Add support for regional secret version resource `google_secret_manager_regional_secret_version` #11699

abheda-crest · 2024-09-13T10:46:11Z

Add support for new regional secret version resource google_secret_manager_regional_secret_version.
More info about regional secrets: https://cloud.google.com/secret-manager/docs/regional-secrets-overview

A point to be noted is that while importing the google_secret_manager_regional_secret_version resources having the is_secret_data_base64 field set to true, the secret_data is decoded from the base64-encoded string received from API. It is potentially due to condition in the flattener for payload (which is in place for the sake of is_secret_data_base64 field to work). It seems the import is working fine when the is_secret_data_base64 is not provided or set to false. While doing a terraform import, there is no way to determine if the resource to be imported requires decoding of base64 response.
References: hashicorp/terraform-provider-google#10129 & #8873

Release Note Template for Downstream PRs (will be copied)

`google_secret_manager_regional_secret_version`

github-actions · 2024-09-13T10:49:02Z

Hello! I am a robot. Tests will require approval from a repository maintainer to run.

@shuyama1, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

…rce-support-main

gptSanyam · 2024-09-15T07:52:21Z

mmv1/products/secretmanagerregional/RegionalSecretVersion.yaml

+    description: |
+      Secret Manager regional secret resource.
+  - !ruby/object:Api::Type::String
+    name: location


Having a location parameter here doesn't make sense, we are already taking secret as a parameter.
Just like other params (secret_id, project) location should also be inferred from the secret param.

The base_url as seen in the Product.yaml contains {{location}} parameter which is replaced using the ReplaceVars function before making any API call. For this, we require the location field to be set in the terraform state. Hence, we have kept the location parameter as computed. We infer the location field using the pre_create and pre_read custom code and override the url to include the information about the location parameter in the base_url.

What happens if a customer puts a value of location while creating secret version which is different from the one defined in secret?
We will override in pre_create and pre_read and the request goes to a different endpoint.
Such request with difference in location should ideally be rejected at the least. Can we introduce such a check if not done already?

Customer won't be able to provide the location field as it is output only field from terraform side (i.e. Computed field). We will infer the location based on the regional secret resource reference.

Aah! missed the output = True bit.
Thanks for clarification.

gptSanyam · 2024-09-15T07:59:23Z

mmv1/products/secretmanagerregional/RegionalSecretVersion.yaml

+  decoder: templates/terraform/decoders/treat_destroyed_state_as_gone.erb
+  pre_delete: templates/terraform/pre_delete/regional_secret_version_deletion_policy.go.erb
+  pre_read: templates/terraform/pre_read/secret_manager_regional_secret_version.go.erb
+  pre_create: templates/terraform/pre_create/secret_manager_regional_secret_version.go.erb


Why is the pre-create needed?
It was not there in the SecretVersion: https://github.com/gptSanyam/magic-modules/blob/main/mmv1/products/secretmanager/SecretVersion.yaml#L60

We infer the location field from the secret field using the pre_create and pre_read custom code and override the url to include the information about the location parameter in the base_url.

Understood.

gptSanyam · 2024-09-15T18:23:17Z

mmv1/templates/terraform/post_create/regional_secret_version.go.erb

+}
+d.SetId(name.(string))
+
+_, err = expandSecretManagerRegionalRegionalSecretVersionEnabled(d.Get("enabled"), d, config)


Where is this function defined?

This function is defined in the custom_expand custom code for the enabled field as we need to explicitly make the enable/disable call based on the value of the enabled field.

gptSanyam · 2024-09-15T18:38:45Z

mmv1/templates/terraform/custom_import/regional_secret_version.go.erb

+	versionRegex := regexp.MustCompile("projects/(.+)/locations/(.+)/secrets/(.+)/versions/(.+)$")
+
+	parts := secretRegex.FindStringSubmatch(name)
+	if len(parts) != 2 {


Why do we need the additional location check in most custom methods?

As mentioned above, we need the location field for the base_url of the regional APIs hence we do it for pre_create, pre_read and custom_import functionalities.

