apply)
!~          logging_variant             = "DEFAULT" -> (known after apply)
!~          machine_type                = "ek-standard-8" -> (known after apply)
!~          metadata                    = {
-               "disable-legacy-endpoints" = "true"
            } -> (known after apply)
+           min_cpu_platform            = (known after apply)
!~          oauth_scopes                = [
-               "https://www.googleapis.com/auth/devstorage.read_only",
-               "https://www.googleapis.com/auth/logging.write",
-               "https://www.googleapis.com/auth/monitoring",
-               "https://www.googleapis.com/auth/service.management.readonly",
-               "https://www.googleapis.com/auth/servicecontrol",
-               "https://www.googleapis.com/auth/trace.append",
            ] -> (known after apply)
-           resource_labels             = {
-               "goog-gke-node-pool-provisioning-model" = "on-demand"
            } -> null
-           resource_manager_tags       = {} -> null
!~          service_account             = "default" -> (known after apply)
-           storage_pools               = [] -> null
-           tags                        = [] -> null
#            (6 unchanged attributes hidden)

!~          boot_disk (known after apply)
-           boot_disk {
-               disk_type              = "pd-balanced" -> null
-               provisioned_iops       = 0 -> null
-               provisioned_throughput = 0 -> null
-               size_gb                = 100 -> null
            }

!~          confidential_nodes (known after apply)

!~          gcfs_config (known after apply)

!~          guest_accelerator (known after apply)

-           gvnic {
-               enabled = true -> null
            }

!~          kubelet_config (known after apply)
-           kubelet_config {
-               allowed_unsafe_sysctls                 = [] -> null
-               container_log_max_files                = 0 -> null
-               cpu_cfs_quota                          = false -> null
-               eviction_max_pod_grace_period_seconds  = 0 -> null
-               image_gc_high_threshold_percent        = 0 -> null
-               image_gc_low_threshold_percent         = 0 -> null
-               insecure_kubelet_readonly_port_enabled = "FALSE" -> null
-               max_parallel_image_pulls               = 2 -> null
-               pod_pids_limit                         = 0 -> null
-               single_process_oom_kill                = false -> null
#                (5 unchanged attributes hidden)
            }

!~          linux_node_config (known after apply)

-           reservation_affinity { # forces replacement
-               consume_reservation_type = "NO_RESERVATION" -> null # forces replacement
-               values                   = [] -> null
#                (1 unchanged attribute hidden)
            }

!~          shielded_instance_config (known after apply)
-           shielded_instance_config {
-               enable_integrity_monitoring = true -> null
-               enable_secure_boot          = true -> null
            }

!~          windows_node_config (known after apply)
-           windows_node_config {
#                (1 unchanged attribute hidden)
            }

#            (1 unchanged block hidden)
        }

!~      node_pool (known after apply)
-       node_pool {
-           initial_node_count          = 1 -> null
-           instance_group_urls         = [] -> null
-           managed_instance_group_urls = [] -> null
-           max_pods_per_node           = 32 -> null
-           name                        = "default-pool" -> null
-           node_count                  = 0 -> null
-           node_locations              = [
-               "us-west2-c",
            ] -> null
-           version                     = "1.33.5-gke.1201000" -> null
#            (1 unchanged attribute hidden)

-           autoscaling {
-               location_policy      = "BALANCED" -> null
-               max_node_count       = 1000 -> null
-               min_node_count       = 0 -> null
-               total_max_node_count = 0 -> null
-               total_min_node_count = 0 -> null
            }

-           management {
-               auto_repair  = true -> null
-               auto_upgrade = true -> null
            }

-           network_config {
-               create_pod_range     = false -> null
-               enable_private_nodes = false -> null
-               pod_ipv4_cidr_block  = "10.89.128.0/17" -> null
-               pod_range            = "gke-sftp-endpoints-pods-32f84df2" -> null
-               subnetwork           = "projects/cal-itp-data-infra-staging/regions/us-west2/subnetworks/default" -> null
            }

