Skip to content

Commit 0295085

Browse files
modular-magicianmodular-magician
authored
Migrate dns data sources back to the SDK to solve auth issue resulting from migration to plugin framework (#10368) (#17847)
[upstream:81454ae2edf4f6861cdf426de49d48b0dc0b2cb7] Signed-off-by: Modular Magician <[email protected]>
1 parent 13a7e31 commit 0295085

13 files changed

+499
-1028
lines changed

‎.changelog/10368.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:bug
2+
dns: fixed bug where some methods of authentication didn't work when using `dns` data sources
3+
```

‎google/acctest/provider_test_utils.go

+29
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,35 @@ func AccTestPreCheck(t *testing.T) {
7373
}
7474
}
7575

76+
// AccTestPreCheck_AdcCredentialsOnly is a PreCheck function for acceptance tests that use ADCs when
77+
func AccTestPreCheck_AdcCredentialsOnly(t *testing.T) {
78+
if v := os.Getenv("GOOGLE_CREDENTIALS_FILE"); v != "" {
79+
t.Log("Ignoring GOOGLE_CREDENTIALS_FILE; acceptance test doesn't use credentials other than ADCs")
80+
}
81+
82+
// Fail on set creds
83+
if v := transport_tpg.MultiEnvSearch(envvar.CredsEnvVarsExcludingAdcs()); v != "" {
84+
t.Fatalf("This acceptance test only uses ADCs, so all of %s must be unset", strings.Join(envvar.CredsEnvVarsExcludingAdcs(), ", "))
85+
}
86+
87+
// Fail on ADC ENV not set
88+
if v := os.Getenv("GOOGLE_APPLICATION_CREDENTIALS"); v == "" {
89+
t.Fatalf("GOOGLE_APPLICATION_CREDENTIALS must be set for acceptance tests that are dependent on ADCs")
90+
}
91+
92+
if v := transport_tpg.MultiEnvSearch(envvar.ProjectEnvVars); v == "" {
93+
t.Fatalf("One of %s must be set for acceptance tests", strings.Join(envvar.ProjectEnvVars, ", "))
94+
}
95+
96+
if v := transport_tpg.MultiEnvSearch(envvar.RegionEnvVars); v == "" {
97+
t.Fatalf("One of %s must be set for acceptance tests", strings.Join(envvar.RegionEnvVars, ", "))
98+
}
99+
100+
if v := transport_tpg.MultiEnvSearch(envvar.ZoneEnvVars); v == "" {
101+
t.Fatalf("One of %s must be set for acceptance tests", strings.Join(envvar.ZoneEnvVars, ", "))
102+
}
103+
}
104+
76105
// GetTestRegion has the same logic as the provider's GetRegion, to be used in tests.
77106
func GetTestRegion(is *terraform.InstanceState, config *transport_tpg.Config) (string, error) {
78107
if res, ok := is.Attributes["region"]; ok {

‎google/envvar/envvar_utils.go

+12
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,18 @@ var CredsEnvVars = []string{
2121
"GOOGLE_USE_DEFAULT_CREDENTIALS",
2222
}
2323

24+
// CredsEnvVarsExcludingAdcs returns the contents of CredsEnvVars excluding GOOGLE_APPLICATION_CREDENTIALS
25+
func CredsEnvVarsExcludingAdcs() []string {
26+
envs := CredsEnvVars
27+
var filtered []string
28+
for _, e := range envs {
29+
if e != "GOOGLE_APPLICATION_CREDENTIALS" {
30+
filtered = append(filtered, e)
31+
}
32+
}
33+
return filtered
34+
}
35+
2436
var ProjectNumberEnvVars = []string{
2537
"GOOGLE_PROJECT_NUMBER",
2638
}

‎google/fwprovider/framework_provider.go

-5
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ import (
1919
"github.com/hashicorp/terraform-provider-google/google/functions"
2020
"github.com/hashicorp/terraform-provider-google/google/fwmodels"
2121
"github.com/hashicorp/terraform-provider-google/google/fwtransport"
22-
"github.com/hashicorp/terraform-provider-google/google/services/dns"
2322
"github.com/hashicorp/terraform-provider-google/google/services/resourcemanager"
2423

2524
transport_tpg "github.com/hashicorp/terraform-provider-google/google/transport"
