Change vault_namespace ID to path

[petems]

• The ID isn’t super useful, it’s only used by Vault internally
• We should use the path as it allows imports of existing namespaces
• Move the namespace ID to its own computed attribute namespace_id

[petems]

After:

$ vault namespace create import_tester
Key     Value
---     -----
id      ghA9v
path    import_tester/
$ terraform import vault_namespace.import_tester import_tester
vault_namespace.import_tester: Importing from ID "import_tester"...
vault_namespace.import_tester: Import prepared!
  Prepared vault_namespace for import
vault_namespace.import_tester: Refreshing state... [id=import_tester]

Import successful!

The resources that were imported are shown above. These resources are now in
your Terraform state and will henceforth be managed by Terraform.
$ cat terraform.tfstate | jq .'resources'
[
  {
    "mode": "managed",
    "type": "vault_namespace",
    "name": "import_tester",
    "provider": "provider.vault",
    "instances": [
      {
        "schema_version": 0,
        "attributes": {
          "id": "import_tester",
          "namespace_id": "ghA9v",
          "path": "import_tester"
        },
        "private": "eyJzY2hlbWFfdmVyc2lvbiI6IjAifQ=="
      }
    ]
  }
]

[petems]

Before:

$ terraform import vault_namespace.import_tester import_tester
vault_namespace.import_tester: Importing from ID "import_tester"...
vault_namespace.import_tester: Import prepared!
  Prepared vault_namespace for import
vault_namespace.import_tester: Refreshing state... [id=import_tester]

Error: error reading from Vault: Error making API request.

URL: GET http://127.0.0.1:8200/v1/sys/namespaces
Code: 405. Errors:

* 1 error occurred:
	* unsupported operation

[tyrannosaurus-becks]

@petems - I had earlier marked this as approved, but I've been thinking about it more and also discussed a change in an ID in a subsequent PR. I realized that actually, changing the ID isn't backwards compatible, and I was wondering if we could add a migration path for the ID instead?

[petems]

@tyrannosaurus-becks Happy to do so, but I'll need a hand helping with that.

Are there examples of doing this in TF providers? Have you got time for a quick pairing session on it as well? 😄

[tyrannosaurus-becks]

@petems actually, I have a sample! We went through the same discussion on this PR, here's a direct link to the convo: #581 (comment). You should be able to check out the subsequent commits to see how it was implemented.

[petems]

@tyrannosaurus-becks Perfect! I'm not sure how to add a test for this new scenario... is there a way to create a special resource to run tests on in the old state?

[petems]

I can see it working in the logs with a manual test of manually editing the statefile:

2019-11-07T02:06:18.453Z [DEBUG] plugin.terraform-provider-vault: 2019/11/07 02:06:18 [INFO] Using Vault token with the following policies: root
2019-11-07T02:06:18.455Z [DEBUG] plugin.terraform-provider-vault: 2019/11/07 02:06:18 [DEBUG] Upgrading old ID to path - abcd123 to import_tester
2019-11-07T02:06:18.455Z [DEBUG] plugin.terraform-provider-vault: 2019/11/07 02:06:18 [DEBUG] Setting namespace_id to old ID - abcd123
2019-11-07T02:06:18.455Z [DEBUG] plugin.terraform-provider-vault: 2019/11/07 02:06:18 [DEBUG] Vault API Request Details:

[tyrannosaurus-becks]

This looks awesome. Thank you!