-           node_config {
-               disk_size_gb                = 100 -> null
-               disk_type                   = "pd-balanced" -> null
-               effective_taints            = [
-                   {
-                       effect = "NO_SCHEDULE"
-                       key    = "cloud.google.com/gke-quick-remove"
-                       value  = "true"
                    },
                ] -> null
-               enable_confidential_storage = false -> null
-               flex_start                  = false -> null
-               image_type                  = "COS_CONTAINERD" -> null
-               labels                      = {} -> null
-               local_ssd_count             = 0 -> null
-               logging_variant             = "DEFAULT" -> null
-               machine_type                = "ek-standard-8" -> null
-               metadata                    = {
-                   "disable-legacy-endpoints" = "true"
                } -> null
-               oauth_scopes                = [
-                   "https://www.googleapis.com/auth/devstorage.read_only",
-                   "https://www.googleapis.com/auth/logging.write",
-                   "https://www.googleapis.com/auth/monitoring",
-                   "https://www.googleapis.com/auth/service.management.readonly",
-                   "https://www.googleapis.com/auth/servicecontrol",
-                   "https://www.googleapis.com/auth/trace.append",
                ] -> null
-               preemptible                 = false -> null
-               resource_labels             = {
-                   "goog-gke-node-pool-provisioning-model" = "on-demand"
                } -> null
-               resource_manager_tags       = {} -> null
-               service_account             = "default" -> null
-               spot                        = false -> null
-               storage_pools               = [] -> null
-               tags                        = [] -> null
#                (5 unchanged attributes hidden)

-               boot_disk {
-                   disk_type              = "pd-balanced" -> null
-                   provisioned_iops       = 0 -> null
-                   provisioned_throughput = 0 -> null
-                   size_gb                = 100 -> null
                }

-               gvnic {
-                   enabled = true -> null
                }

-               kubelet_config {
-                   allowed_unsafe_sysctls                 = [] -> null
-                   container_log_max_files                = 0 -> null
-                   cpu_cfs_quota                          = false -> null
-                   eviction_max_pod_grace_period_seconds  = 0 -> null
-                   image_gc_high_threshold_percent        = 0 -> null
-                   image_gc_low_threshold_percent         = 0 -> null
-                   insecure_kubelet_readonly_port_enabled = "FALSE" -> null
-                   max_parallel_image_pulls               = 2 -> null
-                   pod_pids_limit                         = 0 -> null
-                   single_process_oom_kill                = false -> null
#                    (5 unchanged attributes hidden)
                }

-               reservation_affinity {
-                   consume_reservation_type = "NO_RESERVATION" -> null
-                   values                   = [] -> null
#                    (1 unchanged attribute hidden)
                }

-               shielded_instance_config {
-                   enable_integrity_monitoring = true -> null
-                   enable_secure_boot          = true -> null
                }

-               windows_node_config {
#                    (1 unchanged attribute hidden)
                }

-               workload_metadata_config {
-                   mode = "GKE_METADATA" -> null
                }
            }

-           upgrade_settings {
-               max_surge       = 1 -> null
-               max_unavailable = 0 -> null
-               strategy        = "SURGE" -> null
            }
        }
-       node_pool {
-           initial_node_count          = 0 -> null
-           instance_group_urls         = [] -> null
-           managed_instance_group_urls = [] -> null
-           max_pods_per_node           = 32 -> null
-           name                        = "pool-1" -> null
-           node_count                  = 0 -> null
-           node_locations              = [
-               "us-west2-a",
-               "us-west2-b",
-               "us-west2-c",
            ] -> null
-           version                     = "1.33.5-gke.1201000" -> null
#            (1 unchanged attribute hidden)

-           autoscaling {
-               location_policy      = "BALANCED" -> null
-               max_node_count       = 1000 -> null
-               min_node_count       = 0 -> null
-               total_max_node_count = 0 -> null
-               total_min_node_count = 0 -> null
            }

-           management {
-               auto_repair  = true -> null
-               auto_upgrade = true -> null
            }

