Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

azurerm_container_registry_token_password - Handle gone container registry token and mark this password as gone #27232

Merged
merged 7 commits into from
Nov 15, 2024
Merged

azurerm_container_registry_token_password - Handle gone container registry token and mark this password as gone #27232

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
d89b363
Update
magodo Sep 10, 2024
6156283
Update internal/services/containers/container_registry_token_password…
magodo Nov 2, 2024
0100768
Merge remote-tracking branch 'upstream/main' into acr_token_password_…
magodo Nov 10, 2024
cd57967
Merge main and pass tests
magodo Nov 11, 2024
90476b1
rename test cases
magodo Nov 12, 2024
8d3f369
Revert "rename test cases"
magodo Nov 12, 2024
d807b05
Skip the test cases
magodo Nov 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 14 additions & 10 deletions internal/services/containers/container_registry_token_password_resource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ import (

"github.com/Azure/go-autorest/autorest/date"
"github.com/hashicorp/go-azure-helpers/lang/pointer"
"github.com/hashicorp/go-azure-helpers/lang/response"
containterregistry_v2021_08_01_preview "github.com/hashicorp/go-azure-sdk/resource-manager/containerregistry/2023-06-01-preview"
"github.com/hashicorp/go-azure-sdk/resource-manager/containerregistry/2023-06-01-preview/registries"
"github.com/hashicorp/go-azure-sdk/resource-manager/containerregistry/2023-06-01-preview/tokens"
Expand Down Expand Up @@ -132,7 +133,7 @@ func (r ContainerRegistryTokenPasswordResource) Create() sdk.ResourceFunc {

id := parse.NewContainerRegistryTokenPasswordID(tokenId.SubscriptionId, tokenId.ResourceGroupName, tokenId.RegistryName, tokenId.TokenName, "password")

pwds, err := r.readPassword(ctx, client, *tokenId)
pwds, _, err := r.readPassword(ctx, client, *tokenId)
if err != nil {
return err
}
Expand Down Expand Up @@ -181,7 +182,10 @@ func (r ContainerRegistryTokenPasswordResource) Read() sdk.ResourceFunc {

tokenId := tokens.NewTokenID(id.SubscriptionId, id.ResourceGroup, id.RegistryName, id.TokenName)

pwds, err := r.readPassword(ctx, client, tokenId)
pwds, notFound, err := r.readPassword(ctx, client, tokenId)
if notFound || (pwds != nil && len(pwds) == 0) {
return metadata.MarkAsGone(id)
}
if err != nil {
return err
}
Expand Down Expand Up @@ -369,35 +373,35 @@ func (r ContainerRegistryTokenPasswordResource) flattenContainerRegistryTokenPas
return
}

func (r ContainerRegistryTokenPasswordResource) readPassword(ctx context.Context, client *containterregistry_v2021_08_01_preview.Client, id tokens.TokenId) ([]tokens.TokenPassword, error) {
func (r ContainerRegistryTokenPasswordResource) readPassword(ctx context.Context, client *containterregistry_v2021_08_01_preview.Client, id tokens.TokenId) ([]tokens.TokenPassword, bool, error) {
existing, err := client.Tokens.Get(ctx, id)
if err != nil {
return nil, fmt.Errorf("retrieving %s: %+v", id, err)
return nil, response.WasNotFound(existing.HttpResponse), fmt.Errorf("retrieving %s: %+v", id, err)
}
if existing.Model == nil {
return nil, fmt.Errorf("checking for presence of existing %s: model is nil", id)
return nil, false, fmt.Errorf("checking for presence of existing %s: model is nil", id)
}

if existing.Model.Properties == nil {
return nil, fmt.Errorf("checking for presence of existing %s: properties is nil", id)
return nil, false, fmt.Errorf("checking for presence of existing %s: properties is nil", id)
}

if existing.Model.Properties.Credentials == nil {
return nil, fmt.Errorf("checking for presence of existing %s: credentials is nil", id)
return nil, false, fmt.Errorf("checking for presence of existing %s: credentials is nil", id)
}

passwords := existing.Model.Properties.Credentials.Passwords
if passwords == nil {
return nil, fmt.Errorf("checking for presence of existing %s: passwords is nil", id)
return nil, false, fmt.Errorf("checking for presence of existing %s: passwords is nil", id)
}

return *passwords, nil
return *passwords, false, nil
}

func (r ContainerRegistryTokenPasswordResource) generatePassword(ctx context.Context, clients client.Client, id tokens.TokenId, passwords []tokens.TokenPassword) ([]tokens.TokenPassword, error) {
var genPasswords []tokens.TokenPassword

existingPasswords, err := r.readPassword(ctx, clients.ContainerRegistryClient_v2023_06_01_preview, id)
existingPasswords, _, err := r.readPassword(ctx, clients.ContainerRegistryClient_v2023_06_01_preview, id)
if err != nil {
return nil, fmt.Errorf("reading existing passwords: %+v", err)
}
Expand Down
73 changes: 71 additions & 2 deletions internal/services/containers/container_registry_token_password_resource_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ func TestAccContainerRegistryTokenPassword_update(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_container_registry_token_password", "test")
r := ContainerRegistryTokenPasswordResource{Expiry: time.Now().Add(time.Hour)}

data.ResourceTest(t, r, []acceptance.TestStep{
data.ResourceTestIgnoreRecreate(t, r, []acceptance.TestStep{
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These tests are called _update so presumably they're checking that certain properties are updating correctly on the resource and not triggering a ForceNew, which means that this isn't a proper fix for the test and is masking an underlying issue.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reason can be found at:

terraform-provider-azurerm/internal/services/containers/container_registry_token_password_resource.go