Understood. Thanks.

gptSanyam

LGTM

modular-magician · 2024-09-16T17:07:41Z

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 6 files changed, 1273 insertions(+), 2 deletions(-))
google-beta provider: Diff ( 6 files changed, 1273 insertions(+), 2 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 136 insertions(+))
Open in Cloud Shell: Diff ( 20 files changed, 554 insertions(+))

modular-magician · 2024-09-16T17:10:36Z

Tests analytics

Total tests: 34
Passed tests: 24
Skipped tests: 2
Affected tests: 8

Click here to see the affected service packages

secretmanagerregional

Action taken

Found 8 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

TestAccSecretManagerRegionalRegionalSecretVersion_cmekOutputOnly

TestAccSecretManagerRegionalRegionalSecretVersion_import

TestAccSecretManagerRegionalRegionalSecretVersion_regionalSecretVersionBasicExample

TestAccSecretManagerRegionalRegionalSecretVersion_regionalSecretVersionDeletionPolicyAbandonExample

TestAccSecretManagerRegionalRegionalSecretVersion_regionalSecretVersionDeletionPolicyDisableExample

TestAccSecretManagerRegionalRegionalSecretVersion_regionalSecretVersionDisabledExample

TestAccSecretManagerRegionalRegionalSecretVersion_regionalSecretVersionWithBase64DataExample

TestAccSecretManagerRegionalRegionalSecretVersion_update

Get to know how VCR tests work

modular-magician · 2024-09-16T17:11:33Z

$\textcolor{green}{\textsf{Tests passed during RECORDING mode:}}$
TestAccSecretManagerRegionalRegionalSecretVersion_cmekOutputOnly[Debug log]
TestAccSecretManagerRegionalRegionalSecretVersion_import[Debug log]
TestAccSecretManagerRegionalRegionalSecretVersion_regionalSecretVersionBasicExample[Debug log]
TestAccSecretManagerRegionalRegionalSecretVersion_regionalSecretVersionDeletionPolicyAbandonExample[Debug log]
TestAccSecretManagerRegionalRegionalSecretVersion_regionalSecretVersionDeletionPolicyDisableExample[Debug log]
TestAccSecretManagerRegionalRegionalSecretVersion_regionalSecretVersionDisabledExample[Debug log]
TestAccSecretManagerRegionalRegionalSecretVersion_regionalSecretVersionWithBase64DataExample[Debug log]
TestAccSecretManagerRegionalRegionalSecretVersion_update[Debug log]

$\textcolor{green}{\textsf{No issues found for passed tests after REPLAYING rerun.}}$

$\textcolor{green}{\textsf{All tests passed!}}$

View the build log or the debug log for each test

shuyama1

This is a regional version of google_secret_manager_secret_version. Overall looks good to me. I only have a small question regarding a test case. Thanks!

shuyama1 · 2024-09-16T23:20:07Z

...m/services/secretmanagerregional/resource_secret_manager_regional_secret_version_test.go.erb

+	"github.com/hashicorp/terraform-provider-google/google/acctest"
+)
+
+func TestAccSecretManagerRegionalRegionalSecretVersion_import(t *testing.T) {


Out of curiosity, why do we need this test specifically, I don't see it's different from the first step of TestAccSecretManagerRegionalRegionalSecretVersion_update

I included this test case to maintain consistency with the other resources and to test a basic import scenario. However, I understand your point about the redundancy, so I've decided to remove this test case.

…rce-support-main

modular-magician · 2024-09-17T06:17:20Z

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 6 files changed, 1249 insertions(+), 2 deletions(-))
google-beta provider: Diff ( 6 files changed, 1249 insertions(+), 2 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 136 insertions(+))
Open in Cloud Shell: Diff ( 20 files changed, 554 insertions(+))

modular-magician · 2024-09-17T06:20:24Z

Tests analytics

Total tests: 34
Passed tests: 32
Skipped tests: 2
Affected tests: 0

Click here to see the affected service packages

secretmanagerregional

$\textcolor{green}{\textsf{All tests passed!}}$

View the build log

shuyama1

Thank you!