-           network_config {
-               create_pod_range     = false -> null
-               enable_private_nodes = false -> null
-               pod_ipv4_cidr_block  = "10.89.128.0/17" -> null
-               pod_range            = "gke-sftp-endpoints-pods-32f84df2" -> null
-               subnetwork           = "projects/cal-itp-data-infra-staging/regions/us-west2/subnetworks/default" -> null
            }

-           node_config {
-               disk_size_gb                = 100 -> null
-               disk_type                   = "pd-balanced" -> null
-               effective_taints            = [] -> null
-               enable_confidential_storage = false -> null
-               flex_start                  = false -> null
-               image_type                  = "COS_CONTAINERD" -> null
-               labels                      = {} -> null
-               local_ssd_count             = 0 -> null
-               logging_variant             = "DEFAULT" -> null
-               machine_type                = "ek-standard-8" -> null
-               metadata                    = {
-                   "disable-legacy-endpoints" = "true"
                } -> null
-               oauth_scopes                = [
-                   "https://www.googleapis.com/auth/devstorage.read_only",
-                   "https://www.googleapis.com/auth/logging.write",
-                   "https://www.googleapis.com/auth/monitoring",
-                   "https://www.googleapis.com/auth/service.management.readonly",
-                   "https://www.googleapis.com/auth/servicecontrol",
-                   "https://www.googleapis.com/auth/trace.append",
                ] -> null
-               preemptible                 = false -> null
-               resource_labels             = {
-                   "goog-gke-node-pool-provisioning-model" = "on-demand"
                } -> null
-               resource_manager_tags       = {} -> null
-               service_account             = "default" -> null
-               spot                        = false -> null
-               storage_pools               = [] -> null
-               tags                        = [] -> null
#                (5 unchanged attributes hidden)

-               boot_disk {
-                   disk_type              = "pd-balanced" -> null
-                   provisioned_iops       = 0 -> null
-                   provisioned_throughput = 0 -> null
-                   size_gb                = 100 -> null
                }

-               gvnic {
-                   enabled = true -> null
                }

-               kubelet_config {
-                   allowed_unsafe_sysctls                 = [] -> null
-                   container_log_max_files                = 0 -> null
-                   cpu_cfs_quota                          = false -> null
-                   eviction_max_pod_grace_period_seconds  = 0 -> null
-                   image_gc_high_threshold_percent        = 0 -> null
-                   image_gc_low_threshold_percent         = 0 -> null
-                   insecure_kubelet_readonly_port_enabled = "FALSE" -> null
-                   max_parallel_image_pulls               = 2 -> null
-                   pod_pids_limit                         = 0 -> null
-                   single_process_oom_kill                = false -> null
#                    (5 unchanged attributes hidden)
                }

-               reservation_affinity {
-                   consume_reservation_type = "NO_RESERVATION" -> null
-                   values                   = [] -> null
#                    (1 unchanged attribute hidden)
                }

-               shielded_instance_config {
-                   enable_integrity_monitoring = true -> null
-                   enable_secure_boot          = true -> null
                }

-               windows_node_config {
#                    (1 unchanged attribute hidden)
                }

-               workload_metadata_config {
-                   mode = "GKE_METADATA" -> null
                }
            }

-           upgrade_settings {
-               max_surge       = 1 -> null
-               max_unavailable = 0 -> null
-               strategy        = "SURGE" -> null
            }
        }
-       node_pool {
-           initial_node_count          = 0 -> null
-           instance_group_urls         = [] -> null
-           managed_instance_group_urls = [] -> null
-           max_pods_per_node           = 32 -> null
-           name                        = "pool-2" -> null
-           node_count                  = 0 -> null
-           node_locations              = [
-               "us-west2-a",
-               "us-west2-b",
-               "us-west2-c",
            ] -> null
-           version                     = "1.33.5-gke.1201000" -> null
#            (1 unchanged attribute hidden)

-           autoscaling {
-               location_policy      = "BALANCED" -> null
-               max_node_count       = 1000 -> null
-               min_node_count       = 0 -> null
-               total_max_node_count = 0 -> null
-               total_min_node_count = 0 -> null
            }

-           management {
-               auto_repair  = true -> null
-               auto_upgrade = true -> null
            }