@@ -954,10 +953,6 @@ func (p *FrameworkProvider) DataSources(_ context.Context) []func() datasource.D
954953
return []func() datasource.DataSource{
955954
resourcemanager.NewGoogleClientConfigDataSource,
956955
resourcemanager.NewGoogleClientOpenIDUserinfoDataSource,
957-
dns.NewGoogleDnsManagedZoneDataSource,
958-
dns.NewGoogleDnsManagedZonesDataSource,
959-
dns.NewGoogleDnsRecordSetDataSource,
960-
dns.NewGoogleDnsKeysDataSource,
961956
}
962957
}
963958

‎google/provider/provider_mmv1_resources.go

+4
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,10 @@ var handwrittenDatasources = map[string]*schema.Resource{
216216
"google_container_registry_repository": containeranalysis.DataSourceGoogleContainerRepo(),
217217
"google_dataproc_metastore_service": dataprocmetastore.DataSourceDataprocMetastoreService(),
218218
"google_datastream_static_ips": datastream.DataSourceGoogleDatastreamStaticIps(),
219+
"google_dns_keys": dns.DataSourceDNSKeys(),
220+
"google_dns_managed_zone": dns.DataSourceDnsManagedZone(),
221+
"google_dns_managed_zones": dns.DataSourceDnsManagedZones(),
222+
"google_dns_record_set": dns.DataSourceDnsRecordSet(),
219223
"google_filestore_instance": filestore.DataSourceGoogleFilestoreInstance(),
220224
"google_iam_policy": resourcemanager.DataSourceGoogleIamPolicy(),
221225
"google_iam_role": resourcemanager.DataSourceGoogleIamRole(),

‎google/services/dns/data_source_dns_key_test.go

+87-66
Original file line numberDiff line numberDiff line change
@@ -12,88 +12,46 @@ import (
1212
)
1313

1414
func TestAccDataSourceDNSKeys_basic(t *testing.T) {
15-
// TODO: https://github.com/hashicorp/terraform-provider-google/issues/14158
16-
acctest.SkipIfVcr(t)
1715
t.Parallel()
1816

1917
dnsZoneName := fmt.Sprintf("tf-test-dnskey-test-%s", acctest.RandString(t, 10))
2018

21-
var kskDigest1, kskDigest2, zskPubKey1, zskPubKey2, kskAlg1, kskAlg2 string
22-
2319
acctest.VcrTest(t, resource.TestCase{
24-
PreCheck: func() { acctest.AccTestPreCheck(t) },
25-
CheckDestroy: testAccCheckDNSManagedZoneDestroyProducerFramework(t),
20+
PreCheck: func() { acctest.AccTestPreCheck(t) },
21+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
22+
CheckDestroy: testAccCheckDNSManagedZoneDestroyProducer(t),
2623
Steps: []resource.TestStep{
2724
{
28-
ExternalProviders: map[string]resource.ExternalProvider{
29-
"google": {
30-
VersionConstraint: "4.58.0",
31-
Source: "hashicorp/google",
32-
},
33-
},
34-
Config: testAccDataSourceDNSKeysConfigWithOutputs(dnsZoneName, "on"),
25+
Config: testAccDataSourceDNSKeysConfig(dnsZoneName, "on"),
3526
Check: resource.ComposeTestCheckFunc(
3627
testAccDataSourceDNSKeysDSRecordCheck("data.google_dns_keys.foo_dns_key"),
3728
resource.TestCheckResourceAttr("data.google_dns_keys.foo_dns_key", "key_signing_keys.#", "1"),
3829
resource.TestCheckResourceAttr("data.google_dns_keys.foo_dns_key", "zone_signing_keys.#", "1"),
3930
resource.TestCheckResourceAttr("data.google_dns_keys.foo_dns_key_id", "key_signing_keys.#", "1"),
4031
resource.TestCheckResourceAttr("data.google_dns_keys.foo_dns_key_id", "zone_signing_keys.#", "1"),
41-
acctest.TestExtractResourceAttr("data.google_dns_keys.foo_dns_key", "key_signing_keys.0.digests.0.digest", &kskDigest1),
42-
acctest.TestExtractResourceAttr("data.google_dns_keys.foo_dns_key_id", "zone_signing_keys.0.public_key", &zskPubKey1),
43-
acctest.TestExtractResourceAttr("data.google_dns_keys.foo_dns_key_id", "key_signing_keys.0.algorithm", &kskAlg1),
44-
),
45-
},
46-
{
47-
