[renovate-bot]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
google (source)	required_provider	major	7.16.0 → 8.9.0

---

Release Notes

hashicorp/terraform-provider-google (google)

v8.9.0

Compare Source

NOTES:

• compute: updated google_compute_disk, google_compute_region_disk, and google_compute_snapshot to fail at plan time instead of recreating the resource when removing the KMS key, or changing it while kms_key_service_account is set (#​30059)

DEPRECATIONS:

• container: deprecated addons_config.parallelstore_csi_driver_config on google_container_cluster. Use addons_config.lustre_csi_driver_config instead (#​30328)
• container: deprecated remove_default_node_pool on google_container_cluster in favor of omitting initial_node_count and node_config (or setting initial_node_count = 0). When this is set to true and the default node pool was not created, this will do a noop. (#​30375)
• parallelstore: deprecated google_parallelstore_instance. Use google_lustre_instance instead (#​30328)

FEATURES:

• New Data Source: google_agent_identity_auth_provider_iam_policy (#​30327)
• New Resource: google_agent_identity_auth_provider_iam_binding (#​30327)
• New Resource: google_agent_identity_auth_provider_iam_member (#​30327)
• New Resource: google_agent_identity_auth_provider_iam_policy (#​30327)
• New Resource: google_bigtable_memory_layer (#​30314)
• New Resource: google_dataflow_flex_template_job (#​30318)
• New Resource: google_network_services_service_lb_policies (#​30223)
• New Resource: google_resource_manager_boundary (#​30257)
• New Resource: google_resource_manager_boundary_config (#​30257)
• New Resource: google_vertex_ai_custom_job (#​30220)
• New Resource: google_vertex_ai_pipeline_job (#​30201)
• New Resource: google_vertex_ai_rag_file (#​30272)

IMPROVEMENTS:

