Skip to content

Commit 19cddf0

Browse files
modular-magicianmodular-magician
authored
Fix permadiff when Access Context Manager returns a different order for ingress / egress rule identities (#12572) (#20794)
[upstream:d630fcf6c9ba4d98b4c0fe8afdb34f3ef2c2fb69] Signed-off-by: Modular Magician <[email protected]>
1 parent 5396f5e commit 19cddf0

6 files changed

+334
-16
lines changed

‎.changelog/12572.txt‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
```release-note:bug
2+
accesscontextmanager: fixed permadiff due to reordering on `google_access_context_manager_service_perimeter_dry_run_egress_policy` `egress_from.identities`
3+
```
4+
```release-note:bug
5+
accesscontextmanager: fixed permadiff due to reordering on `google_access_context_manager_service_perimeter_dry_run_ingress_policy` `ingress_from.identities`
6+
```
7+
```release-note:bug
8+
accesscontextmanager: fixed permadiff due to reordering on `google_access_context_manager_service_perimeter_egress_policy` `egress_from.identities`
9+
```
10+
```release-note:bug
11+
accesscontextmanager: fixed permadiff due to reordering on `google_access_context_manager_service_perimeter_ingress_policy` `ingress_from.identities`
12+
```

‎google/services/accesscontextmanager/resource_access_context_manager_service_perimeter.go‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,48 @@ func AccessContextManagerServicePerimeterIngressToResourcesDiffSuppressFunc(_, _
7676
return slices.Equal(oldResources, newResources)
7777
}
7878

79+
func AccessContextManagerServicePerimeterEgressFromIdentitiesDiffSuppressFunc(_, _, _ string, d *schema.ResourceData) bool {
80+
old, new := d.GetChange("egress_from.0.identities")
81+
82+
oldResources, err := tpgresource.InterfaceSliceToStringSlice(old)
83+
if err != nil {
84+
log.Printf("[ERROR] Failed to convert egress from identities config value: %s", err)
85+
return false
86+
}
87+
88+
newResources, err := tpgresource.InterfaceSliceToStringSlice(new)
89+
if err != nil {
90+
log.Printf("[ERROR] Failed to convert egress from identities api value: %s", err)
91+
return false
92+
}
93+
94+
sort.Strings(oldResources)
95+
sort.Strings(newResources)
96+
97+
return slices.Equal(oldResources, newResources)
98+
}
99+
100+
func AccessContextManagerServicePerimeterIngressFromIdentitiesDiffSuppressFunc(_, _, _ string, d *schema.ResourceData) bool {
101+
old, new := d.GetChange("ingress_from.0.identities")
102+
103+
oldResources, err := tpgresource.InterfaceSliceToStringSlice(old)
104+
if err != nil {
105+
log.Printf("[ERROR] Failed to convert ingress from identities config value: %s", err)
106+
return false
107+
}
108+
109+
newResources, err := tpgresource.InterfaceSliceToStringSlice(new)
110+
if err != nil {
111+
log.Printf("[ERROR] Failed to convert ingress from identities api value: %s", err)
112+
return false
113+
}
114+
115+
sort.Strings(oldResources)
116+
sort.Strings(newResources)
117+
118+
return slices.Equal(oldResources, newResources)
119+
}
120+
79121
func AccessContextManagerServicePerimeterIdentityTypeDiffSuppressFunc(_, old, new string, _ *schema.ResourceData) bool {
80122
if old == "" && new == "IDENTITY_TYPE_UNSPECIFIED" {
81123
return true

‎google/services/accesscontextmanager/resource_access_context_manager_service_perimeter_dry_run_egress_policy.go‎

Lines changed: 70 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,48 @@ func AccessContextManagerServicePerimeterDryRunEgressPolicyIngressToResourcesDif
7575
return slices.Equal(oldResources, newResources)
7676
}
7777

