Skip to content

Commit

Permalink
Added support for auto and deprecated automatic field in `google_…
Browse files Browse the repository at this point in the history
…secret_manager_secret` resource (#8838)

* Added support for automatic_replication field in google_secret_manager_secret resource

* Replaced deprecated field automatic with automatic_replication in terraform configs

* Improved the deprecation_message

* Changed the name of field from automatic_replication to auto

* Adjusted white spaces

* Added test case to cover the automatic field
  • Loading branch information
abheda-crest authored Sep 11, 2023
1 parent 20d170f commit 1e2b51e
Show file tree
Hide file tree
Showing 28 changed files with 592 additions and 36 deletions.
39 changes: 37 additions & 2 deletions mmv1/products/secretmanager/Secret.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,14 @@ examples:
primary_resource_id: 'secret-with-annotations'
vars:
secret_id: 'secret'
- !ruby/object:Provider::Terraform::Examples
name: 'secret_with_automatic_cmek'
primary_resource_id: 'secret-with-automatic-cmek'
vars:
secret_id: 'secret'
kms_key_name: 'kms-key'
test_vars_overrides:
kms_key_name: 'acctest.BootstrapKMSKey(t).CryptoKey.Name'
import_format: ['projects/{{project}}/secrets/{{secret_id}}']
custom_code: !ruby/object:Provider::Terraform::CustomCode
pre_update: templates/terraform/pre_update/secret_manager_secret.go.erb
Expand Down Expand Up @@ -109,6 +117,8 @@ properties:
name: replication
required: true
immutable: true
custom_expand: templates/terraform/custom_expand/secret_manager_replication.go.erb
custom_flatten: templates/terraform/custom_flatten/secret_manager_replication.go.erb
description: |
The replication policy of the secret data attached to the Secret. It cannot be changed
after the Secret has been created.
Expand All @@ -119,16 +129,41 @@ properties:
exactly_one_of:
- replication.0.automatic
- replication.0.user_managed
- replication.0.auto
deprecation_message: >-
`automatic` is deprecated and will be removed in a future major release. Use `auto` instead.
description: |
The Secret will automatically be replicated without any restrictions.
- !ruby/object:Api::Type::NestedObject
name: auto
api_name: automatic
immutable: true
exactly_one_of:
- replication.0.automatic
- replication.0.user_managed
- replication.0.auto
description: |
The Secret will automatically be replicated without any restrictions.
custom_flatten: templates/terraform/custom_flatten/object_to_bool.go.erb
custom_expand: templates/terraform/custom_expand/bool_to_object.go.erb
properties:
- !ruby/object:Api::Type::NestedObject
name: customerManagedEncryption
description: |
The customer-managed encryption configuration of the Secret.
If no configuration is provided, Google-managed default
encryption is used.
properties:
- !ruby/object:Api::Type::String
name: kmsKeyName
required: true
description: |
The resource name of the Cloud KMS CryptoKey used to encrypt secret payloads.
- !ruby/object:Api::Type::NestedObject
name: userManaged
immutable: true
exactly_one_of:
- replication.0.automatic
- replication.0.user_managed
- replication.0.auto
description: |
The Secret will be replicated to the regions specified by the user.
properties:
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,180 @@
<%# The license inside this block applies to this file.
# Copyright 2023 Google Inc.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
-%>
func expandSecretManagerSecretReplication(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
l := v.([]interface{})
if len(l) == 0 || l[0] == nil {
return nil, nil
}
raw := l[0]
original := raw.(map[string]interface{})
transformed := make(map[string]interface{})

if _, ok := d.GetOk("replication.0.automatic"); ok{
transformedAutomatic, err := expandSecretManagerSecretReplicationAutomatic(original["automatic"], d, config)
if err != nil {
return nil, err
} else if val := reflect.ValueOf(transformedAutomatic); val.IsValid() && !tpgresource.IsEmptyValue(val) {
transformed["automatic"] = transformedAutomatic
}
}

if _, ok := d.GetOk("replication.0.auto"); ok{
transformedAuto, err := expandSecretManagerSecretReplicationAuto(original["auto"], d, config)
if err != nil {
return nil, err
} else {
transformed["automatic"] = transformedAuto
}
}

transformedUserManaged, err := expandSecretManagerSecretReplicationUserManaged(original["user_managed"], d, config)
if err != nil {
return nil, err
} else if val := reflect.ValueOf(transformedUserManaged); val.IsValid() && !tpgresource.IsEmptyValue(val) {
transformed["userManaged"] = transformedUserManaged
}