• agenticapplications: added artifacts_config.audit_trail_export_options field to google_agentic_applications_analyst_agent_persona resource (#​30227)
• bigqueryconnection: added salesforce_data_cloud field to google_bigquery_connection resource (#​30356)
• bigqueryreservation: added scheduling_policy field to google_bigquery_reservation and google_bigquery_reservation_assignment resources (#​30065)
• bigtable: added standard_isolation.memory_config field to google_bigtable_app_profile resource (#​30368)
• cloudbuild: added worker_config.worker_release field to google_cloudbuild_worker_pool resource (#​30315)
• cloudbuild: increased default create, update, and delete timeouts for google_cloudbuild_worker_pool from 20 minutes to 120 minutes (#​30079)
• colab: added workbench_runtime.custom_container_image and kernel_name fields to google_colab_notebook_execution resource (#​30219)
• compute: added address_id attribute for google_compute_address data source (#​30316)
• compute: added FORCE deletion_policy support to google_compute_instance_group_manager and google_compute_region_instance_group_manager (#​30058)
• compute: added IDPF and SUSPEND_SAFE_FPR to guest_os_features.type in google_compute_region_disk and SUSPEND_SAFE_FPR in google_compute_image (#​30047)
• compute: added ipv6_address field to google_compute_network_endpoint (#​30317)
• compute: added ipv6_address field to google_compute_network_endpoints (#​30371)
• compute: added params.resource_manager_tags field to google_compute_network_edge_security_service resource (#​30218)
• compute: added in-place updates when adding disk_encryption_key.kms_key_self_link to google_compute_disk, disk_encryption_key.kms_key_name to google_compute_region_disk, and snapshot_encryption_key.kms_key_self_link to google_compute_snapshot when the resource has no key (#​30059)
• compute: added server generated id as firewall_id to google_compute_firewall (#​30367)
• compute: added server generated id as router_id to google_compute_router (#​30367)
• compute: added server generated id as service_attachment_id to google_compute_service_attachment (#​30367)
• compute: allowed updating provisioned_iops and provisioned_throughput in place on google_compute_instance hyperdisk boot disks instead of recreating the instance (#​30334)
• compute: promoted instance_flexibility_policy.instance_selections.min_cpu_platform and instance_flexibility_policy.instance_selections.disks to GA in google_compute_region_instance_group_manager (#​30162)
• compute: promoted mirror_percent in request_mirror_policy to GA for google_compute_url_map and google_compute_region_url_map (#​30224)
• container: added default_image_type and valid_image_types fields to google_container_engine_versions data source (#​30243)
• container: added support for SHORT_LIVED value to node_pool.upgrade_settings.strategy in google_container_cluster and upgrade_settings.strategy in google_container_node_pool (#​30322)
• container: promoted schedule_upgrade_config to GA in google_container_cluster (#​30254)
• container: updated google_container_cluster to support creating clusters without a default node pool when initial_node_count and node_config are omitted (or initial_node_count is set to 0). When remove_default_node_pool = true and the default node pool was not created, remove_default_node_pool will do a noop. (#​30375)
• container: updated initial_node_count on google_container_cluster so it can be removed from config or set to null without creating a diff while still respecting 0 when set in config (#​30375)
• dataproc: added cluster_config.master_flexible_config, cluster_config.worker_flexible_config, and cluster_config.secondary_worker_flexible_config fields to google_dataproc_cluster resource (#​30372)
• discoveryengine: added model_configs field to google_discovery_engine_search_engine resource (#​30319)
• discoveryengine: fixed google_discovery_engine_target_site operations by increasing timeout to 24hrs (#​30246)
• dlp: added FILE_STORE_PROFILE as an accepted detail_of_message value in google_data_loss_prevention_discovery_config (#​30161)
• geminidataanalytics: added datasource_references.bq.property_graph_references, datasource_references.bq.table_references.schema, datasource_references.looker.explore_references, datasource_references.studio.studio_references, example_queries.parameters, looker_golden_queries, options.model, and user_functions.bq_routines fields to published_context and staging_context in google_gemini_data_analytics_data_agent resource (#​30320)
• networksecurity: promoted wildfire_analysis_profile field to GA on google_network_security_security_profile_group resource (#​30198)
• networksecurity: promoted wildfire_analysis_profile to GA on google_network_security_security_profile resource (#​30198)
• networksecurity: promoted wildfire_settings and endpoint_settings.content_cloud_region, endpoint_settings.http_partial_response_blocked fields to GA on google_network_security_firewall_endpoint resource (#​30198)
• networkservices: increased default create, update, and delete timeouts from 20m to 30m for google_network_services_multicast_consumer_association, google_network_services_multicast_domain, google_network_services_multicast_domain_activation, google_network_services_multicast_domain_group, google_network_services_multicast_group_consumer_activation, google_network_services_multicast_group_producer_activation, google_network_services_multicast_group_range, google_network_services_multicast_group_range_activation, and google_network_services_multicast_producer_association (#​30066)
• oracledatabase: added in-place update support for labels on google_oracle_database_cloud_exadata_infrastructure, google_oracle_database_cloud_vm_cluster, google_oracle_database_exascale_db_storage_vault, google_oracle_database_db_system, google_oracle_database_odb_subnet, google_oracle_database_goldengate_deployment, google_oracle_database_goldengate_connection, google_oracle_database_goldengate_connection_assignment and google_oracle_database_autonomous_database (#​30213)
• oracledatabase: added support for setting properties.scan_listener_port_tcp and properties.scan_listener_port_tcp_ssl on google_oracle_database_cloud_vm_cluster creation (#​30202)
• recaptchaenterprise: added express_settings and universal_settings fields to google_recaptcha_enterprise_key resource (#​30164)
• vertexai: added metadata.config.algorithm_config.tree_ah_config.fraction_leaf_nodes_to_search field to google_vertex_ai_index resource (#​30323)

BUG FIXES:

• accesscontextmanager: added plan-time format validation and fixed a crash when perimeter_name, perimeter, access_level, egress_policy_name, or ingress_policy_name is not in the expected accessPolicies/{policy}/... format in google_access_context_manager_access_level_condition, google_access_context_manager_egress_policy, google_access_context_manager_ingress_policy, google_access_context_manager_service_perimeter_dry_run_egress_policy, google_access_context_manager_service_perimeter_dry_run_ingress_policy, google_access_context_manager_service_perimeter_dry_run_resource, google_access_context_manager_service_perimeter_egress_policy, google_access_context_manager_service_perimeter_ingress_policy, and google_access_context_manager_service_perimeter_resource (#​30332)
• agenticapplications: fixed a bug where mcp_data_sources.0.api_key and mcp_data_sources.0.client_secret were attempting to read from the API in google_agentic_applications_analyst_agent_persona (#​30042)
• alloydb: fixed an issue where google_alloydb_instance operations could fail with a 400 or 409 error when the instance is temporarily undergoing another update operation or unable to queue the operation (#​30265)
• apigee: fixed a crash when importing google_apigee_endpoint_attachment (#​30330)
• ces: fixed an eventual consistency error when deleting google_ces_app_version immediately after google_ces_deployment (#​30331)
• cloudrun: fixed Provider produced inconsistent final plan when metadata.0.labels or metadata.0.annotations contains unknown values in google_cloud_run_service and google_cloud_run_domain_mapping (#​30270)
• colab: fixed google_colab_runtime and google_colab_notebook_execution failures when the subnetwork is not ready during operation execution (#​30269)
• compute: fixed google_compute_instance boot disk updates not setting the user project header correctly when user_project_override is enabled (#​30334)
• compute: fixed google_compute_reservation, data.google_compute_reservation_block, and data.google_compute_reservation_sub_block to respect compute_custom_endpoint when querying reservation blocks and sub-blocks (#​30045)
• compute: fixed resourceNotReady errors across Compute Engine resources by retrying HTTP 400 resourceNotReady responses globally (#​30215)
• compute: fixed a bug where google_compute_instance_group_manager ignored the PREVENT deletion_policy (#​30058)
• compute: increased default create, update, and delete timeouts from 20m to 30m on google_compute_snapshot_settings (#​30072)
• compute: updated google_compute_disk, google_compute_region_disk, and google_compute_snapshot to reject a KMS key with a /cryptoKeyVersions/ suffix at plan time instead of recreating the resource on every apply (#​30046)
• container: fixed a crash when empty configuration blocks such as node_config {} are specified on google_container_cluster or google_container_node_pool, or blocks with zero values are specified like authenticator_groups_config {} (#​30252)
• dataproc: fixed google_dataproc_cluster creation failures when the subnetwork is not ready during cluster provisioning (#​30269)
• dataproc: fixed creation and update failures when a referenced Compute Engine resource is not ready yet (#​30312)
• datastream: fixed a permadiff on mongodb_profile.secret_manager_stored_password and mongodb_profile.password in google_datastream_connection_profile (#​30044)
• firebaseapphosting: fixed spurious diff on google_firebase_app_hosting_domain create by polling until configuration is materialized (#​30225)
• gkehub: fixed an issue that prevented spec.workloadidentity and spec.fleetobservability from being set to empty blocks in google_gke_hub_feature (#​30244)
• healthcare: fixed an issue where google_healthcare_dataset creation did not wait for the create long-running operation and could fail after 5 minutes with Root object was present, but now absent (#​30199)
• networksecurity: increased default create, update, and delete timeouts from 20m to 60m on google_network_security_firewall_endpoint_association (#​30071)
• networkservices: increased default create, update, and delete timeouts from 20m to 60m on google_network_services_multicast_domain_activation (#​30070)
• provider: fixed a bug where google_apikeys_key, google_assured_workloads_workload, google_cloudbuild_worker_pool, google_clouddeploy_delivery_pipeline, google_clouddeploy_target, google_container_aws_cluster, google_container_aws_node_pool, google_container_azure_client, google_container_azure_cluster, google_container_azure_node_pool, google_dataplex_asset, google_dataplex_lake, google_dataplex_zone, google_dataproc_workflow_template, google_firebaserules_release, google_firebaserules_ruleset, google_gke_hub_feature_membership, and google_recaptcha_enterprise_key were removed from state on read errors (#​30258)
• provider: fixed a bug where google_apikeys_key, google_assured_workloads_workload, google_cloudbuild_worker_pool, google_clouddeploy_delivery_pipeline, google_clouddeploy_target, google_container_aws_cluster, google_container_aws_node_pool, google_container_azure_client, google_container_azure_cluster, google_container_azure_node_pool, google_dataplex_asset, google_dataplex_lake, google_dataplex_zone, google_dataproc_workflow_template, google_firebaserules_release, google_firebaserules_ruleset, google_gke_hub_feature_membership, and google_recaptcha_enterprise_key were removed from state when an update or delete failed (#​30156)
• provider: fixed a bug where google_compute_firewall_policy_association, google_compute_firewall_policy_rule, google_compute_organization_security_policy_association, google_compute_organization_security_policy_rule, google_endpoints_service, google_logging_billing_account_bucket_config, google_logging_folder_bucket_config, google_logging_organization_bucket_config, google_logging_project_bucket_config, and google_service_networking_vpc_service_controls were removed from state when read, update, or delete operations failed (#​30261)
• provider: fixed an unbound retry in IAM writes when hitting API quotas (429 error). Now, IAM read-modify-writes will exponentially backoff, and terminate (#​30057)
• provider: removed an extra sleep on IAM writes while several concurrent changes are happening, backoff and terminate for a longer window (90s + grace period) (#​30057)
• sql: fixed issue where creating SQL Server Entra ID users (google_sql_user with type = "ENTRAID_USER") failed state refresh due to username domain truncation (#​30229)
• vertexai: fixed an issue where GOOGLE_CLOUD_AGENT_ENGINE_ENABLE_TELEMETRY environment variable in google_vertex_ai_reasoning_engine was ignored in state when explicitly configured (#​30221)
• workbench: fixed google_workbench_instance creation and update failures when the subnetwork is not ready during operation execution (#​30269)

v8.8.1

Compare Source

NOTES:

• Updated to Go 1.26.10 for security fixes to the crypto/x509 package described under https://github.com/golang/go/issues?q=milestone%3AGo1.26.10+label%3ACherryPickApproved

v8.8.0

Compare Source

FEATURES:

• New Data Source: google_cloud_run_v2_instance_iam_policy (#​29991)
• New Resource: google_cloud_run_v2_instance (#​29991)
• New Resource: google_cloud_run_v2_instance_iam_binding (#​29991)
• New Resource: google_cloud_run_v2_instance_iam_member (#​29991)
• New Resource: google_cloud_run_v2_instance_iam_policy (#​29991)
• New Resource: google_dns_outbound_endpoint (#​30018)
• New Resource: google_document_ai_schema_version (#​29915)

IMPROVEMENTS:

• accesscontextmanager: added scoped_access_settings.scope.client_scope.restricted_project and principal.federated_principal fields to google_access_context_manager_gcp_user_access_binding resource (#​29964)
• ces: added data_store_tool.modality_configs.rewriter_config.model_settings.thinking_level and data_store_tool.modality_configs.summarization_config.model_settings.thinking_level fields to google_ces_tool resource (#​29974)
• ces: added data_store_tool.modality_configs.snippets_config.max_snippets field to google_ces_tool resource (#​29988)
• ces: added llm_policy.model_settings.thinking_level and llm_prompt_security.custom_policy.model_settings.thinking_level fields to google_ces_guardrail resource (#​29953)
• ces: added model_settings.thinking_level field to google_ces_app resource (#​29949)
• ces: added remote_agent_tool.input_variable_mapping, remote_agent_tool.output_variable_mapping, and remote_agent_tool.stateful_agent fields to google_ces_tool resource (#​29966)
• cloudsecuritycompliance: added update support for google_cloud_security_compliance_framework_deployment (#​29919)
• compute: promoted preconfigured_waf_config.exclusion.request_body field to GA for google_compute_security_policy_rule and google_compute_region_security_policy_rule, rule.preconfigured_waf_config.exclusion.request_body for google_compute_security_policy, and rules.preconfigured_waf_config.exclusion.request_body for google_compute_region_security_policy (#​29920)
• container: added MICROVM support to node_config.sandbox_config.type in google_container_cluster and google_container_node_pool (#​29985)
• container: promoted managed_opentelemetry_config field on google_container_cluster to GA (#​29962)
• dialogflow: added stt_config.use_gemini_asr and stt_config.gemini_asr_config fields to google_dialogflow_conversation_profile resource (#​29950)
• dns: added alternative_name_server_config.outbound_endpoints field to google_dns_policy resource (#​30023)
• dns: added forwarding_config.outbound_endpoints field to google_dns_managed_zone resource (#​30023)
• gemini: added gemini_enterprise_project and release_channel fields to google_gemini_gemini_gcp_enablement_setting resource (#​29986)
• managedkafka: increased the update timeout of google_managed_kafka_cluster to 150 minutes (#​29997)
• memorystore: added TOKEN_AUTH value and update support for authorization_mode on google_memorystore_instance resource (#​30014)
• networkconnectivity: promoted hub, psc_routing_enabled, and auto_accept fields on google_network_connectivity_transport resource to GA (#​29968)
