Terraform-provider-google: Cannot re-create previously destroyed projects

[chiefy]

Terraform Version

Terraform v0.11.3
+ provider.google v1.5.0

Terraform Configuration Files

https://github.com/chiefy/tf-gcp-mediawiki

Debug Output

https://gist.github.com/chiefy/fd205a65c8727dbde3de29c915ed849d

Crash Output

n/a

Expected Behavior

A previously deleted project is re-created

Actual Behavior

Steps to Reproduce

make apply
terraform import -no-color google_project.mediawiki <project-id>

Additional Context

This occurred after TF had already created/destroyed said project (successfully) once.

References

[colin92]

To my knowledge, this is because of the way project deletion in GCP works. The project_id namespace is global in GCP and it takes 30 days for projects to be actually deleted (until then they are just pending deletion) and for the project_id to be available again. You can get around this by using the random provider to add a random element to a project ID so that it unique every time it is destroyed and recreated. The display name of a project is both mutable and does not have to be unique, since it is only for display purposes, so that can stay the same.

resource "random_string" "project_random_string" {
  length  = 4
  special = false
  upper   = false
}

resource "google_project" "my_project" {
  name            = "${var.name}"
  project_id      = "${var.name}-${random_string.project_random_string.result}"
  folder_id       = "${var.folder_id}"
  billing_account = "${var.billing_id"

  labels = "${var.labels}"
}

[chiefy]

@colin92 I have limited GCP experience, but I believe you are correct. I think maybe the solution to this is to check if the project-id is in "pending deletion" state and throwing a message to the user? I know it left me very confused.

Thanks for your workaround - I will try that w/ my TF setup.

[wmuizelaar]

Well, the project_id actually never becomes available again. At least, not for a whole lot longer then 30 days, in my experience. We actually questioned Google about this, and they told is that once it's gone, it's gone.

[amoiseiev]

As @colin92 mentioned above, the right way of handling it appears to be adding some extra logic, maybe on exception, to check if lifecycleState of the project is "DELETE_REQUESTED" and then calling "undelete" REST endpoint.

Additional info:

https://cloud.google.com/resource-manager/reference/rest/v1/projects#Project
https://cloud.google.com/resource-manager/reference/rest/v1/projects/undelete

[nickjacques]

Assuming "project-a" existed and was deleted, would it make sense for the workflow to look like this?

1. terraform apply to create the project using default values: fails, due to namespace collision (project already "exists" but is in an inactive [pending deletion] state). The apply fails/exits 1.
2. terraform apply to create the project, with a property key undelete: true, which will cause projects in inactive (pending deletion) states to be undeleted. The apply succeeds/exits 0.
3. terraform apply to create the project, with a property key undelete: false, which will _not_ cause projects in inactive (pending deletion) states to be undeleted. This is exactly like case 1 above, just more explicit. The apply fails/exits 1.

The only issue with this approach is that a control parameter for project objects would be created that exists solely in Terraform and not in the GCP APIs.

[chiefy]

@nickjacques I like that. I don't mind the control parameter since GCP projects are not truly ephemeral.

[ensonic]

The same would help endpoints:

• google_endpoints_service.xxx: 1 error(s) occurred:

• google_endpoints_service.xxx: googleapi: Error 400: Service xxx.endpoints..cloud.goog has been deleted and will be purged after 30 days. To reuse this service, please undelete the service following https://cloud.google.com/service-management/create-delete., failedPrecondition

[chiefy]

Closing this since no movement.

[jasonmcboyd]

Hi, why was this closed, it seems like a legitimate issue? I am bumping up against issues caused by this soft delete behavior with the google_endpoint_service resource. At first glance it looks like the solution proposed by @nickjacques should be given consideration.

[chiefy]

@jasonmcboyd there was no movement on it, and it doesn't look like the team was going to change functionality. Feel free to re-open w/ your own issue.

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!