return transformed, nil
}

func expandSecretManagerSecretReplicationAutomatic(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
if v == nil || !v.(bool) {
return nil, nil
}

return struct{}{}, nil
}

func expandSecretManagerSecretReplicationAuto(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
l := v.([]interface{})
if len(l) == 0 {
return nil, nil
}

if l[0] == nil {
transformed := make(map[string]interface{})
return transformed, nil
}
raw := l[0]
original := raw.(map[string]interface{})
transformed := make(map[string]interface{})

transformedCustomerManagedEncryption, err := expandSecretManagerSecretReplicationAutoCustomerManagedEncryption(original["customer_managed_encryption"], d, config)
if err != nil {
return nil, err
} else if val := reflect.ValueOf(transformedCustomerManagedEncryption); val.IsValid() && !tpgresource.IsEmptyValue(val) {
transformed["customerManagedEncryption"] = transformedCustomerManagedEncryption
}

return transformed, nil
}

func expandSecretManagerSecretReplicationAutoCustomerManagedEncryption(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
l := v.([]interface{})
if len(l) == 0 || l[0] == nil {
return nil, nil
}
raw := l[0]
original := raw.(map[string]interface{})
transformed := make(map[string]interface{})

transformedKmsKeyName, err := expandSecretManagerSecretReplicationAutoCustomerManagedEncryptionKmsKeyName(original["kms_key_name"], d, config)
if err != nil {
return nil, err
} else if val := reflect.ValueOf(transformedKmsKeyName); val.IsValid() && !tpgresource.IsEmptyValue(val) {
transformed["kmsKeyName"] = transformedKmsKeyName
}

return transformed, nil
}

func expandSecretManagerSecretReplicationAutoCustomerManagedEncryptionKmsKeyName(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
return v, nil
}

func expandSecretManagerSecretReplicationUserManaged(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
l := v.([]interface{})
if len(l) == 0 || l[0] == nil {
return nil, nil
}
raw := l[0]
original := raw.(map[string]interface{})
transformed := make(map[string]interface{})

transformedReplicas, err := expandSecretManagerSecretReplicationUserManagedReplicas(original["replicas"], d, config)
if err != nil {
return nil, err
} else if val := reflect.ValueOf(transformedReplicas); val.IsValid() && !tpgresource.IsEmptyValue(val) {
transformed["replicas"] = transformedReplicas
}

return transformed, nil
}

func expandSecretManagerSecretReplicationUserManagedReplicas(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
l := v.([]interface{})
req := make([]interface{}, 0, len(l))
for _, raw := range l {
if raw == nil {
continue
}
original := raw.(map[string]interface{})
transformed := make(map[string]interface{})

transformedLocation, err := expandSecretManagerSecretReplicationUserManagedReplicasLocation(original["location"], d, config)
if err != nil {
return nil, err
} else if val := reflect.ValueOf(transformedLocation); val.IsValid() && !tpgresource.IsEmptyValue(val) {
transformed["location"] = transformedLocation
}

transformedCustomerManagedEncryption, err := expandSecretManagerSecretReplicationUserManagedReplicasCustomerManagedEncryption(original["customer_managed_encryption"], d, config)
if err != nil {
return nil, err
} else if val := reflect.ValueOf(transformedCustomerManagedEncryption); val.IsValid() && !tpgresource.IsEmptyValue(val) {
transformed["customerManagedEncryption"] = transformedCustomerManagedEncryption
}

req = append(req, transformed)
}
return req, nil
}

func expandSecretManagerSecretReplicationUserManagedReplicasLocation(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
return v, nil
}

func expandSecretManagerSecretReplicationUserManagedReplicasCustomerManagedEncryption(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
l := v.([]interface{})
if len(l) == 0 || l[0] == nil {
return nil, nil
}
raw := l[0]
original := raw.(map[string]interface{})
transformed := make(map[string]interface{})

transformedKmsKeyName, err := expandSecretManagerSecretReplicationUserManagedReplicasCustomerManagedEncryptionKmsKeyName(original["kms_key_name"], d, config)
if err != nil {
return nil, err
} else if val := reflect.ValueOf(transformedKmsKeyName); val.IsValid() && !tpgresource.IsEmptyValue(val) {
transformed["kmsKeyName"] = transformedKmsKeyName
}

