Skip to content

Conversation

@ohrite
Copy link
Contributor

@ohrite ohrite commented Nov 9, 2025

Description

This PR creates a Cloud Run service to host Metabase

Relates to #4490

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation

How has this been tested?

terraform plan

Post-merge follow-ups

  • No action required
  • Actions required (specified below)

Monitor terraform apply and exercise environment

@ohrite ohrite self-assigned this Nov 9, 2025
@ohrite ohrite force-pushed the staging/mov/4490-staging-cloud-run-metabase branch 3 times, most recently from 1bdc3f7 to a083a86 Compare November 9, 2025 14:47
@github-actions
Copy link

github-actions bot commented Nov 9, 2025

Terraform plan in iac/cal-itp-data-infra-staging/metabase/us

Plan: 0 to add, 1 to change, 0 to destroy.
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place

Terraform will perform the following actions:

  # google_cloud_run_v2_service.metabase-staging will be updated in-place
!~  resource "google_cloud_run_v2_service" "metabase-staging" {
        id                      = "projects/cal-itp-data-infra-staging/locations/us-west2/services/metabase-staging"
        name                    = "metabase-staging"
#        (34 unchanged attributes hidden)

!~      scaling {
-           max_instance_count    = 100 -> null
#            (3 unchanged attributes hidden)
        }

!~      template {
#            (11 unchanged attributes hidden)

!~          containers {
                name           = null
#                (7 unchanged attributes hidden)

!~              resources {
!~                  limits            = {
!~                      "cpu"    = "2" -> "1"
#                        (1 unchanged element hidden)
                    }
#                    (2 unchanged attributes hidden)
                }

#                (10 unchanged blocks hidden)
            }

#            (1 unchanged block hidden)
        }

#        (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

📝 Plan generated in Terraform Plan #674

@ohrite ohrite force-pushed the staging/mov/4490-staging-cloud-run-metabase branch from a083a86 to d9f2a8d Compare November 9, 2025 14:49
@github-actions
Copy link

github-actions bot commented Nov 9, 2025

Terraform plan in iac/cal-itp-data-infra-staging/iam/us

No changes. Your infrastructure matches the configuration.
No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.

📝 Plan generated in Terraform Plan #674

@ohrite ohrite force-pushed the staging/mov/4490-staging-cloud-run-metabase branch 8 times, most recently from b3bcc0f to 521410d Compare November 10, 2025 21:34
@ohrite ohrite force-pushed the staging/mov/4490-staging-cloud-run-metabase branch from 521410d to 366feaa Compare November 10, 2025 23:23
@ohrite ohrite force-pushed the staging/mov/4490-staging-cloud-run-metabase branch from 366feaa to 86aea45 Compare November 11, 2025 21:28
@github-actions
Copy link

github-actions bot commented Nov 11, 2025

Terraform plan in iac/cal-itp-data-infra-staging/composer/us

Plan: 0 to add, 1 to change, 0 to destroy.
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place

Terraform will perform the following actions:

  # google_composer_environment.calitp-staging-composer will be updated in-place
!~  resource "google_composer_environment" "calitp-staging-composer" {
        id               = "projects/cal-itp-data-infra-staging/locations/us-west2/environments/calitp-staging-composer"
        name             = "calitp-staging-composer"
#        (5 unchanged attributes hidden)

!~      config {
#            (8 unchanged attributes hidden)

!~          software_config {
!~              image_version            = "composer-2.10.2-airflow-2.9.3" -> "composer-2.13.1-airflow-2.9.3"
#                (6 unchanged attributes hidden)

#                (1 unchanged block hidden)
            }

#            (8 unchanged blocks hidden)
        }

#        (1 unchanged block hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

📝 Plan generated in Terraform Plan #674

@github-actions
Copy link

github-actions bot commented Nov 11, 2025

Terraform plan in iac/cal-itp-data-infra-staging/enghouse-sftp/us

Plan: 5 to add, 0 to change, 0 to destroy. Changes to Outputs.
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create

Terraform will perform the following actions:

  # kubernetes_deployment.enghouse-sftp will be created
+   resource "kubernetes_deployment" "enghouse-sftp" {
+       id               = (known after apply)
+       wait_for_rollout = true

+       metadata {
+           generation       = (known after apply)
+           labels           = {
+               "app" = "enghouse-sftp"
            }
+           name             = "enghouse-sftp-deployment"
+           namespace        = "default"
+           resource_version = (known after apply)
+           uid              = (known after apply)
        }

+       spec {
+           min_ready_seconds         = 0
+           paused                    = false
+           progress_deadline_seconds = 600
+           replicas                  = "1"
+           revision_history_limit    = 10

+           selector {
+               match_labels = {
+                   "app" = "enghouse-sftp"
                }
            }

+           strategy (known after apply)

+           template {
+               metadata {
+                   annotations      = {
+                       "gke-gcsfuse/volumes" = "true"
                    }
+                   generation       = (known after apply)
+                   labels           = {
+                       "app" = "enghouse-sftp"
                    }
+                   name             = (known after apply)
+                   resource_version = (known after apply)
+                   uid              = (known after apply)
                }
+               spec {
+                   automount_service_account_token  = true
+                   dns_policy                       = "ClusterFirst"
+                   enable_service_links             = true
+                   host_ipc                         = false
+                   host_network                     = false
+                   host_pid                         = false
+                   hostname                         = (known after apply)
+                   node_name                        = (known after apply)
+                   restart_policy                   = "Always"
+                   scheduler_name                   = (known after apply)
+                   service_account_name             = "sftp-pod-service-account"
+                   share_process_namespace          = false
+                   termination_grace_period_seconds = 30

+                   container {
+                       command                    = [
+                           "/bin/sh",
+                           "-c",
+                           <<-EOT
                                apk update
                                            apk add openssl openssh openssh-server
                                            addgroup -g 2222 sftpusers
                                            adduser -u 2222 -S -G sftpusers -s /sbin/nologin -D -H enghouse
                                            echo 'enghouse:enghousesftpuserpassword' | chpasswd
                                
                                            mkdir -p /home/enghouse/.ssh
                                            cp /tmp/ssh-keys/authorized_keys /home/enghouse/.ssh/authorized_keys
                                            chmod 700 /home/enghouse/.ssh
                                            chmod 600 /home/enghouse/.ssh/authorized_keys
                                            chown -R enghouse:sftpusers /home/enghouse/.ssh
                                
                                            echo "HostKey /etc/ssh/hostkey/id_rsa" >> /etc/ssh/sshd_config
                                            echo "PasswordAuthentication no" >> /etc/ssh/sshd_config
                                            echo "PermitRootLogin no" >> /etc/ssh/sshd_config
                                            echo "X11Forwarding no" >> /etc/ssh/sshd_config
                                            echo "AllowTcpForwarding no" >> /etc/ssh/sshd_config
                                            echo "Match User enghouse" >> /etc/ssh/sshd_config
                                            echo "Subsystem sftp internal-sftp" >> /etc/ssh/sshd_config
                                            echo "ForceCommand internal-sftp" >> /etc/ssh/sshd_config
                                            echo "ChrootDirectory %h" >> /etc/ssh/sshd_config
                                            /usr/sbin/sshd -D -e
                            EOT,
                        ]
+                       image                      = "alpine"
+                       image_pull_policy          = (known after apply)
+                       name                       = "sftp-server"
+                       stdin                      = false
+                       stdin_once                 = false
+                       termination_message_path   = "/dev/termination-log"
+                       termination_message_policy = (known after apply)
+                       tty                        = false

