[Internal Range] Fix for issue 27175

[dorianverna]

Release Note Template for Downstream PRs (will be copied)

See Write release notes for guidance.

Issue: hashicorp/terraform-provider-google#27175

Tested:

go test -v -run=TestAccComputeSubnetwork_secondaryIpRangeInternalRangeInUse
=== RUN   TestAccComputeSubnetwork_secondaryIpRangeInternalRangeInUse
=== PAUSE TestAccComputeSubnetwork_secondaryIpRangeInternalRangeInUse
=== CONT  TestAccComputeSubnetwork_secondaryIpRangeInternalRangeInUse
--- PASS: TestAccComputeSubnetwork_secondaryIpRangeInternalRangeInUse (379.64s)
PASS
ok      github.com/hashicorp/terraform-provider-google-beta/google-beta/services/compute        379.878s

Furter details:

• Bug 1: Detaching/Deleting InternalRange (GHE Issue #27175)
  The Problem: Terraform attempts to delete the google_network_connectivity_internal_range resource while the subnetwork still has it registered in GCP, resulting in a 400 Resource is already being used failure.
  The Solution: Our internal_range_detach.go.tmpl custom delete code intercepts GCE's 400 error, safely extracts it (even when wrapped), matching by /internalRanges/ in a robust and project-independent way, and PATCHes the subnetwork to remove/detach the referencing secondary range.
  Verified by: Step 2 of the acceptance test (testAccComputeSubnetwork_secondaryIpRangeInternalRangeRemoved) where the range is completely removed and the InternalRange is successfully destroyed.

• Bug 2: Positional Stability
  The Problem: Adding a new secondary range that sorts lexicographically before an existing range (or re-adding a range) triggers a positional shift diff in the TypeList schema, showing a "rename" at position 0 instead of a clean addition. In real-world, in-use subnets, this positional re-ordering fails to apply.
  The Solution: This is resolved by the custom diff logic resourceComputeSubnetworkSecondaryIpRangeSetStyleDiff (already part of the subnetwork resource implementation). It calculates the difference and explicitly locks existing/surviving ranges to their old index slots, only appending new ranges to the remaining index gaps.
  Verified by: Step 3 of the acceptance test (testAccComputeSubnetwork_secondaryIpRangePositionalStability) where a new range is added to the empty subnetwork, confirming that positional stability and range addition work perfectly.

compute: fixed an issue in `google_compute_subnetwork` where `secondary_ip_range` entries linked to an `internal_range` could not be removed and adding new ranges would sometimes fail due to positional shifts ([#27175](https://github.com/hashicorp/terraform-provider-google/issues/27175))

[github-actions]

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@hao-nan-li, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 00d463d:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	2 files changed, 233 insertions(+), 61 deletions(-)
google-beta provider	View Diff	2 files changed, 233 insertions(+), 61 deletions(-)
terraform-google-conversion	View Diff	4 files changed, 174 insertions(+), 33 deletions(-)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
1428	1335	91	2

Affected Service Packages

• compute

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 2 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

• TestAccComputeSubnetwork_secondaryIpRangeInternalRangeInUse
• TestAccComputeSubnetwork_secondaryIpRanges

View the build log

---

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
✅ Log	✅	TestAccComputeSubnetwork_secondaryIpRanges
❌ Error · Log	-	TestAccComputeSubnetwork_secondaryIpRangeInternalRangeInUse

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the build log or the debug logs folder for detailed results.

@dorianverna, @hao-nan-li VCR tests complete for 00d463d!

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 73a0de1:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	4 files changed, 350 insertions(+), 365 deletions(-)
google-beta provider	View Diff	4 files changed, 350 insertions(+), 365 deletions(-)
terraform-google-conversion	View Diff	4 files changed, 174 insertions(+), 33 deletions(-)

Test report

Important

Manual Verification Required

VCR cannot automatically execute the following tests added in this PR. Please verify them manually:

🔴 TestAccComputeSubnetwork_secondaryIpRangeInternalRangeInUse

Analytics

Total Tests	Passed	Skipped	Affected
14	14	0	0

Affected Service Packages

• compute
• networkconnectivityv1

Learn how VCR tests work

---

Step 1: Replaying Mode

Caution

🔴 Errors occurred during REPLAYING mode. Please check the build log for details.