78+
func AccessContextManagerServicePerimeterDryRunEgressPolicyEgressFromIdentitiesDiffSuppressFunc(_, _, _ string, d *schema.ResourceData) bool {
79+
old, new := d.GetChange("egress_from.0.identities")
80+
81+
oldResources, err := tpgresource.InterfaceSliceToStringSlice(old)
82+
if err != nil {
83+
log.Printf("[ERROR] Failed to convert egress from identities config value: %s", err)
84+
return false
85+
}
86+
87+
newResources, err := tpgresource.InterfaceSliceToStringSlice(new)
88+
if err != nil {
89+
log.Printf("[ERROR] Failed to convert egress from identities api value: %s", err)
90+
return false
91+
}
92+
93+
sort.Strings(oldResources)
94+
sort.Strings(newResources)
95+
96+
return slices.Equal(oldResources, newResources)
97+
}
98+
99+
func AccessContextManagerServicePerimeterDryRunEgressPolicyIngressFromIdentitiesDiffSuppressFunc(_, _, _ string, d *schema.ResourceData) bool {
100+
old, new := d.GetChange("ingress_from.0.identities")
101+
102+
oldResources, err := tpgresource.InterfaceSliceToStringSlice(old)
103+
if err != nil {
104+
log.Printf("[ERROR] Failed to convert ingress from identities config value: %s", err)
105+
return false
106+
}
107+
108+
newResources, err := tpgresource.InterfaceSliceToStringSlice(new)
109+
if err != nil {
110+
log.Printf("[ERROR] Failed to convert ingress from identities api value: %s", err)
111+
return false
112+
}
113+
114+
sort.Strings(oldResources)
115+
sort.Strings(newResources)
116+
117+
return slices.Equal(oldResources, newResources)
118+
}
119+
78120
func AccessContextManagerServicePerimeterDryRunEgressPolicyIdentityTypeDiffSuppressFunc(_, old, new string, _ *schema.ResourceData) bool {
79121
if old == "" && new == "IDENTITY_TYPE_UNSPECIFIED" {
80122
return true
@@ -111,9 +153,10 @@ func ResourceAccessContextManagerServicePerimeterDryRunEgressPolicy() *schema.Re
111153
Elem: &schema.Resource{
112154
Schema: map[string]*schema.Schema{
113155
"identities": {
114-
Type: schema.TypeList,
115-
Optional: true,
116-
ForceNew: true,
156+
Type: schema.TypeList,
157+
Optional: true,
158+
ForceNew: true,
159+
DiffSuppressFunc: AccessContextManagerServicePerimeterDryRunEgressPolicyEgressFromIdentitiesDiffSuppressFunc,
117160
Description: `Identities can be an individual user, service account, Google group,
118161
or third-party identity. For third-party identity, only single identities
119162
are supported and other identity types are not supported.The v1 identities
@@ -508,7 +551,30 @@ func flattenNestedAccessContextManagerServicePerimeterDryRunEgressPolicyEgressFr
508551
}
509552

510553
func flattenNestedAccessContextManagerServicePerimeterDryRunEgressPolicyEgressFromIdentities(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
511-
return v
554+
rawConfigValue := d.Get("egress_from.0.identities")
555+
// Convert config value to []string
556+
configValue, err := tpgresource.InterfaceSliceToStringSlice(rawConfigValue)
557+
if err != nil {
558+
log.Printf("[ERROR] Failed to convert egress from identities config value: %s", err)
559+
return v
560+
}
561+
sortedConfigValue := append([]string{}, configValue...)
562+
sort.Strings(sortedConfigValue)
563+
564+
// Convert v to []string
565+
apiValue, err := tpgresource.InterfaceSliceToStringSlice(v)
566+
if err != nil {
567+
log.Printf("[ERROR] Failed to convert egress from identities API value: %s", err)
568+
return v
569+
}
570+
sortedApiValue := append([]string{}, apiValue...)
571+
sort.Strings(sortedApiValue)
572+
573+
if slices.Equal(sortedApiValue, sortedConfigValue) {
574+
return configValue
575+
}
576+
577+
return apiValue
512578
}
513579

514580
func flattenNestedAccessContextManagerServicePerimeterDryRunEgressPolicyEgressFromSources(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {

‎google/services/accesscontextmanager/resource_access_context_manager_service_perimeter_dry_run_ingress_policy.go‎

Lines changed: 70 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,48 @@ func AccessContextManagerServicePerimeterDryRunIngressPolicyIngressToResourcesDi
7575
return slices.Equal(oldResources, newResources)
7676
}
7777