+                       env {
+                           name  = "SFTP_USER"
+                           value = "enghouse"
                        }

+                       port {
+                           container_port = 22
+                           protocol       = "TCP"
                        }

+                       resources (known after apply)

+                       volume_mount {
+                           mount_path        = "/home/enghouse/data"
+                           mount_propagation = "None"
+                           name              = "gcs-volume"
+                           read_only         = false
                        }
+                       volume_mount {
+                           mount_path        = "/etc/ssh/hostkey"
+                           mount_propagation = "None"
+                           name              = "sftp-hostkeys"
+                           read_only         = true
                        }
+                       volume_mount {
+                           mount_path        = "/tmp/ssh-keys"
+                           mount_propagation = "None"
+                           name              = "sftp-authorizedkey"
+                           read_only         = true
                        }
                    }

+                   image_pull_secrets (known after apply)

+                   readiness_gate (known after apply)

+                   volume {
+                       name = "gcs-volume"

+                       csi {
+                           driver            = "gcsfuse.csi.storage.gke.io"
+                           volume_attributes = {
+                               "bucketName"   = "cal-itp-data-infra-staging-enghouse-raw"
+                               "mountOptions" = "uid=2222,gid=2222,file-mode=777,dir-mode=777"
                            }
                        }
                    }
+                   volume {
+                       name = "sftp-hostkeys"

+                       secret {
+                           default_mode = "0600"
+                           secret_name  = "enghouse-sftp-hostkeys"
                        }
                    }
+                   volume {
+                       name = "sftp-authorizedkey"

+                       secret {
+                           default_mode = "0600"
+                           secret_name  = "enghouse-sftp-authorizedkey"
                        }
                    }
                }
            }
        }
    }

  # kubernetes_secret.enghouse-sftp-authorizedkey will be created
+   resource "kubernetes_secret" "enghouse-sftp-authorizedkey" {
+       binary_data_wo                 = (write-only attribute)
+       data                           = (sensitive value)
+       data_wo                        = (write-only attribute)
+       id                             = (known after apply)
+       type                           = "Opaque"
+       wait_for_service_account_token = true

+       metadata {
+           generation       = (known after apply)
+           name             = "enghouse-sftp-authorizedkey"
+           namespace        = "default"
+           resource_version = (known after apply)
+           uid              = (known after apply)
        }
    }

  # kubernetes_secret.enghouse-sftp-hostkeys will be created
+   resource "kubernetes_secret" "enghouse-sftp-hostkeys" {
+       binary_data_wo                 = (write-only attribute)
+       data                           = (sensitive value)
+       data_wo                        = (write-only attribute)
+       id                             = (known after apply)
+       type                           = "Opaque"
+       wait_for_service_account_token = true

+       metadata {
+           generation       = (known after apply)
+           name             = "enghouse-sftp-hostkeys"
+           namespace        = "default"
+           resource_version = (known after apply)
+           uid              = (known after apply)
        }
    }

  # kubernetes_service.enghouse-sftp will be created
+   resource "kubernetes_service" "enghouse-sftp" {
+       id                     = (known after apply)
+       status                 = (known after apply)
+       wait_for_load_balancer = true

+       metadata {
+           generation       = (known after apply)
+           name             = "enghouse-sftp"
+           namespace        = "default"
+           resource_version = (known after apply)
+           uid              = (known after apply)
        }

+       spec {
+           allocate_load_balancer_node_ports = true
+           cluster_ip                        = (known after apply)
+           cluster_ips                       = (known after apply)
+           external_traffic_policy           = (known after apply)
+           health_check_node_port            = (known after apply)
+           internal_traffic_policy           = (known after apply)
+           ip_families                       = (known after apply)
+           ip_family_policy                  = (known after apply)
+           load_balancer_ip                  = "35.236.24.31"
+           publish_not_ready_addresses       = false
+           selector                          = {
+               "app" = "enghouse-sftp"
            }
+           session_affinity                  = "None"
+           type                              = "LoadBalancer"

+           port {
+               node_port   = (known after apply)
+               port        = 22
+               protocol    = "TCP"
+               target_port = "22"
            }

+           session_affinity_config (known after apply)
        }
    }

  # kubernetes_service_account.sftp-pod-service-account will be created
+   resource "kubernetes_service_account" "sftp-pod-service-account" {
+       automount_service_account_token = true
+       default_secret_name             = (known after apply)
+       id                              = (known after apply)

+       metadata {
+           annotations      = {
+               "iam.gke.io/gcp-service-account" = "sftp-pod-service-account@cal-itp-data-infra-staging.iam.gserviceaccount.com"
            }
+           generation       = (known after apply)
+           name             = "sftp-pod-service-account"
+           namespace        = "default"
+           resource_version = (known after apply)
+           uid              = (known after apply)
        }
    }

Plan: 5 to add, 0 to change, 0 to destroy.

Changes to Outputs:
!~  kubernetes_service_enghouse-sftp_load_balancer_status = [
-       {
-           load_balancer = [
-               {
-                   ingress = [
-                       {
-                           hostname = ""
-                           ip       = "35.236.24.31"
                        },
                    ]
                },
            ]
        },
    ] -> (known after apply)

📝 Plan generated in Terraform Plan #674

@github-actions
Copy link

github-actions bot commented Nov 11, 2025

Terraform plan in iac/cal-itp-data-infra-staging/gke/us

Plan: 1 to add, 0 to change, 1 to destroy. Changes to Outputs.
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # google_container_cluster.sftp-endpoints must be replaced
-/+ resource "google_container_cluster" "sftp-endpoints" {
!~      cluster_ipv4_cidr                        = "10.51.0.0/17" -> (known after apply)
!~      datapath_provider                        = "ADVANCED_DATAPATH" -> (known after apply)
!~      default_max_pods_per_node                = 110 -> (known after apply)
-       enable_tpu                               = false -> null
!~      endpoint                                 = "34.186.154.17" -> (known after apply)
!~      id                                       = "******************************************************************************" -> (known after apply)
-       initial_node_count                       = 0 -> null
!~      label_fingerprint                        = "78cdf2f6" -> (known after apply)
!~      logging_service                          = "logging.googleapis.com/kubernetes" -> (known after apply)
!~      master_version                           = "1.33.5-gke.1201000" -> (known after apply)
!~      monitoring_service                       = "monitoring.googleapis.com/kubernetes" -> (known after apply)
        name                                     = "sftp-endpoints"
!~      network                                  = "projects/cal-itp-data-infra-staging/global/networks/default" -> "https://www.googleapis.com/compute/v1/projects/cal-itp-data-infra-staging/global/networks/default"
!~      node_locations                           = [
-           "us-west2-a",
-           "us-west2-b",
-           "us-west2-c",
        ] -> (known after apply)
!~      node_version                             = "1.33.5-gke.1201000" -> (known after apply)
+       operation                                = (known after apply)
+       private_ipv6_google_access               = (known after apply)
-       resource_labels                          = {} -> null
!~      self_link                                = "https://container.googleapis.com/v1/projects/cal-itp-data-infra-staging/locations/us-west2/clusters/sftp-endpoints" -> (known after apply)
!~      services_ipv4_cidr                       = "34.118.224.0/20" -> (known after apply)
!~      subnetwork                               = "projects/cal-itp-data-infra-staging/regions/us-west2/subnetworks/default" -> (known after apply)
+       tpu_ipv4_cidr_block                      = (known after apply)
#        (18 unchanged attributes hidden)

