Add parent project ID to varsets

This new attribute specifies that the varset is owned by the
given project.

Author: mkam

internal/provider/resource_tfe_variable_set.go

@@ -9,6 +9,7 @@
 package provider
 
 import (
+	"context"
 	"fmt"
 	"log"
 	"regexp"
@@ -29,7 +30,16 @@ func resourceTFEVariableSet() *schema.Resource {
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
-		CustomizeDiff: customizeDiffIfProviderDefaultOrganizationChanged,
+		CustomizeDiff: func(c context.Context, d *schema.ResourceDiff, meta interface{}) error {
+			if err := customizeDiffIfProviderDefaultOrganizationChanged(c, d, meta); err != nil {
+				return err
+			}
+
+			if err := validateParentProjectID(d); err != nil {
+				return err
+			}
+			return nil
+		},
 
 		Schema: map[string]*schema.Schema{
 			"name": {
@@ -68,6 +78,13 @@ func resourceTFEVariableSet() *schema.Resource {
 				Computed: true,
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
+
+			"parent_project_id": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ForceNew: true,
+			},
 		},
 	}
 }
@@ -89,6 +106,14 @@ func resourceTFEVariableSetCreate(d *schema.ResourceData, meta interface{}) erro
 		Priority: tfe.Bool(d.Get("priority").(bool)),
 	}
 
+	if parentProject, ok := d.GetOk("parent_project_id"); ok {
+		options.Parent = &tfe.Parent{
+			Project: &tfe.Project{
+				ID: parentProject.(string),
+			},
+		}
+	}
+
 	if description, descriptionSet := d.GetOk("description"); descriptionSet {
 		options.Description = tfe.String(description.(string))
 	}
@@ -151,6 +176,10 @@ func resourceTFEVariableSetRead(d *schema.ResourceData, meta interface{}) error
 	}
 	d.Set("workspace_ids", wids)
 
+	if variableSet.Parent != nil && variableSet.Parent.Project != nil {
+		d.Set("parent_project_id", variableSet.Parent.Project.ID)
+	}
+
 	return nil
 }
 
@@ -168,7 +197,7 @@ func resourceTFEVariableSetUpdate(d *schema.ResourceData, meta interface{}) erro
 		log.Printf("[DEBUG] Update variable set: %s", d.Id())
 		_, err := config.Client.VariableSets.Update(ctx, d.Id(), &options)
 		if err != nil {
-			return fmt.Errorf("Error updateing variable %s: %w", d.Id(), err)
+			return fmt.Errorf("Error updating variable %s: %w", d.Id(), err)
 		}
 	}
 
@@ -212,3 +241,19 @@ func resourceTFEVariableSetDelete(d *schema.ResourceData, meta interface{}) erro
 func warnWorkspaceIdsDeprecation() {
 	log.Printf("[WARN] The workspace_ids field of tfe_variable_set is deprecated as of release 0.33.0 and may be removed in a future version. The preferred method of associating a variable set to a workspace is by using the tfe_workspace_variable_set resource.")
 }
+
+func validateParentProjectID(d *schema.ResourceDiff) error {
+	_, ok := d.GetOk("parent_project_id")
+	if !ok {
+		return nil
+	}
+
+	// If parent_project_id is set, global must be false
+	if global, ok := d.GetOk("global"); ok {
+		if global.(bool) {
+			return fmt.Errorf("global must be 'false' when setting parent_project_id")
+		}
+	}
+
+	return nil
+}

internal/provider/resource_tfe_variable_set_test.go

@@ -144,6 +144,34 @@ func TestAccTFEVariableSet_import(t *testing.T) {
 	})
 }
 
+func TestAccTFEVariableSet_project_owned(t *testing.T) {
+	skipUnlessBeta(t)
+	rInt := rand.New(rand.NewSource(time.Now().UnixNano())).Int()
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckTFEVariableSetDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testACCTFEVariableSet_ProjectOwned(rInt),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair(
+						"tfe_variable_set.project_owned", "parent_project_id", "tfe_project.foobar", "id"),
+				),
+			},
+
+			{
+				Config: testACCTFEVariableSet_UpdateProjectOwned(rInt),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrPair(
+						"tfe_variable_set.project_owned", "parent_project_id", "tfe_project.updated", "id"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckTFEVariableSetExists(
 	n string, variableSet *tfe.VariableSet) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
@@ -325,3 +353,49 @@ func testAccTFEVariableSet_update(rInt int) string {
 			organization = tfe_organization.foobar.id
 		}`, rInt)
 }
+
+func testACCTFEVariableSet_ProjectOwned(rInt int) string {
+	return fmt.Sprintf(`
+		resource "tfe_organization" "foobar" {
+			name = "tst-terraform-%d"
+			email = "[email protected]"
+		}
+
+		resource "tfe_project" "foobar" {
+			organization = tfe_organization.foobar.id
+			name         = "tst-terraform-%d"
+		}
+
+		resource "tfe_variable_set" "project_owned" {
+			name              = "project_owned_variable_set_test"
+			description       = "a project-owned test variable set"
+			organization      = tfe_organization.foobar.id
+			parent_project_id = tfe_project.foobar.id
+		}`, rInt, rInt)
+}
+
+func testACCTFEVariableSet_UpdateProjectOwned(rInt int) string {
+	return fmt.Sprintf(`
+		resource "tfe_organization" "foobar" {
+			name = "tst-terraform-%d"
+			email = "[email protected]"
+		}
+
+		resource "tfe_project" "foobar" {
+			organization = tfe_organization.foobar.id
+			name         = "tst-terraform-%d"
+		}
+
+		resource "tfe_project" "updated" {
+			organization = tfe_organization.foobar.id
+			name         = "updated-%d"
+		}
+
+		resource "tfe_variable_set" "project_owned" {
+			name              = "project_owned_variable_set_test"
+			description       = "a project-owned test variable set"
+			organization      = tfe_organization.foobar.id
+			global            = false
+			parent_project_id = tfe_project.updated.id
+		}`, rInt, rInt, rInt)
+}

website/docs/r/variable_set.html.markdown

@@ -139,6 +139,7 @@ The following arguments are supported:
   Must not be set if `global` is set. This argument is mutually exclusive with using the resource
   [tfe_workspace_variable_set](workspace_variable_set.html) which is the preferred method of associating a workspace
   with a variable set.
+* `parent_project_id` - (Optional) ID of the project that should own the variable set. If set, than the value of `global` must be `false`. This feature is currently in beta and is not available to all users.
 
 ## Attributes Reference