feat(google_container_cluster): support fqdn network policy

[toVersus]

Fixes: hashicorp/terraform-provider-google#15295

This PR added support for enabling FQDN Network Policy for the google_container_cluster resource. This allows users to enable / disable FQDN Network Policy feature. For standard GKE cluster users, they need to restart anetd DaemonSet after enablement. See Control Pod egress traffic using FQDN network policies and corresponding REST API doc.

If this PR is for Terraform, I acknowledge that I have:

• Searched through the issue tracker for an open issue that this either resolves or contributes to, commented on it to claim it, and written "fixes {url}" or "part of {url}" in this PR description. If there were no relevant open issues, I opened one and commented that I would like to work on it (not necessary for very small changes).
• Ensured that all new fields I added that can be set by a user appear in at least one example (for generated resources) or third_party test (for handwritten resources or update tests).
• Generated Terraform providers, and ran make test and make lint in the generated providers to ensure it passes unit and linter tests.
• Ran relevant acceptance tests using my own Google Cloud project and credentials (If the acceptance tests do not yet pass or you are unable to run them, please let your reviewer know).
• Read Write release notes before writing my release note below.

Release Note Template for Downstream PRs (will be copied)

container: added `enable_fqdn_network_policy` field to `google_container_cluster`

[modular-magician]

Hello! I am a robot. It looks like you are a community contributor. @rileykarson, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

[toVersus]

I ran the test locally and got the following error. I'll look into it.

✖  make testacc TEST=./google-beta TESTARGS='-run=TestAccContainerCluster_withFQDNNetworkPolicy'
==> Checking that code complies with gofmt requirements...
go vet
TF_ACC=1 TF_SCHEMA_PANIC_ON_ERROR=1 go test ./google-beta -v -run=TestAccContainerCluster_withFQDNNetworkPolicy -timeout 240m -ldflags="-X=github.com/hashicorp/terraform-provider-google-beta/version.ProviderVersion=acc"
=== RUN   TestAccContainerCluster_withFQDNNetworkPolicy
=== PAUSE TestAccContainerCluster_withFQDNNetworkPolicy
=== CONT  TestAccContainerCluster_withFQDNNetworkPolicy
    vcr_utils.go:152: Step 5/6 error: Error running apply: exit status 1

        Error: googleapi: Error 400: Must specify a field to update.
        Details:
        [
          {
            "@type": "type.googleapis.com/google.rpc.RequestInfo",
            "requestId": "0xb457adc22a798dd2"
          }
        ]
        , badRequest

          with google_container_cluster.cluster,
          on terraform_plugin_test.tf line 41, in resource "google_container_cluster" "cluster":

[toVersus]

Once the FQDN network policy feature is enabled, it seems that it cannot be disabled. I added the CustomizeDiff similar to L4 ILB subsetting, and changed the allow value from false to true. Otherwise force recreate it.

[toVersus]

ping @rileykarson

[em-le-ts]

+1

[rileykarson]

Rolling alt reviewer as I'll be out for a bit

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

Terraform GA: Diff ( 2 files changed, 4 insertions(+), 1 deletion(-))
Terraform Beta: Diff ( 3 files changed, 123 insertions(+), 1 deletion(-))
TF Conversion: Diff ( 2 files changed, 3 insertions(+), 3 deletions(-))

Missing test report

Your PR includes resource fields which are not covered by any test.

Resource: google_container_cluster (227 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_container_cluster" "primary" {
  enable_fqdn_network_policy = # value needed
}

[modular-magician]

Tests analytics

Total tests: 2940
Passed tests 2637
Skipped tests: 302
Affected tests: 1

Action taken

Found 1 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

TestAccContainerCluster_withFQDNNetworkPolicy

Get to know how VCR tests work

[modular-magician]

$\textcolor{green}{\textsf{Tests passed during RECORDING mode:}}$
TestAccContainerCluster_withFQDNNetworkPolicy[Debug log]

Rerun these tests in REPLAYING mode to catch issues

$\textcolor{green}{\textsf{No issues found for passed tests after REPLAYING rerun.}}$

---

$\textcolor{green}{\textsf{All tests passed!}}
View the build log or the debug log for each test

[toVersus]

Gentle ping @slevenick

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

Terraform GA: Diff ( 2 files changed, 4 insertions(+), 1 deletion(-))
Terraform Beta: Diff ( 3 files changed, 123 insertions(+), 1 deletion(-))

Missing test report

Your PR includes resource fields which are not covered by any test.

Resource: google_container_cluster (227 total tests)
Please add an acceptance test which includes these fields. The test should include the following:

resource "google_container_cluster" "primary" {
  enable_fqdn_network_policy = # value needed
}

[modular-magician]

Tests analytics

Total tests: 2962
Passed tests 2657
Skipped tests: 302
Affected tests: 3

Action taken

Found 3 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

TestAccBigtableAppProfile_bigtableAppProfileAnyclusterExample|TestAccBigtableAppProfile_bigtableAppProfileSingleclusterExample|TestAccBigtableAppProfile_bigtableAppProfileMulticlusterExample

Get to know how VCR tests work

[modular-magician]

$\textcolor{green}{\textsf{Tests passed during RECORDING mode:}}$
TestAccBigtableAppProfile_bigtableAppProfileAnyclusterExample[Debug log]
TestAccBigtableAppProfile_bigtableAppProfileSingleclusterExample[Debug log]
TestAccBigtableAppProfile_bigtableAppProfileMulticlusterExample[Debug log]

Rerun these tests in REPLAYING mode to catch issues

$\textcolor{green}{\textsf{No issues found for passed tests after REPLAYING rerun.}}$

---

$\textcolor{green}{\textsf{All tests passed!}}$
View the build log or the debug log for each test