Promote Redis Auth to GA

[upodroid]

Fixes: hashicorp/terraform-provider-google#8005
Fixes: hashicorp/terraform-provider-google#7601

If this PR is for Terraform, I acknowledge that I have:

• Searched through the issue tracker for an open issue that this either resolves or contributes to, commented on it to claim it, and written "fixes {url}" or "part of {url}" in this PR description. If there were no relevant open issues, I opened one and commented that I would like to work on it (not necessary for very small changes).
• Generated Terraform, and ran make test and make lint to ensure it passes unit and linter tests.
• Ensured that all new fields I added that can be set by a user appear in at least one example (for generated resources) or third_party test (for handwritten resources or update tests).
• Ran relevant acceptance tests (If the acceptance tests do not yet pass or you are unable to run them, please let your reviewer know).
• Read the Release Notes Guide before writing my release note below.

Release Note Template for Downstream PRs (will be copied)

redis: promoted `google_redis_instance.auth_enabled` to GA

redis: added `auth_string` output to `google_redis_instance` when `auth_enabled` is `true`

[modular-magician]

Hello! I am a robot who works on Magic Modules PRs.

I have detected that you are a community contributor, so your PR will be assigned to someone with a commit-bit on this repo for initial review.

Thanks for your contribution! A human will be with you soon.

@ScottSuarez, please review this PR or find an appropriate assignee.

[modular-magician]

Hi! I'm the modular magician. Your PR generated some diffs in downstreams - here they are.

Diff report:

Terraform GA: Diff ( 3 files changed, 166 insertions(+), 1 deletion(-))
Terraform Beta: Diff ( 3 files changed, 76 insertions(+), 3 deletions(-))
Ansible: Diff ( 2 files changed, 27 insertions(+))
TF Conversion: Diff ( 1 file changed, 10 insertions(+))
Inspec: Diff ( 2 files changed, 2 insertions(+), 2 deletions(-))

[ScottSuarez]

looks good to me but adding @rileykarson for a second pass

[ScottSuarez]

/gcbrun

[modular-magician]

I have triggered VCR tests based on this PR's diffs. See the results here: "https://ci-oss.hashicorp.engineering/viewQueued.html?itemId=164686"

[modular-magician]

Hi! I'm the modular magician. Your PR generated some diffs in downstreams - here they are.

Diff report:

Terraform GA: Diff ( 3 files changed, 166 insertions(+), 1 deletion(-))
Terraform Beta: Diff ( 3 files changed, 76 insertions(+), 3 deletions(-))
Ansible: Diff ( 2 files changed, 27 insertions(+))
TF Conversion: Diff ( 1 file changed, 10 insertions(+))
Inspec: Diff ( 2 files changed, 2 insertions(+), 2 deletions(-))

[modular-magician]

I have triggered VCR tests in RECORDING mode for the following tests that failed during VCR: TestAccDataSourceStorageBucketObjectContent_Basic|TestAccActiveDirectoryDomainTrust_activeDirectoryDomainTrustBasicExample|TestAccContainerCluster_withConfidentialNodes|TestAccContainerCluster_withPrivateClusterConfigMissingCidrBlock|TestAccContainerCluster_withIPv4Error|TestAccDataprocJob_Spark|TestAccRedisInstance_redisInstanceAuthEnabled You can view the result here: "https://ci-oss.hashicorp.engineering/viewQueued.html?itemId=164689"

[rileykarson]

How do you feel about exposing the auth string through a datasource instead of through this resource? Users have been hesitant about including secrets of this type in state the past, and that could be a happy compromise.

Also affects hashicorp/terraform-provider-google#7601 (assuming we keep auth string in-resource, fixes it)

[rileykarson]

Why do we ignore auth_string? Does the value change each GET? That's another case for using a datasource imo (since the volatile value won't impact the resource, and afaik the primary usecase of the auth string will be exporting it as an output)

If we don't expect the string to expire we could also use a resource to get the value and store it in state, keeping a stable value around.

[upodroid]

I didn't see that other issue.

I excluded the field from import because the import step was failing.

That value is fixed on each call.

[rileykarson]

Why was the import step failing? Do you have an error message? That's often an indicator of an actual issue.

[upodroid]

I'll repro it now. Also I don't like the idea of having to use a separate ds to pull the auth string.

Also it is sent unencrypted. I know there is a new preview feature which enables TLS connections to redis.

https://cloud.google.com/memorystore/docs/redis/auth-overview#security_and_privacy

[upodroid]

Also 7601 will be fixed by this PR.

Good security for Redis is achieved by using TLS + network isolation. https://redis.io/topics/security

[upodroid]

I figured it out. The decoder logic was broken. Pushed a fix now.

[modular-magician]

Hi! I'm the modular magician. Your PR generated some diffs in downstreams - here they are.

Diff report:

Terraform GA: Diff ( 3 files changed, 166 insertions(+), 1 deletion(-))
Terraform Beta: Diff ( 3 files changed, 75 insertions(+), 2 deletions(-))
Ansible: Diff ( 2 files changed, 27 insertions(+))
TF Conversion: Diff ( 1 file changed, 10 insertions(+))
Inspec: Diff ( 2 files changed, 2 insertions(+), 2 deletions(-))