fix(terraform): support GKE build-suffixed versions

[plural-copilot]

Summary

Fixes the shared terraform/gke-cluster module's semantic version parsing when next_kubernetes_version contains a valid GKE build suffix such as 1.35.3-gke.2190000.

Compatibility

Numeric dotted versions such as 1.33 and 1.34.9 retain their existing parsed major/minor/patch behavior. Build-suffixed versions parse their semantic components for the existing node-group parity conditional, while the original full version string continues unchanged to module.gke, GKE cluster configuration, node pools, and cluster metadata.

Boundaries / non-goals

This is a one-line shared-module-only change. It does not modify fleet cluster configurations, version defaults, networking, node-pool configuration, direct infrastructure configuration, Cilium, or GKE-managed Dataplane V2 settings.

Why now

This is a prerequisite for an exact-version GKE upgrade because the exact GKE build identifier must be accepted by the module without altering the version passed to GKE.

Validation

• terraform fmt terraform/gke-cluster
• terraform init -backend=false -input=false
• terraform validate
• Terraform console evaluation for 1.34.9 and 1.35.3-gke.2190000 (including unchanged build-suffixed pass-through)

Plural Stack: gke-fleet-cluster-dev
Plural Stack: gke-fleet-cluster-prod

[plural-copilot]

This PR was generated by the codex Plural Agent Runtime. Here's some useful information you might want to know to evaluate the ai's perfomance:

Name	Details
💬 Prompt	Create one focused PR against main for the shared Terraform module terraform/gke-cluster....
🔗 Run history	View run history

[plural-copilot]

Plural has generated a plan for this PR, full details here

Plan Details

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # module.gke.google_container_cluster.primary has changed
  ~ resource "google_container_cluster" "primary" {
        id                                       = "projects/pluralsh-test-384515/locations/us-central1/clusters/gke-fleet-dev"
        name                                     = "gke-fleet-dev"
      ~ node_version                             = "1.33.11-gke.1197000" -> "1.34.9-gke.1322001"
        # (38 unchanged attributes hidden)

      ~ node_pool {
            name                        = "blue"
          ~ node_count                  = 0 -> 2
          ~ version                     = "1.33.11-gke.1197000" -> "1.34.10-gke.1236000"
            # (6 unchanged attributes hidden)

          ~ autoscaling {
              ~ min_node_count       = 0 -> 1
                # (4 unchanged attributes hidden)
            }

          ~ node_config {
              ~ effective_taints            = [
                  - {
                      - effect = "NO_SCHEDULE"
                      - key    = "platform.plural.sh/pending"
                      - value  = "upgrade"
                    },
                ]
                tags                        = [
                    "gke-gke-fleet-dev",
                    "gke-gke-fleet-dev-blue",
                ]
                # (22 unchanged attributes hidden)

                # (5 unchanged blocks hidden)
            }

            # (3 unchanged blocks hidden)
        }
      ~ node_pool {
            name                        = "green"
          ~ node_count                  = 1 -> 0
          ~ version                     = "1.33.11-gke.1197000" -> "1.34.10-gke.1236000"
            # (6 unchanged attributes hidden)

          ~ autoscaling {
              ~ min_node_count       = 1 -> 0
                # (4 unchanged attributes hidden)
            }

          ~ node_config {
              ~ effective_taints            = [
                  + {
                      + effect = "NO_SCHEDULE"
                      + key    = "platform.plural.sh/pending"
                      + value  = "upgrade"
                    },
                ]
                tags                        = [
                    "gke-gke-fleet-dev",
                    "gke-gke-fleet-dev-green",
                ]
                # (22 unchanged attributes hidden)

                # (5 unchanged blocks hidden)
            }

            # (3 unchanged blocks hidden)
        }

        # (29 unchanged blocks hidden)
    }


Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

─────────────────────────────────────────────────────────────────────────────

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # plural_cluster.this will be updated in-place
  ~ resource "plural_cluster" "this" {
        id             = "5e1553c4-aa35-49c6-aae6-7a12551a0341"
      ~ kubeconfig     = {
          ~ token                  = (sensitive value)
            # (2 unchanged attributes hidden)
        }
        name           = "gke-fleet-dev"
        tags           = {
            "fleet" = "gke-fleet"
            "tier"  = "dev"
        }
        # (8 unchanged attributes hidden)
    }