return transformed, nil
}

func expandSecretManagerSecretReplicationUserManagedReplicasCustomerManagedEncryptionKmsKeyName(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
return v, nil
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,118 @@
<%# The license inside this block applies to this file.
# Copyright 2023 Google Inc.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
-%>
func flattenSecretManagerSecretReplication(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
if v == nil {
return nil
}
original := v.(map[string]interface{})
if len(original) == 0 {
return nil
}
transformed := make(map[string]interface{})
_, ok := d.GetOk("replication.0.automatic")
if ok {
transformed["automatic"] =
flattenSecretManagerSecretReplicationAutomatic(original["automatic"], d, config)
} else {
transformed["auto"] =
flattenSecretManagerSecretReplicationAuto(original["automatic"], d, config)
}
transformed["user_managed"] =
flattenSecretManagerSecretReplicationUserManaged(original["userManaged"], d, config)
return []interface{}{transformed}
}
func flattenSecretManagerSecretReplicationAutomatic(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
return v != nil
}

func flattenSecretManagerSecretReplicationAuto(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
if v == nil {
return nil
}
original := v.(map[string]interface{})
transformed := make(map[string]interface{})
transformed["customer_managed_encryption"] =
flattenSecretManagerSecretReplicationAutoCustomerManagedEncryption(original["customerManagedEncryption"], d, config)
return []interface{}{transformed}
}
func flattenSecretManagerSecretReplicationAutoCustomerManagedEncryption(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
if v == nil {
return nil
}
original := v.(map[string]interface{})
if len(original) == 0 {
return nil
}
transformed := make(map[string]interface{})
transformed["kms_key_name"] =
flattenSecretManagerSecretReplicationAutoCustomerManagedEncryptionKmsKeyName(original["kmsKeyName"], d, config)
return []interface{}{transformed}
}
func flattenSecretManagerSecretReplicationAutoCustomerManagedEncryptionKmsKeyName(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
return v
}

func flattenSecretManagerSecretReplicationUserManaged(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
if v == nil {
return nil
}
original := v.(map[string]interface{})
if len(original) == 0 {
return nil
}
transformed := make(map[string]interface{})
transformed["replicas"] =
flattenSecretManagerSecretReplicationUserManagedReplicas(original["replicas"], d, config)
return []interface{}{transformed}
}
func flattenSecretManagerSecretReplicationUserManagedReplicas(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
if v == nil {
return v
}
l := v.([]interface{})
transformed := make([]interface{}, 0, len(l))
for _, raw := range l {
original := raw.(map[string]interface{})
if len(original) < 1 {
// Do not include empty json objects coming back from the api
continue
}
transformed = append(transformed, map[string]interface{}{
"location": flattenSecretManagerSecretReplicationUserManagedReplicasLocation(original["location"], d, config),
"customer_managed_encryption": flattenSecretManagerSecretReplicationUserManagedReplicasCustomerManagedEncryption(original["customerManagedEncryption"], d, config),
})
}
return transformed
}
func flattenSecretManagerSecretReplicationUserManagedReplicasLocation(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
return v
}

func flattenSecretManagerSecretReplicationUserManagedReplicasCustomerManagedEncryption(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
if v == nil {
return nil
}
original := v.(map[string]interface{})
if len(original) == 0 {
return nil
}
transformed := make(map[string]interface{})
transformed["kms_key_name"] =
flattenSecretManagerSecretReplicationUserManagedReplicasCustomerManagedEncryptionKmsKeyName(original["kmsKeyName"], d, config)
return []interface{}{transformed}
}
func flattenSecretManagerSecretReplicationUserManagedReplicasCustomerManagedEncryptionKmsKeyName(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
return v
}
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ data "google_project" "project" {
resource "google_secret_manager_secret" "secret" {
secret_id = "<%= ctx[:vars]['secret_id'] %>"
replication {
automatic = true
auto {}
}
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ data "google_project" "project" {
resource "google_secret_manager_secret" "secret" {
secret_id = "<%= ctx[:vars]['secret_id'] %>"
replication {
automatic = true
auto {}
}
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ data "google_project" "project" {
resource "google_secret_manager_secret" "secret" {
secret_id = "<%= ctx[:vars]['secret_id'] %>"
replication {
automatic = true
auto {}
}
}

Expand Down
Loading

0 comments on commit 1e2b51e

Please sign in to comment.