-           network_config {
-               create_pod_range     = false -> null
-               enable_private_nodes = false -> null
-               pod_ipv4_cidr_block  = "10.89.128.0/17" -> null
-               pod_range            = "gke-sftp-endpoints-pods-32f84df2" -> null
-               subnetwork           = "projects/cal-itp-data-infra-staging/regions/us-west2/subnetworks/default" -> null
            }

-           node_config {
-               disk_size_gb                = 100 -> null
-               disk_type                   = "pd-balanced" -> null
-               effective_taints            = [] -> null
-               enable_confidential_storage = false -> null
-               flex_start                  = false -> null
-               image_type                  = "COS_CONTAINERD" -> null
-               labels                      = {} -> null
-               local_ssd_count             = 0 -> null
-               logging_variant             = "DEFAULT" -> null
-               machine_type                = "ek-standard-16" -> null
-               metadata                    = {
-                   "disable-legacy-endpoints" = "true"
                } -> null
-               oauth_scopes                = [
-                   "https://www.googleapis.com/auth/devstorage.read_only",
-                   "https://www.googleapis.com/auth/logging.write",
-                   "https://www.googleapis.com/auth/monitoring",
-                   "https://www.googleapis.com/auth/service.management.readonly",
-                   "https://www.googleapis.com/auth/servicecontrol",
-                   "https://www.googleapis.com/auth/trace.append",
                ] -> null
-               preemptible                 = false -> null
-               resource_labels             = {
-                   "goog-gke-node-pool-provisioning-model" = "on-demand"
                } -> null
-               resource_manager_tags       = {} -> null
-               service_account             = "default" -> null
-               spot                        = false -> null
-               storage_pools               = [] -> null
-               tags                        = [] -> null
#                (5 unchanged attributes hidden)

-               boot_disk {
-                   disk_type              = "pd-balanced" -> null
-                   provisioned_iops       = 0 -> null
-                   provisioned_throughput = 0 -> null
-                   size_gb                = 100 -> null
                }

-               gvnic {
-                   enabled = true -> null
                }

-               kubelet_config {
-                   allowed_unsafe_sysctls                 = [] -> null
-                   container_log_max_files                = 0 -> null
-                   cpu_cfs_quota                          = false -> null
-                   eviction_max_pod_grace_period_seconds  = 0 -> null
-                   image_gc_high_threshold_percent        = 0 -> null
-                   image_gc_low_threshold_percent         = 0 -> null
-                   insecure_kubelet_readonly_port_enabled = "FALSE" -> null
-                   max_parallel_image_pulls               = 2 -> null
-                   pod_pids_limit                         = 0 -> null
-                   single_process_oom_kill                = false -> null
#                    (5 unchanged attributes hidden)
                }

-               reservation_affinity {
-                   consume_reservation_type = "NO_RESERVATION" -> null
-                   values                   = [] -> null
#                    (1 unchanged attribute hidden)
                }

-               shielded_instance_config {
-                   enable_integrity_monitoring = true -> null
-                   enable_secure_boot          = true -> null
                }

-               windows_node_config {
#                    (1 unchanged attribute hidden)
                }

-               workload_metadata_config {
-                   mode = "GKE_METADATA" -> null
                }
            }

-           upgrade_settings {
-               max_surge       = 1 -> null
-               max_unavailable = 0 -> null
-               strategy        = "SURGE" -> null
            }
        }
-       node_pool {
-           initial_node_count          = 0 -> null
-           instance_group_urls         = [] -> null
-           managed_instance_group_urls = [] -> null
-           max_pods_per_node           = 32 -> null
-           name                        = "pool-3" -> null
-           node_count                  = 0 -> null
-           node_locations              = [
-               "us-west2-a",
-               "us-west2-b",
-               "us-west2-c",
            ] -> null
-           version                     = "1.33.5-gke.1201000" -> null
#            (1 unchanged attribute hidden)

-           autoscaling {
-               location_policy      = "BALANCED" -> null
-               max_node_count       = 1000 -> null
-               min_node_count       = 0 -> null
-               total_max_node_count = 0 -> null
-               total_min_node_count = 0 -> null
            }

