-
Notifications
You must be signed in to change notification settings - Fork 1.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add BlockingFunctionsConfig, AuthorizedDomains and QuotaConfig fields to identityplatform config #8064
Conversation
Hello! I am a robot who works on Magic Modules PRs. I've detected that you're a community contributor. @roaks3, a repository maintainer, has been assigned to assist you and help review your changes. ❓ First time contributing? Click here for more detailsYour assigned reviewer will help review your code by:
You can help make sure that review is quick by running local tests and ensuring they're passing in between each push you make to your PR's branch. Also, try to leave a comment with each push you make, as pushes generally don't generate emails. If your reviewer doesn't get back to you within a week after your most recent change, please feel free to leave a comment on the issue asking them to take a look! In the absence of a dedicated review dashboard most maintainers manage their pending reviews through email, and those will sometimes get lost in their inbox. |
name: 'functionUri' | ||
description: | | ||
HTTP URI trigger for the Cloud Function. | ||
- !ruby/object:Api::Type::NestedObject |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should this be a Timestamp, as in !ruby/object:Api::Type::Time
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
yep, good catch.
HTTP URI trigger for the Cloud Function. | ||
- !ruby/object:Api::Type::NestedObject | ||
name: 'updateTime' | ||
description: | |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should this also be output only?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done.
value_type: !ruby/object:Api::Type::NestedObject | ||
properties: | ||
- !ruby/object:Api::Type::String | ||
name: 'functionUri' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
would it make sense for this to be a resource reference to https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloudfunctions_function instead of a pure string?
In theory we could accommodate someone that uses Terraform for Auth but not Functions, but do we expect that to be a common use-case?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Would defer this to the reviewer to weigh in.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Possibly, but there is currently some work being done with ResourceRef to get it working the way we want, and we are advising teams to avoid adding them for now. (see #8127)
Unrelated, but setting a function_uri
within the map value seems like it should be required.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yep. Done.
item_type: Api::Type::NestedObject | ||
properties: | ||
- !ruby/object:Api::Type::String | ||
name: 'key' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
are these keys represented as a resource in another product? They aren't ApiKeys I know, but if we can reference an object that is managed it will be less error prone.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ditto -- this field is removed from the PR for now.
description: | | ||
Corresponds to the 'refill_token_count' field in QuotaServer config. | ||
- !ruby/object:Api::Type::NestedObject | ||
name: 'startTime' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ditto !ruby/object:Api::Type::Time
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done.
- !ruby/object:Api::Type::Integer | ||
name: 'nanos' | ||
- !ruby/object:Api::Type::NestedObject | ||
name: 'quotaDuration' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is a string based on https://cloud.google.com/identity-platform/docs/reference/rest/v2/Config#TemporaryQuota
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done.
- :RECAPTCHA_ACTION_UNSPECIFIED | ||
- :BLOCK | ||
- !ruby/object:Api::Type::Array | ||
name: 'recaptchaKeys' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is output only
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Based on the GCIP team request, this field is removed from the PR for now.
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are. Terraform GA: Diff ( 2 files changed, 539 insertions(+)) Missing test reportYour PR includes resource fields which are not covered by any test. Resource: Please add acceptance tests which include these fields. |
Tests analyticsTotal tests: Action takenFound 2 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected testsTestAccComputeNetworkEndpoints_networkEndpointsBasic|TestAccComputeFirewallPolicyRule_multipleRules |
Tests passed during RECORDING mode: Tests failed during RECORDING mode: Please fix these to complete your PR |
@roaks3 This PR is ready for review. |
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are. Terraform GA: Diff ( 2 files changed, 555 insertions(+)) Missing test reportYour PR includes resource fields which are not covered by any test. Resource: Please add acceptance tests which include these fields. |
Tests analyticsTotal tests: Action takenFound 1 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected testsTestAccComputeFirewallPolicyRule_multipleRules |
Tests failed during RECORDING mode: Please fix these to complete your PR |
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are. Terraform GA: Diff ( 2 files changed, 561 insertions(+)) Missing test reportYour PR includes resource fields which are not covered by any test. Resource: Please add acceptance tests which include these fields. |
Tests analyticsTotal tests: Action takenFound 2 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected testsTestAccContainerAwsNodePool_BetaBasicHandWritten|TestAccComputeFirewallPolicyRule_multipleRules |
Tests failed during RECORDING mode: Please fix these to complete your PR |
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are. Terraform GA: Diff ( 2 files changed, 561 insertions(+)) Missing test reportYour PR includes resource fields which are not covered by any test. Resource: Please add acceptance tests which include these fields. |
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are. Terraform GA: Diff ( 2 files changed, 561 insertions(+)) Missing test reportYour PR includes resource fields which are not covered by any test. Resource: Please add acceptance tests which include these fields. |
Tests analyticsTotal tests: Action takenFound 4 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected testsTestAccComputeTargetHttpsProxy_targetHttpsProxyHttpKeepAliveTimeoutExample|TestAccContainerAwsNodePool_BetaBasicHandWritten|TestAccComputeTargetHttpProxy_targetHttpProxyHttpKeepAliveTimeoutExample|TestAccComputeFirewallPolicyRule_multipleRules |
Tests analyticsTotal tests: Action takenFound 4 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected testsTestAccContainerAwsNodePool_BetaBasicHandWritten|TestAccComputeFirewallPolicyRule_multipleRules|TestAccComputeTargetHttpsProxy_targetHttpsProxyHttpKeepAliveTimeoutExample|TestAccComputeTargetHttpProxy_targetHttpProxyHttpKeepAliveTimeoutExample |
Rerun these tests in REPLAYING mode to catch issues
|
Rerun these tests in REPLAYING mode to catch issues
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Apologies for the delay on this! The changes overall look good, I had a few small comments but nothing major.
