Add resource manager tags to GKE autopilot

[maxi-cit]

Adds support for Resource Manager Tags for Autopilot GKE cluster resource

Part of: hashicorp/terraform-provider-google#16614

Release Note Template for Downstream PRs (will be copied)

container: added `node_pool_auto_config.resource_manager_tags` field to `google_container_cluster` resource

[modular-magician]

$\textcolor{green}{\textsf{Tests passed during RECORDING mode:}}$
TestAccContainerCluster_withAutopilotResourceManagerTags[Debug log]

$\textcolor{green}{\textsf{No issues found for passed tests after REPLAYING rerun.}}$

---

$\textcolor{green}{\textsf{All tests passed!}}$
View the build log or the debug log for each test

[maxi-cit]

Hello @SarahFrench could u tell me if there is something missing to merge this PR?

[SarahFrench]

This PR looks good given the tests for the new field. There's a small refactor that we'd need before merging, to make sure the new test doesn't impact other acceptance tests.

[maxi-cit]

Hello @SarahFrench, I updated the PR considering your suggestions, could you run the tests again please?

[SarahFrench]

Thanks for doing the refactoring I suggested- I noticed some problems with use of the new _iam_membership resources and I left some comments. Those comments may need to be applied in other places where those resources are used.

[SarahFrench]

Suggested change

	members = [
	"serviceAccount:service-${data.google_project.project.number}@container-engine-robot.iam.gserviceaccount.com",
	]
	member = "serviceAccount:service-${data.google_project.project.number}@container-engine-robot.iam.gserviceaccount.com"

IAM membership resources manage only one membership in a binding, so cannot take a list as an argument here.

[SarahFrench]

I'm afraid there'll need to be two membership resources used here to replace the original binding resource; _iam_membership resources only take a singular member argument

[maxi-cit]

Hello @SarahFrench can I just roll back to google_project_iam_binding? I ve got the strong feeling I will mess up with the replaying mode.
Besides I already got a similar PR merged using iam binding resource
Check this

[SarahFrench]

Ok, roll back and I can update your PR to use _iam_member resources after it's merged. Even though you got a previous PR accepted while using _iam_binding resources that doesn't mean that it's ideal. Once your new test joins our full test suite it will have the potential to conflict with other tests that also try to create bindings for that role at the project level. This type of conflict is what the _iam_member resources are designed to avoid.

[maxi-cit]

Hello @SarahFrench, thanks for the feedback. I reverted the changes to the commit where tests were passing.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 4 files changed, 501 insertions(+), 2 deletions(-))
google-beta provider: Diff ( 4 files changed, 501 insertions(+), 2 deletions(-))

[modular-magician]

Tests analytics

Total tests: 187
Passed tests: 175
Skipped tests: 12
Affected tests: 0

Click here to see the affected service packages

• container

$\textcolor{green}{\textsf{All tests passed!}}$
View the build log