Skip to content

Commit 1f61428

Browse files
modular-magicianmodular-magician
authored
Add named binary authorization policy support for cloud run v2 resources (#11229) (#18995)
[upstream:2c134e22300ecea2f8c3c2b0ca8619fce0fd2fc1] Signed-off-by: Modular Magician <[email protected]>
1 parent 64525a5 commit 1f61428

7 files changed

+81
-12
lines changed

‎.changelog/11229.txt

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
```release-note:enhancement
2+
cloudrunv2: added field `binary_authorization.policy` to resource `google_cloud_run_v2_job` and resource `google_cloud_run_v2_service` to support named binary authorization policy.
3+
```

‎google/services/cloudrunv2/resource_cloud_run_v2_job.go

+27-3
Original file line numberDiff line numberDiff line change
@@ -461,10 +461,17 @@ Please refer to the field 'effective_annotations' for all of the annotations pre
461461
Optional: true,
462462
Description: `If present, indicates to use Breakglass using this justification. If useDefault is False, then it must be empty. For more information on breakglass, see https://cloud.google.com/binary-authorization/docs/using-breakglass`,
463463
},
464+
"policy": {
465+
Type: schema.TypeString,
466+
Optional: true,
467+
Description: `The path to a binary authorization policy. Format: projects/{project}/platforms/cloudRun/{policy-name}`,
468+
ConflictsWith: []string{},
469+
},
464470
"use_default": {
465-
Type: schema.TypeBool,
466-
Optional: true,
467-
Description: `If True, indicates to use the default project's binary authorization policy. If False, binary authorization will be disabled.`,
471+
Type: schema.TypeBool,
472+
Optional: true,
473+
Description: `If True, indicates to use the default project's binary authorization policy. If False, binary authorization will be disabled.`,
474+
ConflictsWith: []string{},
468475
},
469476
},
470477
},
@@ -1226,6 +1233,8 @@ func flattenCloudRunV2JobBinaryAuthorization(v interface{}, d *schema.ResourceDa
12261233
flattenCloudRunV2JobBinaryAuthorizationBreakglassJustification(original["breakglassJustification"], d, config)
12271234
transformed["use_default"] =
12281235
flattenCloudRunV2JobBinaryAuthorizationUseDefault(original["useDefault"], d, config)
1236+
transformed["policy"] =
1237+
flattenCloudRunV2JobBinaryAuthorizationPolicy(original["policy"], d, config)
12291238
return []interface{}{transformed}
12301239
}
12311240
func flattenCloudRunV2JobBinaryAuthorizationBreakglassJustification(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
@@ -1236,6 +1245,10 @@ func flattenCloudRunV2JobBinaryAuthorizationUseDefault(v interface{}, d *schema.
12361245
return v
12371246
}
12381247

1248+
func flattenCloudRunV2JobBinaryAuthorizationPolicy(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
1249+
return v
1250+
}
1251+
12391252
func flattenCloudRunV2JobTemplate(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
12401253
if v == nil {
12411254
return nil
@@ -1966,6 +1979,13 @@ func expandCloudRunV2JobBinaryAuthorization(v interface{}, d tpgresource.Terrafo
19661979
transformed["useDefault"] = transformedUseDefault
19671980
}
19681981

1982+
transformedPolicy, err := expandCloudRunV2JobBinaryAuthorizationPolicy(original["policy"], d, config)
1983+
if err != nil {
1984+
return nil, err
1985+
} else if val := reflect.ValueOf(transformedPolicy); val.IsValid() && !tpgresource.IsEmptyValue(val) {
1986+
transformed["policy"] = transformedPolicy
1987+
}
1988+
19691989
return transformed, nil
19701990
}
19711991

@@ -1977,6 +1997,10 @@ func expandCloudRunV2JobBinaryAuthorizationUseDefault(v interface{}, d tpgresour
19771997
return v, nil
19781998
}
19791999

2000+
func expandCloudRunV2JobBinaryAuthorizationPolicy(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
2001+
return v, nil
2002+
}
2003+
19802004
func expandCloudRunV2JobTemplate(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
19812005
l := v.([]interface{})
19822006
if len(l) == 0 || l[0] == nil {

‎google/services/cloudrunv2/resource_cloud_run_v2_job_test.go

+8-4
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88

99
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
1010
"github.com/hashicorp/terraform-provider-google/google/acctest"
11+
"github.com/hashicorp/terraform-provider-google/google/envvar"
1112
)
1213