View the build log

@dorianverna, @hao-nan-li VCR tests complete for 73a0de1!

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 1a3aea1:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	4 files changed, 305 insertions(+), 305 deletions(-)
google-beta provider	View Diff	4 files changed, 305 insertions(+), 305 deletions(-)
terraform-google-conversion	View Diff	4 files changed, 174 insertions(+), 33 deletions(-)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
1448	1353	91	4

Affected Service Packages

• compute
• networkconnectivityv1

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 4 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

• TestAccComputeInstanceFromTemplate_DiskForceAttach
• TestAccComputeRouterPeer_AddMd5AuthenticationKey
• TestAccComputeSecurityPolicyRule_securityPolicyRuleWithBodyExcludeExample
• TestAccComputeSubnetwork_secondaryIpRangeInternalRangeInUse

View the build log

---

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
✅ Log	✅	TestAccComputeRouterPeer_AddMd5AuthenticationKey
✅ Log	✅	TestAccComputeSubnetwork_secondaryIpRangeInternalRangeInUse
❌ Error · Log	-	TestAccComputeInstanceFromTemplate_DiskForceAttach
❌ Error · Log	-	TestAccComputeSecurityPolicyRule_securityPolicyRuleWithBodyExcludeExample

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the build log or the debug logs folder for detailed results.

@dorianverna, @hao-nan-li VCR tests complete for 1a3aea1!

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit de2a49a:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	5 files changed, 373 insertions(+), 305 deletions(-)
google-beta provider	View Diff	5 files changed, 373 insertions(+), 305 deletions(-)
terraform-google-conversion	View Diff	4 files changed, 174 insertions(+), 33 deletions(-)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
1460	1364	93	3

Affected Service Packages

• compute
• networkconnectivityv1

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 3 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

• TestAccComputeInstanceFromTemplate_DiskForceAttach
• TestAccComputeSecurityPolicyRule_securityPolicyRuleWithBodyExcludeExample
• TestAccComputeSubnetwork_secondaryIpRangeInternalRangeInUse

View the build log

---

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
✅ Log	✅	TestAccComputeSubnetwork_secondaryIpRangeInternalRangeInUse
❌ Error · Log	-	TestAccComputeInstanceFromTemplate_DiskForceAttach
❌ Error · Log	-	TestAccComputeSecurityPolicyRule_securityPolicyRuleWithBodyExcludeExample

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the build log or the debug logs folder for detailed results.

@dorianverna, @hao-nan-li VCR tests complete for de2a49a!

[github-actions]

@hao-nan-li This PR has been waiting for review for 3 weekdays. Please take a look! Use the label disable-review-reminders to disable these notifications.

[hao-nan-li]

/gcbrun

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit de2a49a:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	5 files changed, 373 insertions(+), 305 deletions(-)
google-beta provider	View Diff	5 files changed, 373 insertions(+), 305 deletions(-)
terraform-google-conversion	View Diff	4 files changed, 174 insertions(+), 33 deletions(-)

Errors

google provider:

• The diff processor failed to build. This is usually due to the downstream provider failing to compile.

google-beta provider:

• The diff processor failed to build. This is usually due to the downstream provider failing to compile.

Step 1: Replaying Mode

Caution

Build Failure during VCR tests

🔴 REPLAYING mode: The following packages failed to build:

• compute
• networkconnectivityv1

Please fix the compilation errors to complete your PR.

View the build log

@dorianverna VCR tests complete for de2a49a!