!~      addons_config {
!~          cloudrun_config (known after apply)
!~          config_connector_config (known after apply)
!~          dns_cache_config (known after apply)
-           dns_cache_config {
-               enabled = true -> null
            }
!~          gce_persistent_disk_csi_driver_config (known after apply)
-           gce_persistent_disk_csi_driver_config {
-               enabled = true -> null
            }
!~          gcp_filestore_csi_driver_config (known after apply)
-           gcp_filestore_csi_driver_config {
-               enabled = true -> null
            }
!~          gke_backup_agent_config (known after apply)
!~          horizontal_pod_autoscaling (known after apply)
!~          http_load_balancing (known after apply)
!~          lustre_csi_driver_config (known after apply)
!~          network_policy_config (known after apply)
-           network_policy_config {
-               disabled = true -> null
            }
!~          parallelstore_csi_driver_config (known after apply)
-           parallelstore_csi_driver_config {
-               enabled = true -> null
            }
!~          ray_operator_config (known after apply)
!~          stateful_ha_config (known after apply)
-           stateful_ha_config {
-               enabled = true -> null
            }

#            (1 unchanged block hidden)
        }

!~      anonymous_authentication_config (known after apply)
-       anonymous_authentication_config {
-           mode = "ENABLED" -> null
        }

!~      authenticator_groups_config (known after apply)

-       binary_authorization {
-           enabled         = false -> null
#            (1 unchanged attribute hidden)
        }

!~      cluster_autoscaling (known after apply)
-       cluster_autoscaling {
-           auto_provisioning_locations   = [] -> null
-           autoscaling_profile           = "OPTIMIZE_UTILIZATION" -> null
-           default_compute_class_enabled = false -> null
-           enabled                       = true -> null

-           auto_provisioning_defaults {
-               disk_size         = 0 -> null
-               image_type        = "COS_CONTAINERD" -> null
-               oauth_scopes      = [
-                   "https://www.googleapis.com/auth/devstorage.read_only",
-                   "https://www.googleapis.com/auth/logging.write",
-                   "https://www.googleapis.com/auth/monitoring",
-                   "https://www.googleapis.com/auth/service.management.readonly",
-                   "https://www.googleapis.com/auth/servicecontrol",
-                   "https://www.googleapis.com/auth/trace.append",
                ] -> null
-               service_account   = "default" -> null
#                (3 unchanged attributes hidden)

-               management {
-                   auto_repair     = true -> null
-                   auto_upgrade    = true -> null
-                   upgrade_options = [] -> null
                }

-               upgrade_settings {
-                   max_surge       = 1 -> null
-                   max_unavailable = 0 -> null
-                   strategy        = "SURGE" -> null
                }
            }

-           resource_limits {
-               maximum       = 1000000000 -> null
-               minimum       = 0 -> null
-               resource_type = "cpu" -> null
            }
-           resource_limits {
-               maximum       = 1000000000 -> null
-               minimum       = 0 -> null
-               resource_type = "memory" -> null
            }
-           resource_limits {
-               maximum       = 1000000000 -> null
-               minimum       = 0 -> null
-               resource_type = "nvidia-tesla-t4" -> null
            }
-           resource_limits {
-               maximum       = 1000000000 -> null
-               minimum       = 0 -> null
-               resource_type = "nvidia-tesla-a100" -> null
            }
        }

!~      confidential_nodes (known after apply)

!~      control_plane_endpoints_config (known after apply)
-       control_plane_endpoints_config {
-           dns_endpoint_config {
-               allow_external_traffic    = false -> null
-               enable_k8s_certs_via_dns  = false -> null
-               enable_k8s_tokens_via_dns = false -> null
-               endpoint                  = "gke-90b48c67a6f147389bed5442f502db896335-473674835135.us-west2.gke.goog" -> null
            }
-           ip_endpoints_config {
-               enabled = true -> null
            }
        }

!~      cost_management_config (known after apply)

!~      database_encryption (known after apply)
-       database_encryption {
-           state    = "DECRYPTED" -> null
#            (1 unchanged attribute hidden)
        }

!~      default_snat_status (known after apply)
-       default_snat_status {
-           disabled = false -> null
        }

-       dns_config {
-           cluster_dns                   = "CLOUD_DNS" -> null
-           cluster_dns_domain            = "cluster.local" -> null
-           cluster_dns_scope             = "CLUSTER_SCOPE" -> null
#            (1 unchanged attribute hidden)
        }

!~      enterprise_config (known after apply)
-       enterprise_config {
-           cluster_tier = "STANDARD" -> null
#            (1 unchanged attribute hidden)
        }

!~      gateway_api_config (known after apply)
-       gateway_api_config {
-           channel = "CHANNEL_STANDARD" -> null
        }

!~      gke_auto_upgrade_config (known after apply)

!~      identity_service_config (known after apply)

!~      ip_allocation_policy (known after apply)
-       ip_allocation_policy {
-           cluster_ipv4_cidr_block       = "10.51.0.0/17" -> null
-           cluster_secondary_range_name  = "gke-sftp-endpoints-pods-90b48c67" -> null
-           services_ipv4_cidr_block      = "34.118.224.0/20" -> null
-           stack_type                    = "IPV4" -> null
#            (1 unchanged attribute hidden)

-           network_tier_config {
-               network_tier = "NETWORK_TIER_DEFAULT" -> null
            }

-           pod_cidr_overprovision_config {
-               disabled = false -> null
            }
        }

!~      logging_config (known after apply)
-       logging_config {
-           enable_components = [
-               "SYSTEM_COMPONENTS",
-               "WORKLOADS",
            ] -> null
        }

