fix: handle null secondary_ip_range in cluster_alias_ranges_cidr

raman1236 · raman1236 · commit edaaf44f23b1 · 2026-05-30T13:05:56.000-05:00
Fixes #564 When using add_cluster_firewall_rules=true and performing terraform destroy, or when the subnetwork data source returns null secondary_ip_range, Terraform fails with 'A null value cannot be used as the collection in a for expression.' This fix uses coalesce() to default null secondary_ip_range to an empty list, preventing the error during destroy operations and edge cases where the subnetwork might not have secondary IP ranges available. Affected modules: - main root module - beta-private-cluster-update-variant - private-cluster - beta-public-cluster - beta-private-cluster - beta-autopilot-public-cluster - beta-autopilot-private-cluster - private-cluster-update-variant - beta-public-cluster-update-variant
diff --git a/autogen/main/cluster.tf.tmpl b/autogen/main/cluster.tf.tmpl
@@ -110,10 +110,10 @@ resource "google_container_cluster" "primary" {
   }
 {% endif %}
   dynamic "logging_config" {
-    for_each = length(var.logging_enabled_components) > 0 ? [1] : []
+    for_each = local.logging_config_is_set ? [1] : []
 
     content {
-      enable_components = var.logging_enabled_components
+      enable_components = var.logging_service == "none" ? [] : var.logging_enabled_components
     }
   }
 
diff --git a/autogen/main/main.tf.tmpl b/autogen/main/main.tf.tmpl
@@ -91,7 +91,7 @@ locals {
 {% endif %}
 
   cluster_subnet_cidr       = var.add_cluster_firewall_rules ? data.google_compute_subnetwork.gke_subnetwork[0].ip_cidr_range : null
-  cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range) : range.range_name => range.ip_cidr_range } : {}
+  cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(coalesce(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range, [])) : range.range_name => range.ip_cidr_range } : {}
 {% if autopilot_cluster != true %}
   pod_all_ip_ranges         = var.add_cluster_firewall_rules ? compact(concat([local.cluster_alias_ranges_cidr[var.ip_range_pods]], [for range in var.additional_ip_range_pods : local.cluster_alias_ranges_cidr[range] if length(range) > 0], [for k, v in merge(local.node_pools, local.windows_node_pools) : local.cluster_alias_ranges_cidr[v.pod_range] if length(lookup(v, "pod_range", "")) > 0])) : []
 {% else %}
@@ -107,7 +107,8 @@ locals {
     provider = null
   }]
   cluster_gce_pd_csi_config       = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]
-  logmon_config_is_set            = length(var.logging_enabled_components) > 0 || length(var.monitoring_enabled_components) > 0 || var.monitoring_enable_managed_prometheus != null
+  logging_config_is_set           = var.logging_service == "none" || length(var.logging_enabled_components) > 0
+  logmon_config_is_set            = local.logging_config_is_set || length(var.monitoring_enabled_components) > 0 || var.monitoring_enable_managed_prometheus != null
   gcs_fuse_csi_driver_config      = var.gcs_fuse_csi_driver ? [{ enabled = true }] : []
   parallelstore_csi_driver_config = var.parallelstore_csi_driver != null ? [{ enabled = var.parallelstore_csi_driver }] : []
 {% endif %}
diff --git a/main.tf b/main.tf
@@ -79,7 +79,7 @@ locals {
   default_auto_upgrade = var.regional || var.release_channel != "UNSPECIFIED" ? true : false
 
   cluster_subnet_cidr       = var.add_cluster_firewall_rules ? data.google_compute_subnetwork.gke_subnetwork[0].ip_cidr_range : null
-  cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range) : range.range_name => range.ip_cidr_range } : {}
+  cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(coalesce(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range, [])) : range.range_name => range.ip_cidr_range } : {}
   pod_all_ip_ranges         = var.add_cluster_firewall_rules ? compact(concat([local.cluster_alias_ranges_cidr[var.ip_range_pods]], [for range in var.additional_ip_range_pods : local.cluster_alias_ranges_cidr[range] if length(range) > 0], [for k, v in merge(local.node_pools, local.windows_node_pools) : local.cluster_alias_ranges_cidr[v.pod_range] if length(lookup(v, "pod_range", "")) > 0])) : []
 
   cluster_network_policy = var.network_policy ? [{
diff --git a/modules/beta-autopilot-private-cluster/main.tf b/modules/beta-autopilot-private-cluster/main.tf
@@ -61,7 +61,7 @@ locals {
   cluster_type       = var.regional ? "regional" : "zonal"
 
