Added support for workload-vulnerability-scanning and workload-config-audit #7310

avinash84 · 2023-02-16T02:08:00Z

Added support for workload-vulnerability-scanning and workload-config-audit
Fixes hashicorp/terraform-provider-google#12778

If this PR is for Terraform, I acknowledge that I have:

Searched through the issue tracker for an open issue that this either resolves or contributes to, commented on it to claim it, and written "fixes {url}" or "part of {url}" in this PR description. If there were no relevant open issues, I opened one and commented that I would like to work on it (not necessary for very small changes).
Ensured that all new fields I added that can be set by a user appear in at least one example (for generated resources) or third_party test (for handwritten resources or update tests).
Generated Terraform providers, and ran make test and make lint in the generated providers to ensure it passes unit and linter tests.
Ran relevant acceptance tests using my own Google Cloud project and credentials (If the acceptance tests do not yet pass or you are unable to run them, please let your reviewer know).
Read the Release Notes Guide before writing my release note below.

Release Note Template for Downstream PRs (will be copied)

container: added field `protect_config` to `google_container_cluster` (beta)

…-audit Fixes hashicorp/terraform-provider-google#12778

avinash84 · 2023-02-16T02:08:17Z

/gcbrun

shuyama1 · 2023-02-16T02:46:15Z

/gcbrun

modular-magician · 2023-02-16T03:06:12Z

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

Terraform GA: Diff ( 1 file changed, 22 insertions(+))
Terraform Beta: Diff ( 3 files changed, 189 insertions(+))
TF Validator: Diff ( 2 files changed, 3 insertions(+), 3 deletions(-))

modular-magician · 2023-02-16T03:53:15Z

Tests analytics

Total tests: 2465
Passed tests 2206
Skipped tests: 256
Failed tests: 3

Action taken

Triggering VCR tests in RECORDING mode for the tests that failed during VCR. Click here to see the failed tests

TestAccFirebaserulesRelease_BasicRelease|TestAccContainerCluster_withProtectConfig|TestAccApigeeAddonsConfig_apigeeAddonsTestExample

modular-magician · 2023-02-16T04:08:34Z

Tests passed during RECORDING mode:
TestAccFirebaserulesRelease_BasicRelease[Debug log]
TestAccContainerCluster_withProtectConfig[Debug log]
TestAccApigeeAddonsConfig_apigeeAddonsTestExample[Debug log]

All tests passed
View the build log or the debug log for each test

shuyama1

only a couple small comments

shuyama1 · 2023-02-21T00:00:01Z

mmv1/third_party/terraform/resources/resource_container_cluster.go.erb

+						"workload_config": {
+							Type:        schema.TypeList,
+							Optional:    true,
+							MaxItems:    1,
+							Description: `WorkloadConfig defines the flags to enable or disable the workload configurations for the cluster.`,
+							Elem: &schema.Resource{
+								Schema: map[string]*schema.Schema{
+									"audit_mode": {
+										Type:        schema.TypeString,
+										Optional:    true,
+										Description: `Mode defines how to audit the workload configs. Accepted values are MODE_UNSPECIFIED, DISABLED, BASIC.`,
+									},
+								},
+							},
+						},
+						"workload_vulnerability_mode": {
+										Type:             schema.TypeString,
+										Optional:         true,
+										Description: `WorkloadVulnerabilityMode defines mode to perform vulnerability scanning. Accepted values are WORKLOAD_VULNERABILITY_MODE_UNSPECIFIED, DISABLED, BASIC.`,
+									},


Can we make one of the subfields required (or have AtLeastOneOf added to them) to prevent users from sending empty blocks.

made workload_config and audit_mode required to ensure that empty objects are never passed as input. Also added computed:true to workload_vulnerability_mode as default value is added to the field by server if no value is specified.

shuyama1 · 2023-02-21T00:09:53Z

mmv1/third_party/terraform/website/docs/r/container_cluster.html.markdown

+
+```hcl
+protect_config {
+	workload_config {
+		audit_mode = "BASIC"
+	}
+	workload_vulnerability_mode = "BASIC"
+}
+```


We don't necessarily need to provide use example usage for every feature. I think we can remove it for this case or we can move it to the top in the same format as other examples.

removed this example.

…ired

avinash84 · 2023-02-21T23:25:24Z

/gcbrun

…r resource.

shuyama1 · 2023-02-27T18:00:12Z

/gcbrun

shuyama1

LGTM! Will merge the PR after tests passed. Thanks!

modular-magician · 2023-02-27T18:19:29Z

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

Terraform GA: Diff ( 1 file changed, 13 insertions(+))
Terraform Beta: Diff ( 3 files changed, 190 insertions(+))
TF Validator: Diff ( 2 files changed, 3 insertions(+), 3 deletions(-))

modular-magician · 2023-02-27T19:08:17Z

Tests analytics

Total tests: 2474
Passed tests 2216
Skipped tests: 255
Failed tests: 3

Action taken

Triggering VCR tests in RECORDING mode for the tests that failed during VCR. Click here to see the failed tests

TestAccFirebaserulesRelease_BasicRelease|TestAccApigeeAddonsConfig_apigeeAddonsTestExample|TestAccWorkstationsWorkstationConfig_workstationConfigEncryptionKeyExample

modular-magician · 2023-02-27T20:01:55Z

Tests passed during RECORDING mode:
TestAccFirebaserulesRelease_BasicRelease[Debug log]
TestAccApigeeAddonsConfig_apigeeAddonsTestExample[Debug log]

Tests failed during RECORDING mode:
TestAccWorkstationsWorkstationConfig_workstationConfigEncryptionKeyExample[Error message] [Debug log]

Please fix these to complete your PR
View the build log or the debug log for each test

shuyama1 · 2023-02-27T20:24:46Z

Test failure seems unrelated to this PR.

…-audit (GoogleCloudPlatform#7310) * Added support for workload-vulnerability-scanning and workload-config-audit Fixes hashicorp/terraform-provider-google#12778 * Made google_container_cluster protect_config field optional * made container_cluster protect_config.workload_config.audit_mode required * Made fields inside protect_config as atleastOneOf in container_cluster resource. --------- Co-authored-by: Avinash Kumar <avikuma@google.com>

* main: (41 commits) update the test cases to resolve resourcename not found error Adds `grpc` field to `liveness_probe` and `startup_probe` to `google_cloud_run_v2_service` resource (GoogleCloudPlatform#6987) Upgrade DCL to v1.34 (GoogleCloudPlatform#7276) Add max_distance field to group placement policy (GoogleCloudPlatform#7354) Add stateful_ips to region_per_instance_config and per_instance_config (GoogleCloudPlatform#7316) Added support for workload-vulnerability-scanning and workload-config-audit (GoogleCloudPlatform#7310) datacatalog - bump Taxonomy and PolicyTag to ga (GoogleCloudPlatform#6989) Added best practices documentation for ForceNew fields (GoogleCloudPlatform#7127) Split resources in "B" products (GoogleCloudPlatform#7350) force recreate on master_config.num_instances (GoogleCloudPlatform#7349) Fix DataFusion instance versions used in tests (GoogleCloudPlatform#7343) remove duplicate word in Cluster.yaml (GoogleCloudPlatform#7347) Move more billing tests that require permissions beyond Billing User to master billing account (GoogleCloudPlatform#7344) Remove artifact repository beta URL, fixup handwritten tests (GoogleCloudPlatform#7345) Cloud Workstations - Workstation Config (GoogleCloudPlatform#7017) Add missing `type` argument to data source docs (GoogleCloudPlatform#7341) Fix caps in spanner resource schema accesses (GoogleCloudPlatform#7346) Downgrade Go to 1.18, modify comments (GoogleCloudPlatform#7339) feat: Add support for deletion_policy on shared vpc service project (GoogleCloudPlatform#7283) fixed virtual field update issues (GoogleCloudPlatform#7318) ...

…-audit (GoogleCloudPlatform#7310) * Added support for workload-vulnerability-scanning and workload-config-audit Fixes hashicorp/terraform-provider-google#12778 * Made google_container_cluster protect_config field optional * made container_cluster protect_config.workload_config.audit_mode required * Made fields inside protect_config as atleastOneOf in container_cluster resource. --------- Co-authored-by: Avinash Kumar <avikuma@google.com>

Avinash Kumar added 2 commits February 15, 2023 17:06

Added support for workload-vulnerability-scanning and workload-config…

1e6bf46

…-audit Fixes hashicorp/terraform-provider-google#12778

Made google_container_cluster protect_config field optional

a720ea7

avinash84 requested a review from a team as a code owner February 16, 2023 02:08

avinash84 requested review from melinath and removed request for a team February 16, 2023 02:08

shuyama1 requested review from shuyama1 and removed request for melinath February 16, 2023 02:46

shuyama1 reviewed Feb 21, 2023

View reviewed changes

made container_cluster protect_config.workload_config.audit_mode requ…

c01d7c1

…ired

Made fields inside protect_config as atleastOneOf in container_cluste…

37c846f

…r resource.

modular-magician requested a review from shuyama1 February 27, 2023 18:01

shuyama1 approved these changes Feb 27, 2023

View reviewed changes

shuyama1 merged commit 974faae into GoogleCloudPlatform:main Feb 27, 2023

This was referenced Feb 27, 2023

Added support for workload-vulnerability-scanning and workload-config-audit hashicorp/terraform-provider-google-beta#5255

Merged

Added support for workload-vulnerability-scanning and workload-config-audit hashicorp/terraform-provider-google#13849

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added support for workload-vulnerability-scanning and workload-config-audit #7310

Added support for workload-vulnerability-scanning and workload-config-audit #7310

avinash84 commented Feb 16, 2023 •

edited by shuyama1

Loading

avinash84 commented Feb 16, 2023

shuyama1 commented Feb 16, 2023

modular-magician commented Feb 16, 2023

modular-magician commented Feb 16, 2023

modular-magician commented Feb 16, 2023

shuyama1 left a comment

shuyama1 Feb 21, 2023

avinash84 Feb 21, 2023

shuyama1 Feb 21, 2023

avinash84 Feb 21, 2023

avinash84 commented Feb 21, 2023

shuyama1 commented Feb 27, 2023

shuyama1 left a comment

modular-magician commented Feb 27, 2023

modular-magician commented Feb 27, 2023

modular-magician commented Feb 27, 2023

shuyama1 commented Feb 27, 2023

Added support for workload-vulnerability-scanning and workload-config-audit #7310

Added support for workload-vulnerability-scanning and workload-config-audit #7310

Conversation

avinash84 commented Feb 16, 2023 • edited by shuyama1 Loading

avinash84 commented Feb 16, 2023

shuyama1 commented Feb 16, 2023

modular-magician commented Feb 16, 2023

Diff report

modular-magician commented Feb 16, 2023

Tests analytics

Action taken

modular-magician commented Feb 16, 2023

shuyama1 left a comment

Choose a reason for hiding this comment

shuyama1 Feb 21, 2023

Choose a reason for hiding this comment

avinash84 Feb 21, 2023

Choose a reason for hiding this comment

shuyama1 Feb 21, 2023

Choose a reason for hiding this comment

avinash84 Feb 21, 2023

Choose a reason for hiding this comment

avinash84 commented Feb 21, 2023

shuyama1 commented Feb 27, 2023

shuyama1 left a comment

Choose a reason for hiding this comment

modular-magician commented Feb 27, 2023

Diff report

modular-magician commented Feb 27, 2023

Tests analytics

Action taken

modular-magician commented Feb 27, 2023

shuyama1 commented Feb 27, 2023

avinash84 commented Feb 16, 2023 •

edited by shuyama1

Loading