• privateca: added issuance_policy.allow_requester_specified_not_before_time field to google_privateca_ca_pool resource (#​29998)
• privateca: added requested_not_before_time field to google_privateca_certificate resource (#​29998)
• pubsub: added bigtable_config field to google_pubsub_subscription resource (#​30011)
• redis: added AUTH_MODE_TOKEN_AUTH value and update support for authorization_mode on google_redis_cluster resource (#​30014)
• securitycenter: added deletion_notifications_enabled field to google_scc_folder_notification_config resource (#​29970)
• securitycenter: added deletion_notifications_enabled field to google_scc_folder_scc_big_query_export resource (#​29970)
• securitycenter: added deletion_notifications_enabled field to google_scc_notification_config resource (#​29970)
• securitycenter: added deletion_notifications_enabled field to google_scc_organization_scc_big_query_export resource (#​29970)
• securitycenter: added deletion_notifications_enabled field to google_scc_project_notification_config resource (#​29970)
• securitycenter: added deletion_notifications_enabled field to google_scc_project_scc_big_query_export resource (#​29970)
• securitycenterv2: added deletion_notifications_enabled field to google_scc_v2_folder_notification_config resource (#​29970)
• securitycenterv2: added deletion_notifications_enabled field to google_scc_v2_folder_scc_big_query_export resource (#​29970)
• securitycenterv2: added deletion_notifications_enabled field to google_scc_v2_organization_notification_config resource (#​29970)
• securitycenterv2: added deletion_notifications_enabled field to google_scc_v2_organization_scc_big_query_export resource (#​29970)
• securitycenterv2: added deletion_notifications_enabled field to google_scc_v2_organization_scc_big_query_exports resource (#​29970)
• securitycenterv2: added deletion_notifications_enabled field to google_scc_v2_project_notification_config resource (#​29970)
• securitycenterv2: added deletion_notifications_enabled field to google_scc_v2_project_scc_big_query_export resource (#​29970)
• vectorsearch: added skip_wait field to google_vector_search_index resource (#​29994)
• vertexai: added resource_runtime_spec.ray_spec field to google_vertex_ai_persistent_resource resource (#​30020)
• vertexai: added support for updating resource_pools.replica_count in-place on google_vertex_ai_persistent_resource resource (#​30020)

BUG FIXES:

• compute: fixed an issue causing google_compute_region_backend_service update to fail when params.resource_manager_tags is set (#​29967)
• compute: fixed an issue where setting security_policy on google_compute_region_backend_service failed during creation when protocol was set to UDP (#​29972)
• container: fixed a permadiff on dns_config.cluster_dns in google_container_cluster when omitted, set to null, or set to PROVIDER_UNSPECIFIED (#​30021)
• container: fixed permadiff and update error on google_container_cluster when managed_opentelemetry_config is empty or managed_opentelemetry_config.scope is omitted (#​29962)
• discoveryengine: fixed json_schema forcing resource replacement on every change in google_discovery_engine_schema (#​29952)
• memorystore: fixed google_memorystore_instance update failures when multiple fields (such as node_type and engine_version) are changed in the same apply (#​29989)

v8.7.0

Compare Source

DEPRECATIONS:

• dataproc: deprecated attached_disk_config.disk_type on google_dataproc_cluster and google_dataproc_workflow_template. Use attached_disk_config.type instead. (#​29870)

FEATURES:

• New Data Source: google_gemini_data_analytics_data_agent_iam_policy (#​29775)
• New Resource: google_gemini_data_analytics_data_agent (#​29775)
• New Resource: google_gemini_data_analytics_data_agent_iam_binding (#​29775)
• New Resource: google_gemini_data_analytics_data_agent_iam_member (#​29775)
• New Resource: google_gemini_data_analytics_data_agent_iam_policy (#​29775)
• New Resource: google_vertex_ai_online_evaluator (#​29810)

IMPROVEMENTS:

• bigqueryanalyticshub: added encryption_configuration field to google_bigquery_analytics_hub_query_template resource (#​29869)
• ces: added model_settings.thinking_level field to google_ces_agent resource (#​29778)
• cloudsecuritycompliance: added nested parameter_spec fields (oneof_value and sub_parameters) to google_cloud_security_compliance_cloud_control (#​29812)
• compute: added network_interface.service_class_id field to google_compute_instance, google_compute_instance_template, and google_compute_region_instance_template resources (#​29821)
• compute: made disk_encryption_key.kms_key_name updatable in place in google_compute_region_disk (#​29833)
• compute: made snapshot_encryption_key.kms_key_self_link updatable in place in google_compute_snapshot (#​29815)
• compute: promoted scheduling.preemption_notice_duration field to GA for google_compute_instance, google_compute_instance_template, google_compute_region_instance_template, and google_compute_instance_from_template resources (#​29814)
• container: added best_effort_provisioning field to google_container_node_pool resource (#​29771)
• container: added node_pool.best_effort_provisioning field to google_container_cluster resource (#​29771)
• dataproc: added attached_disk_config.type field to google_dataproc_cluster resource (#​29870)
• dataproc: added attached_disk_config.type field to google_dataproc_workflow_template resource (#​29870)
• dialogflow: added free_form_context, agent_coaching_context, and tools fields to google_dialogflow_generator (#​29777)
• looker: added support for Regional Endpoint Policies (REP). See the provider reference for more details on configuration. (#​29811)
• modelarmor: added modalities to template_metadata in google_model_armor_template (#​29774)
• networksecurity: added missing matchers ignore_case, prefix, suffix and contains on network_rules for google_network_security_authz_policy resource (#​29865)
• networksecurity: added nested field to.not_operations on network_rules for google_network_security_authz_policy resource (#​29865)
• networksecurity: added nested fields from.sources.resources and from.not_sources.resources on network_rules for google_network_security_authz_policy resource (#​29865)
• networkservices: added agent_compute and deployment_model fields to google_network_services_agent_connectivity_template resource (#​29817)
• networkservices: removed client-side validation of flex_shielding.flex_shielding_regions in google_network_services_edge_cache_origin, so new regions such as EUROPE_WEST3 and US_EAST5 are now accepted (#​29825)
• oracledatabase: added properties.vm_file_system_storage_type and properties.vm_backup_storage_type fields to google_oracle_database_cloud_vm_cluster resource (#​29776)
• workbench: added disable-bigquery, enable-opencode, enable-opencode-web, and enable-antigravity to the metadata keys that trigger a stop/restart of a google_workbench_instance on update, since they only take effect at startup (#​29864)

BUG FIXES:

• cloudsecuritycompliance: fixed ExactlyOneOf validation between organization and parent on google_cloud_security_compliance_cloud_control (#​29822)
• cloudsecuritycompliance: fixed ExactlyOneOf validation between organization and parent on google_cloud_security_compliance_framework (#​29822)
• cloudsecuritycompliance: fixed ExactlyOneOf validation between organization and parent on google_cloud_security_compliance_framework_deployment (#​29822)
• compute: fixed google_compute_subnetwork to recreate the subnetwork when changing ipv6_access_type, ip_collection, or external_ipv6_prefix unless stack_type is being upgraded from IPV4_ONLY to IPV4_IPV6, as the API does not allow in-place updates for these fields in other cases (#​29773)
• compute: fixed a permanent diff in google_compute_backend_service and google_compute_region_backend_service when cdn_policy.client_ttl or cdn_policy.default_ttl is set to 0 (#​29837)
• compute: fixed an issue where google_compute_forwarding_rule was not recreated when its referenced google_compute_address was recreated (#​29866)
• compute: fixed an issue where security_policy was not attached on initial create for google_compute_region_backend_service in the GA provider (#​29839)
• compute: reduced likelihood of name collisions when using a long name_prefix on google_compute_instance_template, google_compute_region_instance_template, google_compute_region_ssl_certificate, and google_compute_ssl_certificate (#​29841)
• container: fixed a bug where updating maintenance_policy on google_container_node_pool was not applied (#​29838)
• container: reduced likelihood of name collisions when using a long name_prefix on google_container_node_pool and google_container_cluster.node_pool (#​29841)
• dataproc: fixed confidential_instance_config.enable_confidential_compute and resource_manager_tags state drift on google_dataproc_cluster (#​29870)
• discoveryengine: fixed json_params updates not taking effect on google_discovery_engine_data_connector (#​29827)
• filestore: fixed ExactlyOneOf validation between location and zone on google_filestore_instance (#​29822)
• sql: fixed Invalid maintenance window. Day of week is unspecified. error when creating or updating google_sql_database_instance with a settings.maintenance_window that sets update_track or hour without day (#​29863)
• sql: fixed permadiff on settings.deny_maintenance_period.start_date and settings.deny_maintenance_period.end_date in google_sql_database_instance when using zero-padded or recurring MM-DD dates (#​29823)
• workflows: reduced likelihood of name collisions when using a long name_prefix on google_workflows_workflow (#​29841)

v8.6.0

Compare Source

FEATURES:

• New Data Source: google_iam_workload_identity_pool_jwks (#​29669)
• New List Resource: google_gkebackup_backup_channel (#​29662)
• New List Resource: google_gkebackup_backup_plan (#​29662)
• New List Resource: google_gkebackup_restore_channel (#​29662)
• New List Resource: google_gkebackup_restore_plan (#​29662)
• New List Resource: google_storage_bucket_iam_member (#​29661)
• New Resource: google_dialogflow_tool (#​29749)

IMPROVEMENTS:

