[amanMahendroo]

Adds macsec.interconnect_key_group (beta) to google_compute_interconnect, so an Interconnect can use customer-provided MACsec keys from a google_network_connectivity_interconnect_key_group.

• macsec.pre_shared_keys is now optional. In beta, at least one of pre_shared_keys or interconnect_key_group must be set.
• Diff suppression for the key group reference (full URL vs relative name, project number vs ID).
• Fixes two update problems found while testing detach. Compute PATCH ignores omitted fields, so:
  • macsec_enabled = false was dropped from the request as an empty value, so MACsec could never be turned off on an existing Interconnect. It's now sent explicitly.
  • Removing the key group or all pre-shared keys now sends explicit empty values, so they are actually cleared.
• After MACsec configuration is removed, the API keeps returning an empty macsec { failOpen: false } object. That's now treated as "no macsec block", so the next plan is clean.
• API rules (no MACsec on insert, no key group swap in one request, no detach while MACsec is enabled) are left to the API and documented on the field.

Stacked on #19795 (the test uses the key group resource); only the last commit is new. Draft for initial review. Manually tested against prod on a 100G Z2Z Interconnect.

Part of b/482272248
Fixes b/568177429

This is a part of 2 PRs:

1. networkconnectivity: add interconnect_key_group resource #19795
2. compute: add macsec.interconnect_key_group to interconnect #19796

compute: added `macsec.interconnect_key_group` field to `google_compute_interconnect` resource (beta)

compute: fixed `macsec_enabled = false` not being sent on update in `google_compute_interconnect`, which prevented disabling MACsec

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 9c063b2:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	5 files changed, 374 insertions(+), 52 deletions(-)
google-beta provider	View Diff	10 files changed, 2206 insertions(+), 52 deletions(-)
terraform-google-conversion	View Diff	5 files changed, 453 insertions(+), 65 deletions(-)

Missing test report

Your PR includes resource fields which are not covered by any test.

Resource: google_compute_interconnect (8 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_compute_interconnect" "primary" {
  macsec {
    interconnect_key_group = # value needed
  }
}

Resource: google_network_connectivity_interconnect_key_group (1 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_network_connectivity_interconnect_key_group" "primary" {
  interconnects {
    interconnect = # value needed
  }
}

Unreadable test report

Missing test detection may be incomplete because the following tests can't be read. Each test step's Config should call a function that returns a single fmt.Sprintf or acctest.Nprintf template.

• TestAccComputeInterconnect_interconnectKeyGroup: errors reading test func TestAccComputeInterconnect_interconnectKeyGroup: [errors reading test steps: [failed to find variable declaration enabled failed to find variable declaration enabled failed to find variable declaration enabled failed to find variable declaration enabled failed to find variab…
• TestAccNetworkConnectivityInterconnectKeyGroup_update: errors reading test func TestAccNetworkConnectivityInterconnectKeyGroup_update: [errors reading test steps: [failed to find variable declaration description failed to find variable declaration description failed to find variable declaration description failed to find variable declaration description…

Test report

Important

Manual Verification Required

VCR cannot automatically execute the following tests added in this PR. Please verify them manually:

🔴 TestAccComputeInterconnect_interconnectKeyGroup
🔴 TestAccNetworkConnectivityInterconnectKeyGroup_update

Analytics

Total Tests	Passed	Skipped	Affected
1639	1536	101	2

Affected Service Packages

• compute
• networkconnectivity

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 2 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests

• TestAccComputeInterconnect_computeInterconnectMacsecTest
• TestAccNetworkConnectivityInterconnectKeyGroup_networkConnectivityInterconnectKeyGroupBasicExample

View the replaying VCR build log

---

Step 2: Recording Mode

Recording Mode	Findings	Test Name
✅ Log	-	TestAccComputeInterconnect_computeInterconnectMacsecTest
❌ Error · Log	-	TestAccNetworkConnectivityInterconnectKeyGroup_networkConnectivityInterconnectKeyGroupBasicExample

Caution

Issues requiring attention before PR completion

🔴 Manual Verification Required: New tests were added that are skipped in presubmit tests. See the "Manual Verification Required" section at the top for details.

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the recording VCR build log or the debug logs folder for detailed results.

@amanMahendroo VCR tests complete for 9c063b2!