78+
func AccessContextManagerServicePerimeterDryRunIngressPolicyEgressFromIdentitiesDiffSuppressFunc(_, _, _ string, d *schema.ResourceData) bool {
79+
old, new := d.GetChange("egress_from.0.identities")
80+
81+
oldResources, err := tpgresource.InterfaceSliceToStringSlice(old)
82+
if err != nil {
83+
log.Printf("[ERROR] Failed to convert egress from identities config value: %s", err)
84+
return false
85+
}
86+
87+
newResources, err := tpgresource.InterfaceSliceToStringSlice(new)
88+
if err != nil {
89+
log.Printf("[ERROR] Failed to convert egress from identities api value: %s", err)
90+
return false
91+
}
92+
93+
sort.Strings(oldResources)
94+
sort.Strings(newResources)
95+
96+
return slices.Equal(oldResources, newResources)
97+
}
98+
99+
func AccessContextManagerServicePerimeterDryRunIngressPolicyIngressFromIdentitiesDiffSuppressFunc(_, _, _ string, d *schema.ResourceData) bool {
100+
old, new := d.GetChange("ingress_from.0.identities")
101+
102+
oldResources, err := tpgresource.InterfaceSliceToStringSlice(old)
103+
if err != nil {
104+
log.Printf("[ERROR] Failed to convert ingress from identities config value: %s", err)
105+
return false
106+
}
107+
108+
newResources, err := tpgresource.InterfaceSliceToStringSlice(new)
109+
if err != nil {
110+
log.Printf("[ERROR] Failed to convert ingress from identities api value: %s", err)
111+
return false
112+
}
113+
114+
sort.Strings(oldResources)
115+
sort.Strings(newResources)
116+
117+
return slices.Equal(oldResources, newResources)
118+
}
119+
78120
func AccessContextManagerServicePerimeterDryRunIngressPolicyIdentityTypeDiffSuppressFunc(_, old, new string, _ *schema.ResourceData) bool {
79121
if old == "" && new == "IDENTITY_TYPE_UNSPECIFIED" {
80122
return true
@@ -112,9 +154,10 @@ to apply.`,
112154
Elem: &schema.Resource{
113155
Schema: map[string]*schema.Schema{
114156
"identities": {
115-
Type: schema.TypeList,
116-
Optional: true,
117-
ForceNew: true,
157+
Type: schema.TypeList,
158+
Optional: true,
159+
ForceNew: true,
160+
DiffSuppressFunc: AccessContextManagerServicePerimeterDryRunIngressPolicyIngressFromIdentitiesDiffSuppressFunc,
118161
Description: `Identities can be an individual user, service account, Google group,
119162
or third-party identity. For third-party identity, only single identities
120163
are supported and other identity types are not supported.The v1 identities
@@ -510,7 +553,30 @@ func flattenNestedAccessContextManagerServicePerimeterDryRunIngressPolicyIngress
510553
}
511554

512555
func flattenNestedAccessContextManagerServicePerimeterDryRunIngressPolicyIngressFromIdentities(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
513-
return v
556+
rawConfigValue := d.Get("ingress_from.0.identities")
557+
// Convert config value to []string
558+
configValue, err := tpgresource.InterfaceSliceToStringSlice(rawConfigValue)
559+
if err != nil {
560+
log.Printf("[ERROR] Failed to convert ingress from identities config value: %s", err)
561+
return v
562+
}
563+
sortedConfigValue := append([]string{}, configValue...)
564+
sort.Strings(sortedConfigValue)
565+
566+
// Convert v to []string
567+
apiValue, err := tpgresource.InterfaceSliceToStringSlice(v)
568+
if err != nil {
569+
log.Printf("[ERROR] Failed to convert ingress from identities API value: %s", err)
570+
return v
571+
}
572+
sortedApiValue := append([]string{}, apiValue...)
573+
sort.Strings(sortedApiValue)
574+
575+
if slices.Equal(sortedApiValue, sortedConfigValue) {
576+
return configValue
577+
}
578+
579+
return apiValue
514580
}
515581

516582
func flattenNestedAccessContextManagerServicePerimeterDryRunIngressPolicyIngressFromSources(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {

‎google/services/accesscontextmanager/resource_access_context_manager_service_perimeter_egress_policy.go‎

Lines changed: 70 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,48 @@ func AccessContextManagerServicePerimeterEgressPolicyIngressToResourcesDiffSuppr
7575
return slices.Equal(oldResources, newResources)
7676
}
7777