   cluster_subnet_cidr       = var.add_cluster_firewall_rules ? data.google_compute_subnetwork.gke_subnetwork[0].ip_cidr_range : null
-  cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range) : range.range_name => range.ip_cidr_range } : {}
+  cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(coalesce(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range, [])) : range.range_name => range.ip_cidr_range } : {}
   pod_all_ip_ranges         = var.add_cluster_firewall_rules ? compact(concat([local.cluster_alias_ranges_cidr[var.ip_range_pods]], [for range in var.additional_ip_range_pods : local.cluster_alias_ranges_cidr[range] if length(range) > 0])) : []
 
   gke_backup_agent_config = var.gke_backup_agent_config ? [{ enabled = true }] : [{ enabled = false }]
diff --git a/modules/beta-autopilot-public-cluster/main.tf b/modules/beta-autopilot-public-cluster/main.tf
@@ -61,7 +61,7 @@ locals {
   cluster_type       = var.regional ? "regional" : "zonal"
 
   cluster_subnet_cidr       = var.add_cluster_firewall_rules ? data.google_compute_subnetwork.gke_subnetwork[0].ip_cidr_range : null
-  cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range) : range.range_name => range.ip_cidr_range } : {}
+  cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(coalesce(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range, [])) : range.range_name => range.ip_cidr_range } : {}
   pod_all_ip_ranges         = var.add_cluster_firewall_rules ? compact(concat([local.cluster_alias_ranges_cidr[var.ip_range_pods]], [for range in var.additional_ip_range_pods : local.cluster_alias_ranges_cidr[range] if length(range) > 0])) : []
 
   gke_backup_agent_config = var.gke_backup_agent_config ? [{ enabled = true }] : [{ enabled = false }]
diff --git a/modules/beta-private-cluster-update-variant/cluster.tf b/modules/beta-private-cluster-update-variant/cluster.tf
@@ -102,10 +102,10 @@ resource "google_container_cluster" "primary" {
     }
   }
   dynamic "logging_config" {
-    for_each = length(var.logging_enabled_components) > 0 ? [1] : []
+    for_each = local.logging_config_is_set ? [1] : []
 
     content {
-      enable_components = var.logging_enabled_components
+      enable_components = var.logging_service == "none" ? [] : var.logging_enabled_components
     }
   }
 
diff --git a/modules/beta-private-cluster-update-variant/main.tf b/modules/beta-private-cluster-update-variant/main.tf
@@ -79,7 +79,7 @@ locals {
   default_auto_upgrade = var.regional || var.release_channel != "UNSPECIFIED" ? true : false
 
   cluster_subnet_cidr       = var.add_cluster_firewall_rules ? data.google_compute_subnetwork.gke_subnetwork[0].ip_cidr_range : null
-  cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range) : range.range_name => range.ip_cidr_range } : {}
+  cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(coalesce(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range, [])) : range.range_name => range.ip_cidr_range } : {}
   pod_all_ip_ranges         = var.add_cluster_firewall_rules ? compact(concat([local.cluster_alias_ranges_cidr[var.ip_range_pods]], [for range in var.additional_ip_range_pods : local.cluster_alias_ranges_cidr[range] if length(range) > 0], [for k, v in merge(local.node_pools, local.windows_node_pools) : local.cluster_alias_ranges_cidr[v.pod_range] if length(lookup(v, "pod_range", "")) > 0])) : []
 
   cluster_network_policy = var.network_policy ? [{
@@ -90,7 +90,8 @@ locals {
     provider = null
   }]
   cluster_gce_pd_csi_config       = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]
-  logmon_config_is_set            = length(var.logging_enabled_components) > 0 || length(var.monitoring_enabled_components) > 0 || var.monitoring_enable_managed_prometheus != null
+  logging_config_is_set           = var.logging_service == "none" || length(var.logging_enabled_components) > 0
+  logmon_config_is_set            = local.logging_config_is_set || length(var.monitoring_enabled_components) > 0 || var.monitoring_enable_managed_prometheus != null
   gcs_fuse_csi_driver_config      = var.gcs_fuse_csi_driver ? [{ enabled = true }] : []
   parallelstore_csi_driver_config = var.parallelstore_csi_driver != null ? [{ enabled = var.parallelstore_csi_driver }] : []
   gke_backup_agent_config         = var.gke_backup_agent_config ? [{ enabled = true }] : [{ enabled = false }]
diff --git a/modules/beta-private-cluster/cluster.tf b/modules/beta-private-cluster/cluster.tf
@@ -102,10 +102,10 @@ resource "google_container_cluster" "primary" {
     }
   }
   dynamic "logging_config" {
-    for_each = length(var.logging_enabled_components) > 0 ? [1] : []
+    for_each = local.logging_config_is_set ? [1] : []
 
