Merge branch 'master' into vcr-matcher

.github/workflows/lint.yaml

@@ -20,11 +20,13 @@ on:
       - "third_party/**"
       - "**.md"
       - pkg/clients/generated
+      - config/tests
   pull_request:
     paths-ignore:
       - "third_party/**"
       - "**.md"
       - pkg/clients/generated
+      - config/tests
 permissions: read-all
 jobs:
   lint:
@@ -44,4 +46,4 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
         with:
-          version: v1.54.2 # should match the version in Makefile
+          version: v1.56.2 # should match the version in Makefile

.github/workflows/presubmit.yaml

@@ -78,6 +78,25 @@ jobs:
         with:
           name: artifacts
           path: /tmp/artifacts/
+  pause-tests:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v4
+        with:
+          go-version: "1.21.5"
+      - name: "Run mock tests"
+        run: |
+          ./scripts/github-actions/ga-pause-test.sh
+        env:
+          GOPATH: /home/runner/go
+          ARTIFACTS: /tmp/artifacts
+      - name: "Upload artifacts"
+        uses: actions/upload-artifact@v3
+        with:
+          name: artifacts
+          path: /tmp/artifacts/
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}

.golangci.yaml

@@ -18,6 +18,7 @@ run:
     - third_party
     - pkg/clients/generated
     - scripts # todo acpana unskip
+    - temp-vendor
 linters:
   disable-all: true
   enable:
@@ -44,3 +45,17 @@ linters:
     # - unconvert
     # - unused
     # - whitespace
+linters-settings:
+  revive:
+    rules:
+      - name: unused-parameter
+        severity: warning
+        disabled: true
+  govet:
+    enable-all: true
+    disable:
+      - fieldalignment
+      - nilness
+      - shadow
+      - testinggoroutine
+      - unusedwrite

Makefile

@@ -24,7 +24,7 @@ UNMANAGED_DETECTOR_IMG ?= gcr.io/${PROJECT_ID}/unmanageddetector:${SHORT_SHA}
 GOLANGCI_LINT_CACHE := $(shell pwd)/.tmp/golangci-lint
 # When updating this, make sure to update the corresponding action in
 # ./github/workflows/lint.yaml
-GOLANGCI_LINT_VERSION := v1.54.2
+GOLANGCI_LINT_VERSION := v1.56.2
 
 # Use Docker BuildKit when building images to allow usage of 'setcap' in
 # multi-stage builds (https://github.com/moby/moby/issues/38132)
@@ -98,7 +98,7 @@ lint:
 	docker run --rm -v $(shell pwd):/app \
 		-v ${GOLANGCI_LINT_CACHE}:/root/.cache/golangci-lint \
 		-w /app golangci/golangci-lint:${GOLANGCI_LINT_VERSION}-alpine \
-		golangci-lint run -v
+		golangci-lint run -v --timeout=10m
 
 # Run go vet against code
 .PHONY: vet

README.UpdatingDCL.md

@@ -4,8 +4,8 @@ Approximately 25% of Config Connector resources leverage the [DCL](https://githu
 
 Upgrade Process:
 
-1. In the repository root directory, run make `upgrade-dcl` to update the DCL dependency.
-1. Run `make read-pr` to ensure proper updates for all generated files.
+1. In the repository root directory, run `make upgrade-dcl` to update the DCL dependency.
+1. Run `make ready-pr` to ensure proper updates for all generated files.
 1. Check both the DCL [release notes](https://github.com/GoogleCloudPlatform/declarative-resource-client-library/releases) and the generated files, especially diff in CRDs.
    * Create a Pull Request titled "Update DCL to v1.58.0" (replace version as needed).
    * In the PR description, list the new CRD fields and relevant bug fixes introduced by the DCL update.

config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_accesscontextmanagerserviceperimeterresources.accesscontextmanager.cnrm.cloud.google.com.yaml