78+
func AccessContextManagerServicePerimeterEgressPolicyEgressFromIdentitiesDiffSuppressFunc(_, _, _ string, d *schema.ResourceData) bool {
79+
old, new := d.GetChange("egress_from.0.identities")
80+
81+
oldResources, err := tpgresource.InterfaceSliceToStringSlice(old)
82+
if err != nil {
83+
log.Printf("[ERROR] Failed to convert egress from identities config value: %s", err)
84+
return false
85+
}
86+
87+
newResources, err := tpgresource.InterfaceSliceToStringSlice(new)
88+
if err != nil {
89+
log.Printf("[ERROR] Failed to convert egress from identities api value: %s", err)
90+
return false
91+
}
92+
93+
sort.Strings(oldResources)
94+
sort.Strings(newResources)
95+
96+
return slices.Equal(oldResources, newResources)
97+
}
98+
99+
func AccessContextManagerServicePerimeterEgressPolicyIngressFromIdentitiesDiffSuppressFunc(_, _, _ string, d *schema.ResourceData) bool {
100+
old, new := d.GetChange("ingress_from.0.identities")
101+
102+
oldResources, err := tpgresource.InterfaceSliceToStringSlice(old)
103+
if err != nil {
104+
log.Printf("[ERROR] Failed to convert ingress from identities config value: %s", err)
105+
return false
106+
}
107+
108+
newResources, err := tpgresource.InterfaceSliceToStringSlice(new)
109+
if err != nil {
110+
log.Printf("[ERROR] Failed to convert ingress from identities api value: %s", err)
111+
return false
112+
}
113+
114+
sort.Strings(oldResources)
115+
sort.Strings(newResources)
116+
117+
return slices.Equal(oldResources, newResources)
118+
}
119+
78120
func AccessContextManagerServicePerimeterEgressPolicyIdentityTypeDiffSuppressFunc(_, old, new string, _ *schema.ResourceData) bool {
79121
if old == "" && new == "IDENTITY_TYPE_UNSPECIFIED" {
80122
return true
@@ -111,9 +153,10 @@ func ResourceAccessContextManagerServicePerimeterEgressPolicy() *schema.Resource
111153
Elem: &schema.Resource{
112154
Schema: map[string]*schema.Schema{
113155
"identities": {
114-
Type: schema.TypeList,
115-
Optional: true,
116-
ForceNew: true,
156+
Type: schema.TypeList,
157+
Optional: true,
158+
ForceNew: true,
159+
DiffSuppressFunc: AccessContextManagerServicePerimeterEgressPolicyEgressFromIdentitiesDiffSuppressFunc,
117160
Description: `Identities can be an individual user, service account, Google group,
118161
or third-party identity. For third-party identity, only single identities
119162
are supported and other identity types are not supported.The v1 identities
@@ -506,7 +549,30 @@ func flattenNestedAccessContextManagerServicePerimeterEgressPolicyEgressFromIden
506549
}
507550

508551
func flattenNestedAccessContextManagerServicePerimeterEgressPolicyEgressFromIdentities(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
509-
return v
552+
rawConfigValue := d.Get("egress_from.0.identities")
553+
// Convert config value to []string
554+
configValue, err := tpgresource.InterfaceSliceToStringSlice(rawConfigValue)
555+
if err != nil {
556+
log.Printf("[ERROR] Failed to convert egress from identities config value: %s", err)
557+
return v
558+
}
559+
sortedConfigValue := append([]string{}, configValue...)
560+
sort.Strings(sortedConfigValue)
561+
562+
// Convert v to []string
563+
apiValue, err := tpgresource.InterfaceSliceToStringSlice(v)
564+
if err != nil {
565+
log.Printf("[ERROR] Failed to convert egress from identities API value: %s", err)
566+
return v
567+
}
568+
sortedApiValue := append([]string{}, apiValue...)
569+
sort.Strings(sortedApiValue)
570+
571+
if slices.Equal(sortedApiValue, sortedConfigValue) {
572+
return configValue
573+
}
574+
575+
return apiValue
510576
}
511577

512578
func flattenNestedAccessContextManagerServicePerimeterEgressPolicyEgressFromSources(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {

0 commit comments

Comments
 (0)