Terraform's Google provider 8.0 makes EXTERNAL_MANAGED the default load balancer scheme

If a configuration leaves a field out, the provider supplies the value. In 8.0, an unset scheme on google_compute_backend_service or google_compute_global_forwarding_rule now means EXTERNAL_MANAGED ^[2]. Those configurations therefore describe the external Application Load Balancer, not the Classic one ^[3]. An existing Classic load balancer built from such a block no longer matches its own code, and the next plan may propose changing it ^[4].

That change shows up in the plan ^[4]. It goes unnoticed only in a pipeline that applies without anyone reading the plan. The fix is one line in each affected block: `load_balancing_scheme = "EXTERNAL"` ^[4]. InfoQ's suggested upgrade steps begin with a code search for load balancer resources that omit the field ^[17]. I would set the field on every one of these resources, including the ones that are supposed to move. Then the move to EXTERNAL_MANAGED is a change someone wrote and reviewed by itself, separate from the provider upgrade.

Configurations that use removed resources need edits before the upgrade ^[6]. Most of the removed resources have a named successor. The three notebooks resources map to google_workbench_instance. The BeyondCorp app connection, connector and gateway map to Security Gateway resources. google_vertex_ai_schedule maps to google_colab_schedule ^[5]. The InfoQ post does not list every removal, and it names the upgrade guide and the GitHub changelog as the authoritative references ^[11].

The list-to-set work is the best engineering in this release. Sometimes an API returns values in a different order from the one the configuration used. A list attribute then reports a diff that never goes away, and HashiCorp says switching to sets prevents those perpetual diffs ^[7]. Some schema changes migrate on their own and some do not. Certain integer-to-string conversions migrate state automatically, while others need configuration edits ^[9]. InfoQ's checklist also covers list-to-set conversions and write-only version attributes that changed type or became required. Those go on the review list next to anything the plan marks for destroy or replace ^[16].

OpenTofu users get every provider-side breaking change, the scheme default included, because those changes ship in the provider whichever CLI runs it ^[12]. They do not get the discovery side of the 7.x work. The provider supports Terraform list resources for the terraform query workflow. That workflow searches for infrastructure outside state and can generate resource and import configuration, across services that include Compute Engine, IAM and BigQuery ^[15]. OpenTofu has no equivalent, and a feature request for tofu query, issue #3787, is still pending ^[14].