Allow updating of resource policies in compute_disk

[chrissng]

Allow updating of resource policies in compute_disk by using an attachment resource.

TODOs:

• Implement a Terraform resource that attaches a resource policy to a disk.
• Write test that verify that the implementation works as intended.

Release Note for Downstream PRs (will be copied)

Allow updating of resource policies in compute_disk by using an attachment resource.

[googlebot]

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project (if not, look below for help). Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed (or fixed any issues), please reply here with @googlebot I signed it!) and we'll verify it.

---

What to do if you already signed the CLA

Individual signers

• It's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.

Corporate signers

• Your company has a Point of Contact who decides which employees are authorized to participate. Ask your POC to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the Google project maintainer to go/cla#troubleshoot (Public version).
• The email used to register you as an authorized contributor must be the email used for the Git commit. Check your existing CLA data and verify that your email is set on your git commits.
• The email used to register you as an authorized contributor must also be attached to your GitHub account.

ℹ️ Googlers: Go here for more info.

[googlebot]

CLAs look good, thanks!

ℹ️ Googlers: Go here for more info.

[modular-magician]

Hello! I am a robot who works on Magic Modules PRs.

I have detected that you are a community contributor, so your PR will be assigned to someone with a commit-bit on this repo for initial review. They will authorize it to run through our CI pipeline, which will generate downstream PRs.

Thanks for your contribution! A human will be with you soon.

@rileykarson, please review this PR or find an appropriate assignee.

[modular-magician]

Hello! I am a robot who works on Magic Modules PRs.

I have detected that you are a community contributor, so your PR will be assigned to someone with a commit-bit on this repo for initial review. They will authorize it to run through our CI pipeline, which will generate downstream PRs.

Thanks for your contribution! A human will be with you soon.

@SirGitsalot, please review this PR or find an appropriate assignee.

[modular-magician]

Hi! I'm the modular magician, I work on Magic Modules.
This PR seems not to have generated downstream PRs before, as of fea1285.

Pull request statuses

No diff detected in terraform-google-conversion.
No diff detected in Ansible.
No diff detected in Inspec.

New Pull Requests

I built this PR into one or more new PRs on other repositories, and when those are closed, this PR will also be merged and closed.
depends: hashicorp/terraform-provider-google-beta#1085
depends: hashicorp/terraform-provider-google#4323

[chrissng]

@rileykarson Thank you for the suggestions, I will work on them.

I realise that the update is not fully addressed. According to the Beta API, there is also the removeResourcePolicies and not just the addResourcePolicies API.

This would suggest that custom update code has to be done on resource_policies property updates that calls both the APIs. It has to handle cases:

1. [Addressed] no resource_policies -> resource_policies X
2. [Not addressed] resource_policies X -> no resource_policies
3. [Not addressed] resource_policies X -> resource_policies Y

In case (1), no need to call removeResourcePolicies. In case (2), need to call removeResourcePolicies only. In case (3), need to call removeResourcePolicies first before calling addResourcePolicies.

Looking at the magic-modules documentation and codelab, I have not been successful incorporating these behavior using pre_update custom code. I am not sure if I am on the right track; do you have any suggestions?

[rileykarson]

Right, sorry about that. I managed to miss that it was an addX/removeX subresource originally.
It looks like you've already picked up on the fine-grained resource pattern. It's the best way to support this kind of behaviour with MM right now.

https://github.com/GoogleCloudPlatform/magic-modules/pull/1846/files is a good sample of what adding one looks like. https://github.com/GoogleCloudPlatform/magic-modules/pull/1504/files#diff-fb4f76e7d870258668a3beac48bf164cR276 is also useful as a reference, but it contains some unrelated changes.

Edit: Ah, but resource policies are primitives and not nested objects. This is case we haven't handled previously. I'll dig a bit more.

[rileykarson]

I looked into the API more closely. The addX/removeX endpoints expecting a list instead of a single element is unusual, but we should be able to express everything cleanly other than that, and use custom code (an encoder) to pretend the API looks how we'd expect.

I haven't personally written a fine-grained resource, so it's very possible that I've missed something. If you encounter any issues or need any clarifications (or otherwise get stuck), please comment and I can provide feedback!

[rileykarson]

It looks like we're just failing to import the resource. I think we need to massage the import id slightly by changing the base_url value. MM constructs the id based on pre-existing data when it can: https://github.com/GoogleCloudPlatform/magic-modules/blob/master/provider/terraform/import.rb#L36

[chrissng]

We're good; the tests passed! 🙏

[modular-magician]

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, 60eb12f.

Pull request statuses

terraform-provider-google-beta already has an open PR.
terraform-google-conversion already has an open PR.
terraform-provider-google already has an open PR.
No diff detected in Ansible.

New Pull Requests

I built this PR into one or more new PRs on other repositories, and when those are closed, this PR will also be merged and closed.
depends: modular-magician/inspec-gcp#200

[rileykarson]

Just a couple small nitpicks left, overall LGTM.

Can you remove google-beta from https://github.com/GoogleCloudPlatform/magic-modules/blob/master/templates/terraform/examples/resource_policy_basic.tf.erb and https://github.com/GoogleCloudPlatform/magic-modules/blob/master/templates/terraform/examples/resource_policy_full.tf.erb?

[modular-magician]

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, b41b21e.

Pull request statuses

terraform-provider-google-beta already has an open PR.
terraform-google-conversion already has an open PR.
terraform-provider-google already has an open PR.
No diff detected in Ansible.
No diff detected in Inspec.

New Pull Requests

I didn't open any new pull requests because of this PR.

[rileykarson]

LGTM! Thanks for your patience in working through adding a fine-grained resource like this @chrissng, we haven't added too many so the patterns aren't very well-defined yet.

Do you mind giving explicit consent to the CLA under GoogleCloudPlatform/terraform-google-conversion#192? While the PR is authored by the our CI robot user, we attribute the PR to the upstream author and our CLA requires explicit consent from committers.

[chrissng]

@rileykarson I would say this would not have been possible without your help. Thank you for your patience and guidance throughout this PR!

[modular-magician]

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, b7de2e6.

Pull request statuses

terraform-provider-google-beta already has an open PR.
terraform-google-conversion already has an open PR.
terraform-provider-google already has an open PR.
No diff detected in Ansible.

New Pull Requests

I built this PR into one or more new PRs on other repositories, and when those are closed, this PR will also be merged and closed.
depends: modular-magician/inspec-gcp#207

[rileykarson]

Sorry! One small thing popped up after your latest merge.

[modular-magician]

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, cd55e96.

Pull request statuses

terraform-provider-google-beta already has an open PR.
No diff detected in terraform-google-conversion.
terraform-provider-google already has an open PR.
No diff detected in Ansible.
No diff detected in Inspec.

New Pull Requests

I didn't open any new pull requests because of this PR.

[rileykarson]

This should be merged soon, our generator attached the wrong downstream changes to this PR yesterday. This next run (should) fix it, and it it doesn't I'll reconcile manually.

[modular-magician]

Hi! I'm the modular magician, I work on Magic Modules.
I see that this PR has already had some downstream PRs generated. Any open downstreams are already updated to your most recent commit, b001d14.

Pull request statuses

terraform-provider-google-beta already has an open PR.
terraform-provider-google already has an open PR.
No diff detected in Ansible.
No diff detected in Inspec.

New Pull Requests

I built this PR into one or more new PRs on other repositories, and when those are closed, this PR will also be merged and closed.
depends: GoogleCloudPlatform/terraform-google-conversion#192

[rileykarson]

Edited above to point to the original conversion PR.