Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow brand new setup for google_developer_connect_connection #12493

Merged
merged 1 commit into from
Dec 19, 2024
+61 −6
Merged

Allow brand new setup for google_developer_connect_connection #12493

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 17 additions & 4 deletions mmv1/products/developerconnect/Connection.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,13 +45,24 @@ async:
message: 'message'
custom_code:
examples:
- name: 'developer_connect_connection_basic'
- name: 'developer_connect_connection_new'
rainshen49 marked this conversation as resolved.
Show resolved Hide resolved
primary_resource_id: 'my-connection'
primary_resource_name: 'fmt.Sprintf("tf-test-connection%s", context["random_suffix"])'
primary_resource_name: 'fmt.Sprintf("tf-test-connection-new%s", context["random_suffix"])'
min_version: 'beta'
vars:
connection_name: 'tf-test-connection'
- name: 'developer_connect_connection_github_doc'
connection_name: 'tf-test-connection-new'
test_env_vars:
project: 'PROJECT_NAME'
- name: 'developer_connect_connection_existing_credentials'
primary_resource_id: 'my-connection'
primary_resource_name: 'fmt.Sprintf("tf-test-connection-cred%s", context["random_suffix"])'
min_version: 'beta'
vars:
connection_name: 'tf-test-connection-cred'
secret_name: "projects/your-project/secrets/your-secret-id/versions/latest"
test_vars_overrides:
secret_name: '"projects/devconnect-terraform-creds/secrets/tf-test-do-not-change-github-oauthtoken-e0b9e7/versions/1"'
- name: 'developer_connect_connection_existing_installation'
min_version: 'beta'
exclude_test: true
parameters:
Expand Down Expand Up @@ -99,6 +110,7 @@ properties:
Represents an OAuth token of the account that authorized the Connection,and
associated metadata.
min_version: 'beta'
default_from_api: true
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My only concern is the inclusion of default_from_api: true on these two properties. What is the reason for this?

Copy link
Contributor Author

@rainshen49 rainshen49 Dec 18, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, this requires some product knowledge, but let me try to explain. default_from_api: true means if the user leave it unspecified, Terraforms defers to the server provided value instead of sending an empty value that wipes out the server side value. This option is designed for fields whose value can be both server-provided and user-supplied. Consider a typical config to set up a connection

resource "google_developer_connect_connection" "default" {
  ...

  github_config {
    github_app = "FIREBASE"
    # Note the unspecified authorizer_credentials field
  }
}

output "next_steps" {
  description = "Follow the action_uri if present to continue setup"
  value = google_developer_connect_connection.default.installation_state
}
  1. Run terraform apply, and the output will provide a URL for the user to visit for an OAuth flow
  2. After the OAuth flow, authorizer_credentials is populated on the server side, but the Terraform configuration doesn't know about it
  3. If the user runs terraform apply again on the same config, without default_from_api, terraform will detect a diff and accidentally wipe out the authorizer_credentials
  4. The correct behavior is that terraform will refresh to capture the authorizer_credentials populated outside of Terraform, and doesn't complain about a diff.
  5. If the user wants to use another authorizer_credentials, they can do so and Terraform will send the new value to the server

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the explanation, this is all I needed!

properties:
- name: 'oauthTokenSecretVersion'
type: String
Expand All @@ -119,6 +131,7 @@ properties:
description: |
Optional. GitHub App installation id.
min_version: 'beta'
default_from_api: true
- name: 'installationUri'
type: String
description: |
Expand Down
7 changes: 6 additions & 1 deletion ...eveloper_connect_connection_basic.tf.tmpl → ...t_connection_existing_credentials.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,12 @@ resource "google_developer_connect_connection" "{{$.PrimaryResourceId}}" {
github_app = "DEVELOPER_CONNECT"

authorizer_credential {
oauth_token_secret_version = "projects/devconnect-terraform-creds/secrets/tf-test-do-not-change-github-oauthtoken-e0b9e7/versions/1"
oauth_token_secret_version = "{{index $.Vars "secret_name"}}"
}
}
}

output "next_steps" {
description = "Follow the action_uri if present to continue setup"
value = google_developer_connect_connection.{{$.PrimaryResourceId}}.installation_state
}
8 changes: 7 additions & 1 deletion ...per_connect_connection_github_doc.tf.tmpl → ..._connection_existing_installation.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,11 +15,17 @@ resource "google_secret_manager_secret_version" "github-token-secret-version" {
secret_data = file("my-github-token.txt")
}

resource "google_project_service_identity" "devconnect-p4sa" {
provider = google-beta

service = "developerconnect.googleapis.com"
}

data "google_iam_policy" "p4sa-secretAccessor" {
binding {
role = "roles/secretmanager.secretAccessor"
// Here, 123456789 is the Google Cloud project number for the project that contains the connection.
members = ["serviceAccount:service-123456789@gcp-sa-devconnect.iam.gserviceaccount.com"]
members = [google_project_service_identity.devconnect-p4sa.member]
}
}

Expand Down
31 changes: 31 additions & 0 deletions mmv1/templates/terraform/examples/developer_connect_connection_new.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
resource "google_developer_connect_connection" "{{$.PrimaryResourceId}}" {
provider = google-beta
location = "us-central1"
connection_id = "{{index $.Vars "connection_name"}}"

github_config {
github_app = "FIREBASE"
}

depends_on = [google_project_iam_member.devconnect-secret]
}

output "next_steps" {
description = "Follow the action_uri if present to continue setup"
value = google_developer_connect_connection.{{$.PrimaryResourceId}}.installation_state
}

# Setup permissions. Only needed once per project
resource "google_project_service_identity" "devconnect-p4sa" {
provider = google-beta

service = "developerconnect.googleapis.com"
}

resource "google_project_iam_member" "devconnect-secret" {
provider = google-beta

project = "{{index $.TestEnvVars "project"}}"
role = "roles/secretmanager.admin"
member = google_project_service_identity.devconnect-p4sa.member
}
Loading