…er_regional_secret_version` (GoogleCloudPlatform#11699)

abheda-crest added 2 commits September 13, 2024 10:30

Add support for regional secret version resource

4112515

minor format change in RegionalSecretVersion.yaml file

62e06a7

modular-magician added the awaiting-approval Pull requests that need reviewer's approval to run presubmit tests label Sep 13, 2024

abheda-crest marked this pull request as ready for review September 13, 2024 10:48

github-actions bot requested a review from shuyama1 September 13, 2024 10:49

Merge branch 'main' into secret-manager-regional-secret-version-resou…

2494b6e

…rce-support-main

gptSanyam suggested changes Sep 16, 2024

View reviewed changes

gptSanyam approved these changes Sep 16, 2024

View reviewed changes

modular-magician added service/secretmanager and removed awaiting-approval Pull requests that need reviewer's approval to run presubmit tests labels Sep 16, 2024

shuyama1 reviewed Sep 16, 2024

View reviewed changes

abheda-crest added 2 commits September 17, 2024 10:25

Merge branch 'main' into secret-manager-regional-secret-version-resou…

83193d3

…rce-support-main

Removed redundant basic test case for regional secret version resource

7b44017

github-actions bot requested a review from shuyama1 September 17, 2024 05:08

modular-magician added awaiting-approval Pull requests that need reviewer's approval to run presubmit tests and removed awaiting-approval Pull requests that need reviewer's approval to run presubmit tests labels Sep 17, 2024

abheda-crest mentioned this pull request Sep 17, 2024

Add support for regional secret version datasource google_secret_manager_regional_secret_version #11730

Merged

shuyama1 approved these changes Sep 17, 2024

View reviewed changes

shuyama1 merged commit 2a9c7e6 into GoogleCloudPlatform:main Sep 17, 2024
13 checks passed

abd-goog pushed a commit to abd-goog/magic-modules that referenced this pull request Sep 23, 2024

Add support for regional secret version resource `google_secret_manag…

1e20236

…er_regional_secret_version` (GoogleCloudPlatform#11699)

niharika-98 pushed a commit to niharika-98/magic-modules that referenced this pull request Oct 7, 2024

Add support for regional secret version resource `google_secret_manag…

99274fb

…er_regional_secret_version` (GoogleCloudPlatform#11699)

Philip-Jonany pushed a commit to Philip-Jonany/magic-modules that referenced this pull request Nov 4, 2024

Add support for regional secret version resource `google_secret_manag…

7186358

…er_regional_secret_version` (GoogleCloudPlatform#11699)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for regional secret version resource `google_secret_manager_regional_secret_version` #11699

Add support for regional secret version resource `google_secret_manager_regional_secret_version` #11699

abheda-crest commented Sep 13, 2024

github-actions bot commented Sep 13, 2024

gptSanyam Sep 15, 2024

abheda-crest Sep 16, 2024

gptSanyam Sep 16, 2024

abheda-crest Sep 16, 2024

gptSanyam Sep 16, 2024

gptSanyam Sep 15, 2024

abheda-crest Sep 16, 2024

gptSanyam Sep 16, 2024

gptSanyam Sep 15, 2024

abheda-crest Sep 16, 2024

gptSanyam Sep 15, 2024

abheda-crest Sep 16, 2024

gptSanyam Sep 16, 2024

gptSanyam left a comment

modular-magician commented Sep 16, 2024

modular-magician commented Sep 16, 2024

modular-magician commented Sep 16, 2024

shuyama1 left a comment

shuyama1 Sep 16, 2024

abheda-crest Sep 17, 2024

modular-magician commented Sep 17, 2024

modular-magician commented Sep 17, 2024

shuyama1 left a comment

Add support for regional secret version resource google_secret_manager_regional_secret_version #11699

Add support for regional secret version resource google_secret_manager_regional_secret_version #11699

Conversation

abheda-crest commented Sep 13, 2024

github-actions bot commented Sep 13, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gptSanyam left a comment

Choose a reason for hiding this comment

modular-magician commented Sep 16, 2024

Diff report

modular-magician commented Sep 16, 2024

Tests analytics

Action taken

modular-magician commented Sep 16, 2024

shuyama1 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

modular-magician commented Sep 17, 2024

Diff report

modular-magician commented Sep 17, 2024

Tests analytics

shuyama1 left a comment

Choose a reason for hiding this comment

Add support for regional secret version resource `google_secret_manager_regional_secret_version` #11699

Add support for regional secret version resource `google_secret_manager_regional_secret_version` #11699