Terraform Google Provider v8.7.0: Gemini Data Analytics Resources, Dataproc Disk Type Deprecation, and More

Introduction

HashiCorp released v8.7.0 of the hashicorp/terraform-provider-google on October 15, 2026. This release introduces new resources for Gemini Data Analytics and Vertex AI, deprecates a Dataproc field in favor of a renamed one, and ships a long list of field-level improvements across compute, container, networksecurity, and other services. This is the first tracked release on terraformpilot.com for this provider, so there is no prior-version diff to reference beyond what is documented in the v8.7.0 release notes.

What Is New

Deprecation: Dataproc disk_type → type

attached_disk_config.disk_type is deprecated on both google_dataproc_cluster and google_dataproc_workflow_template (#29870). Use attached_disk_config.type instead:

resource "google_dataproc_cluster" "example" {
  name   = "example-cluster"
  region = "us-central1"
 
  cluster_config {
    worker_config {
      disk_config {
        attached_disk_config {
          # Old (deprecated):
          # disk_type = "pd-ssd"
 
          # New:
          type = "pd-ssd"
        }
      }
    }
  }
}

Plan for removal of disk_type in a future major version and migrate existing configurations now to avoid a forced rewrite later.

New resources: Gemini Data Analytics

The provider adds a full resource/data-source set for google_gemini_data_analytics_data_agent (#29775):

• google_gemini_data_analytics_data_agent (resource)
• google_gemini_data_analytics_data_agent_iam_binding (resource)
• google_gemini_data_analytics_data_agent_iam_member (resource)
• google_gemini_data_analytics_data_agent_iam_policy (resource)
• google_gemini_data_analytics_data_agent_iam_policy (data source)

resource "google_gemini_data_analytics_data_agent" "agent" {
  data_agent_id = "analytics-agent"
  location      = "us-central1"
  display_name  = "Analytics Data Agent"
}
 
resource "google_gemini_data_analytics_data_agent_iam_member" "viewer" {
  data_agent_id = google_gemini_data_analytics_data_agent.agent.data_agent_id
  location      = "us-central1"
  role          = "roles/viewer"
  member        = "user:luca@openempower.com"
}

New resource: Vertex AI online evaluator

google_vertex_ai_online_evaluator is added (#29810) for managing online evaluation jobs on Vertex AI. Check the provider docs page for the resource for the full argument reference before adopting it.

Notable improvements

• Compute: network_interface.service_class_id added on google_compute_instance, google_compute_instance_template, and google_compute_region_instance_template (#29821); disk_encryption_key.kms_key_name is now updatable in place on google_compute_region_disk (#29833); snapshot_encryption_key.kms_key_self_link is now updatable in place on google_compute_snapshot (#29815); scheduling.preemption_notice_duration is promoted to GA (#29814).
• Container (GKE): best_effort_provisioning added to google_container_node_pool and to node_pool blocks inside google_container_cluster (#29771):

resource "google_container_node_pool" "spot_pool" {
  name     = "spot-pool"
  cluster  = google_container_cluster.primary.name
  location = "us-central1"
 
  node_config {
    machine_type = "e2-medium"
  }
 
  best_effort_provisioning {
    enabled = true
  }
}

• Networksecurity: google_network_security_authz_policy gains new network_rules matchers (ignore_case, prefix, suffix, contains), a to.not_operations field, and from.sources.resources / from.not_sources.resources nested fields (#29865).
• Networkservices: client-side validation of flex_shielding.flex_shielding_regions on google_network_services_edge_cache_origin was removed, so newer regions such as EUROPE_WEST3 and US_EAST5 are now accepted without a provider upgrade blocking them (#29825).
• Looker: added support for Regional Endpoint Policies (REP); see the provider reference guide for configuration (#29811).
• Workbench: metadata keys disable-bigquery, enable-opencode, enable-opencode-web, and enable-antigravity now trigger a stop/restart of google_workbench_instance on update, since they only take effect at startup (#29864). Expect a stop/restart on the next apply after changing these keys.
• Smaller field additions: encryption_configuration on google_bigquery_analytics_hub_query_template (#29869); model_settings.thinking_level on google_ces_agent (#29778); oneof_value/sub_parameters on google_cloud_security_compliance_cloud_control (#29812); free_form_context, agent_coaching_context, tools on google_dialogflow_generator (#29777); modalities in template_metadata on google_model_armor_template (#29774); agent_compute/deployment_model on google_network_services_agent_connectivity_template (#29817); properties.vm_file_system_storage_type/vm_backup_storage_type on google_oracle_database_cloud_vm_cluster (#29776).

Bug fix

ExactlyOneOf validation between organization and parent on google_cloud_security_compliance_cloud_control was fixed; configurations that previously failed or incorrectly passed validation on this mutually-exclusive pair should be re-checked after upgrading.

Upgrade Steps

Pin the provider version in the required_providers block:

terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 8.7.0"
    }
  }
}

Then re-initialize to pull the new provider release:

terraform init -upgrade

If any configuration uses attached_disk_config.disk_type on google_dataproc_cluster or google_dataproc_workflow_template, update it to attached_disk_config.type and run a plan to confirm no unexpected diff before applying.

Verify

Confirm the provider version and run a plan to check for drift from the deprecation rename or the validation fix:

terraform version
terraform plan

terraform version should report provider registry.terraform.io/hashicorp/google v8.7.0. If Dataproc configurations were migrated to type, the plan should show no changes for that attribute; if a diff appears, review the resource state against the new field name before applying.

Conclusion

v8.7.0 is primarily additive: new Gemini Data Analytics and Vertex AI online evaluator resources, a GA promotion for preemption notice duration, and several in-place-update improvements for compute encryption keys. The only action item is the Dataproc disk_type → type rename, which is a straightforward find-and-replace in HCL. Teams using Workbench metadata keys for opencode/antigravity features should expect a stop/restart on next apply. Full details are on the release page.