The tests are not running for this resource, so to approve we will need you to show evidence of running the test locally. Alternatively, I mentioned an option to switch these fields to another resource where testing is enabled.
value_type: !ruby/object:Api::Type::NestedObject | ||
properties: | ||
- !ruby/object:Api::Type::String | ||
name: 'functionUri' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Possibly, but there is currently some work being done with ResourceRef to get it working the way we want, and we are advising teams to avoid adding them for now. (see #8127)
Unrelated, but setting a function_uri
within the map value seems like it should be required.
- !ruby/object:Api::Type::Integer | ||
name: 'quota' | ||
description: | | ||
Corresponds to the 'refill_token_count' field in QuotaServer config. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Honest question because I'm not caught up on your exact use case: is this a user-friendly description?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Was this addressed?
|
||
blocking_functions { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Due to hashicorp/terraform-provider-google#13327, tests are currently disabled on this resource. In short, the initial apply (and later the destroy) that is done during tests will clear out other settings on the project.
I think there are two main directions you can go from here:
- Keep the changes where they are, but keep in mind that this bug is unresolved, so your users may experience difficulties. You can attempt to resolve the bug if you choose, which would help make these new features more usable. For testing, you will need to turn off
skip_test
locally, and run the test in your own environment to ensure things are working. - Move the changes to
identityplatform/Config.yaml
, which appears to use the same endpoint but without this bug. For testing, you could probably remove theskip_vcr: true
so that they run in the PR, otherwise you will need to run the test in your own environment.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not sure this was addressed either. It seems like you're choosing to keep the changes in this resource (cc @tylerg-dev who I see is a reviewer and also authored identityplatform/Config.yaml
#6587).
Either way, you will need to provide some sort of proof (ie. output) from running the acceptance tests.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I can't see why we'd have a duplicate at all? this one has more fields, but those should have just been merged into the initially added resource.
At this point do we have a way to combine them back together (and properly use field-masks to avoid the bug listed above)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yea, the second resources was added with #6679, and I believe it was created due to a miscommunication combined with unfortunate timing. Since users could be using the newer resource, we cannot simply remove or merge it, but we could choose to start down the deprecation process and remove it in the next major release.
Ideally, I think the fields on this resource should be moved to yours, and this resource removed.
} | ||
|
||
authorized_domains = ["test.domain.com", "new..domain.com"] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Since this will go into the docs, how about let's put the default domains here? This way even if they didn't visit Firebase's docs, they still have some clue to follow.
authorized_domains = ["localhost", "${projectId}.firebaseapp.com", "${projectId}.web.app"]
…uthorized domains
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are. Terraform GA: Diff ( 2 files changed, 561 insertions(+)) Missing test reportYour PR includes resource fields which are not covered by any test. Resource: Please add acceptance tests which include these fields. |
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are. Terraform GA: Diff ( 2 files changed, 561 insertions(+)) Missing test reportYour PR includes resource fields which are not covered by any test. Resource: Please add acceptance tests which include these fields. |
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are. Terraform GA: Diff ( 2 files changed, 565 insertions(+)) Missing test reportYour PR includes resource fields which are not covered by any test. Resource: Please add acceptance tests which include these fields. |
Tests analyticsTotal tests: Action takenFound 2 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected testsTestAccContainerAwsNodePool_BetaBasicHandWritten|TestAccComputeFirewallPolicyRule_multipleRules |
|
authorized_domains = [ | ||
"localhost", | ||
"project_id.firebaseapp.com", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I was thinking more of doing it properly, like "<%= ctx[:vars]['project_id'] %>"
, or actually put in a data source and reference.
Modify the test template to fetch the actual project_id.
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are. Terraform GA: Diff ( 2 files changed, 565 insertions(+)) Missing test reportYour PR includes resource fields which are not covered by any test. Resource: Please add acceptance tests which include these fields. |
Tests analyticsTotal tests: Action takenFound 3 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected testsTestAccHealthcareFhirStore_healthcareFhirStoreBasicExample|TestAccContainerAwsNodePool_BetaBasicHandWritten|TestAccComputeFirewallPolicyRule_multipleRules |
Rerun these tests in REPLAYING mode to catch issues
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think a few things were not addressed, and we will need to confirm tests pass before approval
- !ruby/object:Api::Type::Integer | ||
name: 'quota' | ||
description: | | ||
Corresponds to the 'refill_token_count' field in QuotaServer config. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Was this addressed?
|
||
blocking_functions { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not sure this was addressed either. It seems like you're choosing to keep the changes in this resource (cc @tylerg-dev who I see is a reviewer and also authored identityplatform/Config.yaml
#6587).
Either way, you will need to provide some sort of proof (ie. output) from running the acceptance tests.
Add BlockingFunctionsConfig, AuthorizedDomains and QuotaConfig fields to identityplatform config
If this PR is for Terraform, I acknowledge that I have:
make test
andmake lint
in the generated providers to ensure it passes unit and linter tests.Release Note Template for Downstream PRs (will be copied)