• agenticapplications: added mcp_data_sources.api_key_header, web_search_config.disabled, and artifacts_config.visualization_options.visualization_mode fields to google_agentic_applications_analyst_agent_persona resource (#​29720)
• agentregistry: made source optional in google_agent_registry_binding (#​29726)
• appengine: added oauth2_client_secret write-only field and oauth2_client_secret_wo_version field in google_app_engine_application resource (#​29724)
• ces: added audio_processing_config.synthesize_speech_configs.model and audio_processing_config.synthesize_speech_configs.instruction fields to google_ces_app resource (#​29747)
• compute: added IN_FLIGHT to balancing_mode on google_compute_region_backend_service resource (#​29719)
• compute: added network_interface.enable_vpc_scoped_dns field to google_compute_instance, google_compute_instance_template, and google_compute_region_instance_template resources (#​29751)
• compute: added path_matcher.route_rules.route_action.url_rewrite.regex_rewrite field to google_compute_region_url_map resource (#​29748)
• compute: added path_matcher.route_rules.route_action.url_rewrite.regex_rewrite field to google_compute_url_map resource (#​29750)
• compute: added request_body field to google_compute_region_security_policy_rules resource (#​29670)
• compute: added request_body field to google_compute_region_security_policy resource (#​29670)
• compute: added request_body field to google_compute_security_policy resource (#​29670)
• compute: added service_lb_policy field to google_compute_region_backend_service resource (#​29763)
• compute: added tls_settings.identity field to google_compute_backend_service and google_compute_region_backend_service resources (#​29743)
• compute: added loadBalancingScheme field to google_compute_target_tcp_proxy resource (#​29668)
• compute: added load_balancing_scheme field to google_compute_region_target_tcp_proxy resource (#​29744)
• compute: made disk_encryption_key.kms_key_self_link updatable in place in google_compute_disk (#​29762)
• compute: supported in-place updates for external_ipv6_prefix in google_compute_subnetwork (#​29725)
• databasemigrationservice: added reserved_public_ip_config field to google_database_migration_service_private_connection resource (#​29742)
• discoveryengine: added procurement_contact_emails field to google_discovery_engine_search_engine resource (#​29737)
• iam3: added target.resource field to google_iam_projects_policy_binding, google_iam_folders_policy_binding, and google_iam_organizations_policy_binding resources (#​29759)
• lustre: added target_version, available_version, and effective_version fields to google_lustre_instance resource (#​29764)
• managedkafka: added kafka_version field to google_managed_kafka_cluster resource (#​29735)
• networksecurity: added primary_ip_ranges field to google_network_security_ull_mirroring_collector_rule resource (#​29734)
• oracledatabase: added properties.exascale_config field to google_oracle_database_cloud_exadata_infrastructure resource (#​29761)
• oracledatabase: added total_vm_storage_size_gb field to google_oracle_database_cloud_exadata_infrastructure_exascale_config resource (#​29761)
• parametermanager: added data_crc32c field to google_parameter_manager_parameter_version and google_parameter_manager_regional_parameter_version resources (#​29658)
• securesourcemanager: added service_account_auth field to google_secure_source_manager_hook resource (#​29758)

BUG FIXES:

• servicedirectory: prevented recreation of google_service_directory_endpoint when the network project ID is canonicalized to a project number (#​29663)
• storage: fixed an inconsistent final plan issue for content field (#​29718)

v8.5.0

Compare Source

NOTES:

• compute: migrated the VPN tunnel lookup in google_compute_router_interface to use direct HTTP rather than a client library (#​29442)

DEPRECATIONS:

• firebaseailogic: deprecated generative_language_config and generative_language_config.api_key in google_firebase_ai_logic_config resource (#​29656)
• networkservices: egress_network_config.dns_peering_config.domain field in google_network_services_agent_connectivity_template is deprecated. Use egress_network_config.dns_peering_config.domains (#​29651)

FEATURES:

• New Data Source: google_network_services_gateway (#​29634)
• New List Resource: google_project_iam_binding (#​29631)
• New List Resource: google_secret_manager_secret_version (#​29654)
• New Resource: google_resource_manager_capability_config (#​29438)
• New Resource: google_vertex_ai_semantic_governance_policy (#​29649)

IMPROVEMENTS:

• agenticapplications: added math_rendering_mode and web_search_config fields to google_agentic_applications_analyst_agent_persona resource (#​29622)
• bigqueryconnection: added password_wo write-only field and password_wo_version field in google_bigquery_connection resource (#​29643)
• ces: added proactive_execution_enabled field to callbacks in google_ces_agent resource (#​29657)
• ces: added proactive_execution_enabled output fields to snapshot.agents callbacks in google_ces_app_version resource (#​29657)
• ces: added remote_a2a_agent field to google_ces_agent resource (#​29440)
• chronicle: added parallel_instance field to google_chronicle_environment resource (#​29444)
• cloudrunv2: added ssh_enabled field to google_cloud_run_v2_service resource (#​29645)
• cloudrunv2: promoted template.scaling.cpu_utilization and template.scaling.concurrency_utilization to GA in google_cloud_run_v2_service resource (#​29630)
• compute: added rsa_encryption_wo and raw_key_wo fields to google_compute_disk resource (#​29621)
• compute: added rsa_encryption_wo and raw_key_wo fields to google_compute_region_disk resource (#​29621)
• compute: added nat_ips_per_endpoint field to google_compute_service_attachment resource ([#​29648](https://redirect.

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.