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit a9d28f1:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	5 files changed, 365 insertions(+), 52 deletions(-)
google-beta provider	View Diff	10 files changed, 2320 insertions(+), 52 deletions(-)
terraform-google-conversion	View Diff	5 files changed, 455 insertions(+), 65 deletions(-)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
1639	1537	99	3

Affected Service Packages

• compute
• networkconnectivity

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 3 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests

• TestAccComputeInterconnect_interconnectKeyGroup
• TestAccNetworkConnectivityInterconnectKeyGroup_networkConnectivityInterconnectKeyGroupBasicExample
• TestAccNetworkConnectivityInterconnectKeyGroup_update

View the replaying VCR build log

---

Step 2: Recording Mode

Recording Mode	Findings	Test Name
❌ Error · Log	-	TestAccComputeInterconnect_interconnectKeyGroup
❌ Error · Log	-	TestAccNetworkConnectivityInterconnectKeyGroup_networkConnectivityInterconnectKeyGroupBasicExample
❌ Error · Log	-	TestAccNetworkConnectivityInterconnectKeyGroup_update

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the recording VCR build log or the debug logs folder for detailed results.

@amanMahendroo VCR tests complete for a9d28f1!

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit b855858:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	5 files changed, 365 insertions(+), 52 deletions(-)
google-beta provider	View Diff	10 files changed, 2320 insertions(+), 52 deletions(-)
terraform-google-conversion	View Diff	5 files changed, 455 insertions(+), 65 deletions(-)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
1648	1546	99	3

Affected Service Packages

• compute
• networkconnectivity

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 3 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests

• TestAccComputeInterconnect_interconnectKeyGroup
• TestAccNetworkConnectivityInterconnectKeyGroup_networkConnectivityInterconnectKeyGroupBasicExample
• TestAccNetworkConnectivityInterconnectKeyGroup_update

View the replaying VCR build log

---

Step 2: Recording Mode

Recording Mode	Findings	Test Name
❌ Error · Log	-	TestAccComputeInterconnect_interconnectKeyGroup
❌ Error · Log	-	TestAccNetworkConnectivityInterconnectKeyGroup_networkConnectivityInterconnectKeyGroupBasicExample
❌ Error · Log	-	TestAccNetworkConnectivityInterconnectKeyGroup_update

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the recording VCR build log or the debug logs folder for detailed results.

@amanMahendroo VCR tests complete for b855858!

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 5d1c63f:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	5 files changed, 365 insertions(+), 52 deletions(-)
google-beta provider	View Diff	10 files changed, 2320 insertions(+), 52 deletions(-)
terraform-google-conversion	View Diff	5 files changed, 455 insertions(+), 65 deletions(-)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
1645	1540	99	6

Affected Service Packages

• networkconnectivity
• compute

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 6 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests

• TestAccComputeBackendService_backendServiceDynamicForwardingForwardProxyDirectForwardingExample
• TestAccComputeImage_imageGuestOsExample
• TestAccComputeInterconnect_interconnectKeyGroup
• TestAccComputeRouter_computeRouterMd5encryptedExample
• TestAccNetworkConnectivityInterconnectKeyGroup_networkConnectivityInterconnectKeyGroupBasicExample
• TestAccNetworkConnectivityInterconnectKeyGroup_update

View the replaying VCR build log

---

Step 2: Recording Mode

Recording Mode	Findings	Test Name
✅ Log	-	TestAccComputeBackendService_backendServiceDynamicForwardingForwardProxyDirectForwardingExample
✅ Log	-	TestAccComputeImage_imageGuestOsExample
✅ Log	-	TestAccComputeInterconnect_interconnectKeyGroup
✅ Log	-	TestAccComputeRouter_computeRouterMd5encryptedExample
✅ Log	-	TestAccNetworkConnectivityInterconnectKeyGroup_networkConnectivityInterconnectKeyGroupBasicExample
✅ Log	-	TestAccNetworkConnectivityInterconnectKeyGroup_update

🟢 All tests passed!

View the recording VCR build log or the debug logs folder for detailed results.

@amanMahendroo VCR tests complete for 5d1c63f!

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 4707394:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	5 files changed, 365 insertions(+), 52 deletions(-)
google-beta provider	View Diff	10 files changed, 2320 insertions(+), 52 deletions(-)
terraform-google-conversion	View Diff	5 files changed, 455 insertions(+), 65 deletions(-)

Test report

Step 1: Replaying Mode

Skipped REPLAYING mode because a newer commit (5d1c63f) was pushed to the PR.

[github-actions]

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@slevenick, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

[slevenick]

We’ve made a process change for Googlers (or individuals on behalf of Googlers) regarding changes to the Terraform Provider for Google Cloud. Please see go/terraform-ssp-adjustment for details.