Lines 59 to 66 in cd57967

"expiry": {
Type: pluginsdk.TypeString,
Optional: true,
// TODO: Remove the force new and add customize diff to SetNewComputed on the `value` once https://github.com/hashicorp/terraform-plugin-sdk/issues/459 is addressed.
ForceNew: true,
ValidateFunc: validation.IsRFC3339Time,
DiffSuppressFunc: suppress.RFC3339Time,
},

Due to this bug, we are not able to update it, but can only recreate a new token password. This doesn't make a big difference for this resource.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Keeping the test called _update is misleading then since we're not actually updating anything, either the config should be adjusted so that we're actually correctly testing the update of update-able properties, or the test should be renamed or removed since we don't typically test for ForceNew behaviours

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed. I skip these two test cases now until we migrated to fw.

{
Config: r.basic(data),
Check: acceptance.ComposeTestCheckFunc(
Expand Down Expand Up @@ -86,7 +86,7 @@ func TestAccContainerRegistryTokenPassword_updateExpiryReflectNewValue(t *testin
data := acceptance.BuildTestData(t, "azurerm_container_registry_token_password", "test")
r := ContainerRegistryTokenPasswordResource{}

data.ResourceTest(t, r, []acceptance.TestStep{
data.ResourceTestIgnoreRecreate(t, r, []acceptance.TestStep{
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The same applies to this test.

{
Config: r.expiryReflectValue(data, time.Now().Add(time.Hour).Format(time.RFC3339), "password1"),
Check: acceptance.ComposeTestCheckFunc(
Expand All @@ -104,6 +104,28 @@ func TestAccContainerRegistryTokenPassword_updateExpiryReflectNewValue(t *testin
})
}

func TestAccContainerRegistryTokenPassword_replace(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_container_registry_token_password", "test")
r := ContainerRegistryTokenPasswordResource{Expiry: time.Now().Add(time.Hour)}

data.ResourceTestIgnoreRecreate(t, r, []acceptance.TestStep{
{
Config: r.basicWithACRName("acctest1", data),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep("password1.0.value"),
{
Config: r.basicWithACRName("acctest2", data),
Check: acceptance.ComposeTestCheckFunc(
check.That(data.ResourceName).ExistsInAzure(r),
),
},
data.ImportStep("password1.0.value"),
})
}

func TestAccContainerRegistryTokenPassword_requiresImport(t *testing.T) {
data := acceptance.BuildTestData(t, "azurerm_container_registry_token_password", "test")
r := ContainerRegistryTokenPasswordResource{Expiry: time.Now().Add(time.Hour)}
Expand Down Expand Up @@ -249,3 +271,50 @@ resource "azurerm_container_registry_token" "test" {
}
`, data.RandomInteger, data.Locations.Primary, data.RandomInteger, data.RandomInteger)
}

func (r ContainerRegistryTokenPasswordResource) basicWithACRName(name string, data acceptance.TestData) string {
template := r.templateWithACRName(name, data)
return fmt.Sprintf(`
%s

resource "azurerm_container_registry_token_password" "test" {
container_registry_token_id = azurerm_container_registry_token.test.id
password1 {}
}
`, template)
}

func (r ContainerRegistryTokenPasswordResource) templateWithACRName(name string, data acceptance.TestData) string {
return fmt.Sprintf(`
provider "azurerm" {
features {}
}

resource "azurerm_resource_group" "test" {
name = "acctestRG-acr-%d"
location = "%s"
}

resource "azurerm_container_registry" "test" {
name = "%s%d"
resource_group_name = azurerm_resource_group.test.name
location = azurerm_resource_group.test.location
sku = "Premium"
admin_enabled = true
}

# use system wide scope map for tests
data "azurerm_container_registry_scope_map" "pull_repos" {
name = "_repositories_pull"
container_registry_name = azurerm_container_registry.test.name
resource_group_name = azurerm_container_registry.test.resource_group_name
}

resource "azurerm_container_registry_token" "test" {
name = "testtoken-%d"
resource_group_name = azurerm_resource_group.test.name
container_registry_name = azurerm_container_registry.test.name
scope_map_id = data.azurerm_container_registry_scope_map.pull_repos.id
}
`, data.RandomInteger, data.Locations.Primary, name, data.RandomInteger, data.RandomInteger)
}
Loading