@@ -6,7 +6,7 @@ metadata:
   creationTimestamp: null
   labels:
     cnrm.cloud.google.com/managed-by-kcc: "true"
-    cnrm.cloud.google.com/stability-level: alpha
+    cnrm.cloud.google.com/stability-level: stable
     cnrm.cloud.google.com/system: "true"
     cnrm.cloud.google.com/tf2crd: "true"
   name: accesscontextmanagerserviceperimeterresources.accesscontextmanager.cnrm.cloud.google.com
@@ -24,6 +24,146 @@ spec:
   preserveUnknownFields: false
   scope: Namespaced
   versions:
+  - additionalPrinterColumns:
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: When 'True', the most recent reconcile of the resource succeeded
+      jsonPath: .status.conditions[?(@.type=='Ready')].status
+      name: Ready
+      type: string
+    - description: The reason for the value in 'Ready'
+      jsonPath: .status.conditions[?(@.type=='Ready')].reason
+      name: Status
+      type: string
+    - description: The last transition time for the value in 'Status'
+      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
+      name: Status Age
+      type: date
+    name: v1beta1
+    schema:
+      openAPIV3Schema:
+        properties:
+          apiVersion:
+            description: 'apiVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              perimeterNameRef:
+                description: "Only the `external` field is supported to configure
+                  the reference.\n\nThe name of the Service Perimeter to add this
+                  resource to. \nReferencing a resource name leads to recursive reference
+                  and KCC does not support the feature for now."
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: 'Allowed value: The `name` field of an `AccessContextManagerServicePerimeter`
+                      resource.'
+                    type: string
+                  name:
+                    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
+                    type: string
+                  namespace:
+                    description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
+                    type: string
+                type: object
+              resourceRef:
+                description: A GCP resource that is inside of the service perimeter.
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: 'Allowed value: string of the format `projects/{{value}}`,
+                      where {{value}} is the `number` field of a `Project` resource.'
+                    type: string
+                  name:
+                    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
+                    type: string
+                  namespace:
+                    description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
+                    type: string
+                type: object
+            required:
+            - perimeterNameRef
+            - resourceRef
+            type: object
+          status:
+            properties:
+              conditions:
+                description: Conditions represent the latest available observation
+                  of the resource's current state.
+                items:
+                  properties:
+                    lastTransitionTime:
+                      description: Last time the condition transitioned from one status
+                        to another.
+                      type: string
+                    message:
+                      description: Human-readable message indicating details about
+                        last transition.
+                      type: string
+                    reason:
+                      description: Unique, one-word, CamelCase reason for the condition's
+                        last transition.
+                      type: string
+                    status:
+                      description: Status is the status of the condition. Can be True,
+                        False, Unknown.
+                      type: string
+                    type:
+                      description: Type is the type of the condition.
+                      type: string
+                  type: object
+                type: array
+              observedGeneration:
+                description: ObservedGeneration is the generation of the resource
+                  that was most recently observed by the Config Connector controller.
+                  If this is equal to metadata.generation, then that means that the
+                  current reported status reflects the most recent desired state of
+                  the resource.
+                type: integer
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: false
+    subresources:
+      status: {}
   - additionalPrinterColumns:
     - jsonPath: .metadata.creationTimestamp
       name: Age
@@ -59,6 +199,10 @@ spec:
           spec:
             properties:
               perimeterNameRef:
+                description: "Only the `external` field is supported to configure
+                  the reference.\n\nThe name of the Service Perimeter to add this
+                  resource to. \nReferencing a resource name leads to recursive reference
+                  and KCC does not support the feature for now."
                 oneOf:
                 - not:
                     required:
@@ -75,8 +219,7 @@ spec:
                   - external
                 properties:
                   external:
-                    description: 'Allowed value: string of the format `{{parent}}/servicePerimeters/{{value}}`,
-                      where {{value}} is the `name` field of an `AccessContextManagerServicePerimeter`
+                    description: 'Allowed value: The `name` field of an `AccessContextManagerServicePerimeter`
                       resource.'
                     type: string
                   name:
@@ -86,15 +229,37 @@ spec:
                     description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                     type: string
                 type: object
-              resource:
-                description: |-
-                  Immutable. A GCP resource that is inside of the service perimeter.
-                  Currently only projects are allowed.
-                  Format: projects/{project_number}.
-                type: string
+              resourceRef:
+                description: A GCP resource that is inside of the service perimeter.
+                oneOf:
+                - not:
+                    required:
+                    - external
+                  required:
+                  - name
+                - not:
+                    anyOf:
+                    - required:
+                      - name
+                    - required:
+                      - namespace
+                  required:
+                  - external
+                properties:
+                  external:
+                    description: 'Allowed value: string of the format `projects/{{value}}`,
+                      where {{value}} is the `number` field of a `Project` resource.'
+                    type: string
+                  name:
+                    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
+                    type: string
+                  namespace:
+                    description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
+                    type: string
+                type: object
             required:
             - perimeterNameRef
-            - resource
+            - resourceRef
             type: object
           status:
             properties: