Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes issue #18911 for Eventarc test flakiness due to IAM races #13200

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Fixes issue #18911 for Eventarc test flakiness due to IAM races #13200

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion mmv1/products/eventarc/Trigger.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,14 +56,16 @@ examples:
exclude_docs: true
- name: eventarc_trigger_with_channel_cmek
primary_resource_id: primary
bootstrap_iam:
- member: "serviceAccount:service-{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
role: "roles/cloudkms.cryptoKeyEncrypterDecrypter"
vars:
trigger_name: some-trigger
service_name: some-service
channel_name: some-channel
key_name: some-key
test_env_vars:
project_id: 'PROJECT_NAME'
project_number: 'PROJECT_NUMBER'
service_account: 'SERVICE_ACCT'
test_vars_overrides:
'key_name': 'acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", "us-central1", "tf-bootstrap-eventarc-trigger-key").CryptoKey.Name'
Expand Down
7 changes: 0 additions & 7 deletions mmv1/templates/terraform/examples/eventarc_trigger_with_channel_cmek.tf.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,8 @@
resource "google_kms_crypto_key_iam_member" "key_member" {
crypto_key_id = "{{index $.Vars "key_name"}}"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
member = "serviceAccount:service-{{index $.TestEnvVars "project_number"}}@gcp-sa-eventarc.iam.gserviceaccount.com"
}

resource "google_eventarc_channel" "test_channel" {
location = "us-central1"
name = "{{index $.Vars "channel_name"}}"
crypto_key_name = "{{index $.Vars "key_name"}}"
third_party_provider = "projects/{{index $.TestEnvVars "project_id"}}/locations/us-central1/providers/datadog"
depends_on = [google_kms_crypto_key_iam_member.key_member]
}

resource "google_cloud_run_service" "default" {
Expand Down
97 changes: 23 additions & 74 deletions mmv1/third_party/terraform/services/eventarc/resource_eventarc_google_channel_config_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,9 +38,13 @@ func testAccEventarcGoogleChannelConfig_basic(t *testing.T) {
"project_number": envvar.GetTestProjectNumberFromEnv(),
"region": region,
"random_suffix": acctest.RandString(t, 10),
"key1": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", region, "tf-bootstrap-eventarc-google-channel-config-key1").CryptoKey.Name,
"key2": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", region, "tf-bootstrap-eventarc-google-channel-config-key2").CryptoKey.Name,
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
Expand All @@ -60,22 +64,9 @@ func testAccEventarcGoogleChannelConfig_basic(t *testing.T) {

func testAccEventarcGoogleChannelConfig_basicCfg(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_kms_crypto_key_iam_member" "key1_member" {
crypto_key_id = "%{key1}"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
}

resource "google_kms_crypto_key_iam_member" "key2_member" {
crypto_key_id = "%{key2}"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
}

resource "google_eventarc_google_channel_config" "primary" {
location = "%{region}"
name = "googleChannelConfig"
depends_on = [google_kms_crypto_key_iam_member.key1_member, google_kms_crypto_key_iam_member.key2_member]
location = "%{region}"
name = "googleChannelConfig"
}
`, context)
}
Expand All @@ -87,9 +78,13 @@ func testAccEventarcGoogleChannelConfig_longForm(t *testing.T) {
"project_number": envvar.GetTestProjectNumberFromEnv(),
"region": region,
"random_suffix": acctest.RandString(t, 10),
"key1": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", region, "tf-bootstrap-eventarc-google-channel-config-key1").CryptoKey.Name,
"key2": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", region, "tf-bootstrap-eventarc-google-channel-config-key2").CryptoKey.Name,
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
Expand All @@ -110,23 +105,10 @@ func testAccEventarcGoogleChannelConfig_longForm(t *testing.T) {

func testAccEventarcGoogleChannelConfig_longFormCfg(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_kms_crypto_key_iam_member" "key1_member" {
crypto_key_id = "%{key1}"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
}

resource "google_kms_crypto_key_iam_member" "key2_member" {
crypto_key_id = "%{key2}"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
}

resource "google_eventarc_google_channel_config" "primary" {
project = "projects/%{project_name}"
location = "long/form/%{region}"
name = "projects/%{project_name}/locations/%{region}/googleChannelConfig"
depends_on = [google_kms_crypto_key_iam_member.key1_member, google_kms_crypto_key_iam_member.key2_member]
project = "projects/%{project_name}"
location = "long/form/%{region}"
name = "projects/%{project_name}/locations/%{region}/googleChannelConfig"
}
`, context)
}
Expand All @@ -141,6 +123,12 @@ func testAccEventarcGoogleChannelConfig_cryptoKeyUpdate(t *testing.T) {
"key1": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", region, "tf-bootstrap-eventarc-google-channel-config-key1").CryptoKey.Name,
"key2": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", region, "tf-bootstrap-eventarc-google-channel-config-key2").CryptoKey.Name,
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
Expand Down Expand Up @@ -186,69 +174,30 @@ func testAccEventarcGoogleChannelConfig_cryptoKeyUpdate(t *testing.T) {

func testAccEventarcGoogleChannelConfig_setCryptoKeyCfg(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_kms_crypto_key_iam_member" "key1_member" {
crypto_key_id = "%{key1}"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
}

resource "google_kms_crypto_key_iam_member" "key2_member" {
crypto_key_id = "%{key2}"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
}

resource "google_eventarc_google_channel_config" "primary" {
location = "%{region}"
name = "projects/%{project_name}/locations/%{region}/googleChannelConfig"
crypto_key_name = "%{key1}"
depends_on = [google_kms_crypto_key_iam_member.key1_member, google_kms_crypto_key_iam_member.key2_member]
}
`, context)
}

func testAccEventarcGoogleChannelConfig_cryptoKeyUpdateCfg(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_kms_crypto_key_iam_member" "key1_member" {
crypto_key_id = "%{key1}"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
}

resource "google_kms_crypto_key_iam_member" "key2_member" {
crypto_key_id = "%{key2}"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
}

resource "google_eventarc_google_channel_config" "primary" {
location = "%{region}"
name = "projects/%{project_name}/locations/%{region}/googleChannelConfig"
crypto_key_name = "%{key2}"
depends_on = [google_kms_crypto_key_iam_member.key1_member, google_kms_crypto_key_iam_member.key2_member]
}
`, context)
}

func testAccEventarcGoogleChannelConfig_deleteCryptoKeyCfg(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_kms_crypto_key_iam_member" "key1_member" {
crypto_key_id = "%{key1}"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
}

resource "google_kms_crypto_key_iam_member" "key2_member" {
crypto_key_id = "%{key2}"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
}

resource "google_eventarc_google_channel_config" "primary" {
location = "%{region}"
name = "projects/%{project_name}/locations/%{region}/googleChannelConfig"
crypto_key_name = ""
depends_on = [google_kms_crypto_key_iam_member.key1_member, google_kms_crypto_key_iam_member.key2_member]
}
`, context)
}
59 changes: 18 additions & 41 deletions mmv1/third_party/terraform/services/eventarc/resource_eventarc_message_bus_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,12 @@ func testAccEventarcMessageBus_basic(t *testing.T) {
"region": envvar.GetTestRegionFromEnv(),
"random_suffix": acctest.RandString(t, 10),
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
Expand Down Expand Up @@ -76,13 +82,18 @@ resource "google_eventarc_message_bus" "primary" {

func testAccEventarcMessageBus_cryptoKey(t *testing.T) {
region := envvar.GetTestRegionFromEnv()

context := map[string]interface{}{
"project_number": envvar.GetTestProjectNumberFromEnv(),
"region": region,
"key": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", region, "tf-bootstrap-eventarc-messagebus-key").CryptoKey.Name,
"random_suffix": acctest.RandString(t, 10),
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
Expand All @@ -104,34 +115,32 @@ func testAccEventarcMessageBus_cryptoKey(t *testing.T) {

func testAccEventarcMessageBus_cryptoKeyCfg(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_kms_crypto_key_iam_member" "key_member" {
crypto_key_id = "%{key}"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
}

resource "google_eventarc_message_bus" "primary" {
location = "%{region}"
message_bus_id = "tf-test-messagebus%{random_suffix}"
crypto_key_name = "%{key}"
logging_config {
log_severity = "ALERT"
}
depends_on = [google_kms_crypto_key_iam_member.key_member]
}
`, context)
}

func testAccEventarcMessageBus_update(t *testing.T) {
region := envvar.GetTestRegionFromEnv()

context := map[string]interface{}{
"project_number": envvar.GetTestProjectNumberFromEnv(),
"region": region,
"key1": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", region, "tf-bootstrap-eventarc-messagebus-key1").CryptoKey.Name,
"key2": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", region, "tf-bootstrap-eventarc-messagebus-key2").CryptoKey.Name,
"random_suffix": acctest.RandString(t, 10),
}
acctest.BootstrapIamMembers(t, []acctest.IamMember{
{
Member: "serviceAccount:service-{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com",
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
},
})

acctest.VcrTest(t, resource.TestCase{
PreCheck: func() { acctest.AccTestPreCheck(t) },
Expand Down Expand Up @@ -181,12 +190,6 @@ func testAccEventarcMessageBus_update(t *testing.T) {

func testAccEventarcMessageBus_setCfg(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_kms_crypto_key_iam_member" "key1_member" {
crypto_key_id = "%{key1}"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
}

resource "google_eventarc_message_bus" "primary" {
location = "%{region}"
message_bus_id = "tf-test-messagebus%{random_suffix}"
Expand All @@ -195,25 +198,12 @@ resource "google_eventarc_message_bus" "primary" {
logging_config {
log_severity = "ALERT"
}
depends_on = [google_kms_crypto_key_iam_member.key1_member]
}
`, context)
}

func testAccEventarcMessageBus_updateCfg(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_kms_crypto_key_iam_member" "key1_member" {
crypto_key_id = "%{key1}"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
}

resource "google_kms_crypto_key_iam_member" "key2_member" {
crypto_key_id = "%{key2}"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
}

resource "google_eventarc_message_bus" "primary" {
location = "%{region}"
message_bus_id = "tf-test-messagebus%{random_suffix}"
Expand All @@ -222,25 +212,12 @@ resource "google_eventarc_message_bus" "primary" {
logging_config {
log_severity = "DEBUG"
}
depends_on = [google_kms_crypto_key_iam_member.key1_member, google_kms_crypto_key_iam_member.key2_member]
}
`, context)
}

func testAccEventarcMessageBus_deleteCfg(context map[string]interface{}) string {
return acctest.Nprintf(`
resource "google_kms_crypto_key_iam_member" "key1_member" {
crypto_key_id = "%{key1}"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
}

resource "google_kms_crypto_key_iam_member" "key2_member" {
crypto_key_id = "%{key2}"
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
}

resource "google_eventarc_message_bus" "primary" {
location = "%{region}"
message_bus_id = "tf-test-messagebus%{random_suffix}"
Expand Down
Loading