Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove use of google_kms_crypto_key_iam_binding resource in tests, to make tests stable in overnight testing #9621

Merged
merged 6 commits into from
Dec 12, 2023
Merged

Remove use of google_kms_crypto_key_iam_binding resource in tests, to make tests stable in overnight testing #9621

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a48218d
Remove `google_kms_crypto_key_iam_binding` resources that affect shar…
SarahFrench Dec 11, 2023
74d3e5c
Remove unnecessary use of `google_kms_crypto_key_iam_binding` (no sha…
SarahFrench Dec 11, 2023
75c45c4
Remove unnecessary use of `google_kms_crypto_key_iam_binding` (no sha…
SarahFrench Dec 11, 2023
18b9658
Fix call to config function in acc test
SarahFrench Dec 11, 2023
3583156
Update mmv1/third_party/terraform/services/cloudfunctions/resource_cl…
SarahFrench Dec 11, 2023
73c86fd
Skip `TestAccCloudFunctionsFunction_cmek` in VCR
SarahFrench Dec 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 2 additions & 4 deletions mmv1/templates/terraform/examples/secure_source_manager_instance_cmek.tf.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,13 +8,11 @@ resource "google_kms_crypto_key" "crypto_key" {
key_ring = google_kms_key_ring.key_ring.id
}

resource "google_kms_crypto_key_iam_binding" "crypto_key_binding" {
resource "google_kms_crypto_key_iam_member" "crypto_key_binding" {
crypto_key_id = google_kms_crypto_key.crypto_key.id
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"

members = [
"serviceAccount:service-${data.google_project.project.number}@gcp-sa-sourcemanager.iam.gserviceaccount.com"
]
member = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-sourcemanager.iam.gserviceaccount.com"
}

resource "google_secure_source_manager_instance" "<%= ctx[:primary_resource_id] %>" {
Expand Down
31 changes: 23 additions & 8 deletions ...hird_party/terraform/services/cloudfunctions/resource_cloudfunctions_function_test.go.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -295,7 +295,9 @@ func TestAccCloudFunctionsFunction_dockerRepository(t *testing.T) {

<% unless version == "ga" -%>
func TestAccCloudFunctionsFunction_cmek(t *testing.T) {
acctest.SkipIfVcr(t)
t.Parallel()

kmsKey := acctest.BootstrapKMSKeyInLocation(t, "us-central1")
funcResourceName := "google_cloudfunctions_function.function"
arRepoName := fmt.Sprintf("tf-cmek-test-docker-repository-%s", acctest.RandString(t, 10))
Expand Down Expand Up @@ -1078,24 +1080,37 @@ resource "google_artifact_registry_repository_iam_binding" "binding" {
]
}

resource "google_kms_crypto_key_iam_binding" "gcf_cmek_keyuser" {
resource "google_kms_crypto_key_iam_member" "gcf_cmek_keyuser_1" {
crypto_key_id = "%s"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"

members = [
"serviceAccount:service-${data.google_project.project.number}@gcf-admin-robot.iam.gserviceaccount.com",
"serviceAccount:service-${data.google_project.project.number}@gcp-sa-artifactregistry.iam.gserviceaccount.com",
"serviceAccount:service-${data.google_project.project.number}@gs-project-accounts.iam.gserviceaccount.com",
]
member = "serviceAccount:service-${data.google_project.project.number}@gcf-admin-robot.iam.gserviceaccount.com"
}

resource "google_kms_crypto_key_iam_member" "gcf_cmek_keyuser_2" {
crypto_key_id = "%s"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"

member = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-artifactregistry.iam.gserviceaccount.com"
}

resource "google_kms_crypto_key_iam_member" "gcf_cmek_keyuser_3" {
crypto_key_id = "%s"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"

member = "serviceAccount:service-${data.google_project.project.number}@gs-project-accounts.iam.gserviceaccount.com"
}


resource "google_artifact_registry_repository" "encoded-ar-repo" {
repository_id = "%s"
kms_key_name = "%s"
location = "us-central1"
format = "DOCKER"
depends_on = [
google_kms_crypto_key_iam_binding.gcf_cmek_keyuser
google_kms_crypto_key_iam_member.gcf_cmek_keyuser_1,
google_kms_crypto_key_iam_member.gcf_cmek_keyuser_2,
google_kms_crypto_key_iam_member.gcf_cmek_keyuser_3,
]
}

Expand Down Expand Up @@ -1123,7 +1138,7 @@ resource "google_cloudfunctions_function" "function" {
timeout = 61
entry_point = "helloGET"
}
`, kmsKey, arRepoName, kmsKey, bucketName, zipFilePath, functionName, kmsKey)
`, kmsKey, kmsKey, kmsKey, arRepoName, kmsKey, bucketName, zipFilePath, functionName, kmsKey)
}
<% end -%>

Expand Down
8 changes: 3 additions & 5 deletions mmv1/third_party/terraform/services/compute/resource_compute_instance_test.go.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6905,12 +6905,10 @@ data "google_compute_image" "my_image" {

data "google_project" "project" {}

resource "google_kms_crypto_key_iam_binding" "crypto_key" {
resource "google_kms_crypto_key_iam_member" "crypto_key" {
crypto_key_id = "%{key_name}"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
members = [
"serviceAccount:${data.google_project.project.number}-compute@developer.gserviceaccount.com",
]
member = "serviceAccount:${data.google_project.project.number}-compute@developer.gserviceaccount.com"
}

resource "google_compute_instance" "foobar" {
Expand All @@ -6932,7 +6930,7 @@ resource "google_compute_instance" "foobar" {
network_interface {
network = "default"
}
depends_on = [google_kms_crypto_key_iam_binding.crypto_key]
depends_on = [google_kms_crypto_key_iam_member.crypto_key]

}
`, context)
Expand Down
8 changes: 3 additions & 5 deletions mmv1/third_party/terraform/services/spanner/resource_spanner_database_test.go.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -642,7 +642,7 @@ resource "google_spanner_database" "database" {

deletion_protection = false

depends_on = [google_kms_crypto_key_iam_binding.crypto-key-binding]
depends_on = [google_kms_crypto_key_iam_member.crypto-key-binding]
}

resource "google_kms_key_ring" "keyring" {
Expand All @@ -658,14 +658,12 @@ resource "google_kms_crypto_key" "example-key" {
rotation_period = "100000s"
}

resource "google_kms_crypto_key_iam_binding" "crypto-key-binding" {
resource "google_kms_crypto_key_iam_member" "crypto-key-binding" {
provider = google-beta
crypto_key_id = google_kms_crypto_key.example-key.id
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"

members = [
"serviceAccount:${google_project_service_identity.ck_sa.email}",
]
member = "serviceAccount:${google_project_service_identity.ck_sa.email}"
}

data "google_project" "project" {
Expand Down