     content {
-      enable_components = var.logging_enabled_components
+      enable_components = var.logging_service == "none" ? [] : var.logging_enabled_components
     }
   }
 
diff --git a/modules/beta-private-cluster/main.tf b/modules/beta-private-cluster/main.tf
@@ -79,7 +79,7 @@ locals {
   default_auto_upgrade = var.regional || var.release_channel != "UNSPECIFIED" ? true : false
 
   cluster_subnet_cidr       = var.add_cluster_firewall_rules ? data.google_compute_subnetwork.gke_subnetwork[0].ip_cidr_range : null
-  cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range) : range.range_name => range.ip_cidr_range } : {}
+  cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(coalesce(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range, [])) : range.range_name => range.ip_cidr_range } : {}
   pod_all_ip_ranges         = var.add_cluster_firewall_rules ? compact(concat([local.cluster_alias_ranges_cidr[var.ip_range_pods]], [for range in var.additional_ip_range_pods : local.cluster_alias_ranges_cidr[range] if length(range) > 0], [for k, v in merge(local.node_pools, local.windows_node_pools) : local.cluster_alias_ranges_cidr[v.pod_range] if length(lookup(v, "pod_range", "")) > 0])) : []
 
   cluster_network_policy = var.network_policy ? [{
@@ -90,7 +90,8 @@ locals {
     provider = null
   }]
   cluster_gce_pd_csi_config       = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]
-  logmon_config_is_set            = length(var.logging_enabled_components) > 0 || length(var.monitoring_enabled_components) > 0 || var.monitoring_enable_managed_prometheus != null
+  logging_config_is_set           = var.logging_service == "none" || length(var.logging_enabled_components) > 0
+  logmon_config_is_set            = local.logging_config_is_set || length(var.monitoring_enabled_components) > 0 || var.monitoring_enable_managed_prometheus != null
   gcs_fuse_csi_driver_config      = var.gcs_fuse_csi_driver ? [{ enabled = true }] : []
   parallelstore_csi_driver_config = var.parallelstore_csi_driver != null ? [{ enabled = var.parallelstore_csi_driver }] : []
   gke_backup_agent_config         = var.gke_backup_agent_config ? [{ enabled = true }] : [{ enabled = false }]
diff --git a/modules/beta-public-cluster-update-variant/cluster.tf b/modules/beta-public-cluster-update-variant/cluster.tf
@@ -102,10 +102,10 @@ resource "google_container_cluster" "primary" {
     }
   }
   dynamic "logging_config" {
-    for_each = length(var.logging_enabled_components) > 0 ? [1] : []
+    for_each = local.logging_config_is_set ? [1] : []
 
     content {
-      enable_components = var.logging_enabled_components
+      enable_components = var.logging_service == "none" ? [] : var.logging_enabled_components
     }
   }
 
diff --git a/modules/beta-public-cluster-update-variant/main.tf b/modules/beta-public-cluster-update-variant/main.tf
@@ -79,7 +79,7 @@ locals {
   default_auto_upgrade = var.regional || var.release_channel != "UNSPECIFIED" ? true : false
 
   cluster_subnet_cidr       = var.add_cluster_firewall_rules ? data.google_compute_subnetwork.gke_subnetwork[0].ip_cidr_range : null
-  cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range) : range.range_name => range.ip_cidr_range } : {}
+  cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(coalesce(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range, [])) : range.range_name => range.ip_cidr_range } : {}
   pod_all_ip_ranges         = var.add_cluster_firewall_rules ? compact(concat([local.cluster_alias_ranges_cidr[var.ip_range_pods]], [for range in var.additional_ip_range_pods : local.cluster_alias_ranges_cidr[range] if length(range) > 0], [for k, v in merge(local.node_pools, local.windows_node_pools) : local.cluster_alias_ranges_cidr[v.pod_range] if length(lookup(v, "pod_range", "")) > 0])) : []
 
   cluster_network_policy = var.network_policy ? [{
@@ -90,7 +90,8 @@ locals {
     provider = null
   }]
   cluster_gce_pd_csi_config       = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]
-  logmon_config_is_set            = length(var.logging_enabled_components) > 0 || length(var.monitoring_enabled_components) > 0 || var.monitoring_enable_managed_prometheus != null
+  logging_config_is_set           = var.logging_service == "none" || length(var.logging_enabled_components) > 0
+  logmon_config_is_set            = local.logging_config_is_set || length(var.monitoring_enabled_components) > 0 || var.monitoring_enable_managed_prometheus != null
   gcs_fuse_csi_driver_config      = var.gcs_fuse_csi_driver ? [{ enabled = true }] : []
   parallelstore_csi_driver_config = var.parallelstore_csi_driver != null ? [{ enabled = var.parallelstore_csi_driver }] : []
   gke_backup_agent_config         = var.gke_backup_agent_config ? [{ enabled = true }] : [{ enabled = false }]
diff --git a/modules/beta-public-cluster/cluster.tf b/modules/beta-public-cluster/cluster.tf
@@ -102,10 +102,10 @@ resource "google_container_cluster" "primary" {
     }
   }
   dynamic "logging_config" {
-    for_each = length(var.logging_enabled_components) > 0 ? [1] : []
+    for_each = local.logging_config_is_set ? [1] : []
 
     content {
-      enable_components = var.logging_enabled_components
+      enable_components = var.logging_service == "none" ? [] : var.logging_enabled_components
     }
   }
 
diff --git a/modules/beta-public-cluster/main.tf b/modules/beta-public-cluster/main.tf
@@ -79,7 +79,7 @@ locals {
   default_auto_upgrade = var.regional || var.release_channel != "UNSPECIFIED" ? true : false
 
   cluster_subnet_cidr       = var.add_cluster_firewall_rules ? data.google_compute_subnetwork.gke_subnetwork[0].ip_cidr_range : null
-  cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range) : range.range_name => range.ip_cidr_range } : {}
+  cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(coalesce(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range, [])) : range.range_name => range.ip_cidr_range } : {}
   pod_all_ip_ranges         = var.add_cluster_firewall_rules ? compact(concat([local.cluster_alias_ranges_cidr[var.ip_range_pods]], [for range in var.additional_ip_range_pods : local.cluster_alias_ranges_cidr[range] if length(range) > 0], [for k, v in merge(local.node_pools, local.windows_node_pools) : local.cluster_alias_ranges_cidr[v.pod_range] if length(lookup(v, "pod_range", "")) > 0])) : []
 
   cluster_network_policy = var.network_policy ? [{
@@ -90,7 +90,8 @@ locals {
     provider = null
   }]
   cluster_gce_pd_csi_config       = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]
-  logmon_config_is_set            = length(var.logging_enabled_components) > 0 || length(var.monitoring_enabled_components) > 0 || var.monitoring_enable_managed_prometheus != null
+  logging_config_is_set           = var.logging_service == "none" || length(var.logging_enabled_components) > 0
+  logmon_config_is_set            = local.logging_config_is_set || length(var.monitoring_enabled_components) > 0 || var.monitoring_enable_managed_prometheus != null
   gcs_fuse_csi_driver_config      = var.gcs_fuse_csi_driver ? [{ enabled = true }] : []
   parallelstore_csi_driver_config = var.parallelstore_csi_driver != null ? [{ enabled = var.parallelstore_csi_driver }] : []
   gke_backup_agent_config         = var.gke_backup_agent_config ? [{ enabled = true }] : [{ enabled = false }]
diff --git a/modules/private-cluster-update-variant/cluster.tf b/modules/private-cluster-update-variant/cluster.tf
@@ -96,10 +96,10 @@ resource "google_container_cluster" "primary" {
   min_master_version = var.release_channel == null || var.release_channel == "UNSPECIFIED" ? local.master_version : var.kubernetes_version == "latest" ? null : var.kubernetes_version
 
   dynamic "logging_config" {
-    for_each = length(var.logging_enabled_components) > 0 ? [1] : []
+    for_each = local.logging_config_is_set ? [1] : []
 
     content {
-      enable_components = var.logging_enabled_components
+      enable_components = var.logging_service == "none" ? [] : var.logging_enabled_components
     }
   }
 
diff --git a/modules/private-cluster-update-variant/main.tf b/modules/private-cluster-update-variant/main.tf
@@ -79,7 +79,7 @@ locals {
   default_auto_upgrade = var.regional || var.release_channel != "UNSPECIFIED" ? true : false
 
   cluster_subnet_cidr       = var.add_cluster_firewall_rules ? data.google_compute_subnetwork.gke_subnetwork[0].ip_cidr_range : null
-  cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range) : range.range_name => range.ip_cidr_range } : {}
+  cluster_alias_ranges_cidr = var.add_cluster_firewall_rules ? { for range in toset(coalesce(data.google_compute_subnetwork.gke_subnetwork[0].secondary_ip_range, [])) : range.range_name => range.ip_cidr_range } : {}
   pod_all_ip_ranges         = var.add_cluster_firewall_rules ? compact(concat([local.cluster_alias_ranges_cidr[var.ip_range_pods]], [for range in var.additional_ip_range_pods : local.cluster_alias_ranges_cidr[range] if length(range) > 0], [for k, v in merge(local.node_pools, local.windows_node_pools) : local.cluster_alias_ranges_cidr[v.pod_range] if length(lookup(v, "pod_range", "")) > 0])) : []
 
   cluster_network_policy = var.network_policy ? [{
@@ -90,7 +90,8 @@ locals {
     provider = null
   }]
   cluster_gce_pd_csi_config       = var.gce_pd_csi_driver ? [{ enabled = true }] : [{ enabled = false }]
-  logmon_config_is_set            = length(var.logging_enabled_components) > 0 || length(var.monitoring_enabled_components) > 0 || var.monitoring_enable_managed_prometheus != null
+  logging_config_is_set           = var.logging_service == "none" || length(var.logging_enabled_components) > 0
+  logmon_config_is_set            = local.logging_config_is_set || length(var.monitoring_enabled_components) > 0 || var.monitoring_enable_managed_prometheus != null
   gcs_fuse_csi_driver_config      = var.gcs_fuse_csi_driver ? [{ enabled = true }] : []
   parallelstore_csi_driver_config = var.parallelstore_csi_driver != null ? [{ enabled = var.parallelstore_csi_driver }] : []
   gke_backup_agent_config         = var.gke_backup_agent_config ? [{ enabled = true }] : [{ enabled = false }]
diff --git a/modules/private-cluster/cluster.tf b/modules/private-cluster/cluster.tf
@@ -96,10 +96,10 @@ resource "google_container_cluster" "primary" {
   min_master_version = var.release_channel == null || var.release_channel == "UNSPECIFIED" ? local.master_version : var.kubernetes_version == "latest" ? null : var.kubernetes_version
 
   dynamic "logging_config" {
-    for_each = length(var.logging_enabled_components) > 0 ? [1] : []
+    for_each = local.logging_config_is_set ? [1] : []
 
     content {
-      enable_components = var.logging_enabled_components
+      enable_components = var.logging_service == "none" ? [] : var.logging_enabled_components
     }
   }
 
diff --git a/modules/private-cluster/main.tf b/modules/private-cluster/main.tf

Original file line number	Diff line number	Diff line change
`@@ -110,10 +110,10 @@ resource "google_container_cluster" "primary" {`
`110`	`110`	`}`
`111`	`111`	`{% endif %}`
`112`	`112`	`dynamic "logging_config" {`
`113`		`- for_each = length(var.logging_enabled_components) > 0 ? [1] : []`
	`113`	`+ for_each = local.logging_config_is_set ? [1] : []`
`114`	`114`
`115`	`115`	`content {`
`116`		`- enable_components = var.logging_enabled_components`
	`116`	`+ enable_components = var.logging_service == "none" ? [] : var.logging_enabled_components`
`117`	`117`	`}`
`118`	`118`	`}`
`119`	`119`
Original file line number	Diff line number	Diff line change
`@@ -102,10 +102,10 @@ resource "google_container_cluster" "primary" {`
`102`	`102`	`}`
`103`	`103`	`}`
`104`	`104`	`dynamic "logging_config" {`
`105`		`- for_each = length(var.logging_enabled_components) > 0 ? [1] : []`
	`105`	`+ for_each = local.logging_config_is_set ? [1] : []`
`106`	`106`
`107`	`107`	`content {`
`108`		`- enable_components = var.logging_enabled_components`
	`108`	`+ enable_components = var.logging_service == "none" ? [] : var.logging_enabled_components`
`109`	`109`	`}`
`110`	`110`	`}`
`111`	`111`