Cycle error during validation using kubernetes-engine_beta-autopilot-public-cluster

[smoothbnc]

TL;DR

terraform validate fails with Cycle error when using kubernetes-engine_beta-autopilot-public-cluster with any configuration options

Expected behavior

terraform validate to complete with no errors

Observed behavior

% terraform validate 
│ Error: Cycle: module.kubernetes-engine_beta-autopilot-public-cluster.kubernetes_config_map.ip_masq_agent, module.kubernetes-engine_beta-autopilot-public-cluster (close), provider["registry.terraform.io/hashicorp/kubernetes"

same error occurs when setting configure_ip_masq is omitted or manually set to true or false i.e. configure_ip_masq = true
configure_ip_masq = false

Terraform Configuration

terraform {
  required_providers {
    google = {
      source = "hashicorp/google"
      # version = "6.32.0"
    }
    kubernetes = {
      source = "hashicorp/kubernetes"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

module "network" {
  source  = "terraform-google-modules/network/google"
  version = "11.0.0"
  # insert the 3 required variables here
  project_id   = var.project_id
  network_name = "project network"
  subnets = [
    {
      subnet_name   = "primary-subnet"
      subnet_ip     = "172.16.0.0/16"
      subnet_region = var.region
      secondary_ip_ranges = {
        "services" = "192.168.0.0/24"
        "pods"     = "192.168.1.0/24"
      }
    }
  ]

  routing_mode = "REGIONAL"
}

#https://registry.terraform.io/modules/terraform-google-modules/kubernetes-engine/google/latest/submodules/beta-autopilot-public-cluster

module "kubernetes-engine_beta-autopilot-public-cluster" {
  source  = "terraform-google-modules/kubernetes-engine/google//modules/beta-autopilot-public-cluster"
  version = "36.3.0"
  # insert the 6 required variables here
  project_id = var.project_id
  region     = var.region
  name       = "node-cluster"
  # network                         = module.network.network_name
  # subnetwork                      = module.network.subnets.primary_subnet.name
  # ip_range_pods                   = module.network.subnets[0].secondary_ip_ranges["pods"]
  # ip_range_services               = module.network.subnets[0].secondary_ip_ranges["services"]
  network                         = "test-network"
  subnetwork                      = "test-subnet"
  ip_range_pods                   = "pod-subnet"
  ip_range_services               = "service-subnet"
  deletion_protection             = false
  description                     = "GKE autopilot cluster created via terraform"
  enable_secret_manager_addon     = true
  gcp_public_cidrs_access_enabled = true
  master_authorized_networks = [{
    cidr_block   = var.master_authorized_external_nets
    display_name = "home network"
  }]
}

Terraform Version

% terraform version
Terraform v1.11.4
on darwin_arm64
+ provider registry.terraform.io/hashicorp/google v6.32.0
+ provider registry.terraform.io/hashicorp/google-beta v6.32.0
+ provider registry.terraform.io/hashicorp/kubernetes v2.36.0
+ provider registry.terraform.io/hashicorp/random v3.7.2

Terraform Provider Versions

% terraform providers

Providers required by configuration:
.
├── provider[registry.terraform.io/hashicorp/kubernetes]
├── provider[registry.terraform.io/hashicorp/google]
├── module.kubernetes-engine_beta-autopilot-public-cluster
│   ├── provider[registry.terraform.io/hashicorp/google] >= 6.14.0, < 7.0.0
│   ├── provider[registry.terraform.io/hashicorp/google-beta] >= 6.14.0, < 7.0.0
│   ├── provider[registry.terraform.io/hashicorp/kubernetes] ~> 2.10
│   └── provider[registry.terraform.io/hashicorp/random] >= 2.1.0
└── module.network
    ├── provider[registry.terraform.io/hashicorp/google] >= 4.64.0, < 7.0.0
    ├── provider[registry.terraform.io/hashicorp/google-beta] >= 4.64.0, < 7.0.0
    ├── module.firewall_rules
        └── provider[registry.terraform.io/hashicorp/google] >= 3.33.0, < 7.0.0
    ├── module.routes
        └── provider[registry.terraform.io/hashicorp/google] >= 3.83.0, < 7.0.0
    ├── module.subnets
        └── provider[registry.terraform.io/hashicorp/google] >= 4.25.0, < 7.0.0
    └── module.vpc
        ├── provider[registry.terraform.io/hashicorp/google] >= 6.19.0, < 7.0.0
        └── provider[registry.terraform.io/hashicorp/google-beta] >= 6.19.0, < 7.0.0

Additional information

No response

[sihai-hu]

same cycle problem here while testing the example https://github.com/terraform-google-modules/terraform-google-kubernetes-engine/tree/v37.0.0/modules/private-cluster

[apeabody]

Hello - I'm unable to reproduce this error with the above TF, which normally indicates a cyclical dependency. You might try using terraform graph to see if it illustrates the dependency on module.kubernetes-engine_beta-autopilot-public-cluster.kubernetes_config_map.ip_masq_agent.