!~      master_auth (known after apply)
-       master_auth {
-           cluster_ca_certificate = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVMRENDQXBTZ0F3SUJBZ0lRWEhXeERzZVlBc0N0ZGsrRGZUdkx2ekFOQmdrcWhraUc5dzBCQVFzRkFEQXYKTVMwd0t3WURWUVFERXlRNU1UUTNNekJrWkMxbE9XUmtMVFEwTVdRdFlqUXlNQzB3TnpoaU5tTTRPRE5oWldVdwpJQmNOTWpVeE1URXhNakF5T1RFeFdoZ1BNakExTlRFeE1EUXlNVEk1TVRGYU1DOHhMVEFyQmdOVkJBTVRKRGt4Ck5EY3pNR1JrTFdVNVpHUXRORFF4WkMxaU5ESXdMVEEzT0dJMll6ZzRNMkZsWlRDQ0FhSXdEUVlKS29aSWh2Y04KQVFFQkJRQURnZ0dQQURDQ0FZb0NnZ0dCQU9ORkY1TmZyTENzbkJqMDIwMHRqekxrc2lyVzhvQWl3dWo5SUwyegpWOHJ2RFdwMldIZXR3aVR6NUhUM0lZcHA1enQwOUVDMlVodHBvd2txbm9MbGJvWlhDWk9aWWtLUU9VSWkrRU9xCnE0cUxQSklnN0loME9iMk1GZGJQL2U1MjE0ckZzNW5HUlNuVm5LSVFvY1J3MHJmQlNNUU14czZ2VUkxaUt5Ui8Ka05ISFpYWGk2MlZHQmlEOFdCQ1NkdnVzYkRMeTRsZUxVeVlnNDVkZzJzajRuTXp2aDdUN1ZPbjY4VjU0aTE0bQpweG50VHg5azZqUDVwRVFUS0doR2FEWnYrSmpUOGFQcWF2MXRjVkh0ZE9VcjNldWlIU25DYVYwRzR5UDFLWjdsCjFxM3JYZ2FVMFA1bS9rWE13TjV5c1lCdTgxY2hqRU5yV2Z6dDBxTlhiT2R5VTFDNEpsL1AzTDVDTkRvcmdiajkKSWlxdEJTdlViajRIZ2YyS3hCbEdqR2xuNkZyYVBtU29jUDJZbFl3YiswcTh0dW1aYzNUSjdkL0VsRkxzYW9xTgpaclhhcWVTZmFrcDNxMWpHQ2NWUkFyRnRsVnZnRldrYzJHY28rZHpmd3gzcHQwTFNPQzJZdEFUM0l3SnNkZmhsCkJMUlg4Qlh3a3JFc284bWNCRTl4VFoyR093SURBUUFCbzBJd1FEQU9CZ05WSFE4QkFmOEVCQU1DQWdRd0R3WUQKVlIwVEFRSC9CQVV3QXdFQi96QWRCZ05WSFE0RUZnUVVhQ0x4eS9TVGtGZ1FEeXZnaWZZL0wySFZzVFV3RFFZSgpLb1pJaHZjTkFRRUxCUUFEZ2dHQkFLVTNJNWZNWWordGxyQ2pXSWxlZnloWnVFdzVxQ1UyZEhTMDM4ZnJDVXI4CjNSbjRNT3pMVkpwNS9PWXlkZThndVdsNFVVa2E0N2dZUFZtRDJhMEE1OWVLN3dpUVpKaHB6WkZsbXRDMTRoMjMKVkxWV2QyWkRlblNTR2VmUGdnTlZIRDVsOUdiMFRhKzRPOGczMUN5SFdYUzJtRHVmY01Pd3dyOEpwTGJtTms2cgpLc2ZFNjVJUGdUOHpRWUFQMW9vNVVjemM3YWxWSEJra2hTT1Zldkt5ckljYW4rWERmVVRydTdOZVIwbHdPTDlmCjhuL0l3cjVyOVoxaExJOW80R2VnV1pVM3dRRjNkd0daWENIOTJIOGZHbGNhaXRPQ253QnJlczJ4WnpwZ1ExOXgKWTBBTGhKdGxUYWZGbWxwWUZQc2tORkR6bmVnUUxXbVF4RnZ3akpBNXdTdlh0aWwyZGNUQ09LVG1FQ3pyU1hSYgpRenkvWHhvaXduUk9rdUNnRWFJbTdpMCt5NHcrVk8wMUhZYUFZMzdGSnZETUNJVHR5M3oydUU2NUIvZFd5ZW1lCmp5MHhBS0NsNTdTaFBQR0sxRktqUStxY3pFSGx4TW43SjNvOUY2NlVJWVBLKzFUMFIyZXBjZGtkSURWNFlBRXEKNXVUeHFEdXIvNGg2U0o5M0k4VzQrQT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K" -> null
#            (2 unchanged attributes hidden)

-           client_certificate_config {
-               issue_client_certificate = false -> null
            }
        }

!~      master_authorized_networks_config (known after apply)

!~      mesh_certificates (known after apply)

!~      monitoring_config (known after apply)
-       monitoring_config {
-           enable_components = [
-               "SYSTEM_COMPONENTS",
-               "POD",
-               "DAEMONSET",
-               "DEPLOYMENT",
-               "STATEFULSET",
-               "JOBSET",
-               "STORAGE",
-               "HPA",
-               "CADVISOR",
-               "KUBELET",
-               "DCGM",
            ] -> null

-           advanced_datapath_observability_config {
-               enable_metrics = true -> null
-               enable_relay   = false -> null
            }

-           managed_prometheus {
-               enabled = true -> null
            }
        }

-       network_policy {
-           enabled  = false -> null
-           provider = "PROVIDER_UNSPECIFIED" -> null
        }

!~      node_config {
!~          disk_size_gb                = 100 -> (known after apply)
!~          disk_type                   = "pd-balanced" -> (known after apply)
!~          effective_taints            = [
-               {
-                   effect = "NO_SCHEDULE"
-                   key    = "cloud.google.com/gke-quick-remove"
-                   value  = "true"
                },
            ] -> (known after apply)
-           enable_confidential_storage = false -> null
-           flex_start                  = false -> null
!~          image_type                  = "COS_CONTAINERD" -> (known after apply)
!~          labels                      = {} -> (known after apply)
!~          local_ssd_count             = 0 -> (known after apply)
!~          logging_variant             = "DEFAULT" -> (known after apply)
!~          machine_type                = "ek-standard-8" -> (known after apply)
!~          metadata                    = {
-               "disable-legacy-endpoints" = "true"
            } -> (known after apply)
+           min_cpu_platform            = (known after apply)
!~          oauth_scopes                = [
-               "https://www.googleapis.com/auth/devstorage.read_only",
-               "https://www.googleapis.com/auth/logging.write",
-               "https://www.googleapis.com/auth/monitoring",
-               "https://www.googleapis.com/auth/service.management.readonly",
-               "https://www.googleapis.com/auth/servicecontrol",
-               "https://www.googleapis.com/auth/trace.append",
            ] -> (known after apply)
-           resource_labels             = {
-               "goog-gke-node-pool-provisioning-model" = "on-demand"
            } -> null
-           resource_manager_tags       = {} -> null
!~          service_account             = "default" -> (known after apply)
-           storage_pools               = [] -> null
-           tags                        = [] -> null
#            (6 unchanged attributes hidden)

!~          boot_disk (known after apply)
-           boot_disk {
-               disk_type              = "pd-balanced" -> null
-               provisioned_iops       = 0 -> null
-               provisioned_throughput = 0 -> null
-               size_gb                = 100 -> null
            }

!~          confidential_nodes (known after apply)

!~          gcfs_config (known after apply)
-           gcfs_config {
-               enabled = true -> null
            }

!~          guest_accelerator (known after apply)