-           management {
-               auto_repair  = true -> null
-               auto_upgrade = true -> null
            }

-           network_config {
-               create_pod_range     = false -> null
-               enable_private_nodes = false -> null
-               pod_ipv4_cidr_block  = "10.89.128.0/17" -> null
-               pod_range            = "gke-sftp-endpoints-pods-32f84df2" -> null
-               subnetwork           = "projects/cal-itp-data-infra-staging/regions/us-west2/subnetworks/default" -> null
            }

-           node_config {
-               disk_size_gb                = 100 -> null
-               disk_type                   = "pd-balanced" -> null
-               effective_taints            = [] -> null
-               enable_confidential_storage = false -> null
-               flex_start                  = false -> null
-               image_type                  = "COS_CONTAINERD" -> null
-               labels                      = {} -> null
-               local_ssd_count             = 0 -> null
-               logging_variant             = "DEFAULT" -> null
-               machine_type                = "ek-standard-32" -> null
-               metadata                    = {
-                   "disable-legacy-endpoints" = "true"
                } -> null
-               oauth_scopes                = [
-                   "https://www.googleapis.com/auth/devstorage.read_only",
-                   "https://www.googleapis.com/auth/logging.write",
-                   "https://www.googleapis.com/auth/monitoring",
-                   "https://www.googleapis.com/auth/service.management.readonly",
-                   "https://www.googleapis.com/auth/servicecontrol",
-                   "https://www.googleapis.com/auth/trace.append",
                ] -> null
-               preemptible                 = false -> null
-               resource_labels             = {
-                   "goog-gke-node-pool-provisioning-model" = "on-demand"
                } -> null
-               resource_manager_tags       = {} -> null
-               service_account             = "default" -> null
-               spot                        = false -> null
-               storage_pools               = [] -> null
-               tags                        = [] -> null
#                (5 unchanged attributes hidden)

-               boot_disk {
-                   disk_type              = "pd-balanced" -> null
-                   provisioned_iops       = 0 -> null
-                   provisioned_throughput = 0 -> null
-                   size_gb                = 100 -> null
                }

-               gvnic {
-                   enabled = true -> null
                }

-               kubelet_config {
-                   allowed_unsafe_sysctls                 = [] -> null
-                   container_log_max_files                = 0 -> null
-                   cpu_cfs_quota                          = false -> null
-                   eviction_max_pod_grace_period_seconds  = 0 -> null
-                   image_gc_high_threshold_percent        = 0 -> null
-                   image_gc_low_threshold_percent         = 0 -> null
-                   insecure_kubelet_readonly_port_enabled = "FALSE" -> null
-                   max_parallel_image_pulls               = 2 -> null
-                   pod_pids_limit                         = 0 -> null
-                   single_process_oom_kill                = false -> null
#                    (5 unchanged attributes hidden)
                }

-               reservation_affinity {
-                   consume_reservation_type = "NO_RESERVATION" -> null
-                   values                   = [] -> null
#                    (1 unchanged attribute hidden)
                }

-               shielded_instance_config {
-                   enable_integrity_monitoring = true -> null
-                   enable_secure_boot          = true -> null
                }

-               windows_node_config {
#                    (1 unchanged attribute hidden)
                }

-               workload_metadata_config {
-                   mode = "GKE_METADATA" -> null
                }
            }

-           upgrade_settings {
-               max_surge       = 1 -> null
-               max_unavailable = 0 -> null
-               strategy        = "SURGE" -> null
            }
        }
-       node_pool {
-           initial_node_count          = 0 -> null
-           instance_group_urls         = [] -> null
-           managed_instance_group_urls = [] -> null
-           max_pods_per_node           = 32 -> null
-           name                        = "pool-4" -> null
-           node_count                  = 0 -> null
-           node_locations              = [
-               "us-west2-a",
-               "us-west2-b",
-               "us-west2-c",
            ] -> null
-           version                     = "1.33.5-gke.1201000" -> null
#            (1 unchanged attribute hidden)

