Add workload identity pool managed identity.

[stevenyang72]

Release Note Template for Downstream PRs (will be copied)

See Write release notes for guidance.

`google_iam_workload_identity_pool_managed_identity` (beta)

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 1 file changed, 206 insertions(+))
google-beta provider: Diff ( 7 files changed, 1128 insertions(+), 2 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 129 insertions(+))

[modular-magician]

Tests analytics

Total tests: 37
Passed tests: 31
Skipped tests: 2
Affected tests: 4

Click here to see the affected service packages

• iambeta

Action taken

Found 4 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

• TestAccIAMBetaWorkloadIdentityPoolManagedIdentity_full
• TestAccIAMBetaWorkloadIdentityPoolManagedIdentity_iamWorkloadIdentityPoolManagedIdentityBasicExample
• TestAccIAMBetaWorkloadIdentityPoolManagedIdentity_iamWorkloadIdentityPoolManagedIdentityFullExample
• TestAccIAMBetaWorkloadIdentityPoolManagedIdentity_minimal

Get to know how VCR tests work

[modular-magician]

🟢 Tests passed during RECORDING mode:
TestAccIAMBetaWorkloadIdentityPoolManagedIdentity_full [Debug log]
TestAccIAMBetaWorkloadIdentityPoolManagedIdentity_iamWorkloadIdentityPoolManagedIdentityBasicExample [Debug log]
TestAccIAMBetaWorkloadIdentityPoolManagedIdentity_iamWorkloadIdentityPoolManagedIdentityFullExample [Debug log]
TestAccIAMBetaWorkloadIdentityPoolManagedIdentity_minimal [Debug log]

🟢 No issues found for passed tests after REPLAYING rerun.

---

🟢 All tests passed!

View the build log or the debug log for each test

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 1 file changed, 206 insertions(+))
google-beta provider: Diff ( 7 files changed, 1128 insertions(+), 2 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 129 insertions(+))

[modular-magician]

Tests analytics

Total tests: 37
Passed tests: 33
Skipped tests: 2
Affected tests: 2

Click here to see the affected service packages

• iambeta

Action taken

Found 2 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

• TestAccIAMBetaWorkloadIdentityPoolManagedIdentity_iamWorkloadIdentityPoolManagedIdentityBasicExample
• TestAccIAMBetaWorkloadIdentityPoolManagedIdentity_iamWorkloadIdentityPoolManagedIdentityFullExample

Get to know how VCR tests work

[modular-magician]

🟢 Tests passed during RECORDING mode:
TestAccIAMBetaWorkloadIdentityPoolManagedIdentity_iamWorkloadIdentityPoolManagedIdentityBasicExample [Debug log]
TestAccIAMBetaWorkloadIdentityPoolManagedIdentity_iamWorkloadIdentityPoolManagedIdentityFullExample [Debug log]

🟢 No issues found for passed tests after REPLAYING rerun.

---

🟢 All tests passed!

View the build log or the debug log for each test

[stevenyang72]

Hi @liminw @kenmccracken-google, please review the following generated documentation:

• google_iam_workload_identity_pool_managed_identity BETA

---

How to view the rendered documentation?

1. Copy the raw markdown documentation pointed by the URL.
2. Open Terraform documentation preview tool: https://registry.terraform.io/tools/doc-preview
3. Paste the file content to the text box of the preview tool.

[github-actions]

Hello! I am a robot. Tests will require approval from a repository maintainer to run.

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@zli82016, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

[stevenyang72]

Hi @zli82016, thanks for reviewing this PR! If you got time, there's a problem I was hoping you can answer.

Even though all the checks have passed in the CI, all the acceptance tests had been skipped when I ran the make testacc command on my local macOS dev env. The console log looks like this:

=== NAME  TestAccIAMBetaWorkloadIdentityPoolManagedIdentity_iamWorkloadIdentityPoolManagedIdentityBasicExample
    envvar_utils.go:263: Environment variable GOOGLE_IDENTITY_USER is not set
--- SKIP: TestAccIAMBetaWorkloadIdentityPoolManagedIdentity_iamWorkloadIdentityPoolManagedIdentityBasicExample (70.59s)

I didn't see these messages during my previous PRs (#13814, #13920). After some digging on myself, I suspect this message stemmed from:

1. This resource used a custom test_check_destroy function following existing practice, which would build a config with GoogleProviderConfig when making the request to query the state of the resource.
2. Image error #13863 introduced a change, where it would get the test universe domain from the env when building the config.
3. And GetTestUniverseDomainFromEnv would SkipIfEnvNotSet(t, IdentityUserEnvVars...)

My questions are:

• What is this GOOGLE_IDENTITY_USER? The comment did not help me to know what value I should set it to.
• Does this affect the local development flow?
• Does SKIP means the tests were not run?

Thank you so much for your help!

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 1 file changed, 206 insertions(+))
google-beta provider: Diff ( 6 files changed, 1103 insertions(+), 2 deletions(-))
terraform-google-conversion: Diff ( 1 file changed, 129 insertions(+))

[modular-magician]

Tests analytics

Total tests: 37
Passed tests: 35
Skipped tests: 2
Affected tests: 0

Click here to see the affected service packages

• iambeta

🟢 All tests passed!

View the build log

[zli82016]

• What is this GOOGLE_IDENTITY_USER? The comment did not help me to know what value I should set it to.
  The GOOGLE_IDENTITY_USER is the user name of an identity account within the GOOGLE_ORG_DOMAIN Cloud Identity/workspace. GOOGLE_ORG_DOMAIN is another env variable to set the Cloud Identity/workspace.
• Does this affect the local development flow?
  Normally, they don't need to set. They are only needed for a couple of tests, but not the tests in this PR.
• Does SKIP means the tests were not run?
  The tests are run locally. Only the check that if the resource has been destroyed is skipped.

[zli82016]

You can output the test logs to a file to check that if the test is run or not.

For example, use the similar command

TF_LOG=DEBUG make testacc TEST=./google-beta/services/container TESTARGS='-run=TestAccContainerNodePool_basic$$' > output.log

[stevenyang72]

• What is this GOOGLE_IDENTITY_USER? The comment did not help me to know what value I should set it to.
  The GOOGLE_IDENTITY_USER is the user name of an identity account within the GOOGLE_ORG_DOMAIN Cloud Identity/workspace. GOOGLE_ORG_DOMAIN is another env variable to set the Cloud Identity/workspace.
• Does this affect the local development flow?
  Normally, they don't need to set. They are only needed for a couple of tests, but not the tests in this PR.
• Does SKIP means the tests were not run?
  The tests are run locally. Only the check that if the resource has been destroyed is skipped.

Thanks for the answer!

You can output the test logs to a file to check that if the test is run or not.

For example, use the similar command

TF_LOG=DEBUG make testacc TEST=./google-beta/services/container TESTARGS='-run=TestAccContainerNodePool_basic$$' > output.log

Got it. Will do next time.