Skip to content

apigee: fix org_id doubled prefix in google_apigee_sharedflow_deployment#16948

Open
xuchenma wants to merge 1 commit intoGoogleCloudPlatform:mainfrom
xuchenma:478035942
Open

apigee: fix org_id doubled prefix in google_apigee_sharedflow_deployment#16948
xuchenma wants to merge 1 commit intoGoogleCloudPlatform:mainfrom
xuchenma:478035942

Conversation

@xuchenma
Copy link
Copy Markdown
Contributor

@xuchenma xuchenma commented Apr 4, 2026

Description

Fixes a bug where importing google_apigee_sharedflow_deployment would trigger an unwanted destroy+recreate cycle when org_id uses a google_apigee_organization.id reference.

Root cause: google_apigee_organization.id returns "organizations/<project-id>". The import regex captures only <project-id> into org_id. After import, the state has org_id = "project-id" but the config has org_id = "organizations/project-id". This diff triggers ForceNew → destroy → undeploy → 400 error if dependent API proxies are attached:

Error: googleapi: Error 400: generic::failed_precondition: undeployment validations failed
Shared flow cannot be removed. It is a dependency of deployment ...

Fix: Added a StateFunc and DiffSuppressFunc to the org_id field that strip the organizations/ prefix if present, so both bare project IDs and fully-qualified organization IDs normalize to the same value and no spurious diff is produced.

Fixes: hashicorp/terraform-provider-google#25852

Tests

TestAccApigeeSharedflowDeployment_apigeeSharedflowDeploymentTestExample passed locally (1323s), including ImportStateVerify steps:

--- PASS: TestAccApigeeSharedflowDeployment_apigeeSharedflowDeploymentTestExample (1323.60s)
PASS
apigee: fixed `google_apigee_sharedflow_deployment` `org_id` to prevent ForceNew destroy on import when using `organizations/` prefix

When users reference google_apigee_organization.id as org_id in
google_apigee_sharedflow_deployment, the value already contains the
'organizations/' prefix (e.g. 'organizations/my-project').

After import, the import regex captures just 'my-project' into org_id.
This causes a state diff: config has 'organizations/my-project', state
has 'my-project'. Since org_id has ForceNew:true, Terraform destroys and
recreates the deployment. Undeploying a sharedflow with dependent API
proxies fails with 400 'undeployment validations failed'.

Fix by adding a StateFunc and DiffSuppressFunc to the org_id field that
strip the 'organizations/' prefix if present, so both bare project IDs
and fully-qualified organization IDs are normalized consistently.

Fixes: hashicorp/terraform-provider-google#25852
@modular-magician modular-magician added the awaiting-approval Pull requests that need reviewer's approval to run presubmit tests label Apr 4, 2026
@github-actions github-actions bot requested a review from hao-nan-li April 4, 2026 11:43
@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 4, 2026

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@hao-nan-li, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

awaiting-approval Pull requests that need reviewer's approval to run presubmit tests

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Error when reading or editing SharedflowDeployment: googleapi: Error 400: generic::failed_precondition: undeployment validations failed

2 participants