Incorrect value of clientTLSPolicy from ComputeBackendService

config/servicemappings/compute.yaml

@@ -172,6 +172,7 @@ spec:
             kind: NetworkSecurityClientTLSPolicy
             version: v1beta1
             group: networksecurity.cnrm.cloud.google.com
+          valueTemplate: "projects/{{project}}/locations/{{location}}/clientTlsPolicies/{{value}}"
           dclBasedResource: true
         - tfField: iap.oauth2_client_id
           description: OAuth2 Client ID for IAP.
@@ -2529,7 +2530,7 @@ spec:
             kind: NetworkSecurityServerTLSPolicy
             version: v1beta1
             group: networksecurity.cnrm.cloud.google.com
-          valueTemplate: "projects/{{project}}/locations/{{location}}/serverTlsPolicies/{{value}}"
+          valueTemplate: "projects/{{project}}/locations/global/serverTlsPolicies/{{value}}"
           dclBasedResource: true
       containers:
         - type: project

pkg/krmtotf/templating.go

@@ -182,6 +182,16 @@ func expandFieldTemplate(template string, r *Resource, c client.Client, smLoader
 		if val, exists, _ := unstructured.NestedString(r.GetStatusOrObservedState(), strings.Split(path, ".")...); exists {
 			return val
 		}
+
+		// todo(yuhou): Special handling to resolve project from DCL-based resource
+		// Only used for fixtures/globalcomputebackendservicesecuritysettings test for now
+		if path == "project" {
+			dclPath := "projectRef.external"
+			if val, exists, _ := unstructured.NestedString(r.Spec, strings.Split(dclPath, ".")...); exists {
+				return val
+			}
+		}
+
 		if isRequired {
 			resolutionError = fmt.Errorf("unable to resolve missing value: %v", field)
 		}

pkg/test/resourcefixture/contexts/compute_context.go

@@ -30,6 +30,13 @@ func init() {
 		SkipUpdate:   true,
 	}
 
+	resourceContextMap["globalcomputebackendservicesecuritysettings"] = ResourceContext{
+		ResourceKind: "ComputeBackendService",
+		// It's expected that during reconciliation, the event reason changes from Updating to UpToDate
+		// There's no change on the object.
+		SkipNoChange: true,
+	}
+
 	resourceContextMap["computeexternalvpngateway"] = ResourceContext{
 		ResourceKind: "ComputeExternalVPNGateway",
 		SkipUpdate:   true,

pkg/test/resourcefixture/testdata/basic/compute/v1beta1/computebackendservice/globalcomputebackendservicesecuritysettings/create.yaml

@@ -0,0 +1,29 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: compute.cnrm.cloud.google.com/v1beta1
+kind: ComputeBackendService
+metadata:
+  name: computebackendservice-yuhou1025
+spec:
+  loadBalancingScheme: INTERNAL_SELF_MANAGED
+  # The security settings that apply to this backend service. This field is applicable to
+  # global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED
+  securitySettings:
+    clientTLSPolicyRef:
+      name: clienttlspolicy-yuhou1025
+    subjectAltNames:
+      - spiffe://junk.svc.id.goog/ns/test/sa/frontend
+  timeoutSec: 10
+  location: global

pkg/test/resourcefixture/testdata/basic/compute/v1beta1/computebackendservice/globalcomputebackendservicesecuritysettings/dependencies.yaml

@@ -0,0 +1,26 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: networksecurity.cnrm.cloud.google.com/v1beta1
+kind: NetworkSecurityClientTLSPolicy
+metadata:
+  name: clienttlspolicy-yuhou1025
+spec:
+  clientCertificate:
+    certificateProviderInstance:
+      pluginInstance: google_cloud_private_spiffe
+  location: global
+  serverValidationCa:
+    - certificateProviderInstance:
+        pluginInstance: google_cloud_private_spiffe

pkg/test/resourcefixture/testdata/basic/compute/v1beta1/computebackendservice/globalcomputebackendservicesecuritysettings/update.yaml

@@ -0,0 +1,29 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: compute.cnrm.cloud.google.com/v1beta1
+kind: ComputeBackendService
+metadata:
+  name: computebackendservice-${uniqueId}
+spec:
+  loadBalancingScheme: INTERNAL_SELF_MANAGED
+  # The security settings that apply to this backend service. This field is applicable to
+  # global backend service with the load_balancing_scheme set to INTERNAL_SELF_MANAGED
+  securitySettings:
+    clientTLSPolicyRef:
+      name: clienttlspolicy-${uniqueId}
+    subjectAltNames:
+      - spiffe://junk.svc.id.goog/ns/test/sa/frontend
+  timeoutSec: 5
+  location: global

third_party/github.com/hashicorp/terraform-provider-google-beta/google-beta/services/compute/resource_compute_backend_service.go

@@ -4305,11 +4305,7 @@ func expandComputeBackendServiceSecuritySettings(v interface{}, d tpgresource.Te
 }
 
 func expandComputeBackendServiceSecuritySettingsClientTlsPolicy(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
-	f, err := tpgresource.ParseGlobalFieldValue("regions", v.(string), "project", d, config, true)
-	if err != nil {
-		return nil, fmt.Errorf("Invalid value for client_tls_policy: %s", err)
-	}
-	return f.RelativeLink(), nil
+	return v, nil
 }
 
 func expandComputeBackendServiceSecuritySettingsSubjectAltNames(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {