-
Notifications
You must be signed in to change notification settings - Fork 1.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ephemeral
: add ephemeral_google_service_account_access_token
#12140
base: FEATURE-BRANCH-ephemeral-resource
Are you sure you want to change the base?
ephemeral
: add ephemeral_google_service_account_access_token
#12140
Conversation
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
51639c8
to
8242932
Compare
recent commit addresses some issues, ephemeral resource is now working when running locally
ephemeral "google_test" "test" {
target_service_account = "malvarezleon@hc-terraform-testing.iam.gserviceaccount.com"
scopes = ["https://www.googleapis.com/auth/cloud-platform"]
lifetime = "10s"
}
POST /v1/projects/-/serviceAccounts/malvarezleon@hc-terraform-testing.iam.gserviceaccount.com:generateAccessToken?alt=json&prettyPrint=false HTTP/1.1
Host: iamcredentials.googleapis.com
User-Agent: google-api-go-client/0.5 Terraform/1.10.0-alpha20241023 (+https://www.terraform.io) Terraform-Plugin-SDK/terraform-plugin-framework terraform-provider-google/dev
Content-Length: 78
Content-Type: application/json
X-Goog-Api-Client: gl-go/1.23.2 gdcl/0.193.0
Accept-Encoding: gzip
{
"lifetime": "10s",
"scope": [
"https://www.googleapis.com/auth/cloud-platform"
]
}
-----------------------------------------------------
2024/11/04 19:41:00 [DEBUG] Google API Response Details:
---[ RESPONSE ]--------------------------------------
HTTP/2.0 200 OK
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Cache-Control: private
Content-Type: application/json; charset=UTF-8
Date: Tue, 05 Nov 2024 03:41:00 GMT
Server: scaffolding on HTTPServer2
Vary: Origin
Vary: X-Origin
Vary: Referer
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 0
{
"accessToken": "ya29.c.c0ASRK0GZTgneHg5v4KBWZPZLdNFhNsehSCn8hpgW5R91nXQuACK3BoU-PFRmOjO7Pxu0WLoyVyCfso2OKHIO7tlZf38imfQ6WVBl7g8g4bg1WLQvVzSo7z0o_RNHKkfmI0xP5xcboXYXHyYf7jzrwEvBSeSYQDUzxxtHNnzQJmvsdD3GtrEKMpb1gTVv8mckZ59Gsn5MztgCd0THTNHZIkuQAsIeUfnVLoiv17Y8MTBTuQE-rSOPN7X51szH-HULI0efAlnNi7Sic8ws5qHi9FfHUNIxwy9LdHiya7d3-MViYsXL-Qf1VUsG9HLdj9uJric3E5k_yT7vTaG-EwKYw2hkefSQDpN5rPWD0G1XoqDvUOZc4GD1P2ZLvC2JsufcwFTKe9LxBoFZcsZF6fiXzqlzwHMZV9E_LiyWhNdqXtKb8s9w8u0d68B-xIptX6bYMlJoVEVqgs7T7rR9yDEWl9OjaWrtI-LK03vi99OG5AFn44h1676CzJwGclPNhGDdFxI1i1bgFu6nadfQ0OvGJfRTA5Gnn3LYEITnG3iChEuXHepxN2CqL6vQ_pKOVprt5GETTjTmBwBFPMFro4Q3hbQ49EthXzS5lTus6Avg2E625Pbbrutwk3JcreuQv_bwz2bbmFqp-pJ1MrZfO-yimq8mZBte0kxB_IVJgmjjbSvl96JkSr1Rurxn10XWZ7lSkyWM5oe51Mvzi2vvtd332yIcV-dWUZgmV-BvekbJmRVgzzvZbih0tbRucg0I7t201kSV-db7omY4aY-_dZXdx3tfS7j64ZQ0O_-uYFUe3_9kgq3gI1gap4MBeBwte19r8O_-yRw3OmQjlhXZikes_jx2w2qbQIQVq1ee4wU2w8uWBWr9oIrhjRx2rydIBn3SZJQ4foeXpYMdwFJ_h_d9zI-Jbgt9Uwh46ibhu1vUpJW2B-gFhUpyhdmF2mgWWOvnlY6F4ts2rQpF85rRyBgfsQStqZMftM0OQSyhZpgyeQq2VJRp2vZXdsvU",
"expireTime": "2024-11-05T03:41:10Z"
}
-----------------------------------------------------
2024/11/04 19:41:00 [DEBUG] Retry Transport: Stopping retries, last request was successful
2024/11/04 19:41:00 [DEBUG] Retry Transport: Returning after 1 attempts still missing tests, though the ability to test ephemeral resources / values is currently being worked on, this was pushed last friday and will be included in an example of how it can be tested can be viewed here: hashicorp/terraform-provider-corner@76f20a3 The echo provider can be found here: hashicorp/terraform-provider-corner@44d5ec0 |
mmv1/third_party/terraform/services/resourcemanager/ephemeral_google_service_account_token.go
Outdated
Show resolved
Hide resolved
This comment was marked as outdated.
This comment was marked as outdated.
1 similar comment
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
mmv1/third_party/terraform/services/resourcemanager/ephemeral_google_service_account_token.go
Outdated
Show resolved
Hide resolved
2cda8ad
to
a618711
Compare
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
a618711
to
20c115f
Compare
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
Errors
|
Tests analyticsTotal tests: 0 Click here to see the affected service packages
🔴 Errors occurred during REPLAYING mode. Please fix them to complete your PR. View the build log |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please rebase your PR on the latest version of FEATURE-BRANCH-ephemeral-resource
- this will pull in the dependency updates and fix the build errors showing in this PR.
Also, please move the validator code into the file discussed here.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Follow up to previous review
mmv1/third_party/terraform/services/resourcemanager/ephemeral_google_service_account_token.go
Outdated
Show resolved
Hide resolved
...hird_party/terraform/services/resourcemanager/ephemeral_google_service_account_token_test.go
Outdated
Show resolved
Hide resolved
mmv1/third_party/terraform/services/resourcemanager/ephemeral_google_service_account_token.go
Outdated
Show resolved
Hide resolved
b7d0840
to
79a87d0
Compare
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
|
tests pass locally however we should consider the === RUN TestEphemeralServiceAccountToken_basic
=== PAUSE TestEphemeralServiceAccountToken_basic
=== RUN TestEphemeralServiceAccountToken_withDelegates
=== PAUSE TestEphemeralServiceAccountToken_withDelegates
=== RUN TestEphemeralServiceAccountToken_withCustomLifetime
=== PAUSE TestEphemeralServiceAccountToken_withCustomLifetime
=== CONT TestEphemeralServiceAccountToken_basic
=== CONT TestEphemeralServiceAccountToken_withCustomLifetime
=== CONT TestEphemeralServiceAccountToken_withDelegates
2024/11/06 16:47:14 [INFO] Authenticating using configured Google JSON 'credentials'...
2024/11/06 16:47:14 [INFO] -- Scopes: [https://www.googleapis.com/auth/cloud-platform https://www.googleapis.com/auth/userinfo.email]
2024/11/06 16:47:14 [INFO] Authenticating using configured Google JSON 'credentials'...
2024/11/06 16:47:14 [INFO] -- Scopes: [https://www.googleapis.com/auth/cloud-platform https://www.googleapis.com/auth/userinfo.email]
2024/11/06 16:47:14 [INFO] Authenticating using configured Google JSON 'credentials'...
2024/11/06 16:47:14 [INFO] -- Scopes: [https://www.googleapis.com/auth/cloud-platform https://www.googleapis.com/auth/userinfo.email]
2024/11/06 16:47:14 [DEBUG] Waiting for state to become: [success]
2024/11/06 16:47:14 [INFO] Authenticating using configured Google JSON 'credentials'...
2024/11/06 16:47:14 [INFO] -- Scopes: [https://www.googleapis.com/auth/cloud-platform https://www.googleapis.com/auth/userinfo.email]
2024/11/06 16:47:14 [DEBUG] Waiting for state to become: [success]
2024/11/06 16:47:14 [INFO] Authenticating using configured Google JSON 'credentials'...
2024/11/06 16:47:14 [INFO] -- Scopes: [https://www.googleapis.com/auth/cloud-platform https://www.googleapis.com/auth/userinfo.email]
2024/11/06 16:47:14 [INFO] Authenticating using configured Google JSON 'credentials'...
2024/11/06 16:47:14 [INFO] -- Scopes: [https://www.googleapis.com/auth/cloud-platform https://www.googleapis.com/auth/userinfo.email]
2024/11/06 16:47:14 [DEBUG] Waiting for state to become: [success]
2024/11/06 16:47:15 [INFO] Terraform is using this identity: mauricio-alvarezleon@hc-terraform-testing.iam.gserviceaccount.com
2024/11/06 16:47:15 [DEBUG] Verifying projects/hc-terraform-testing/serviceAccounts/tf-bootstrap-sa-delegates@hc-terraform-testing.iam.gserviceaccount.com as bootstrapped service account.
2024/11/06 16:47:15 [INFO] Instantiating Google Cloud IAM client for path https://iam.googleapis.com/
2024/11/06 16:47:15 [DEBUG] Retry Transport: starting RoundTrip retry loop
2024/11/06 16:47:15 [DEBUG] Retry Transport: request attempt 0
2024/11/06 16:47:15 [INFO] Terraform is using this identity: mauricio-alvarezleon@hc-terraform-testing.iam.gserviceaccount.com
2024/11/06 16:47:15 [DEBUG] Verifying projects/hc-terraform-testing/serviceAccounts/tf-bootstrap-sa-lifetime@hc-terraform-testing.iam.gserviceaccount.com as bootstrapped service account.
2024/11/06 16:47:15 [INFO] Instantiating Google Cloud IAM client for path https://iam.googleapis.com/
2024/11/06 16:47:15 [DEBUG] Retry Transport: starting RoundTrip retry loop
2024/11/06 16:47:15 [DEBUG] Retry Transport: request attempt 0
2024/11/06 16:47:15 [INFO] Terraform is using this identity: mauricio-alvarezleon@hc-terraform-testing.iam.gserviceaccount.com
2024/11/06 16:47:15 [DEBUG] Verifying projects/hc-terraform-testing/serviceAccounts/tf-bootstrap-sa-basic@hc-terraform-testing.iam.gserviceaccount.com as bootstrapped service account.
2024/11/06 16:47:15 [INFO] Instantiating Google Cloud IAM client for path https://iam.googleapis.com/
2024/11/06 16:47:15 [DEBUG] Retry Transport: starting RoundTrip retry loop
2024/11/06 16:47:15 [DEBUG] Retry Transport: request attempt 0
2024/11/06 16:47:15 [DEBUG] Retry Transport: Stopping retries, last request was successful
2024/11/06 16:47:15 [DEBUG] Retry Transport: Returning after 1 attempts
2024/11/06 16:47:15 [DEBUG] Setting service account permissions.
2024/11/06 16:47:15 [INFO] Instantiating Google Cloud IAM client for path https://iam.googleapis.com/
2024/11/06 16:47:15 [DEBUG] Retry Transport: Stopping retries, last request was successful
2024/11/06 16:47:15 [DEBUG] Retry Transport: Returning after 1 attempts
2024/11/06 16:47:15 [DEBUG] Setting service account permissions.
2024/11/06 16:47:15 [INFO] Instantiating Google Cloud IAM client for path https://iam.googleapis.com/
2024/11/06 16:47:15 [DEBUG] Retry Transport: starting RoundTrip retry loop
2024/11/06 16:47:15 [DEBUG] Retry Transport: request attempt 0
2024/11/06 16:47:15 [DEBUG] Retry Transport: starting RoundTrip retry loop
2024/11/06 16:47:15 [DEBUG] Retry Transport: request attempt 0
2024/11/06 16:47:15 [DEBUG] Retry Transport: Stopping retries, last request was successful
2024/11/06 16:47:15 [DEBUG] Retry Transport: Returning after 1 attempts
2024/11/06 16:47:15 [DEBUG] Setting service account permissions.
2024/11/06 16:47:15 [INFO] Instantiating Google Cloud IAM client for path https://iam.googleapis.com/
2024/11/06 16:47:15 [DEBUG] Retry Transport: starting RoundTrip retry loop
2024/11/06 16:47:15 [DEBUG] Retry Transport: request attempt 0
2024/11/06 16:47:16 [DEBUG] Retry Transport: Stopping retries, last request was successful
2024/11/06 16:47:16 [DEBUG] Retry Transport: Returning after 1 attempts
--- PASS: TestEphemeralServiceAccountToken_basic (26.47s)
--- PASS: TestEphemeralServiceAccountToken_withDelegates (26.69s)
--- PASS: TestEphemeralServiceAccountToken_withCustomLifetime (26.79s)
PASS
ok github.com/hashicorp/terraform-provider-google/google/services/resourcemanager 31.149s |
Tests analyticsTotal tests: 4267 Click here to see the affected service packages
Action takenFound 235 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
|
This comment was marked as outdated.
