There appears to be a bug in the health check code for both net-lb-int & net-lib-ext

[LaoZhuBaba]

Have a look here: https://github.com/GoogleCloudPlatform/cloud-foundation-fabric/blob/master/modules/net-lb-int/health-check.tf#L92

If you compare with net-lb-proxy-int, it has the same code but without the bug.

Am I misunderstanding something? I don't see how this code can work?

  dynamic "https_health_check" {
    for_each = local.hc_https ? [""] : []
    content {
      host               = local.hc.https.host
      port               = local.hc.https.port
      port_name          = local.hc.https.port_name
      port_specification = local.hc.https.port_specification
      proxy_header       = local.hc.https.proxy_header
      request_path       = local.hc.https.request_path
      response           = local.hc.https.response
    }
  }

  dynamic "ssl_health_check" {
    for_each = local.hc_ssl ? [""] : []
    content {
      port               = local.hc.tcp.port #                           <-- why is this tcp not ssl?????
      port_name          = local.hc.tcp.port_name #                      <-- why is this tcp not ssl?????
      port_specification = local.hc.tcp.port_specification #             <-- why is this tcp not ssl?????
      proxy_header       = local.hc.tcp.proxy_header #                   <-- why is this tcp not ssl?????
      request            = local.hc.tcp.request #                        <-- why is this tcp not ssl?????
      response           = local.hc.tcp.response #                       <-- why is this tcp not ssl?????
    }
  }

  dynamic "tcp_health_check" {
    for_each = local.hc_tcp ? [""] : []
    content {
      port               = local.hc.tcp.port
      port_name          = local.hc.tcp.port_name
      port_specification = local.hc.tcp.port_specification
      proxy_header       = local.hc.tcp.proxy_header
      request            = local.hc.tcp.request
      response           = local.hc.tcp.response
    }
  }

[wiktorn]

Good catch, fix is in #3551. There was also similar issue with http2 health check