New TGC failures

[hao-nan-li]

Reassign as I'll be OOO

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit a2aeba8:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	5 files changed, 377 insertions(+), 305 deletions(-)
google-beta provider	View Diff	5 files changed, 377 insertions(+), 305 deletions(-)
terraform-google-conversion	View Diff	4 files changed, 174 insertions(+), 33 deletions(-)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
1461	1360	93	8

Affected Service Packages

• compute
• networkconnectivityv1

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 8 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

• TestAccComputeAutoscaler_autoscalerBasicExample
• TestAccComputeAutoscaler_autoscalerSingleInstanceExample
• TestAccComputeForwardingRule_ip
• TestAccComputeInstanceFromTemplate_DiskForceAttach
• TestAccComputeRegionAutoscaler_regionAutoscalerBasicExample
• TestAccComputeSubnetwork_secondaryIpRangeInternalRangeInUse
• TestAccComputeSubnetwork_secondaryIpRanges
• TestAccComputeSubnetwork_secondaryIpRanges_sendEmpty

View the build log

---

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
✅ Log	✅	TestAccComputeAutoscaler_autoscalerBasicExample
✅ Log	✅	TestAccComputeAutoscaler_autoscalerSingleInstanceExample
✅ Log	✅	TestAccComputeForwardingRule_ip
✅ Log	✅	TestAccComputeRegionAutoscaler_regionAutoscalerBasicExample
✅ Log	✅	TestAccComputeSubnetwork_secondaryIpRanges
❌ Error · Log	-	TestAccComputeInstanceFromTemplate_DiskForceAttach
❌ Error · Log	-	TestAccComputeSubnetwork_secondaryIpRangeInternalRangeInUse
❌ Error · Log	-	TestAccComputeSubnetwork_secondaryIpRanges_sendEmpty

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the build log or the debug logs folder for detailed results.

@dorianverna, @NickElliot, @hao-nan-li VCR tests complete for a2aeba8!

[NickElliot]

could you resolve the conflicts? thanks!

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 5e0759c:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	5 files changed, 453 insertions(+), 309 deletions(-)
google-beta provider	View Diff	5 files changed, 455 insertions(+), 309 deletions(-)
terraform-google-conversion	View Diff	4 files changed, 287 insertions(+), 37 deletions(-)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
1462	1366	93	3

Affected Service Packages

• compute
• networkconnectivityv1

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 3 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests

• TestAccComputeSubnetwork_secondaryIpRanges
• TestAccComputeSubnetwork_secondaryIpv6Ranges
• TestAccComputeSubnetwork_subnetworkWithSecondaryIpv6RangeExample

View the replaying VCR build log

---

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
❌ Error · Log	-	TestAccComputeSubnetwork_secondaryIpRanges
❌ Error · Log	-	TestAccComputeSubnetwork_secondaryIpv6Ranges
❌ Error · Log	-	TestAccComputeSubnetwork_subnetworkWithSecondaryIpv6RangeExample

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the recording VCR build log or the debug logs folder for detailed results.

@dorianverna, @NickElliot, @hao-nan-li VCR tests complete for 5e0759c!

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 087d9a6:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	5 files changed, 451 insertions(+), 309 deletions(-)
google-beta provider	View Diff	5 files changed, 451 insertions(+), 309 deletions(-)
terraform-google-conversion	View Diff	4 files changed, 283 insertions(+), 37 deletions(-)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
1462	1367	93	2

Affected Service Packages

• compute
• networkconnectivityv1

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 2 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests

• TestAccComputeSubnetwork_secondaryIpv6Ranges
• TestAccComputeSubnetwork_subnetworkWithSecondaryIpv6RangeExample

View the replaying VCR build log

---

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
❌ Error · Log	-	TestAccComputeSubnetwork_secondaryIpv6Ranges
❌ Error · Log	-	TestAccComputeSubnetwork_subnetworkWithSecondaryIpv6RangeExample

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the recording VCR build log or the debug logs folder for detailed results.

@dorianverna, @NickElliot, @hao-nan-li VCR tests complete for 087d9a6!

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 50f050f:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	5 files changed, 457 insertions(+), 309 deletions(-)
google-beta provider	View Diff	5 files changed, 457 insertions(+), 309 deletions(-)
terraform-google-conversion	View Diff	4 files changed, 295 insertions(+), 37 deletions(-)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
1462	1367	93	2

Affected Service Packages

• compute
• networkconnectivityv1

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 2 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests

• TestAccComputeSubnetwork_secondaryIpv6Ranges
• TestAccComputeSubnetwork_subnetworkWithSecondaryIpv6RangeExample

View the replaying VCR build log

---

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
❌ Error · Log	-	TestAccComputeSubnetwork_secondaryIpv6Ranges
❌ Error · Log	-	TestAccComputeSubnetwork_subnetworkWithSecondaryIpv6RangeExample

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the recording VCR build log or the debug logs folder for detailed results.

