Cannot create an App Engine NEG with default routing

[javierdialpad]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Terraform Version

Terraform v1.5.5 on darwin_arm64 + provider registry.terraform.io/hashicorp/google-beta v4.79.0

Description

When creating a serverless NEG pointing to App Engine, there's an option called "Default routing", which targets the App Engine application in general, not any specific service or version. This is useful for defining internal routing rules in the application, using the dispatch.yaml configuration file.

Creating the NEG on the GCP console looks like this:

However, it doesn't seem that current Terraform code supports that feature. The resource required to create a NEG is compute_region_network_endpoint_group. The app_engine block inside that resource defines 3 optional arguments: service, version and url_mask. Specifying only one of those voids the intent of default routing, and leaving the block empty is not valid as it generates an API error when trying to create the resource:

google_compute_region_network_endpoint_group.app_engine_neg: Creating...
╷
│ Error: Error creating RegionNetworkEndpointGroup: googleapi: Error 400: Either Cloud Run, App Engine, Cloud Function, or Serverless Deployment must be set., badRequest
│
│   with google_compute_region_network_endpoint_group.app_engine_neg,
│   on main.tf line 7, in resource "google_compute_region_network_endpoint_group" "app_engine_neg":
│    7: resource "google_compute_region_network_endpoint_group" "app_engine_neg" {
│

The above error can be reproduced with the following resource definition:

resource "google_compute_region_network_endpoint_group" "app_engine_neg" {
  provider              = google-beta
  name                  = "appengine-neg"
  network_endpoint_type = "SERVERLESS"
  project               = "test-project"
  region                = "us-central1"
  app_engine {
  }
}

New or Affected Resource(s)

• google_compute_region_network_endpoint_group

Potential Terraform Configuration

One option to solve this could be to add a new flag inside the app_engine block named "default_routing" or similar, to be explicit about creating an App Engine NEG:

resource "google_compute_region_network_endpoint_group" "app_engine_neg" {
  provider              = google-beta
  name                  = "appengine-neg"
  network_endpoint_type = "SERVERLESS"
  project               = "test-project"
  region                = "us-central1"
  app_engine {
    default_routing = true
  }
}

References

• #0000

b/312433182

[bbrinegar-champion]

Also encountered this limitation. The workaround seems to be to create separate NEG and Backend Services per App Engine service and move the routing to the load balancer. Frustrating given how simple it is to use the default routing via the Google Console.

[melinath]

If the issue is that appEngine needs to be an empty object, adding allow_empty_object and making the nested fields optional might get the right behavior.

Possibly relevant context:

• https://github.com/hashicorp/terraform-provider-google/issues/12651
• https://github.com/hashicorp/terraform-provider-google/issues/13201

[melinath]

Double-checked and it's already set up that way, except that it's missing send_empty_value: true as described in https://github.com/hashicorp/terraform-provider-google/issues/12651#issuecomment-1258737997

I can reproduce this with the following config:

resource "google_compute_region_network_endpoint_group" "appengine_neg" {
  name                  = "tf-test-appengine-negawlekr"
  network_endpoint_type = "SERVERLESS"
  region                = "us-central1"
  app_engine {}
}

[Cheriit]

Fix is waiting in https://github.com/GoogleCloudPlatform/magic-modules/pull/9980

[github-actions[bot]]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.