-           gvnic {
-               enabled = true -> null
            }

!~          kubelet_config (known after apply)
-           kubelet_config {
-               allowed_unsafe_sysctls                 = [] -> null
-               container_log_max_files                = 0 -> null
-               cpu_cfs_quota                          = false -> null
-               eviction_max_pod_grace_period_seconds  = 0 -> null
-               image_gc_high_threshold_percent        = 0 -> null
-               image_gc_low_threshold_percent         = 0 -> null
-               insecure_kubelet_readonly_port_enabled = "FALSE" -> null
-               max_parallel_image_pulls               = 2 -> null
-               pod_pids_limit                         = 0 -> null
-               single_process_oom_kill                = false -> null
#                (5 unchanged attributes hidden)
            }

!~          linux_node_config (known after apply)

-           reservation_affinity { # forces replacement
-               consume_reservation_type = "NO_RESERVATION" -> null # forces replacement
-               values                   = [] -> null
#                (1 unchanged attribute hidden)
            }

!~          shielded_instance_config (known after apply)
-           shielded_instance_config {
-               enable_integrity_monitoring = true -> null
-               enable_secure_boot          = true -> null
            }

!~          windows_node_config (known after apply)
-           windows_node_config {
#                (1 unchanged attribute hidden)
            }

#            (1 unchanged block hidden)
        }

!~      node_pool (known after apply)
-       node_pool {
-           initial_node_count          = 1 -> null
-           instance_group_urls         = [] -> null
-           managed_instance_group_urls = [] -> null
-           max_pods_per_node           = 32 -> null
-           name                        = "default-pool" -> null
-           node_count                  = 0 -> null
-           node_locations              = [
-               "us-west2-c",
            ] -> null
-           version                     = "1.33.5-gke.1201000" -> null
#            (1 unchanged attribute hidden)

-           autoscaling {
-               location_policy      = "BALANCED" -> null
-               max_node_count       = 1000 -> null
-               min_node_count       = 0 -> null
-               total_max_node_count = 0 -> null
-               total_min_node_count = 0 -> null
            }

-           management {
-               auto_repair  = true -> null
-               auto_upgrade = true -> null
            }

-           network_config {
-               create_pod_range     = false -> null
-               enable_private_nodes = false -> null
-               pod_ipv4_cidr_block  = "10.51.0.0/17" -> null
-               pod_range            = "gke-sftp-endpoints-pods-90b48c67" -> null
-               subnetwork           = "projects/cal-itp-data-infra-staging/regions/us-west2/subnetworks/default" -> null
            }

-           node_config {
-               disk_size_gb                = 100 -> null
-               disk_type                   = "pd-balanced" -> null
-               effective_taints            = [
-                   {
-                       effect = "NO_SCHEDULE"
-                       key    = "cloud.google.com/gke-quick-remove"
-                       value  = "true"
                    },
                ] -> null
-               enable_confidential_storage = false -> null
-               flex_start                  = false -> null
-               image_type                  = "COS_CONTAINERD" -> null
-               labels                      = {} -> null
-               local_ssd_count             = 0 -> null
-               logging_variant             = "DEFAULT" -> null
-               machine_type                = "ek-standard-8" -> null
-               metadata                    = {
-                   "disable-legacy-endpoints" = "true"
                } -> null
-               oauth_scopes                = [
-                   "https://www.googleapis.com/auth/devstorage.read_only",
-                   "https://www.googleapis.com/auth/logging.write",
-                   "https://www.googleapis.com/auth/monitoring",
-                   "https://www.googleapis.com/auth/service.management.readonly",
-                   "https://www.googleapis.com/auth/servicecontrol",
-                   "https://www.googleapis.com/auth/trace.append",
                ] -> null
-               preemptible                 = false -> null
-               resource_labels             = {
-                   "goog-gke-node-pool-provisioning-model" = "on-demand"
                } -> null
-               resource_manager_tags       = {} -> null
-               service_account             = "default" -> null
-               spot                        = false -> null
-               storage_pools               = [] -> null
-               tags                        = [] -> null
#                (5 unchanged attributes hidden)

-               boot_disk {
-                   disk_type              = "pd-balanced" -> null
-                   provisioned_iops       = 0 -> null
-                   provisioned_throughput = 0 -> null
-                   size_gb                = 100 -> null
                }

-               gcfs_config {
-                   enabled = true -> null
                }

-               gvnic {
-                   enabled = true -> null
                }

-               kubelet_config {
-                   allowed_unsafe_sysctls                 = [] -> null
-                   container_log_max_files                = 0 -> null
-                   cpu_cfs_quota                          = false -> null
-                   eviction_max_pod_grace_period_seconds  = 0 -> null
-                   image_gc_high_threshold_percent        = 0 -> null
-                   image_gc_low_threshold_percent         = 0 -> null
-                   insecure_kubelet_readonly_port_enabled = "FALSE" -> null
-                   max_parallel_image_pulls               = 2 -> null
-                   pod_pids_limit                         = 0 -> null
-                   single_process_oom_kill                = false -> null
#                    (5 unchanged attributes hidden)
                }

-               reservation_affinity {
-                   consume_reservation_type = "NO_RESERVATION" -> null
-                   values                   = [] -> null
#                    (1 unchanged attribute hidden)
                }

-               shielded_instance_config {
-                   enable_integrity_monitoring = true -> null
-                   enable_secure_boot          = true -> null
                }

-               windows_node_config {
#                    (1 unchanged attribute hidden)
                }

-               workload_metadata_config {
-                   mode = "GKE_METADATA" -> null
                }
            }

-           upgrade_settings {
-               max_surge       = 1 -> null
-               max_unavailable = 0 -> null
-               strategy        = "SURGE" -> null
            }
        }
-       node_pool {
-           initial_node_count          = 0 -> null
-           instance_group_urls         = [] -> null
-           managed_instance_group_urls = [] -> null
-           max_pods_per_node           = 32 -> null
-           name                        = "pool-1" -> null
-           node_count                  = 0 -> null
-           node_locations              = [
-               "us-west2-a",
-               "us-west2-b",
-               "us-west2-c",
            ] -> null
-           version                     = "1.33.5-gke.1201000" -> null
#            (1 unchanged attribute hidden)

-           autoscaling {
-               location_policy      = "BALANCED" -> null
-               max_node_count       = 1000 -> null
-               min_node_count       = 0 -> null
-               total_max_node_count = 0 -> null
-               total_min_node_count = 0 -> null
            }

-           management {
-               auto_repair  = true -> null
-               auto_upgrade = true -> null
            }

-           network_config {
-               create_pod_range     = false -> null
-               enable_private_nodes = false -> null
-               pod_ipv4_cidr_block  = "10.51.0.0/17" -> null
-               pod_range            = "gke-sftp-endpoints-pods-90b48c67" -> null
-               subnetwork           = "projects/cal-itp-data-infra-staging/regions/us-west2/subnetworks/default" -> null
            }