1314
func TestAccCloudRunV2Job_cloudrunv2JobFullUpdate(t *testing.T) {
@@ -214,6 +215,7 @@ func TestAccCloudRunV2Job_cloudrunv2JobWithDirectVPCUpdate(t *testing.T) {
214215
jobName := fmt.Sprintf("tf-test-cloudrun-service%s", acctest.RandString(t, 10))
215216
context := map[string]interface{}{
216217
"job_name": jobName,
218+
"project": envvar.GetTestProjectFromEnv(),
217219
}
218220

219221
acctest.VcrTest(t, resource.TestCase{
@@ -231,7 +233,7 @@ func TestAccCloudRunV2Job_cloudrunv2JobWithDirectVPCUpdate(t *testing.T) {
231233
ImportStateVerifyIgnore: []string{"location", "launch_stage"},
232234
},
233235
{
234-
Config: testAccCloudRunV2Job_cloudrunv2JobWithDirectVPCUpdate(context),
236+
Config: testAccCloudRunV2Job_cloudrunv2JobWithDirectVPCAndNamedBinAuthPolicyUpdate(context),
235237
},
236238
{
237239
ResourceName: "google_cloud_run_v2_job.default",
@@ -248,7 +250,6 @@ func testAccCloudRunV2Job_cloudrunv2JobWithDirectVPC(context map[string]interfac
248250
resource "google_cloud_run_v2_job" "default" {
249251
name = "%{job_name}"
250252
location = "us-central1"
251-
launch_stage = "BETA"
252253
template {
253254
template {
254255
containers {
@@ -271,12 +272,15 @@ func testAccCloudRunV2Job_cloudrunv2JobWithDirectVPC(context map[string]interfac
271272
`, context)
272273
}
273274

274-
func testAccCloudRunV2Job_cloudrunv2JobWithDirectVPCUpdate(context map[string]interface{}) string {
275+
func testAccCloudRunV2Job_cloudrunv2JobWithDirectVPCAndNamedBinAuthPolicyUpdate(context map[string]interface{}) string {
275276
return acctest.Nprintf(`
276277
resource "google_cloud_run_v2_job" "default" {
277278
name = "%{job_name}"
278279
location = "us-central1"
279-
launch_stage = "BETA"
280+
binary_authorization {
281+
policy = "projects/%{project}/platforms/cloudRun/policies/my-policy"
282+
breakglass_justification = "Some justification"
283+
}
280284
template {
281285
template {
282286
containers {

‎google/services/cloudrunv2/resource_cloud_run_v2_service.go

+27-3
Original file line numberDiff line numberDiff line change
@@ -774,10 +774,17 @@ Please refer to the field 'effective_annotations' for all of the annotations pre
774774
Optional: true,
775775
Description: `If present, indicates to use Breakglass using this justification. If useDefault is False, then it must be empty. For more information on breakglass, see https://cloud.google.com/binary-authorization/docs/using-breakglass`,
776776
},
777+
"policy": {
778+
Type: schema.TypeString,
779+
Optional: true,
780+
Description: `The path to a binary authorization policy. Format: projects/{project}/platforms/cloudRun/{policy-name}`,
781+
ConflictsWith: []string{},
782+
},
777783
"use_default": {
778-
Type: schema.TypeBool,
779-
Optional: true,
780-
Description: `If True, indicates to use the default project's binary authorization policy. If False, binary authorization will be disabled.`,
784+
Type: schema.TypeBool,
785+
Optional: true,
786+
Description: `If True, indicates to use the default project's binary authorization policy. If False, binary authorization will be disabled.`,
787+
ConflictsWith: []string{},
781788
},
782789
},
783790
},
@@ -1680,6 +1687,8 @@ func flattenCloudRunV2ServiceBinaryAuthorization(v interface{}, d *schema.Resour
16801687
flattenCloudRunV2ServiceBinaryAuthorizationBreakglassJustification(original["breakglassJustification"], d, config)
16811688
transformed["use_default"] =
16821689
flattenCloudRunV2ServiceBinaryAuthorizationUseDefault(original["useDefault"], d, config)
1690+
transformed["policy"] =
1691+
flattenCloudRunV2ServiceBinaryAuthorizationPolicy(original["policy"], d, config)
16831692
return []interface{}{transformed}
16841693
}
16851694
func flattenCloudRunV2ServiceBinaryAuthorizationBreakglassJustification(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
@@ -1690,6 +1699,10 @@ func flattenCloudRunV2ServiceBinaryAuthorizationUseDefault(v interface{}, d *sch
16901699
return v
16911700
}
16921701

1702+
func flattenCloudRunV2ServiceBinaryAuthorizationPolicy(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
1703+
return v
1704+
}
1705+
16931706
func flattenCloudRunV2ServiceCustomAudiences(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
16941707
return v
16951708
}
@@ -3024,6 +3037,13 @@ func expandCloudRunV2ServiceBinaryAuthorization(v interface{}, d tpgresource.Ter
30243037
transformed["useDefault"] = transformedUseDefault
30253038
}
30263039

3040+
transformedPolicy, err := expandCloudRunV2ServiceBinaryAuthorizationPolicy(original["policy"], d, config)
3041+
if err != nil {
3042+
return nil, err
3043+
} else if val := reflect.ValueOf(transformedPolicy); val.IsValid() && !tpgresource.IsEmptyValue(val) {
3044+
transformed["policy"] = transformedPolicy
3045+
}
3046+
30273047
return transformed, nil
30283048
}
30293049

@@ -3035,6 +3055,10 @@ func expandCloudRunV2ServiceBinaryAuthorizationUseDefault(v interface{}, d tpgre
30353055
return v, nil
30363056
}
30373057

3058+
func expandCloudRunV2ServiceBinaryAuthorizationPolicy(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
3059+
return v, nil
3060+
}
3061+
30383062
func expandCloudRunV2ServiceCustomAudiences(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
30393063
return v, nil
30403064
}

‎google/services/cloudrunv2/resource_cloud_run_v2_service_test.go

+8-2
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010

1111
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
1212
"github.com/hashicorp/terraform-provider-google/google/acctest"
13+
"github.com/hashicorp/terraform-provider-google/google/envvar"
1314
"github.com/hashicorp/terraform-provider-google/google/services/cloudrunv2"
1415
)
1516

@@ -597,6 +598,7 @@ func TestAccCloudRunV2Service_cloudrunv2ServiceWithDirectVPCUpdate(t *testing.T)
597598
serviceName := fmt.Sprintf("tf-test-cloudrun-service%s", acctest.RandString(t, 10))
598599
context := map[string]interface{}{
599600
"service_name": serviceName,
601+
"project": envvar.GetTestProjectFromEnv(),
600602
}
601603

602604
acctest.VcrTest(t, resource.TestCase{
@@ -614,7 +616,7 @@ func TestAccCloudRunV2Service_cloudrunv2ServiceWithDirectVPCUpdate(t *testing.T)
614616
ImportStateVerifyIgnore: []string{"name", "location"},
615617
},
616618
{
617-
Config: testAccCloudRunV2Service_cloudRunServiceWithDirectVPCUpdate(context),
619+
Config: testAccCloudRunV2Service_cloudRunServiceWithDirectVPCAndNamedBinAuthPolicyUpdate(context),
618620
},
619621
{
620622
ResourceName: "google_cloud_run_v2_service.default",
@@ -646,12 +648,16 @@ resource "google_cloud_run_v2_service" "default" {
646648
`, context)
647649
}
648650

649-
func testAccCloudRunV2Service_cloudRunServiceWithDirectVPCUpdate(context map[string]interface{}) string {
651+
func testAccCloudRunV2Service_cloudRunServiceWithDirectVPCAndNamedBinAuthPolicyUpdate(context map[string]interface{}) string {
650652
return acctest.Nprintf(`
651653
resource "google_cloud_run_v2_service" "default" {
652654
name = "%{service_name}"
653655
location = "us-central1"
654656
launch_stage = "GA"
657+
binary_authorization {
658+
policy = "projects/%{project}/platforms/cloudRun/policies/my-policy"
659+
breakglass_justification = "Some justification"
660+
}
655661
template {
656662
containers {
657663
image = "us-docker.pkg.dev/cloudrun/container/hello"

‎website/docs/r/cloud_run_v2_job.html.markdown

+4
Original file line numberDiff line numberDiff line change
@@ -761,6 +761,10 @@ The following arguments are supported:
761761
(Optional)
762762
If True, indicates to use the default project's binary authorization policy. If False, binary authorization will be disabled.
763763

764+
* `policy` -
765+
(Optional)
766+
The path to a binary authorization policy. Format: projects/{project}/platforms/cloudRun/{policy-name}
767+
764768
## Attributes Reference
765769

766770
In addition to the arguments listed above, the following computed attributes are exported:

‎website/docs/r/cloud_run_v2_service.html.markdown

+4
Original file line numberDiff line numberDiff line change
@@ -1091,6 +1091,10 @@ The following arguments are supported:
10911091
(Optional)
10921092
If True, indicates to use the default project's binary authorization policy. If False, binary authorization will be disabled.
10931093

1094+
* `policy` -
1095+
(Optional)
1096+
The path to a binary authorization policy. Format: projects/{project}/platforms/cloudRun/{policy-name}
1097+
10941098
<a name="nested_scaling"></a>The `scaling` block supports:
10951099

10961100
* `min_instance_count` -

0 commit comments

Comments
 (0)