This comment was marked as outdated.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Here are some more review comments, mainly:
- Requesting testing of the new validators
- Requested changes to the acc test using
delegates
...hird_party/terraform/services/resourcemanager/ephemeral_google_service_account_token_test.go
Outdated
Show resolved
Hide resolved
...hird_party/terraform/services/resourcemanager/ephemeral_google_service_account_token_test.go
Outdated
Show resolved
Hide resolved
...hird_party/terraform/services/resourcemanager/ephemeral_google_service_account_token_test.go
Outdated
Show resolved
Hide resolved
mmv1/third_party/terraform/services/resourcemanager/ephemeral_google_service_account_token.go
Outdated
Show resolved
Hide resolved
mmv1/third_party/terraform/services/resourcemanager/ephemeral_google_service_account_token.go
Outdated
Show resolved
Hide resolved
...hird_party/terraform/services/resourcemanager/ephemeral_google_service_account_token_test.go
Outdated
Show resolved
Hide resolved
…google_service_account_token_test.go Co-authored-by: Sarah French <15078782+SarahFrench@users.noreply.github.com>
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
|
2 similar comments
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
|
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
|
Tests analyticsTotal tests: 4270 Click here to see the affected service packages
Action takenFound 7 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
|
1 similar comment
Tests analyticsTotal tests: 4270 Click here to see the affected service packages
Action takenFound 7 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
|
Tests analyticsTotal tests: 4270 Click here to see the affected service packages
Action takenFound 8 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
|
🔴 Tests failed during RECORDING mode: 🔴 Errors occurred during RECORDING mode. Please fix them to complete your PR. |
🔴 Tests failed during RECORDING mode: 🔴 Errors occurred during RECORDING mode. Please fix them to complete your PR. |
🟢 Tests passed during RECORDING mode: 🟢 No issues found for passed tests after REPLAYING rerun. 🔴 Tests failed during RECORDING mode: 🔴 Errors occurred during RECORDING mode. Please fix them to complete your PR. |
ephemeral
: add ephemeral_google_service_account_token
ephemeral
: add ephemeral_google_service_account_access_token
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think this'll be the final review! The big thing is fixing the name, and the rest is making sure the code is easier to understand for people to understand if they're new to the plugin-framework (and weren't involved in this PR).
mmv1/third_party/terraform/services/resourcemanager/ephemeral_google_service_account_token.go
Outdated
Show resolved
Hide resolved
mmv1/third_party/terraform/services/resourcemanager/ephemeral_google_service_account_token.go
Outdated
Show resolved
Hide resolved
...hird_party/terraform/services/resourcemanager/ephemeral_google_service_account_token_test.go
Outdated
Show resolved
Hide resolved
mmv1/third_party/terraform/services/resourcemanager/ephemeral_google_service_account_token.go
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I just realised - this PR should also include some handwritten documentation for google_service_account_access_token! However Registry support for docs is currently in progress.
I think you can use the docs for the existing data source as a starting point : google_service_account_access_token. We'll need to get confirmation about the new folder name in this folder
mmv1/third_party/terraform/services/resourcemanager/ephemeral_google_service_account_token.go
Outdated
Show resolved
Hide resolved
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
|
Tests analyticsTotal tests: 4270 Click here to see the affected service packages
Action takenFound 10 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
|
🟢 Tests passed during RECORDING mode: 🟢 No issues found for passed tests after REPLAYING rerun. 🔴 Tests failed during RECORDING mode: 🔴 Errors occurred during RECORDING mode. Please fix them to complete your PR. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
One final, final, final review and we can merge this to the feature branch. We should check the docs example in future but that should block merging the feature branch to main, not this PR.
mmv1/third_party/terraform/services/resourcemanager/ephemeral_google_service_account_token.go
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
provider "google" { | ||
} | ||
|
||
data "google_client_config" "default" { | ||
provider = google | ||
} | ||
|
||
ephemeral "google_service_account_access_token" "default" { | ||
provider = google | ||
target_service_account = "service_B@projectB.iam.gserviceaccount.com" | ||
scopes = ["userinfo-email", "cloud-platform"] | ||
lifetime = "300s" | ||
} | ||
|
||
provider "google" { | ||
alias = "impersonated" | ||
access_token = ephemeral.google_service_account_access_token.default.access_token | ||
} | ||
|
||
data "google_client_openid_userinfo" "me" { | ||
provider = google.impersonated | ||
} | ||
|
||
output "target-email" { | ||
value = data.google_client_openid_userinfo.me.email | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Once the plan time bug is fixed we should test this - I'll make a jira ticket for that (non blocking on this PR)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
TFECO-8280
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
|
Tests analyticsTotal tests: 4270 Click here to see the affected service packages
Action takenFound 10 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
|
🟢 Tests passed during RECORDING mode: 🟢 No issues found for passed tests after REPLAYING rerun. 🔴 Tests failed during RECORDING mode: 🔴 Errors occurred during RECORDING mode. Please fix them to complete your PR. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
An ephemeral resource that mimics the google_service_account_access_token data source
Release Note Template for Downstream PRs (will be copied)
See Write release notes for guidance.