Add a new field desired_state to manage CertificateAuthority state

[gfxcc]

If this PR is for Terraform, I acknowledge that I have:

• Searched through the issue tracker for an open issue that this either resolves or contributes to, commented on it to claim it, and written "fixes {url}" or "part of {url}" in this PR description. If there were no relevant open issues, I opened one and commented that I would like to work on it (not necessary for very small changes).
• Generated Terraform, and ran make test and make lint to ensure it passes unit and linter tests.
• Ensured that all new fields I added that can be set by a user appear in at least one example (for generated resources) or third_party test (for handwritten resources or update tests).
• Ran relevant acceptance tests (If the acceptance tests do not yet pass or you are unable to run them, please let your reviewer know).
• Read the Release Notes Guide before writing my release note below.

Release Note Template for Downstream PRs (will be copied)

privateca: add a new field `desired_state` to manage CertificateAuthority state.

[modular-magician]

Hello! I am a robot who works on Magic Modules PRs.

I have detected that you are a community contributor, so your PR will be assigned to someone with a commit-bit on this repo for initial review.

Thanks for your contribution! A human will be with you soon.

@c2thorn, please review this PR or find an appropriate assignee.

[modular-magician]

Hi! I'm the modular magician. Your PR generated some diffs in downstreams - here they are.

Diff report:

Terraform GA: Diff ( 3 files changed, 135 insertions(+), 4 deletions(-))
Terraform Beta: Diff ( 3 files changed, 135 insertions(+), 4 deletions(-))
TF Validator: Diff ( 2 files changed, 3 insertions(+), 3 deletions(-))

[modular-magician]

Tests analytics

Total tests: 1983
Passed tests 1740
Skipped tests: 240
Failed tests: 3

Action taken

Triggering VCR tests in RECORDING mode for the following tests that failed during VCR: TestAccServiceNetworkingPeeredDNSDomain_basic|TestAccDataprocCluster_withImageVersion|TestAccPrivatecaCertificateAuthority_privatecaCertificateAuthorityIsStaged

[modular-magician]

Tests passed during RECORDING mode:
TestAccPrivatecaCertificateAuthority_privatecaCertificateAuthorityIsStaged[view]
TestAccServiceNetworkingPeeredDNSDomain_basic[view]

Tests failed during RECORDING mode:
TestAccDataprocCluster_withImageVersion[view]

Please fix these to complete your PR
View the build log or the debug log for each test

[c2thorn]

@gfxcc asking for a second opinion from the team as this is fairly unusual behavior. May not be worth addressing my previous comment until I hear back

[c2thorn]

After discussion, we think that state-controlling behavior is best represented as a desired_state field.
is_staged would not be able to accommodate new states in the future, and there is precedence for this type of field in compute instance: https://github.com/hashicorp/terraform-provider-google/blob/main/google/resource_compute_instance.go#L740

The field would be an optional field that enables the CA if unset, and controls the state when explicitly set.

It would need a lot of custom code to get working:

1. Customizediff - would error on invalid state transitions
2. customflatten - If desired_state is set, the current state would be read. (see https://github.com/hashicorp/terraform-provider-google/blob/main/google/resource_compute_instance.go#L1361). If unset, leave unset.
3. customexpand - should always return empty as we do not want to send the field to the API.

This field would provide a better representation of the resource, wouldn't be a breaking change (CA is still enabled if unset), but is fairly complex. @gfxcc let me know what you think.

[gfxcc]

@c2thorn That sounds a great idea. Will push a new revision later.

[modular-magician]

Hi! I'm the modular magician. Your PR generated some diffs in downstreams - here they are.

Diff report:

Terraform GA: Diff ( 13 files changed, 270 insertions(+), 4 deletions(-))
Terraform Beta: Diff ( 14 files changed, 271 insertions(+), 4 deletions(-))
TF Validator: Diff ( 2 files changed, 3 insertions(+), 3 deletions(-))

[modular-magician]

Hi! I'm the modular magician. Your PR generated some diffs in downstreams - here they are.

Diff report:

Terraform GA: Diff ( 3 files changed, 347 insertions(+), 21 deletions(-))
Terraform Beta: Diff ( 3 files changed, 347 insertions(+), 21 deletions(-))
TF Validator: Diff ( 2 files changed, 3 insertions(+), 3 deletions(-))

[modular-magician]

Tests analytics

Total tests: 1993
Passed tests 1747
Skipped tests: 240
Failed tests: 6

Action taken

Triggering VCR tests in RECORDING mode for the following tests that failed during VCR: TestAccDatasourceGoogleServiceNetworkingPeeredDnsDomain_basic|TestAccFirebaserulesRelease_BasicRelease|TestAccPrivatecaCertificateAuthority_rootCaManageDesiredState|TestAccPrivatecaCertificateAuthority_rootCaIsEnabledByDefault|TestAccPrivatecaCertificateAuthority_rootCaCreatedInStaged|TestAccPrivatecaCertificateAuthority_subordinateCaCreatedInAwaitingUserActivation

[modular-magician]

Tests passed during RECORDING mode:
TestAccDatasourceGoogleServiceNetworkingPeeredDnsDomain_basic[view]
TestAccPrivatecaCertificateAuthority_subordinateCaCreatedInAwaitingUserActivation[view]
TestAccPrivatecaCertificateAuthority_rootCaManageDesiredState[view]
TestAccPrivatecaCertificateAuthority_rootCaIsEnabledByDefault[view]
TestAccPrivatecaCertificateAuthority_rootCaCreatedInStaged[view]
TestAccFirebaserulesRelease_BasicRelease[view]

All tests passed
View the build log or the debug log for each test

[modular-magician]

Hi! I'm the modular magician. Your PR generated some diffs in downstreams - here they are.

Diff report:

Terraform GA: Diff ( 3 files changed, 342 insertions(+), 21 deletions(-))
Terraform Beta: Diff ( 3 files changed, 342 insertions(+), 21 deletions(-))
TF Validator: Diff ( 2 files changed, 3 insertions(+), 3 deletions(-))

[modular-magician]

Tests analytics

Total tests: 1999
Passed tests 1755
Skipped tests: 241
Failed tests: 3

Action taken

Triggering VCR tests in RECORDING mode for the following tests that failed during VCR: TestAccServiceNetworkingPeeredDNSDomain_basic|TestAccFirebaserulesRelease_BasicRelease|TestAccDatasourceGoogleServiceNetworkingPeeredDnsDomain_basic

[modular-magician]

Tests passed during RECORDING mode:
TestAccDatasourceGoogleServiceNetworkingPeeredDnsDomain_basic[view]
TestAccServiceNetworkingPeeredDNSDomain_basic[view]
TestAccFirebaserulesRelease_BasicRelease[view]

All tests passed
View the build log or the debug log for each test

[modular-magician]

Hi! I'm the modular magician. Your PR generated some diffs in downstreams - here they are.

Diff report:

Terraform GA: Diff ( 3 files changed, 360 insertions(+), 21 deletions(-))
Terraform Beta: Diff ( 3 files changed, 360 insertions(+), 21 deletions(-))
TF Validator: Diff ( 3 files changed, 35 insertions(+), 4 deletions(-))

[modular-magician]

Tests analytics

Total tests: 1999
Passed tests 1756
Skipped tests: 241
Failed tests: 2

Action taken

Triggering VCR tests in RECORDING mode for the following tests that failed during VCR: TestAccFirebaserulesRelease_BasicRelease|TestAccBigQueryDataTable_bigtable

[modular-magician]

Tests passed during RECORDING mode:
TestAccBigQueryDataTable_bigtable[view]
TestAccFirebaserulesRelease_BasicRelease[view]

All tests passed
View the build log or the debug log for each test

[c2thorn]

Apologies for the delay @gfxcc, LGTM