  # module.gke.google_container_node_pool.pools["blue"] will be updated in-place
  ~ resource "google_container_node_pool" "pools" {
        id                          = "projects/pluralsh-test-384515/locations/us-central1/clusters/gke-fleet-dev/nodePools/blue"
        name                        = "blue"
      ~ version                     = "1.34.10-gke.1236000" -> "1.34"
        # (10 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }

  # module.gke.google_container_node_pool.pools["green"] will be updated in-place
  ~ resource "google_container_node_pool" "pools" {
        id                          = "projects/pluralsh-test-384515/locations/us-central1/clusters/gke-fleet-dev/nodePools/green"
        name                        = "green"
      ~ version                     = "1.34.10-gke.1236000" -> "1.34"
        # (10 unchanged attributes hidden)

        # (6 unchanged blocks hidden)
    }

Plan: 0 to add, 3 to change, 0 to destroy.

[plural-copilot]

Plural AI has generated a summary of what this plan entails here

Plan Summary

Summary

The plan makes three in-place updates and no resource additions or destruction. It reconciles a GKE blue/green upgrade state that was changed outside Terraform, updates both node pools from a concrete patch version to the 1.34 minor-version constraint, and refreshes the registered Plural cluster kubeconfig token. The change is probably safe for a development cluster, but it is not risk-free: node-pool version reconciliation can trigger rolling node replacement or disruption, and the Plural token update can affect management-cluster access to this cluster.

Root Cause

The live GKE cluster was modified outside Terraform during a blue/green Kubernetes upgrade: the control plane and both pools moved from 1.33 to 1.34, capacity shifted from green to blue, and the upgrade taint moved between pools. The checked-in configuration at commit ddf682fa4564d35b2a9d28ea21def7962d9f876f intentionally derives the active pool from the even minor version: for 1.34, blue is active with min_count = 1 and green is the draining pool with min_count = 0 plus platform.plural.sh/pending=upgrade. Terraform is now reconciling the two node-pool resources to the configured 1.34 version and updating the plural_cluster registration with a newly evaluated access token.

Key Evidence

• Plan: 0 to add, 3 to change, 0 to destroy; every planned action is an in-place update.
• Both google_container_node_pool.pools["blue"] and ["green"] change only visibly in version, from 1.34.10-gke.1236000 to 1.34; GKE will select a matching/current patch release rather than creating a new Terraform resource.
• The out-of-band diff shows the expected blue/green transition: blue went from 0 to 2 nodes and min_node_count from 0 to 1, while green went from 1 to 0 and min_node_count from 1 to 0. The upgrade taint was removed from blue and added to green.
• locals.tf selects blue as active_node_group for an even 1.34 minor version and green as drain_node_group; cluster.tf applies the active/draining counts and taints accordingly.
• plural_cluster.this changes its sensitive kubeconfig.token. plural.tf obtains this from data.google_client_config.default.access_token, so token rotation or refresh can produce this diff even when cluster identity is unchanged.
• The provided IAM code grants the Plural stacks service account roles/owner and roles/storage.admin, and ExternalDNS roles/dns.admin, but none of those IAM bindings are in this plan.

Contextual Observations

• Expected blast radius: limited to the gke-fleet-dev regional GKE cluster in project pluralsh-test-384515, specifically its blue and green node pools, plus the Plural management-plane registration for this cluster. The VPC, subnets, secondary ranges, APIs, IAM roles, and databases are not planned for change.
• Workload impact: changing a GKE node-pool version can cordon/drain and recreate nodes depending on the provider/module's upgrade behavior. Pods may be rescheduled, and workloads without sufficient replicas, PodDisruptionBudgets, or spare capacity can experience downtime. The desired blue/green state provides one active pool, but the visible plan alone does not prove that every workload has capacity or that draining is complete.
• Critical systems: no specific production system is indicated—the cluster and tier = "dev" tags identify it as development. However, workloads running on this cluster can be affected, and the plural_cluster token update could temporarily affect Plural operators or GitOps actions that use the registered kubeconfig.
• Safety assessment: conditionally safe, not automatically safe. The absence of destroys is reassuring, and the desired state matches the upgrade design, but the out-of-band changes must be intentional and the node-pool rollout should be treated as a maintenance event.
• Important discrepancy to verify: the file defaults shown use kubernetes_version = "1.33" and next_kubernetes_version = "1.33", while the plan targets 1.34. Therefore the stack is receiving variable overrides, another tfvars source, or generated inputs that are not included in the snippets. Confirm those inputs before applying.