-           node_config {
-               disk_size_gb                = 100 -> null
-               disk_type                   = "pd-balanced" -> null
-               effective_taints            = [] -> null
-               enable_confidential_storage = false -> null
-               flex_start                  = false -> null
-               image_type                  = "COS_CONTAINERD" -> null
-               labels                      = {} -> null
-               local_ssd_count             = 0 -> null
-               logging_variant             = "DEFAULT" -> null
-               machine_type                = "ek-standard-8" -> null
-               metadata                    = {
-                   "disable-legacy-endpoints" = "true"
                } -> null
-               oauth_scopes                = [
-                   "https://www.googleapis.com/auth/devstorage.read_only",
-                   "https://www.googleapis.com/auth/logging.write",
-                   "https://www.googleapis.com/auth/monitoring",
-                   "https://www.googleapis.com/auth/service.management.readonly",
-                   "https://www.googleapis.com/auth/servicecontrol",
-                   "https://www.googleapis.com/auth/trace.append",
                ] -> null
-               preemptible                 = false -> null
-               resource_labels             = {
-                   "goog-gke-node-pool-provisioning-model" = "on-demand"
                } -> null
-               resource_manager_tags       = {} -> null
-               service_account             = "default" -> null
-               spot                        = false -> null
-               storage_pools               = [] -> null
-               tags                        = [] -> null
#                (5 unchanged attributes hidden)

-               boot_disk {
-                   disk_type              = "pd-balanced" -> null
-                   provisioned_iops       = 0 -> null
-                   provisioned_throughput = 0 -> null
-                   size_gb                = 100 -> null
                }

-               gcfs_config {
-                   enabled = true -> null
                }

-               gvnic {
-                   enabled = true -> null
                }

-               kubelet_config {
-                   allowed_unsafe_sysctls                 = [] -> null
-                   container_log_max_files                = 0 -> null
-                   cpu_cfs_quota                          = false -> null
-                   eviction_max_pod_grace_period_seconds  = 0 -> null
-                   image_gc_high_threshold_percent        = 0 -> null
-                   image_gc_low_threshold_percent         = 0 -> null
-                   insecure_kubelet_readonly_port_enabled = "FALSE" -> null
-                   max_parallel_image_pulls               = 2 -> null
-                   pod_pids_limit                         = 0 -> null
-                   single_process_oom_kill                = false -> null
#                    (5 unchanged attributes hidden)
                }

-               reservation_affinity {
-                   consume_reservation_type = "NO_RESERVATION" -> null
-                   values                   = [] -> null
#                    (1 unchanged attribute hidden)
                }

-               shielded_instance_config {
-                   enable_integrity_monitoring = true -> null
-                   enable_secure_boot          = true -> null
                }

-               windows_node_config {
#                    (1 unchanged attribute hidden)
                }

-               workload_metadata_config {
-                   mode = "GKE_METADATA" -> null
                }
            }

-           upgrade_settings {
-               max_surge       = 1 -> null
-               max_unavailable = 0 -> null
-               strategy        = "SURGE" -> null
            }
        }
-       node_pool {
-           initial_node_count          = 0 -> null
-           instance_group_urls         = [] -> null
-           managed_instance_group_urls = [] -> null
-           max_pods_per_node           = 32 -> null
-           name                        = "pool-2" -> null
-           node_count                  = 0 -> null
-           node_locations              = [
-               "us-west2-a",
-               "us-west2-b",
-               "us-west2-c",
            ] -> null
-           version                     = "1.33.5-gke.1201000" -> null
#            (1 unchanged attribute hidden)

-           autoscaling {
-               location_policy      = "BALANCED" -> null
-               max_node_count       = 1000 -> null
-               min_node_count       = 0 -> null
-               total_max_node_count = 0 -> null
-               total_min_node_count = 0 -> null
            }

-           management {
-               auto_repair  = true -> null
-               auto_upgrade = true -> null
            }

-           network_config {
-               create_pod_range     = false -> null
-               enable_private_nodes = false -> null
-               pod_ipv4_cidr_block  = "10.51.0.0/17" -> null
-               pod_range            = "gke-sftp-endpoints-pods-90b48c67" -> null
-               subnetwork           = "projects/cal-itp-data-infra-staging/regions/us-west2/subnetworks/default" -> null
            }

-           node_config {
-               disk_size_gb                = 100 -> null
-               disk_type                   = "pd-balanced" -> null
-               effective_taints            = [] -> null
-               enable_confidential_storage = false -> null
-               flex_start                  = false -> null
-               image_type                  = "COS_CONTAINERD" -> null
-               labels                      = {} -> null
-               local_ssd_count             = 0 -> null
-               logging_variant             = "DEFAULT" -> null
-               machine_type                = "ek-standard-16" -> null
-               metadata                    = {
-                   "disable-legacy-endpoints" = "true"
                } -> null
-               oauth_scopes                = [
-                   "https://www.googleapis.com/auth/devstorage.read_only",
-                   "https://www.googleapis.com/auth/logging.write",
-                   "https://www.googleapis.com/auth/monitoring",
-                   "https://www.googleapis.com/auth/service.management.readonly",
-                   "https://www.googleapis.com/auth/servicecontrol",
-                   "https://www.googleapis.com/auth/trace.append",
                ] -> null
-               preemptible                 = false -> null
-               resource_labels             = {
-                   "goog-gke-node-pool-provisioning-model" = "on-demand"
                } -> null
-               resource_manager_tags       = {} -> null
-               service_account             = "default" -> null
-               spot                        = false -> null
-               storage_pools               = [] -> null
-               tags                        = [] -> null
#                (5 unchanged attributes hidden)

-               boot_disk {
-                   disk_type              = "pd-balanced" -> null
-                   provisioned_iops       = 0 -> null
-                   provisioned_throughput = 0 -> null
-                   size_gb                = 100 -> null
                }

-               gcfs_config {
-                   enabled = true -> null
                }

-               gvnic {
-                   enabled = true -> null
                }

-               kubelet_config {
-                   allowed_unsafe_sysctls                 = [] -> null
-                   container_log_max_files                = 0 -> null
-                   cpu_cfs_quota                          = false -> null
-                   eviction_max_pod_grace_period_seconds  = 0 -> null
-                   image_gc_high_threshold_percent        = 0 -> null
-                   image_gc_low_threshold_percent         = 0 -> null
-                   insecure_kubelet_readonly_port_enabled = "FALSE" -> null
-                   max_parallel_image_pulls               = 2 -> null
-                   pod_pids_limit                         = 0 -> null
-                   single_process_oom_kill                = false -> null
#                    (5 unchanged attributes hidden)
                }

-               reservation_affinity {
-                   consume_reservation_type = "NO_RESERVATION" -> null
-                   values                   = [] -> null
#                    (1 unchanged attribute hidden)
                }

-               shielded_instance_config {
-                   enable_integrity_monitoring = true -> null
-                   enable_secure_boot          = true -> null
                }

-               windows_node_config {
#                    (1 unchanged attribute hidden)
                }

-               workload_metadata_config {
-                   mode = "GKE_METADATA" -> null
                }
            }

-           upgrade_settings {
-               max_surge       = 1 -> null
-               max_unavailable = 0 -> null
-               strategy        = "SURGE" -> null
            }
        }
-       node_pool {
-           initial_node_count          = 0 -> null
-           instance_group_urls         = [] -> null
-           managed_instance_group_urls = [] -> null
-           max_pods_per_node           = 32 -> null
-           name                        = "pool-3" -> null
-           node_count                  = 0 -> null
-           node_locations              = [
-               "us-west2-a",
-               "us-west2-b",
-               "us-west2-c",
            ] -> null
-           version                     = "1.33.5-gke.1201000" -> null
#            (1 unchanged attribute hidden)