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
48-
Config: testAccDataSourceDNSKeysConfigWithOutputs(dnsZoneName, "on"),
49-
Check: resource.ComposeTestCheckFunc(
50-
testAccDataSourceDNSKeysDSRecordCheck("data.google_dns_keys.foo_dns_key"),
51-
resource.TestCheckResourceAttr("data.google_dns_keys.foo_dns_key", "key_signing_keys.#", "1"),
52-
resource.TestCheckResourceAttr("data.google_dns_keys.foo_dns_key", "zone_signing_keys.#", "1"),
53-
acctest.TestExtractResourceAttr("data.google_dns_keys.foo_dns_key", "key_signing_keys.0.digests.0.digest", &kskDigest2),
54-
acctest.TestExtractResourceAttr("data.google_dns_keys.foo_dns_key_id", "zone_signing_keys.0.public_key", &zskPubKey2),
55-
acctest.TestExtractResourceAttr("data.google_dns_keys.foo_dns_key_id", "key_signing_keys.0.algorithm", &kskAlg2),
56-
acctest.TestCheckAttributeValuesEqual(&kskDigest1, &kskDigest2),
57-
acctest.TestCheckAttributeValuesEqual(&zskPubKey1, &zskPubKey2),
58-
acctest.TestCheckAttributeValuesEqual(&kskAlg1, &kskAlg2),
5932
),
6033
},
6134
},
6235
})
6336
}
6437

6538
func TestAccDataSourceDNSKeys_noDnsSec(t *testing.T) {
66-
// TODO: https://github.com/hashicorp/terraform-provider-google/issues/14158
67-
acctest.SkipIfVcr(t)
6839
t.Parallel()
6940

7041
dnsZoneName := fmt.Sprintf("tf-test-dnskey-test-%s", acctest.RandString(t, 10))
7142

7243
acctest.VcrTest(t, resource.TestCase{
73-
PreCheck: func() { acctest.AccTestPreCheck(t) },
74-
CheckDestroy: testAccCheckDNSManagedZoneDestroyProducerFramework(t),
44+
PreCheck: func() { acctest.AccTestPreCheck(t) },
45+
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
46+
CheckDestroy: testAccCheckDNSManagedZoneDestroyProducer(t),
7547
Steps: []resource.TestStep{
7648
{
77-
ExternalProviders: map[string]resource.ExternalProvider{
78-
"google": {
79-
VersionConstraint: "4.58.0",
80-
Source: "hashicorp/google",
81-
},
82-
},
8349
Config: testAccDataSourceDNSKeysConfig(dnsZoneName, "off"),
8450
Check: resource.ComposeTestCheckFunc(
8551
resource.TestCheckResourceAttr("data.google_dns_keys.foo_dns_key", "key_signing_keys.#", "0"),
8652
resource.TestCheckResourceAttr("data.google_dns_keys.foo_dns_key", "zone_signing_keys.#", "0"),
8753
),
8854
},
89-
{
90-
ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
91-
Config: testAccDataSourceDNSKeysConfig(dnsZoneName, "off"),
92-
Check: resource.ComposeTestCheckFunc(
93-
resource.TestCheckResourceAttr("data.google_dns_keys.foo_dns_key", "key_signing_keys.#", "0"),
94-
resource.TestCheckResourceAttr("data.google_dns_keys.foo_dns_key", "zone_signing_keys.#", "0"),
95-
),
96-
},
9755
},
9856
})
9957
}
@@ -117,7 +75,7 @@ func testAccDataSourceDNSKeysConfig(dnsZoneName, dnssecStatus string) string {
11775
return fmt.Sprintf(`
11876
resource "google_dns_managed_zone" "foo" {
11977
name = "%s"
120-
dns_name = "%s.hashicorptest.com."
78+
dns_name = "dnssec.gcp.tfacc.hashicorptest.com."
12179
12280
dnssec_config {
12381
state = "%s"
@@ -132,27 +90,90 @@ data "google_dns_keys" "foo_dns_key" {
13290
data "google_dns_keys" "foo_dns_key_id" {
13391
managed_zone = google_dns_managed_zone.foo.id
13492
}
135-
`, dnsZoneName, dnsZoneName, dnssecStatus)
93+
`, dnsZoneName, dnssecStatus)
94+
}
95+
96+
// TestAccDataSourceDNSKeys_basic_AdcAuth is the same as TestAccDataSourceDNSKeys_basic but the test enforces that a developer runs this using
97+
// ADCs, supplied via GOOGLE_APPLICATION_CREDENTIALS. If any other credentials ENVs are set the PreCheck will fail.
98+
// Commented out until this test can run in TeamCity/CI.
