Use stable name for dynamic group (#69)

Signed-off-by: Devon Crouse <[email protected]>

Signed-off-by: Devon Crouse <[email protected]>

Author: devoncrouse

instance_principal.tf

@@ -1,29 +1,43 @@
-# Copyright 2017, 2021 Oracle Corporation and/or affiliates.  All rights reserved.
+# Copyright (c) 2022, Oracle Corporation and/or affiliates.  All rights reserved.
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl
 
-resource "oci_identity_dynamic_group" "enable_operator_instance_principal" {
+resource "random_id" "dynamic_group_suffix" {
+  keepers = {
+    # Generate a new suffix only when variables are changed
+    label_prefix = local.dynamic_group_prefix
+    tenancy_id   = var.tenancy_id
+  }
+
+  byte_length = 8
+}
+
+resource "oci_identity_dynamic_group" "operator_group" {
   provider = oci.home
 
-  compartment_id = var.tenancy_id
-  description    = var.label_prefix == "none" ? "dynamic group to allow operator instance to invoke services" : "dynamic group with label ${var.label_prefix} to allow operator to invoke services"
+  compartment_id = random_id.dynamic_group_suffix.keepers.tenancy_id
+  description    = "dynamic group %{ if var.label_prefix != "none" }with label ${var.label_prefix}%{ endif } to allow operator to invoke services"
 
   lifecycle {
-    ignore_changes = [name, defined_tags]
+    ignore_changes = [defined_tags]
   }
 
   matching_rule = "ALL {instance.id = '${join(",", data.oci_core_instance.operator.*.id)}'}"
-  name          = "operator-instance-principal-${substr(uuid(), 0, 8)}"
+  name           = join("-", compact([
+    random_id.dynamic_group_suffix.keepers.label_prefix,
+    "operator-instance-principal",
+    random_id.dynamic_group_suffix.hex
+  ]))
 
   count = var.enable_operator_instance_principal == true ? 1 : 0
 }
 
-resource "oci_identity_policy" "enable_operator_instance_principal" {
+resource "oci_identity_policy" "operator_group_policy" {
   provider = oci.home
 
   compartment_id = var.compartment_id
   description    = "policy to allow operator host to call services"
-  name           = var.label_prefix == "none" ? "operator-instance-principal" : "${var.label_prefix}-operator-instance-principal"
-  statements     = ["Allow dynamic-group ${oci_identity_dynamic_group.enable_operator_instance_principal[0].name} to manage all-resources in compartment id ${var.compartment_id}"]
+  name           = join("-", compact([ local.dynamic_group_prefix, "operator-instance-principal" ]))
+  statements     = ["Allow dynamic-group ${oci_identity_dynamic_group.operator_group[0].name} to manage all-resources in compartment id ${var.compartment_id}"]
 
   count = var.enable_operator_instance_principal == true ? 1 : 0
 }

locals.tf

@@ -1,4 +1,4 @@
-# Copyright 2017, 2021 Oracle Corporation and/or affiliates.  All rights reserved.
+# Copyright (c) 2022, Oracle Corporation and/or affiliates.  All rights reserved.
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
 
 # Protocols are specified as protocol numbers.
@@ -9,6 +9,8 @@ locals {
 
   anywhere = "0.0.0.0/0"
 
+  dynamic_group_prefix = (var.label_prefix == "none") ? "" : "${var.label_prefix}"
+
   operator_image_id = var.operator_image_id == "Oracle" ? data.oci_core_images.oracle_images[0].images.0.id : var.operator_image_id
 
   operator_subnet = cidrsubnet(local.vcn_cidr, var.newbits, var.netnum) 

outputs.tf

@@ -1,12 +1,12 @@
-# Copyright 2017, 2021 Oracle Corporation and/or affiliates.  All rights reserved.
+# Copyright (c) 2022, Oracle Corporation and/or affiliates.  All rights reserved.
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl
 
 output "operator_private_ip" {
   value = join(",", data.oci_core_vnic.operator_vnic.*.private_ip_address)
 }
 
 output "operator_instance_principal_group_name" {
-  value = var.enable_operator_instance_principal == true ? oci_identity_dynamic_group.enable_operator_instance_principal[0].name : null
+  value = var.enable_operator_instance_principal == true ? oci_identity_dynamic_group.operator_group[0].name : null
 }
 
 output "operator_subnet_id" {