Merge 6.0 branch into main

from commit '944e9f08dbb0cf0c6ac66ac41c1f0ef47b119d44'

.changelog/10274.txt

@@ -0,0 +1,6 @@
+```release-note:breaking-change
+container: removed deprecated field `advanced_datapath_observability_config.relay_mode` from `google_container_cluster` resource. Users are expected to use `enable_relay` field instead.
+```
+```release-note:breaking-change
+container: made field `advanced_datapath_observability_config.enable_relay` required in `google_container_cluster` resource
+```

.changelog/10313.txt

@@ -0,0 +1,9 @@
+```release-note:breaking-change
+vpcaccess: removed default values for `min_throughput` and `min_instances` fields on `google_vpc_access_connector` and made them default to values returned from the API when not provided by users
+```
+```release-note:breaking-change
+vpcaccess: added a conflicting fields restriction between `min_throughput` and `min_instances` fields on `google_vpc_access_connector`
+```
+```release-note:breaking-change
+vpcaccess: added a conflicting fields restriction between `max_throughput` and `max_instances` fields on `google_vpc_access_connector`
+```

.changelog/10367.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+redis: added a `deletion_protection_enabled` field with a default value of `true` to the `google_redis_cluster` resource
+```

.changelog/10897.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+compute: added fields `reserved_internal_range` and `secondary_ip_ranges[].reserved_internal_range` to `google_compute_subnetwork` resource
+```

.changelog/11023.txt

@@ -0,0 +1,3 @@
+```release-note:none
+
+```

.changelog/11038.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+pubsub: Allow `schema_settings` of `google_pubsub_topic` to be removed
+```

.changelog/11088.txt

@@ -0,0 +1,3 @@
+```release-note:none
+
+```

.changelog/11101.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+bigquery: added validation to prevent table view creation if schema contains required fields for `google_bigquery_table` resource
+```

.changelog/11117.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+compute: Updated default values  of `connection_draining_timeout_sec`, `balancing_mode` and `outlier_detection` in `google_compute_region_backend_service` and `google_compute_backend_service`.
+```

.changelog/11126.txt

@@ -0,0 +1,3 @@
+```release-note:none
+
+```

.changelog/11135.txt

@@ -0,0 +1,3 @@
+```release-note:none
+
+```

.changelog/11154.txt

@@ -0,0 +1,3 @@
+```release-note:deprecation
+sql: `settings.ip_configuration.require_ssl` is now deprecated within `google_sql_database_instance`. Please use `settings.ip_configuration.ssl_mode` instead.
+```

.changelog/11179.txt

@@ -0,0 +1,3 @@
+```release-note:none
+
+```

.changelog/11190.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+cloudrunv2: `liveness_probe` field in `google_cloud_run_v2_service` resource no longer has a default value from API side. Removing this field and applying the change will remove liveness probe from the Cloud Run service.
+```

.changelog/11199.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+cloudrunv2: retyped `containers.env` to SET from ARRAY for `google_cloud_run_v2_service` and `google_cloud_run_v2_job`.
+```

.changelog/11209.txt

@@ -0,0 +1,3 @@
+```release-note:none
+
+```

.changelog/11225.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+workstation: `host.gce_instance.disable_ssh` now defaults to true for `google_workstations_workstation_config`
+```

.changelog/11226.txt

@@ -0,0 +1,3 @@
+```release-note:note
+billing: updated resource id for `google_billing_project_info`
+```

.changelog/11237.txt

@@ -0,0 +1,3 @@
+```release-note:none
+
+```

.changelog/11240.txt

@@ -0,0 +1,3 @@
+```release-note:note
+compute: updated resource id for `compute_network_endpoints`
+```

.changelog/11255.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+resourcemanager: Make `deletion-policy` in `google_project` 'PREVENT' by default. This makes deleting them require an explicit intent. `google_project` resources cannot be destroyed unless `deletion_policy` is set to 'ABANDON' or 'NONE' for the resource.
+```

.changelog/11256.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+activeDirectory: added `deletion_protection` field to `google_active_directory_domain` to make deleting them require an explicit intent. `google_active_directory_domain` resources now cannot be destroyed unless `deletion_protection = false` is set for the resource.
+```

.changelog/11293.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+google_folders: added `deletion_protection` field to `folders` to make deleting them require an explicit intent. `folder` resources now cannot be destroyed unless `deletion_protection = false` is set for the resource.
+```

.changelog/11304.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+bigqueryreservation: remove `multi_region_auxiliary` from `google_bigquery_reservation`
+```

.changelog/11318.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+cloudrunv2: added `deletion_protection` field to `google_cloudrunv2_service` to make deleting them require an explicit intent. `google_cloudrunv2_service` resources now cannot be destroyed unless `deletion_protection = false` is set for the resource.
+```

.changelog/11320.txt

@@ -0,0 +1,9 @@
+```release-note:breaking-change
+container: three label-related fields are now in `google_container_cluster` resource. `resource_labels` field is non-authoritative and only manages the labels defined by the users on the resource through Terraform. The new output-only `terraform_labels` field merges the labels defined by the users on the resource through Terraform and the default labels configured on the provider. The new output-only `effective_labels` field lists all of labels present on the resource in GCP, including the labels configured through Terraform, the system, and other clients.
+```
+```release-note:breaking-change
+container: made three fields `resource_labels`, `terraform_labels`, and `effective_labels` be present in `google_container_cluster` datasources. All three fields will have all of labels present on the resource in GCP including the labels configured through Terraform, the system, and other clients, equivalent to `effective_labels` on the resource.
+```
+```release-note:breaking-change
+edgenetwork: three label-related fields are now in `google_edgenetwork_network ` and `google_edgenetwork_subnet` resources. `labels` field is non-authoritative and only manages the labels defined by the users on the resource through Terraform. The new output-only `terraform_labels` field merges the labels defined by the users on the resource through Terraform and the default labels configured on the provider. The new output-only `effective_labels` field lists all of labels present on the resource in GCP, including the labels configured through Terraform, the system, and other clients.
+```

.changelog/11329.txt

@@ -0,0 +1,3 @@
+```release-note:none
+
+```

.changelog/11354.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+identityplatform: removed resource `google_identity_platform_project_default_config` in favor of `google_identity_platform_project_config`
+```

.changelog/11356.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+storage: removed `no_age` field from  `lifecycle_rule.condition` in the `google_storage_bucket` resource
+```

.changelog/11393.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+bigquery: removed `allow_resource_tags_on_deletion` from `google_bigquery_table`. Resource tags are now always allowed on table deletion.
+```

.changelog/11400.txt

@@ -0,0 +1,3 @@
+```release-note:none
+
+```

.changelog/11409.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+compute: stopped the `certifcate_id` field in `google_compute_managed_ssl_certificate` resource being incorrectly marked as a user-configurable value when it should just be an output.
+```

.changelog/11434.txt

@@ -0,0 +1,3 @@
+```release-note:none
+
+```

.changelog/11439.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+changed provider labels to add the `goog-terraform-provisioned: true` label by default.
+```

.changelog/11448.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+compute: changed the behavior of `name_prefix` in multiple Compute resources to allow for a longer max length of 54 characters. See the upgrade guide and resource documentation for more details.
+```

.changelog/11450.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+integrations: `create_sample_workflows` and `provision_gmek` are removed from `google_integrations_client`
+```

.changelog/11457.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+datastore: `google_datastore_index` has been removed in favor of `google_firestore_index`
+```

.changelog/11460.txt

@@ -0,0 +1,3 @@
+```release-note:deprecation
+alloydb: `network` removed in `google_alloy_db_cluster`. Use `network_config.network` instead.
+```

.changelog/11462.txt

@@ -0,0 +1,3 @@
+```release-note:none
+
+```

.changelog/11471.txt

@@ -0,0 +1,3 @@
+```release-note:none
+
+```

.changelog/11489.txt

@@ -0,0 +1,3 @@
+```release-note:none
+
+```

.changelog/11499.txt

@@ -0,0 +1,3 @@
+```release-note:none
+
+```

.changelog/11506.txt

@@ -0,0 +1,18 @@
+```release-note:breaking-change
+composer: `ip_allocation_policy = []` in `google_composer_environment` is no longer valid configuration. Removing the field from configuration should not produce a diff.
+```
+```release-note:breaking-change
+compute: `secondary_ip_ranges = []` in `google_compute_subnetwork` is no longer valid configuration. To set an explicitly empty list, use `send_secondary_ip_range_if_empty` and completely remove `secondary_ip_range` from config.
+```
+```release-note:breaking-change
+compute: `guest_accelerator = []` is no longer valid configuration in `google_compute_instance`. To explicitly set an empty list of objects, set guest_accelerator.count = 0.
+```
+```release-note:breaking-change
+compute: `google_compute_instance_from_template` and `google_compute_instance_from_machine_image` `network_interface.alias_ip_range, network_interface.access_config, attached_disk, guest_accelerator, service_account, scratch_disk` can no longer be set to an empty block `[]`. Removing the fields from configuration should not produce a diff.
+```
+```release-note:breaking-change
+container: `guest_accelerator = []` is no longer valid configuration in `google_container_cluster` and `google_container_node_pool`. To explicitly set an empty list of objects, set guest_accelerator.count = 0.
+```
+```release-note:breaking-change
+container: `guest_accelerator.gpu_driver_installation_config = []` and `guest_accelerator.gpu_sharing_config = []` are no longer valid configuration in `google_container_cluster` and `google_container_node_pool`. Removing the fields from configuration should not produce a diff.
+```

.changelog/11513.txt

@@ -0,0 +1,3 @@
+```release-note:none
+
+```

.changelog/9581.txt

@@ -0,0 +1,6 @@
+```release-note:bug
+compute: fixed an issue regarding sending `enabled` field by default for null `iap` message in `google_compute_backend_service` and `google_compute_region_backend_service`
+```
+```release-note:breaking-change
+compute: Add new required field `enabled` in `google_compute_backend_service` and `google_compute_region_backend_service`
+```

.teamcity/components/inputs/services_beta.kt

@@ -301,11 +301,6 @@ var ServicesListBeta = mapOf(
         "displayName" to "Dataprocmetastore",
         "path" to "./google-beta/services/dataprocmetastore"
     ),
-    "datastore" to mapOf(
-        "name" to "datastore",
-        "displayName" to "Datastore",
-        "path" to "./google-beta/services/datastore"
-    ),
     "datastream" to mapOf(
         "name" to "datastream",
         "displayName" to "Datastream",

.teamcity/components/inputs/services_ga.kt

@@ -301,11 +301,6 @@ var ServicesListGa = mapOf(
         "displayName" to "Dataprocmetastore",
         "path" to "./google/services/dataprocmetastore"
     ),
-    "datastore" to mapOf(
-        "name" to "datastore",
-        "displayName" to "Datastore",
-        "path" to "./google/services/datastore"
-    ),
     "datastream" to mapOf(
         "name" to "datastream",
         "displayName" to "Datastream",

google/acctest/test_utils.go

@@ -50,10 +50,7 @@ func CheckDataSourceStateMatchesResourceStateWithIgnores(dataSourceName, resourc
 			if _, ok := ignoreFields[k]; ok {
 				continue
 			}
-			if _, ok := ignoreFields["labels.%"]; ok && strings.HasPrefix(k, "labels.") {
-				continue
-			}
-			if _, ok := ignoreFields["terraform_labels.%"]; ok && strings.HasPrefix(k, "terraform_labels.") {
+			if strings.HasPrefix(k, "labels.") || strings.HasPrefix(k, "terraform_labels.") || strings.HasPrefix(k, "effective_labels.") {
 				continue
 			}
 			if k == "%" {

google/acctest/vcr_utils.go

@@ -16,6 +16,7 @@ import (
 	"path/filepath"
 	"reflect"
 	"regexp"
+	"slices"
 	"strconv"
 	"strings"
 	"sync"
@@ -149,6 +150,20 @@ func VcrTest(t *testing.T, c resource.TestCase) {
 	} else if isReleaseDiffEnabled() {
 		c = initializeReleaseDiffTest(c, t.Name())
 	}
+
+	// terraform_labels is a computed field to which "goog-terraform-provisioned": "true" is always
+	// added by the provider. ImportStateVerify "checks for strict equality and does not respect
+	// DiffSuppressFunc or CustomizeDiff" so any test using ImportStateVerify must ignore
+	// terraform_labels.
+	var steps []resource.TestStep
+	for _, s := range c.Steps {
+		if s.ImportStateVerify && !slices.Contains(s.ImportStateVerifyIgnore, "terraform_labels") {
+			s.ImportStateVerifyIgnore = append(s.ImportStateVerifyIgnore, "terraform_labels")
+		}
+		steps = append(steps, s)
+	}
+	c.Steps = steps
+
 	resource.Test(t, c)
 }
 

google/fwmodels/provider_model.go

@@ -76,7 +76,6 @@ type ProviderModel struct {
 	DataplexCustomEndpoint                 types.String `tfsdk:"dataplex_custom_endpoint"`
 	DataprocCustomEndpoint                 types.String `tfsdk:"dataproc_custom_endpoint"`
 	DataprocMetastoreCustomEndpoint        types.String `tfsdk:"dataproc_metastore_custom_endpoint"`
-	DatastoreCustomEndpoint                types.String `tfsdk:"datastore_custom_endpoint"`
 	DatastreamCustomEndpoint               types.String `tfsdk:"datastream_custom_endpoint"`
 	DeploymentManagerCustomEndpoint        types.String `tfsdk:"deployment_manager_custom_endpoint"`
 	DialogflowCustomEndpoint               types.String `tfsdk:"dialogflow_custom_endpoint"`

google/fwprovider/framework_provider.go

@@ -432,12 +432,6 @@ func (p *FrameworkProvider) Schema(_ context.Context, _ provider.SchemaRequest,
 					transport_tpg.CustomEndpointValidator(),
 				},
 			},
-			"datastore_custom_endpoint": &schema.StringAttribute{
-				Optional: true,
-				Validators: []validator.String{
-					transport_tpg.CustomEndpointValidator(),
-				},
-			},
 			"datastream_custom_endpoint": &schema.StringAttribute{
 				Optional: true,
 				Validators: []validator.String{

google/fwtransport/framework_config.go

@@ -100,7 +100,6 @@ type FrameworkProviderConfig struct {
 	DataplexBasePath                 string
 	DataprocBasePath                 string
 	DataprocMetastoreBasePath        string
-	DatastoreBasePath                string
 	DatastreamBasePath               string
 	DeploymentManagerBasePath        string
 	DialogflowBasePath               string
@@ -260,7 +259,6 @@ func (p *FrameworkProviderConfig) LoadAndValidateFramework(ctx context.Context,
 	p.DataplexBasePath = data.DataplexCustomEndpoint.ValueString()
 	p.DataprocBasePath = data.DataprocCustomEndpoint.ValueString()
 	p.DataprocMetastoreBasePath = data.DataprocMetastoreCustomEndpoint.ValueString()
-	p.DatastoreBasePath = data.DatastoreCustomEndpoint.ValueString()
 	p.DatastreamBasePath = data.DatastreamCustomEndpoint.ValueString()
 	p.DeploymentManagerBasePath = data.DeploymentManagerCustomEndpoint.ValueString()
 	p.DialogflowBasePath = data.DialogflowCustomEndpoint.ValueString()
@@ -844,14 +842,6 @@ func (p *FrameworkProviderConfig) HandleDefaults(ctx context.Context, data *fwmo
 			data.DataprocMetastoreCustomEndpoint = types.StringValue(customEndpoint.(string))
 		}
 	}
-	if data.DatastoreCustomEndpoint.IsNull() {
-		customEndpoint := transport_tpg.MultiEnvDefault([]string{
-			"GOOGLE_DATASTORE_CUSTOM_ENDPOINT",
-		}, transport_tpg.DefaultBasePaths[transport_tpg.DatastoreBasePathKey])
-		if customEndpoint != nil {
-			data.DatastoreCustomEndpoint = types.StringValue(customEndpoint.(string))
-		}
-	}
 	if data.DatastreamCustomEndpoint.IsNull() {
 		customEndpoint := transport_tpg.MultiEnvDefault([]string{
 			"GOOGLE_DATASTREAM_CUSTOM_ENDPOINT",