99+
// func TestAccDataSourceDNSKeys_basic_AdcAuth(t *testing.T) {
100+
// acctest.SkipIfVcr(t) // Uses external providers
101+
// t.Parallel()
102+
103+
// creds := os.Getenv("GOOGLE_APPLICATION_CREDENTIALS") // PreCheck assertion handles checking this is set
104+
105+
// dnsZoneName := fmt.Sprintf("tf-test-dnskey-test-%s", acctest.RandString(t, 10))
106+
107+
// context := map[string]interface{}{
108+
// "credentials_path": creds,
109+
// "dns_zone_name": dnsZoneName,
110+
// "dnssec_status": "on",
111+
// }
112+
113+
// acctest.VcrTest(t, resource.TestCase{
114+
// PreCheck: func() { acctest.AccTestPreCheck_AdcCredentialsOnly(t) }, // Note different than default
115+
// CheckDestroy: testAccCheckDNSManagedZoneDestroyProducer(t),
116+
// Steps: []resource.TestStep{
117+
// // Check test fails with version of provider where data source is implemented with PF
118+
// {
119+
// ExternalProviders: map[string]resource.ExternalProvider{
120+
// "google": {
121+
// VersionConstraint: "4.60.0", // Muxed provider with dns data sources migrated to PF
122+
// Source: "hashicorp/google",
123+
// },
124+
// },
125+
// ExpectError: regexp.MustCompile("Post \"https://oauth2.googleapis.com/token\": context canceled"),
126+
// Config: testAccDataSourceDNSKeysConfig_AdcCredentials(context),
127+
// Check: resource.ComposeTestCheckFunc(
128+
// testAccDataSourceDNSKeysDSRecordCheck("data.google_dns_keys.foo_dns_key"),
129+
// resource.TestCheckResourceAttr("data.google_dns_keys.foo_dns_key", "key_signing_keys.#", "1"),
130+
// resource.TestCheckResourceAttr("data.google_dns_keys.foo_dns_key", "zone_signing_keys.#", "1"),
131+
// resource.TestCheckResourceAttr("data.google_dns_keys.foo_dns_key_id", "key_signing_keys.#", "1"),
132+
// resource.TestCheckResourceAttr("data.google_dns_keys.foo_dns_key_id", "zone_signing_keys.#", "1"),
133+
// ),
134+
// },
135+
// // Test should pass with more recent code
136+
// {
137+
// ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
138+
// Config: testAccDataSourceDNSKeysConfig_AdcCredentials(context),
139+
// Check: resource.ComposeTestCheckFunc(
140+
// testAccDataSourceDNSKeysDSRecordCheck("data.google_dns_keys.foo_dns_key"),
141+
// resource.TestCheckResourceAttr("data.google_dns_keys.foo_dns_key", "key_signing_keys.#", "1"),
142+
// resource.TestCheckResourceAttr("data.google_dns_keys.foo_dns_key", "zone_signing_keys.#", "1"),
143+
// resource.TestCheckResourceAttr("data.google_dns_keys.foo_dns_key_id", "key_signing_keys.#", "1"),
144+
// resource.TestCheckResourceAttr("data.google_dns_keys.foo_dns_key_id", "zone_signing_keys.#", "1"),
145+
// ),
146+
// },
147+
// },
148+
// })
149+
// }
150+
151+
func testAccDataSourceDNSKeysConfig_AdcCredentials(context map[string]interface{}) string {
152+
return acctest.Nprintf(`
153+
154+
// The auth problem isn't triggered unless provider block is
155+
// present in the test config.
156+
157+
provider "google" {
158+
credentials = "%{credentials_path}"
136159
}
137160
138-
// This function extends the config returned from the `testAccDataSourceDNSKeysConfig` function
139-
// to include output blocks that access the `key_signing_keys` and `zone_signing_keys` attributes.
140-
// These are null if DNSSEC is not enabled.
141-
func testAccDataSourceDNSKeysConfigWithOutputs(dnsZoneName, dnssecStatus string) string {
161+
resource "google_dns_managed_zone" "foo" {
162+
name = "%{dns_zone_name}"
163+
dns_name = "dnssec.gcp.tfacc.hashicorptest.com."
142164
143-
config := testAccDataSourceDNSKeysConfig(dnsZoneName, dnssecStatus)
144-
config = config + `
145-
# These outputs will cause an error if google_dns_managed_zone.foo.dnssec_config.state == "off"
165+
dnssec_config {
166+
state = "%{dnssec_status}"
167+
non_existence = "nsec3"
168+
}
169+
}
146170
147-
output "test_access_google_dns_keys_key_signing_keys" {
148-
description = "Testing that we can access a value in key_signing_keys ok as a computed block"
149-
value = data.google_dns_keys.foo_dns_key_id.key_signing_keys[0].ds_record
171+
data "google_dns_keys" "foo_dns_key" {
172+
managed_zone = google_dns_managed_zone.foo.name
150173
}
151174
152-
output "test_access_google_dns_keys_zone_signing_keys" {
153-
description = "Testing that we can access a value in zone_signing_keys ok as a computed block"
154-
value = data.google_dns_keys.foo_dns_key_id.zone_signing_keys[0].id
175+
data "google_dns_keys" "foo_dns_key_id" {
176+
managed_zone = google_dns_managed_zone.foo.id
155177
}
156-
`
157-
return config
178+
`, context)
158179
}

0 commit comments

Comments
 (0)