Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add conditions to kms iam #2841

Merged
merged 4 commits into from
Dec 17, 2019
Merged

add conditions to kms iam #2841

merged 4 commits into from
Dec 17, 2019

Conversation

danawillow
Copy link
Contributor

Part of hashicorp/terraform-provider-google#2909.

I opted not to generate these because the generated forms aren't compatible with the current forms- a generated cryptoKey iam resource for example would add a required field key_ring_id, and if we update the base_url so that the crypto_key_id represents the full self link, we would lose the import forms that we currently get.

Release Note Template for Downstream PRs (will be copied)

kms: added support for IAM Conditions to the `google_kms_key_ring_iam_*` and `google_kms_crypto_key_iam_*` resources (beta provider only)

`google_kms_key_ring_iam_*` and `google_kms_crypto_key_iam_*` resources now support IAM Conditions (beta provider only). If any conditions had been created out of band before this release, take extra care to ensure they are present in your Terraform config so the provider doesn't try to create new bindings with no conditions. Terraform will show a diff that it is adding the condition to the resource, which is safe to apply.

@modular-magician
Copy link
Collaborator

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, 22ae502.

Pull request statuses

No diff detected in terraform-google-conversion.
No diff detected in Ansible.
No diff detected in Inspec.

New Pull Requests

I built this PR into one or more new PRs on other repositories, and when those are closed, this PR will also be merged and closed.
depends: hashicorp/terraform-provider-google-beta#1524
depends: hashicorp/terraform-provider-google#5200

@modular-magician
Copy link
Collaborator

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, 4e5875e.

Pull request statuses

terraform-provider-google-beta already has an open PR.
No diff detected in terraform-google-conversion.
terraform-provider-google already has an open PR.
No diff detected in Ansible.
No diff detected in Inspec.

New Pull Requests

I didn't open any new pull requests because of this PR.

1 similar comment
@modular-magician
Copy link
Collaborator

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, 4e5875e.

Pull request statuses

terraform-provider-google-beta already has an open PR.
No diff detected in terraform-google-conversion.
terraform-provider-google already has an open PR.
No diff detected in Ansible.
No diff detected in Inspec.

New Pull Requests

I didn't open any new pull requests because of this PR.

@danawillow danawillow requested a review from slevenick December 17, 2019 01:00
slevenick
slevenick approved these changes Dec 17, 2019
View reviewed changes
Copy link
Contributor

@slevenick slevenick left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense to not generate this at this point due to the parseKmsCryptoKeyId usage

third_party/terraform/utils/iam_kms_key_ring.go.erb
p, err := u.Config.clientKms.Projects.Locations.KeyRings.GetIamPolicy(u.resourceId).Do()
<% else -%>
p, err := u.Config.clientKms.Projects.Locations.KeyRings.GetIamPolicy(u.resourceId).OptionsRequestedPolicyVersion(iamPolicyVersion).Do()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we not need a similar change to the SetIamPolicy calls? Maybe not because the policy would have the policy version attached by that point?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's already there in the resource_iam_*.go files

third_party/terraform/website/docs/r/google_kms_crypto_key_iam_member.html.markdown Outdated
With IAM Conditions ([beta](https://terraform.io/docs/providers/google/provider_versions.html)):
```hcl
resource "google_kms_crypto_key_iam_member" "crypto_key" {
crypto_key_id = "your-crypto-key-id"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Keep this consistent with the longer form?
crypto_key_id = "my-gcp-project/us-central1/my-key-ring/my-crypto-key"

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated the docs to use more full examples that reference other resources instead of spelling out the ids

@modular-magician
Copy link
Collaborator

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, 0918780.

Pull request statuses

terraform-provider-google-beta already has an open PR.
No diff detected in terraform-google-conversion.
terraform-provider-google already has an open PR.
No diff detected in Ansible.
No diff detected in Inspec.

New Pull Requests

I didn't open any new pull requests because of this PR.

danawillow and others added 4 commits December 17, 2019 23:16
@modular-magician modular-magician merged commit 008247d into GoogleCloudPlatform:master Dec 17, 2019
@danawillow danawillow deleted the kms-iam branch December 17, 2019 23:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@slevenick slevenick slevenick approved these changes

Assignees
No one assigned
Labels
automerged cla: yes downstream-generated terraform-provider-google terraform-provider-google-beta
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@danawillow @modular-magician @slevenick @googlebot