Immutable backups (#14080) (#23087)

[upstream:c3228e5fea156d1729f529cecc08435f0febd2ed]

Signed-off-by: Modular Magician <[email protected]>

Author: modular-magician

google/services/netapp/resource_netapp_backup_test.go

@@ -341,3 +341,173 @@ resource "google_netapp_backup" "test_backup" {
 }
 `, context)
 }
+
+func TestAccNetappBackup_NetappImmutableBackup(t *testing.T) {
+	context := map[string]interface{}{
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "gcnv-network-config-3", acctest.ServiceNetworkWithParentService("netapp.servicenetworking.goog")),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckNetappBackupDestroyProducer(t),
+		ExternalProviders: map[string]resource.ExternalProvider{
+			"time": {},
+		},
+		Steps: []resource.TestStep{
+			{
+				Config: testAccNetappBackup_ImmutableBackup(context),
+			},
+			{
+				ResourceName:            "google_netapp_backup.test_backup",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "location", "name", "terraform_labels", "vault_name"},
+			},
+			{
+				Config: testAccNetappBackup_ImmutableBackupUpdate(context),
+			},
+			{
+				ResourceName:            "google_netapp_backup.test_backup",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"labels", "location", "name", "terraform_labels", "vault_name"},
+			},
+		},
+	})
+}
+
+func testAccNetappBackup_ImmutableBackup(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+resource "google_netapp_storage_pool" "default" {
+  name = "tf-test-backup-pool%{random_suffix}"
+  location = "us-central1"
+  service_level = "FLEX"
+  capacity_gib = "2048"
+  network = data.google_compute_network.default.id
+  zone = "us-central1-a"
+  replica_zone = "us-central1-b"
+}
+resource "time_sleep" "wait_3_minutes" {
+    depends_on = [google_netapp_storage_pool.default]
+    create_duration = "3m"
+}
+resource "google_netapp_volume" "default" {
+  name = "tf-test-backup-volume%{random_suffix}"
+  location = "us-central1"
+  capacity_gib = "100"
+  share_name = "tf-test-backup-volume%{random_suffix}"
+  storage_pool = google_netapp_storage_pool.default.name
+  protocols = ["NFSV3"]
+  deletion_policy = "FORCE"
+  backup_config {
+    backup_vault = google_netapp_backup_vault.default.id
+  }
+}
+resource "google_netapp_backup_vault" "default" {
+  name = "tf-test-backup-vault%{random_suffix}"
+  location = "us-central1"
+  backup_retention_policy {
+    backup_minimum_enforced_retention_days = 2
+    daily_backup_immutable = true
+    weekly_backup_immutable = false
+    monthly_backup_immutable = false
+    manual_backup_immutable = false
+  }
+}
+resource "google_netapp_volume_snapshot" "default" {
+  depends_on = [google_netapp_volume.default]
+  location = "us-central1"
+  volume_name = google_netapp_volume.default.name
+  description = "This is a test description"
+  name = "testvolumesnap%{random_suffix}"
+  labels = {
+    key= "test"
+    value= "snapshot"
+  }
+}
+resource "google_netapp_backup" "test_backup" {
+  name = "tf-test-test-backup%{random_suffix}"
+  description = "This is a test immutable backup"
+  source_volume = google_netapp_volume.default.id
+  location = "us-central1"
+  vault_name = google_netapp_backup_vault.default.name
+  source_snapshot = google_netapp_volume_snapshot.default.id
+  labels = {
+    key= "test"
+    value= "backup"
+  }
+}
+`, context)
+}
+
+func testAccNetappBackup_ImmutableBackupUpdate(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+resource "google_netapp_storage_pool" "default" {
+  name = "tf-test-backup-pool%{random_suffix}"
+  location = "us-central1"
+  service_level = "FLEX"
+  capacity_gib = "2048"
+  network = data.google_compute_network.default.id
+  zone = "us-central1-a"
+  replica_zone = "us-central1-b"
+}
+resource "time_sleep" "wait_3_minutes" {
+    depends_on = [google_netapp_storage_pool.default]
+    create_duration = "3m"
+}
+resource "google_netapp_volume" "default" {
+  name = "tf-test-backup-volume%{random_suffix}"
+  location = "us-central1"
+  capacity_gib = "100"
+  share_name = "tf-test-backup-volume%{random_suffix}"
+  storage_pool = google_netapp_storage_pool.default.name
+  protocols = ["NFSV3"]
+  deletion_policy = "FORCE"
+  backup_config {
+    backup_vault = google_netapp_backup_vault.default.id
+  }
+}
+resource "google_netapp_backup_vault" "default" {
+  name = "tf-test-backup-vault%{random_suffix}"
+  location = "us-central1"
+  backup_retention_policy {
+    backup_minimum_enforced_retention_days = 12
+    daily_backup_immutable = true
+    weekly_backup_immutable = true
+    monthly_backup_immutable = true
+    manual_backup_immutable = true
+  }
+}
+resource "google_netapp_volume_snapshot" "default" {
+  depends_on = [google_netapp_volume.default]
+  location = "us-central1"
+  volume_name = google_netapp_volume.default.name
+  description = "This is a test description"
+  name = "testvolumesnap%{random_suffix}"
+  labels = {
+    key= "test"
+    value= "snapshot"
+  }
+}
+resource "google_netapp_backup" "test_backup" {
+  name = "tf-test-test-backup%{random_suffix}"
+  description = "This is a test immutable backup"
+  source_volume = google_netapp_volume.default.id
+  location = "us-central1"
+  vault_name = google_netapp_backup_vault.default.name
+  source_snapshot = google_netapp_volume_snapshot.default.id
+  labels = {
+    key= "test"
+    value= "backup"
+  }
+}
+`, context)
+}

google/services/netapp/resource_netapp_backup_vault.go

@@ -75,6 +75,41 @@ func ResourceNetappBackupVault() *schema.Resource {
 				Optional:    true,
 				Description: `Region in which backup is stored.`,
 			},
+			"backup_retention_policy": {
+				Type:        schema.TypeList,
+				Optional:    true,
+				Description: `Backup retention policy defining the retention of the backups.`,
+				MaxItems:    1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"backup_minimum_enforced_retention_days": {
+							Type:        schema.TypeInt,
+							Required:    true,
+							Description: `Minimum retention duration in days for backups in the backup vault.`,
+						},
+						"daily_backup_immutable": {
+							Type:        schema.TypeBool,
+							Optional:    true,
+							Description: `Indicates if the daily backups are immutable. At least one of daily_backup_immutable, weekly_backup_immutable, monthly_backup_immutable and manual_backup_immutable must be true.`,
+						},
+						"manual_backup_immutable": {
+							Type:        schema.TypeBool,
+							Optional:    true,
+							Description: `Indicates if the manual backups are immutable. At least one of daily_backup_immutable, weekly_backup_immutable, monthly_backup_immutable and manual_backup_immutable must be true.`,
+						},
+						"monthly_backup_immutable": {
+							Type:        schema.TypeBool,
+							Optional:    true,
+							Description: `Indicates if the monthly backups are immutable. At least one of daily_backup_immutable, weekly_backup_immutable, monthly_backup_immutable and manual_backup_immutable must be true.`,
+						},
+						"weekly_backup_immutable": {
+							Type:        schema.TypeBool,
+							Optional:    true,
+							Description: `Indicates if the weekly backups are immutable. At least one of daily_backup_immutable, weekly_backup_immutable, monthly_backup_immutable and manual_backup_immutable must be true.`,
+						},
+					},
+				},
+			},
 			"backup_vault_type": {
 				Type:         schema.TypeString,
 				Computed:     true,
@@ -172,6 +207,12 @@ func resourceNetappBackupVaultCreate(d *schema.ResourceData, meta interface{}) e
 	} else if v, ok := d.GetOkExists("backup_region"); !tpgresource.IsEmptyValue(reflect.ValueOf(backupRegionProp)) && (ok || !reflect.DeepEqual(v, backupRegionProp)) {
 		obj["backupRegion"] = backupRegionProp
 	}
+	backupRetentionPolicyProp, err := expandNetappBackupVaultBackupRetentionPolicy(d.Get("backup_retention_policy"), d, config)
+	if err != nil {
+		return err
+	} else if v, ok := d.GetOkExists("backup_retention_policy"); !tpgresource.IsEmptyValue(reflect.ValueOf(backupRetentionPolicyProp)) && (ok || !reflect.DeepEqual(v, backupRetentionPolicyProp)) {
+		obj["backupRetentionPolicy"] = backupRetentionPolicyProp
+	}
 	labelsProp, err := expandNetappBackupVaultEffectiveLabels(d.Get("effective_labels"), d, config)
 	if err != nil {
 		return err
@@ -304,6 +345,9 @@ func resourceNetappBackupVaultRead(d *schema.ResourceData, meta interface{}) err
 	if err := d.Set("destination_backup_vault", flattenNetappBackupVaultDestinationBackupVault(res["destinationBackupVault"], d, config)); err != nil {
 		return fmt.Errorf("Error reading BackupVault: %s", err)
 	}
+	if err := d.Set("backup_retention_policy", flattenNetappBackupVaultBackupRetentionPolicy(res["backupRetentionPolicy"], d, config)); err != nil {
+		return fmt.Errorf("Error reading BackupVault: %s", err)
+	}
 	if err := d.Set("terraform_labels", flattenNetappBackupVaultTerraformLabels(res["labels"], d, config)); err != nil {
 		return fmt.Errorf("Error reading BackupVault: %s", err)
 	}
@@ -348,6 +392,12 @@ func resourceNetappBackupVaultUpdate(d *schema.ResourceData, meta interface{}) e
 	} else if v, ok := d.GetOkExists("backup_region"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, backupRegionProp)) {
 		obj["backupRegion"] = backupRegionProp
 	}
+	backupRetentionPolicyProp, err := expandNetappBackupVaultBackupRetentionPolicy(d.Get("backup_retention_policy"), d, config)
+	if err != nil {
+		return err
+	} else if v, ok := d.GetOkExists("backup_retention_policy"); !tpgresource.IsEmptyValue(reflect.ValueOf(v)) && (ok || !reflect.DeepEqual(v, backupRetentionPolicyProp)) {
+		obj["backupRetentionPolicy"] = backupRetentionPolicyProp
+	}
 	labelsProp, err := expandNetappBackupVaultEffectiveLabels(d.Get("effective_labels"), d, config)
 	if err != nil {
 		return err
@@ -376,6 +426,10 @@ func resourceNetappBackupVaultUpdate(d *schema.ResourceData, meta interface{}) e
 		updateMask = append(updateMask, "backupRegion")
 	}
 
+	if d.HasChange("backup_retention_policy") {
+		updateMask = append(updateMask, "backupRetentionPolicy")
+	}
+
 	if d.HasChange("effective_labels") {
 		updateMask = append(updateMask, "labels")
 	}
@@ -545,6 +599,60 @@ func flattenNetappBackupVaultDestinationBackupVault(v interface{}, d *schema.Res
 	return v
 }
 
+func flattenNetappBackupVaultBackupRetentionPolicy(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	if v == nil {
+		return nil
+	}
+	original := v.(map[string]interface{})
+	if len(original) == 0 {
+		return nil
+	}
+	transformed := make(map[string]interface{})
+	transformed["backup_minimum_enforced_retention_days"] =
+		flattenNetappBackupVaultBackupRetentionPolicyBackupMinimumEnforcedRetentionDays(original["backupMinimumEnforcedRetentionDays"], d, config)
+	transformed["daily_backup_immutable"] =
+		flattenNetappBackupVaultBackupRetentionPolicyDailyBackupImmutable(original["dailyBackupImmutable"], d, config)
+	transformed["weekly_backup_immutable"] =
+		flattenNetappBackupVaultBackupRetentionPolicyWeeklyBackupImmutable(original["weeklyBackupImmutable"], d, config)
+	transformed["monthly_backup_immutable"] =
+		flattenNetappBackupVaultBackupRetentionPolicyMonthlyBackupImmutable(original["monthlyBackupImmutable"], d, config)
+	transformed["manual_backup_immutable"] =
+		flattenNetappBackupVaultBackupRetentionPolicyManualBackupImmutable(original["manualBackupImmutable"], d, config)
+	return []interface{}{transformed}
+}
+func flattenNetappBackupVaultBackupRetentionPolicyBackupMinimumEnforcedRetentionDays(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	// Handles the string fixed64 format
+	if strVal, ok := v.(string); ok {
+		if intVal, err := tpgresource.StringToFixed64(strVal); err == nil {
+			return intVal
+		}
+	}
+
+	// number values are represented as float64
+	if floatVal, ok := v.(float64); ok {
+		intVal := int(floatVal)
+		return intVal
+	}
+
+	return v // let terraform core handle it otherwise
+}
+
+func flattenNetappBackupVaultBackupRetentionPolicyDailyBackupImmutable(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return v
+}
+
+func flattenNetappBackupVaultBackupRetentionPolicyWeeklyBackupImmutable(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return v
+}
+
+func flattenNetappBackupVaultBackupRetentionPolicyMonthlyBackupImmutable(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return v
+}
+
+func flattenNetappBackupVaultBackupRetentionPolicyManualBackupImmutable(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return v
+}
+
 func flattenNetappBackupVaultTerraformLabels(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
 	if v == nil {
 		return v
@@ -576,6 +684,73 @@ func expandNetappBackupVaultBackupRegion(v interface{}, d tpgresource.TerraformR
 	return v, nil
 }
 
+func expandNetappBackupVaultBackupRetentionPolicy(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	l := v.([]interface{})
+	if len(l) == 0 || l[0] == nil {
+		return nil, nil
+	}
+	raw := l[0]
+	original := raw.(map[string]interface{})
+	transformed := make(map[string]interface{})
+
+	transformedBackupMinimumEnforcedRetentionDays, err := expandNetappBackupVaultBackupRetentionPolicyBackupMinimumEnforcedRetentionDays(original["backup_minimum_enforced_retention_days"], d, config)
+	if err != nil {
+		return nil, err
+	} else if val := reflect.ValueOf(transformedBackupMinimumEnforcedRetentionDays); val.IsValid() && !tpgresource.IsEmptyValue(val) {
+		transformed["backupMinimumEnforcedRetentionDays"] = transformedBackupMinimumEnforcedRetentionDays
+	}
+
+	transformedDailyBackupImmutable, err := expandNetappBackupVaultBackupRetentionPolicyDailyBackupImmutable(original["daily_backup_immutable"], d, config)
+	if err != nil {
+		return nil, err
+	} else if val := reflect.ValueOf(transformedDailyBackupImmutable); val.IsValid() && !tpgresource.IsEmptyValue(val) {
+		transformed["dailyBackupImmutable"] = transformedDailyBackupImmutable
+	}
+
+	transformedWeeklyBackupImmutable, err := expandNetappBackupVaultBackupRetentionPolicyWeeklyBackupImmutable(original["weekly_backup_immutable"], d, config)
+	if err != nil {
+		return nil, err
+	} else if val := reflect.ValueOf(transformedWeeklyBackupImmutable); val.IsValid() && !tpgresource.IsEmptyValue(val) {
+		transformed["weeklyBackupImmutable"] = transformedWeeklyBackupImmutable
+	}
+
+	transformedMonthlyBackupImmutable, err := expandNetappBackupVaultBackupRetentionPolicyMonthlyBackupImmutable(original["monthly_backup_immutable"], d, config)
+	if err != nil {
+		return nil, err
+	} else if val := reflect.ValueOf(transformedMonthlyBackupImmutable); val.IsValid() && !tpgresource.IsEmptyValue(val) {
+		transformed["monthlyBackupImmutable"] = transformedMonthlyBackupImmutable
+	}
+
+	transformedManualBackupImmutable, err := expandNetappBackupVaultBackupRetentionPolicyManualBackupImmutable(original["manual_backup_immutable"], d, config)
+	if err != nil {
+		return nil, err
+	} else if val := reflect.ValueOf(transformedManualBackupImmutable); val.IsValid() && !tpgresource.IsEmptyValue(val) {
+		transformed["manualBackupImmutable"] = transformedManualBackupImmutable
+	}
+
+	return transformed, nil
+}
+
+func expandNetappBackupVaultBackupRetentionPolicyBackupMinimumEnforcedRetentionDays(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	return v, nil
+}
+
+func expandNetappBackupVaultBackupRetentionPolicyDailyBackupImmutable(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	return v, nil
+}
+
+func expandNetappBackupVaultBackupRetentionPolicyWeeklyBackupImmutable(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	return v, nil
+}
+
+func expandNetappBackupVaultBackupRetentionPolicyMonthlyBackupImmutable(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	return v, nil
+}
+
+func expandNetappBackupVaultBackupRetentionPolicyManualBackupImmutable(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	return v, nil
+}
+
 func expandNetappBackupVaultEffectiveLabels(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (map[string]string, error) {
 	if v == nil {
 		return map[string]string{}, nil