@dorianverna, @NickElliot, @hao-nan-li VCR tests complete for 50f050f!

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit c3f94b1:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	5 files changed, 469 insertions(+), 309 deletions(-)
google-beta provider	View Diff	5 files changed, 469 insertions(+), 309 deletions(-)
terraform-google-conversion	View Diff	4 files changed, 319 insertions(+), 37 deletions(-)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
1462	1367	93	2

Affected Service Packages

• compute
• networkconnectivityv1

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 2 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests

• TestAccComputeSubnetwork_secondaryIpv6Ranges
• TestAccComputeSubnetwork_subnetworkWithSecondaryIpv6RangeExample

View the replaying VCR build log

---

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
❌ Error · Log	-	TestAccComputeSubnetwork_secondaryIpv6Ranges
❌ Error · Log	-	TestAccComputeSubnetwork_subnetworkWithSecondaryIpv6RangeExample

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the recording VCR build log or the debug logs folder for detailed results.

@dorianverna, @NickElliot, @hao-nan-li VCR tests complete for c3f94b1!

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 03d94a8:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	5 files changed, 479 insertions(+), 311 deletions(-)
google-beta provider	View Diff	5 files changed, 492 insertions(+), 312 deletions(-)
terraform-google-conversion	View Diff	4 files changed, 339 insertions(+), 41 deletions(-)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
1462	1367	93	2

Affected Service Packages

• compute
• networkconnectivityv1

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 2 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests

• TestAccComputeSubnetwork_secondaryIpv6Ranges
• TestAccComputeSubnetwork_subnetworkWithSecondaryIpv6RangeExample

View the replaying VCR build log

---

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
❌ Error · Log	-	TestAccComputeSubnetwork_secondaryIpv6Ranges
❌ Error · Log	-	TestAccComputeSubnetwork_subnetworkWithSecondaryIpv6RangeExample

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the recording VCR build log or the debug logs folder for detailed results.

@dorianverna, @NickElliot, @hao-nan-li VCR tests complete for 03d94a8!

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit ec9c564:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	5 files changed, 496 insertions(+), 309 deletions(-)
google-beta provider	View Diff	5 files changed, 496 insertions(+), 309 deletions(-)
terraform-google-conversion	View Diff	4 files changed, 373 insertions(+), 37 deletions(-)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
1462	1368	93	1

Affected Service Packages

• compute
• networkconnectivityv1

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 1 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests

• TestAccComputeSubnetwork_secondaryIpv6Ranges

View the replaying VCR build log

---

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
✅ Log	✅	TestAccComputeSubnetwork_secondaryIpv6Ranges

🟢 All tests passed!

View the recording VCR build log or the debug logs folder for detailed results.

@dorianverna, @NickElliot, @hao-nan-li VCR tests complete for ec9c564!

[dorianverna]

@NickElliot can you please take a look now? The latest IPv6 test introduced some conflicting changes, but I resolved them now.

The integration test failure doesn't seem to be related to the change here.

[NickElliot]

updating a few comment formattings for consistency, but otherwise LGTM! verified the test case adequately covers the scenario this update resolves.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 9f938e7:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	5 files changed, 496 insertions(+), 309 deletions(-)
google-beta provider	View Diff	5 files changed, 496 insertions(+), 309 deletions(-)
terraform-google-conversion	View Diff	4 files changed, 373 insertions(+), 37 deletions(-)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
1471	1378	93	0

Affected Service Packages

• compute
• networkconnectivityv1

Learn how VCR tests work

---

Step 1: Replaying Mode

🟢 All tests passed in Replaying mode! No Recording was needed.

View the replaying VCR build log

@dorianverna, @NickElliot, @hao-nan-li VCR tests complete for 9f938e7!