-           autoscaling {
-               location_policy      = "BALANCED" -> null
-               max_node_count       = 1000 -> null
-               min_node_count       = 0 -> null
-               total_max_node_count = 0 -> null
-               total_min_node_count = 0 -> null
            }

-           management {
-               auto_repair  = true -> null
-               auto_upgrade = true -> null
            }

-           network_config {
-               create_pod_range     = false -> null
-               enable_private_nodes = false -> null
-               pod_ipv4_cidr_block  = "10.51.0.0/17" -> null
-               pod_range            = "gke-sftp-endpoints-pods-90b48c67" -> null
-               subnetwork           = "projects/cal-itp-data-infra-staging/regions/us-west2/subnetworks/default" -> null
            }

-           node_config {
-               disk_size_gb                = 100 -> null
-               disk_type                   = "pd-balanced" -> null
-               effective_taints            = [] -> null
-               enable_confidential_storage = false -> null
-               flex_start                  = false -> null
-               image_type                  = "COS_CONTAINERD" -> null
-               labels                      = {} -> null
-               local_ssd_count             = 0 -> null
-               logging_variant             = "DEFAULT" -> null
-               machine_type                = "ek-standard-32" -> null
-               metadata                    = {
-                   "disable-legacy-endpoints" = "true"
                } -> null
-               oauth_scopes                = [
-                   "https://www.googleapis.com/auth/devstorage.read_only",
-                   "https://www.googleapis.com/auth/logging.write",
-                   "https://www.googleapis.com/auth/monitoring",
-                   "https://www.googleapis.com/auth/service.management.readonly",
-                   "https://www.googleapis.com/auth/servicecontrol",
-                   "https://www.googleapis.com/auth/trace.append",
                ] -> null
-               preemptible                 = false -> null
-               resource_labels             = {
-                   "goog-gke-node-pool-provisioning-model" = "on-demand"
                } -> null
-               resource_manager_tags       = {} -> null
-               service_account             = "default" -> null
-               spot                        = false -> null
-               storage_pools               = [] -> null
-               tags                        = [] -> null
#                (5 unchanged attributes hidden)

-               boot_disk {
-                   disk_type              = "pd-balanced" -> null
-                   provisioned_iops       = 0 -> null
-                   provisioned_throughput = 0 -> null
-                   size_gb                = 100 -> null
                }

-               gcfs_config {
-                   enabled = true -> null
                }

-               gvnic {
-                   enabled = true -> null
                }

-               kubelet_config {
-                   allowed_unsafe_sysctls                 = [] -> null
-                   container_log_max_files                = 0 -> null
-                   cpu_cfs_quota                          = false -> null
-                   eviction_max_pod_grace_period_seconds  = 0 -> null
-                   image_gc_high_threshold_percent        = 0 -> null
-                   image_gc_low_threshold_percent         = 0 -> null
-                   insecure_kubelet_readonly_port_enabled = "FALSE" -> null
-                   max_parallel_image_pulls               = 2 -> null
-                   pod_pids_limit                         = 0 -> null
-                   single_process_oom_kill                = false -> null
#                    (5 unchanged attributes hidden)
                }

-               reservation_affinity {
-                   consume_reservation_type = "NO_RESERVATION" -> null
-                   values                   = [] -> null
#                    (1 unchanged attribute hidden)
                }

-               shielded_instance_config {
-                   enable_integrity_monitoring = true -> null
-                   enable_secure_boot          = true -> null
                }

-               windows_node_config {
#                    (1 unchanged attribute hidden)
                }

-               workload_metadata_config {
-                   mode = "GKE_METADATA" -> null
                }
            }

-           upgrade_settings {
-               max_surge       = 1 -> null
-               max_unavailable = 0 -> null
-               strategy        = "SURGE" -> null
            }
        }
-       node_pool {
-           initial_node_count          = 0 -> null
-           instance_group_urls         = [] -> null
-           managed_instance_group_urls = [] -> null
-           max_pods_per_node           = 32 -> null
-           name                        = "pool-4" -> null
-           node_count                  = 0 -> null
-           node_locations              = [
-               "us-west2-a",
-               "us-west2-b",
-               "us-west2-c",
            ] -> null
-           version                     = "1.33.5-gke.1201000" -> null
#            (1 unchanged attribute hidden)

-           autoscaling {
-               location_policy      = "BALANCED" -> null
-               max_node_count       = 1000 -> null
-               min_node_count       = 0 -> null
-               total_max_node_count = 0 -> null
-               total_min_node_count = 0 -> null
            }

-           management {
-               auto_repair  = true -> null
-               auto_upgrade = true -> null
            }

-           network_config {
-               create_pod_range     = false -> null
-               enable_private_nodes = false -> null
-               pod_ipv4_cidr_block  = "10.51.0.0/17" -> null
-               pod_range            = "gke-sftp-endpoints-pods-90b48c67" -> null
-               subnetwork           = "projects/cal-itp-data-infra-staging/regions/us-west2/subnetworks/default" -> null
            }

-           node_config {
-               disk_size_gb                = 100 -> null
-               disk_type                   = "pd-balanced" -> null
-               effective_taints            = [] -> null
-               enable_confidential_storage = false -> null
-               flex_start                  = false -> null
-               image_type                  = "COS_CONTAINERD" -> null
-               labels                      = {} -> null
-               local_ssd_count             = 0 -> null
-               logging_variant             = "DEFAULT" -> null
-               machine_type                = "e2-medium" -> null
-               metadata                    = {
-                   "disable-legacy-endpoints" = "true"
                } -> null
-               oauth_scopes                = [
-                   "https://www.googleapis.com/auth/devstorage.read_only",
-                   "https://www.googleapis.com/auth/logging.write",
-                   "https://www.googleapis.com/auth/monitoring",
-                   "https://www.googleapis.com/auth/service.management.readonly",
-                   "https://www.googleapis.com/auth/servicecontrol",
-                   "https://www.googleapis.com/auth/trace.append",
                ] -> null
-               preemptible                 = false -> null
-               resource_labels             = {
-                   "goog-gke-node-pool-provisioning-model" = "on-demand"
                } -> null
-               resource_manager_tags       = {} -> null
-               service_account             = "default" -> null
-               spot                        = false -> null
-               storage_pools               = [] -> null
-               tags                        = [] -> null
#                (5 unchanged attributes hidden)

-               boot_disk {
-                   disk_type              = "pd-balanced" -> null
-                   provisioned_iops       = 0 -> null
-                   provisioned_throughput = 0 -> null
-                   size_gb                = 100 -> null
                }

-               gcfs_config {
-                   enabled = true -> null
                }

-               gvnic {
-                   enabled = true -> null
                }

-               kubelet_config {
-                   allowed_unsafe_sysctls                 = [] -> null
-                   container_log_max_files                = 0 -> null
-                   cpu_cfs_quota                          = false -> null
-                   eviction_max_pod_grace_period_seconds  = 0 -> null
-                   image_gc_high_threshold_percent        = 0 -> null
-                   image_gc_low_threshold_percent         = 0 -> null
-                   insecure_kubelet_readonly_port_enabled = "FALSE" -> null
-                   max_parallel_image_pulls               = 2 -> null
-                   pod_pids_limit                         = 0 -> null
-                   single_process_oom_kill                = false -> null
#                    (5 unchanged attributes hidden)
                }

-               reservation_affinity {
-                   consume_reservation_type = "NO_RESERVATION" -> null
-                   values                   = [] -> null
#                    (1 unchanged attribute hidden)
                }

-               shielded_instance_config {
-                   enable_integrity_monitoring = true -> null
-                   enable_secure_boot          = true -> null
                }

-               windows_node_config {
#                    (1 unchanged attribute hidden)
                }

-               workload_metadata_config {
-                   mode = "GKE_METADATA" -> null
                }
            }

-           upgrade_settings {
-               max_surge       = 1 -> null
-               max_unavailable = 0 -> null
-               strategy        = "SURGE" -> null
            }
        }
-       node_pool {
-           initial_node_count          = 0 -> null
-           instance_group_urls         = [] -> null
-           managed_instance_group_urls = [] -> null
-           max_pods_per_node           = 32 -> null
-           name                        = "pool-5" -> null
-           node_count                  = 0 -> null
-           node_locations              = [
-               "us-west2-a",
-               "us-west2-b",
-               "us-west2-c",
            ] -> null
-           version                     = "1.33.5-gke.1201000" -> null
#            (1 unchanged attribute hidden)

-           autoscaling {
-               location_policy      = "BALANCED" -> null
-               max_node_count       = 1000 -> null
-               min_node_count       = 0 -> null
-               total_max_node_count = 0 -> null
-               total_min_node_count = 0 -> null
            }

-           management {
-               auto_repair  = true -> null
-               auto_upgrade = true -> null
            }

-           network_config {
-               create_pod_range     = false -> null
-               enable_private_nodes = false -> null
-               pod_ipv4_cidr_block  = "10.51.0.0/17" -> null
-               pod_range            = "gke-sftp-endpoints-pods-90b48c67" -> null
-               subnetwork           = "projects/cal-itp-data-infra-staging/regions/us-west2/subnetworks/default" -> null
            }

-           node_config {
-               disk_size_gb                = 100 -> null
-               disk_type                   = "pd-balanced" -> null
-               effective_taints            = [] -> null
-               enable_confidential_storage = false -> null
-               flex_start                  = false -> null
-               image_type                  = "COS_CONTAINERD" -> null
-               labels                      = {} -> null
-               local_ssd_count             = 0 -> null
-               logging_variant             = "DEFAULT" -> null
-               machine_type                = "e2-standard-2" -> null
-               metadata                    = {
-                   "disable-legacy-endpoints" = "true"
                } -> null
-               oauth_scopes                = [
-                   "https://www.googleapis.com/auth/devstorage.read_only",
-                   "https://www.googleapis.com/auth/logging.write",
-                   "https://www.googleapis.com/auth/monitoring",
-                   "https://www.googleapis.com/auth/service.management.readonly",
-                   "https://www.googleapis.com/auth/servicecontrol",
-                   "https://www.googleapis.com/auth/trace.append",
                ] -> null
-               preemptible                 = false -> null
-               resource_labels             = {
-                   "goog-gke-node-pool-provisioning-model" = "on-demand"
                } -> null
-               resource_manager_tags       = {} -> null
-               service_account             = "default" -> null
-               spot                        = false -> null
-               storage_pools               = [] -> null
-               tags                        = [] -> null
#                (5 unchanged attributes hidden)

-               boot_disk {
-                   disk_type              = "pd-balanced" -> null
-                   provisioned_iops       = 0 -> null
-                   provisioned_throughput = 0 -> null
-                   size_gb                = 100 -> null
                }

-               gcfs_config {
-                   enabled = true -> null
                }

-               gvnic {
-                   enabled = true -> null
                }

-               kubelet_config {
-                   allowed_unsafe_sysctls                 = [] -> null
-                   container_log_max_files                = 0 -> null
-                   cpu_cfs_quota                          = false -> null
-                   eviction_max_pod_grace_period_seconds  = 0 -> null
-                   image_gc_high_threshold_percent        = 0 -> null
-                   image_gc_low_threshold_percent         = 0 -> null
-                   insecure_kubelet_readonly_port_enabled = "FALSE" -> null
-                   max_parallel_image_pulls               = 2 -> null
-                   pod_pids_limit                         = 0 -> null
-                   single_process_oom_kill                = false -> null
#                    (5 unchanged attributes hidden)
                }

-               reservation_affinity {
-                   consume_reservation_type = "NO_RESERVATION" -> null
-                   values                   = [] -> null
#                    (1 unchanged attribute hidden)
                }

-               shielded_instance_config {
-                   enable_integrity_monitoring = true -> null
-                   enable_secure_boot          = true -> null
                }

-               windows_node_config {
#                    (1 unchanged attribute hidden)
                }

-               workload_metadata_config {
-                   mode = "GKE_METADATA" -> null
                }
            }

-           upgrade_settings {
-               max_surge       = 1 -> null
-               max_unavailable = 0 -> null
-               strategy        = "SURGE" -> null
            }
        }
-       node_pool {
-           initial_node_count          = 0 -> null
-           instance_group_urls         = [] -> null
-           managed_instance_group_urls = [] -> null
-           max_pods_per_node           = 32 -> null
-           name                        = "pool-6" -> null
-           node_count                  = 0 -> null
-           node_locations              = [
-               "us-west2-a",
-               "us-west2-b",
-               "us-west2-c",
            ] -> null
-           version                     = "1.33.5-gke.1201000" -> null
#            (1 unchanged attribute hidden)

-           autoscaling {
Plan is too large to fit in a PR comment. See the full plan in the workflow log.

📝 Plan generated in Terraform Plan #674

@ohrite ohrite force-pushed the staging/mov/4490-staging-cloud-run-metabase branch from 86aea45 to 493eab0 Compare November 12, 2025 19:29
@github-actions
Copy link

Terraform plan in iac/cal-itp-data-infra-staging/gtfs-rt-archiver/us

Plan: 0 to add, 1 to change, 0 to destroy.
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
!~  update in-place

Terraform will perform the following actions:

  # google_cloud_scheduler_job.gtfs-rt-archiver will be updated in-place
!~  resource "google_cloud_scheduler_job" "gtfs-rt-archiver" {
        id               = "projects/cal-itp-data-infra-staging/locations/us-west2/jobs/gtfs-rt-archiver"
        name             = "gtfs-rt-archiver"
#        (8 unchanged attributes hidden)

!~      http_target {
!~          body        = "eyJhcmd1bWVudCI6Int9In0=" -> "eyJhcmd1bWVudCI6IntcImxpbWl0XCI6MX0ifQ=="
#            (3 unchanged attributes hidden)

#            (1 unchanged block hidden)
        }

-       retry_config {
-           max_backoff_duration = "3600s" -> null
-           max_doublings        = 1 -> null
-           max_retry_duration   = "0s" -> null
-           min_backoff_duration = "5s" -> null
-           retry_count          = 0 -> null
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

📝 Plan generated in Terraform Plan #674

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants