bidirectional sync for pubsub

[priyanshujain]

To build a bidirectional sync service, we need to expand your current unidirectional GCP-to-Terraform implementation.

1. Add state comparison capabilities to detect differences between Terraform and GCP
2. Implement reconciliation logic to handle conflicts
3. Create a mechanism to apply Terraform changes to GCP resources

The challenge is tracking state and handling bidirectional updates safely. You'll need to:

1. Parse Terraform state files
2. Compare against live cloud resources
3. Generate reconciliation plans
4. Add conflict resolution strategies

[priyanshujain]

To incorporate updates when resources are changed manually in the GCP console, we need to add these capabilities:

1. State Tracking: Store resource attributes after initial import
2. Drift Detection: Compare current GCP state with previous state
3. Terraform State Reading: Parse .tfstate files to understand what Terraform knows
4. Resource Definition Generation: Create actual resource blocks, not just import blocks

[priyanshujain]

1. Implementation Requirements:

   • Add auth handling for cloud providers
   • Include PR generation to update configs when drift is detected

2. Workflow Process:
   a. Fetch current state from backend GCS
   b. Discover current cloud resources
   c. Compare with Terraform state
   d. Generate updated configs
   e. Create PR with changes if drift detected

3. Security Considerations:

• Store credentials as GitHub secrets
• Use short-lived tokens through OIDC when possible
• Limit permissions to minimum required