-           autoscaling {
-               location_policy      = "BALANCED" -> null
-               max_node_count       = 1000 -> null
-               min_node_count       = 0 -> null
-               total_max_node_count = 0 -> null
-               total_min_node_count = 0 -> null
            }

-           management {
-               auto_repair  = true -> null
-               auto_upgrade = true -> null
            }

-           network_config {
-               create_pod_range     = false -> null
-               enable_private_nodes = false -> null
-               pod_ipv4_cidr_block  = "10.89.128.0/17" -> null
-               pod_range            = "gke-sftp-endpoints-pods-32f84df2" -> null
-               subnetwork           = "projects/cal-itp-data-infra-staging/regions/us-west2/subnetworks/default" -> null
            }

-           node_config {
-               disk_size_gb                = 100 -> null
-               disk_type                   = "pd-balanced" -> null
-               effective_taints            = [] -> null
-               enable_confidential_storage = false -> null
-               flex_start                  = false -> null
-               image_type                  = "COS_CONTAINERD" -> null
-               labels                      = {} -> null
-               local_ssd_count             = 0 -> null
-               logging_variant             = "DEFAULT" -> null
-               machine_type                = "e2-medium" -> null
-               metadata                    = {
-                   "disable-legacy-endpoints" = "true"
                } -> null
-               oauth_scopes                = [
-                   "https://www.googleapis.com/auth/devstorage.read_only",
-                   "https://www.googleapis.com/auth/logging.write",
-                   "https://www.googleapis.com/auth/monitoring",
-                   "https://www.googleapis.com/auth/service.management.readonly",
-                   "https://www.googleapis.com/auth/servicecontrol",
-                   "https://www.googleapis.com/auth/trace.append",
                ] -> null
-               preemptible                 = false -> null
-               resource_labels             = {
-                   "goog-gke-node-pool-provisioning-model" = "on-demand"
                } -> null
-               resource_manager_tags       = {} -> null
-               service_account             = "default" -> null
-               spot                        = false -> null
-               storage_pools               = [] -> null
-               tags                        = [] -> null
#                (5 unchanged attributes hidden)

-               boot_disk {
-                   disk_type              = "pd-balanced" -> null
-                   provisioned_iops       = 0 -> null
-                   provisioned_throughput = 0 -> null
-                   size_gb                = 100 -> null
                }

-               gvnic {
-                   enabled = true -> null
                }

-               kubelet_config {
-                   allowed_unsafe_sysctls                 = [] -> null
-                   container_log_max_files                = 0 -> null
-                   cpu_cfs_quota                          = false -> null
-                   eviction_max_pod_grace_period_seconds  = 0 -> null
-                   image_gc_high_threshold_percent        = 0 -> null
-                   image_gc_low_threshold_percent         = 0 -> null
-                   insecure_kubelet_readonly_port_enabled = "FALSE" -> null
-                   max_parallel_image_pulls               = 2 -> null
-                   pod_pids_limit                         = 0 -> null
-                   single_process_oom_kill                = false -> null
#                    (5 unchanged attributes hidden)
                }

-               reservation_affinity {
-                   consume_reservation_type = "NO_RESERVATION" -> null
-                   values                   = [] -> null
#                    (1 unchanged attribute hidden)
                }

-               shielded_instance_config {
-                   enable_integrity_monitoring = true -> null
-                   enable_secure_boot          = true -> null
                }

-               windows_node_config {
#                    (1 unchanged attribute hidden)
                }

-               workload_metadata_config {
-                   mode = "GKE_METADATA" -> null
                }
            }

-           upgrade_settings {
-               max_surge       = 1 -> null
-               max_unavailable = 0 -> null
-               strategy        = "SURGE" -> null
            }
        }
-       node_pool {
-           initial_node_count          = 0 -> null
-           instance_group_urls         = [] -> null
-           managed_instance_group_urls = [] -> null
-           max_pods_per_node           = 32 -> null
-           name                        = "pool-5" -> null
-           node_count                  = 0 -> null
-           node_locations              = [
-               "us-west2-a",
-               "us-west2-b",
-               "us-west2-c",
            ] -> null
-           version                     = "1.33.5-gke.1201000" -> null
#            (1 unchanged attribute hidden)

-           autoscaling {
-               location_policy      = "BALANCED" -> null
-               max_node_count       = 1000 -> null
-               min_node_count       = 0 -> null
-               total_max_node_count = 0 -> null
-               total_min_node_count = 0 -> null
            }

-           management {
-               auto_repair  = true -> null
-               auto_upgrade = true -> null
            }

-           network_config {
-               create_pod_range     = false -> null
-               enable_private_nodes = false -> null
-               pod_ipv4_cidr_block  = "10.89.128.0/17" -> null
-               pod_range            = "gke-sftp-endpoints-pods-32f84df2" -> null
-               subnetwork           = "projects/cal-itp-data-infra-staging/regions/us-west2/subnetworks/default" -> null
            }

-           node_config {
-               disk_size_gb                = 100 -> null
-               disk_type                   = "pd-balanced" -> null
-               effective_taints            = [] -> null
-               enable_confidential_storage = false -> null
-               flex_start                  = false -> null
-               image_type                  = "COS_CONTAINERD" -> null
-               labels                      = {} -> null
-               local_ssd_count             = 0 -> null
-               logging_variant             = "DEFAULT" -> null
-               machine_type                = "e2-standard-2" -> null
-               metadata                    = {
-                   "disable-legacy-endpoints" = "true"
                } -> null
-               oauth_scopes                = [
-                   "https://www.googleapis.com/auth/devstorage.read_only",
-                   "https://www.googleapis.com/auth/logging.write",
-                   "https://www.googleapis.com/auth/monitoring",
-                   "https://www.googleapis.com/auth/service.management.readonly",
-                   "https://www.googleapis.com/auth/servicecontrol",
-                   "https://www.googleapis.com/auth/trace.append",
                ] -> null
-               preemptible                 = false -> null
-               resource_labels             = {
-                   "goog-gke-node-pool-provisioning-model" = "on-demand"
                } -> null
-               resource_manager_tags       = {} -> null
-               service_account             = "default" -> null
-               spot                        = false -> null
-               storage_pools               = [] -> null
-               tags                        = [] -> null
#                (5 unchanged attributes hidden)

-               boot_disk {
-                   disk_type              = "pd-balanced" -> null
-                   provisioned_iops       = 0 -> null
-                   provisioned_throughput = 0 -> null
-                   size_gb                = 100 -> null
                }

-               gvnic {
-                   enabled = true -> null
                }

-               kubelet_config {
-                   allowed_unsafe_sysctls                 = [] -> null
-                   container_log_max_files                = 0 -> null
-                   cpu_cfs_quota                          = false -> null
-                   eviction_max_pod_grace_period_seconds  = 0 -> null
-                   image_gc_high_threshold_percent        = 0 -> null
-                   image_gc_low_threshold_percent         = 0 -> null
-                   insecure_kubelet_readonly_port_enabled = "FALSE" -> null
-                   max_parallel_image_pulls               = 2 -> null
-                   pod_pids_limit                         = 0 -> null
-                   single_process_oom_kill                = false -> null
#                    (5 unchanged attributes hidden)
                }

-               reservation_affinity {
-                   consume_reservation_type = "NO_RESERVATION" -> null
-                   values                   = [] -> null
#                    (1 unchanged attribute hidden)
                }

-               shielded_instance_config {
-                   enable_integrity_monitoring = true -> null
-                   enable_secure_boot          = true -> null
                }

-               windows_node_config {
#                    (1 unchanged attribute hidden)
                }

-               workload_metadata_config {
-                   mode = "GKE_METADATA" -> null
                }
            }

-           upgrade_settings {
-               max_surge       = 1 -> null
-               max_unavailable = 0 -> null
-               strategy        = "SURGE" -> null
            }
        }
-       node_pool {
-           initial_node_count          = 0 -> null
-           instance_group_urls         = [] -> null
-           managed_instance_group_urls = [] -> null
-           max_pods_per_node           = 32 -> null
-           name                        = "pool-6" -> null
-           node_count                  = 0 -> null
-           node_locations              = [
-               "us-west2-a",
-               "us-west2-b",
-               "us-west2-c",
            ] -> null
-           version                     = "1.33.5-gke.1201000" -> null
#            (1 unchanged attribute hidden)

-           autoscaling {
-               location_policy      = "BALANCED" -> null
-               max_node_count       = 1000 -> null
-               min_node_count       = 0 -> null
-               total_max_node_count = 0 -> null
-               total_min_node_count = 0 -> null
            }

-           management {
-               auto_repair  = true -> null
-               auto_upgrade = true -> null
            }

-           network_config {
-               create_pod_range     = false -> null
-               enable_private_nodes = false -> null
-               pod_ipv4_cidr_block  = "10.89.128.0/17" -> null
Plan is too large to fit in a PR comment. See the full plan in the workflow log.

:memo: Plan generated in Terraform Plan #672

github-actions[bot] avatar Nov 11 '25 21:11 github-actions[bot]

Terraform plan in iac/cal-itp-data-infra-staging/composer/us

Plan: 0 to add, 1 to change, 0 to destroy.
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place

Terraform will perform the following actions:

  # google_composer_environment.calitp-staging-composer will be updated in-place
!~  resource "google_composer_environment" "calitp-staging-composer" {
        id               = "projects/cal-itp-data-infra-staging/locations/us-west2/environments/calitp-staging-composer"
        name             = "calitp-staging-composer"
#        (5 unchanged attributes hidden)

!~      config {
#            (8 unchanged attributes hidden)

!~          software_config {
!~              image_version            = "composer-2.10.2-airflow-2.9.3" -> "composer-2.13.1-airflow-2.9.3"
#                (6 unchanged attributes hidden)

#                (1 unchanged block hidden)
            }

#            (8 unchanged blocks hidden)
        }

#        (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

:memo: Plan generated in Terraform Plan #672

github-actions[bot] avatar Nov 11 '25 21:11 github-actions[bot]

Terraform plan in iac/cal-itp-data-infra-staging/enghouse-sftp/us

Plan: 0 to add, 1 to change, 0 to destroy.
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place

Terraform will perform the following actions:

  # kubernetes_deployment.enghouse-sftp will be updated in-place
!~  resource "kubernetes_deployment" "enghouse-sftp" {
        id               = "default/enghouse-sftp-deployment"
#        (1 unchanged attribute hidden)

!~      spec {
#            (5 unchanged attributes hidden)

!~          template {
!~              spec {
#                    (18 unchanged attributes hidden)

!~                  container {
                        name                       = "sftp-server"
#                        (10 unchanged attributes hidden)

-                       security_context {
-                           allow_privilege_escalation = false -> null
-                           privileged                 = false -> null
-                           read_only_root_filesystem  = false -> null
-                           run_as_non_root            = false -> null
#                            (2 unchanged attributes hidden)

-                           capabilities {
-                               add  = [] -> null
-                               drop = [
-                                   "NET_RAW",
                                ] -> null
                            }
                        }

#                        (6 unchanged blocks hidden)
                    }

-                   security_context {
-                       run_as_non_root        = false -> null
-                       supplemental_groups    = [] -> null
#                        (4 unchanged attributes hidden)

-                       seccomp_profile {
-                           type              = "RuntimeDefault" -> null
#                            (1 unchanged attribute hidden)
                        }
                    }

-                   toleration {
-                       effect             = "NoSchedule" -> null
-                       key                = "kubernetes.io/arch" -> null
-                       operator           = "Equal" -> null
-                       value              = "amd64" -> null
#                        (1 unchanged attribute hidden)
                    }

#                    (3 unchanged blocks hidden)
                }

#                (1 unchanged block hidden)
            }

#            (2 unchanged blocks hidden)
        }

#        (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

:memo: Plan generated in Terraform Plan #672

github-actions[bot] avatar Nov 11 '25 21:11 github-actions[bot]