Add path to invoke update without determining changed CRN data, add validator for name of secrets #4859

jared-hayes-dev · 2023-10-11T16:33:06Z

Users have been looking for way to invoke update on secret without field change to pull in upstream changes from secrets manager instance so the update path was changed to allow such behavior. Users wanted validation on secret name when using terraform to ensure compliance with Kubernetes resource naming scheme.

Community Note

Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Relates OR Closes #0000

Output from acceptance testing:

make testacc TEST=./ibm/service/kubernetes TESTARGS='-run=TestAccIBMContainerIngressSecretTLS_Basic'

==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./ibm/service/kubernetes -v -run=TestAccIBMContainerIngressSecretTLS_Basic -timeout 700m
=== RUN   TestAccIBMContainerIngressSecretTLS_Basic
--- PASS: TestAccIBMContainerIngressSecretTLS_Basic (44.43s)
PASS
ok  	github.com/IBM-Cloud/terraform-provider-ibm/ibm/service/kubernetes	45.876s

make testacc TEST=./ibm/service/kubernetes TESTARGS='-run=TestAccIBMContainerIngressSecretTLSDatasourceBasic'

==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./ibm/service/kubernetes -v -run=TestAccIBMContainerIngressSecretTLSDatasourceBasic -timeout 700m
=== RUN   TestAccIBMContainerIngressSecretTLSDatasourceBasic
--- PASS: TestAccIBMContainerIngressSecretTLSDatasourceBasic (23.68s)
PASS
ok  	github.com/IBM-Cloud/terraform-provider-ibm/ibm/service/kubernetes	25.144s

make testacc TEST=./ibm/service/kubernetes TESTARGS='-run=TestAccIBMContainerIngressSecretOpaque_Basic'

==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./ibm/service/kubernetes -v -run=TestAccIBMContainerIngressSecretOpaque_Basic -timeout 700m
=== RUN   TestAccIBMContainerIngressSecretOpaque_Basic
--- PASS: TestAccIBMContainerIngressSecretOpaque_Basic (41.07s)
PASS
ok  	github.com/IBM-Cloud/terraform-provider-ibm/ibm/service/kubernetes	42.528s

make testacc TEST=./ibm/service/kubernetes TESTARGS='-run=TestAccIBMContainerIngressSecretOpaqueDatasourceBasic'

==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./ibm/service/kubernetes -v -run=TestAccIBMContainerIngressSecretOpaqueDatasourceBasic -timeout 700m
=== RUN   TestAccIBMContainerIngressSecretOpaqueDatasourceBasic
--- PASS: TestAccIBMContainerIngressSecretOpaqueDatasourceBasic (25.61s)
PASS
ok  	github.com/IBM-Cloud/terraform-provider-ibm/ibm/service/kubernetes	27.047s

…validate-name

jared-hayes-dev · 2023-10-16T21:25:08Z

make testacc TEST=./ibm/service/kubernetes TESTARGS='-run=TestAccIBMContainerIngressSecretTLS_InvalidName'

==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./ibm/service/kubernetes -v -run=TestAccIBMContainerIngressSecretTLS_InvalidName -timeout 700m
=== RUN   TestAccIBMContainerIngressSecretTLS_InvalidName
--- PASS: TestAccIBMContainerIngressSecretTLS_InvalidName (0.55s)
PASS
ok  	github.com/IBM-Cloud/terraform-provider-ibm/ibm/service/kubernetes	2.079s

make testacc TEST=./ibm/service/kubernetes TESTARGS='-run=TestAccIBMContainerIngressSecretOpaque_InvalidName'

==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./ibm/service/kubernetes -v -run=TestAccIBMContainerIngressSecretOpaque_InvalidName -timeout 700m
=== RUN   TestAccIBMContainerIngressSecretOpaque_InvalidName
--- PASS: TestAccIBMContainerIngressSecretOpaque_InvalidName (0.55s)
PASS
ok  	github.com/IBM-Cloud/terraform-provider-ibm/ibm/service/kubernetes	2.261s

make testacc TEST=./ibm/service/kubernetes TESTARGS='-run=TestAccIBMContainerIngressSecretOpaque_ForceUpdate'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./ibm/service/kubernetes -v -run=TestAccIBMContainerIngressSecretOpaque_ForceUpdate -timeout 700m
=== RUN   TestAccIBMContainerIngressSecretOpaque_ForceUpdate
--- PASS: TestAccIBMContainerIngressSecretOpaque_ForceUpdate (43.36s)
PASS
ok  	github.com/IBM-Cloud/terraform-provider-ibm/ibm/service/kubernetes	44.963s

make testacc TEST=./ibm/service/kubernetes TESTARGS='-run=TestAccIBMContainerIngressSecretTLS_BasicForceUpdate'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./ibm/service/kubernetes -v -run=TestAccIBMContainerIngressSecretTLS_BasicForceUpdate -timeout 700m
=== RUN   TestAccIBMContainerIngressSecretTLS_BasicForceUpdate
--- PASS: TestAccIBMContainerIngressSecretTLS_BasicForceUpdate (40.20s)
PASS
ok  	github.com/IBM-Cloud/terraform-provider-ibm/ibm/service/kubernetes	41.789s

hkantare · 2023-10-18T05:02:46Z

ibm/service/kubernetes/resource_ibm_container_ingress_secret_opaque.go

@@ -73,6 +76,17 @@ func ResourceIBMContainerIngressSecretOpaque() *schema.Resource {
 				Computed:    true,
 				Description: "Status of the secret",
 			},
+			"update_secret": {
+				Type:        schema.TypeBool,


we will have issue if you want to update_secret multiple times .
If user add this field for first time and mark update_secret = true it goes a head and update secret but next time when he wants to update again it will not show any diff to apply since update_secret = true already exists in state file.

Generally for this kind of scenario we define "update_secret" as int when user want to change it he will just increment the value

similar to https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/container_vpc_cluster#retry_patch_version

hkantare · 2023-10-18T05:03:47Z

Update documentation files also respectively

theodoracheng · 2023-10-18T22:58:44Z

website/docs/r/container_ingress_secret_opaque.html.markdown

@@ -34,6 +34,7 @@ Review the argument references that you can specify for your resource.
 - `secret_name` - (Required, String) The name of the kubernetes secret.
 - `secret_namespace` - (Required, String) The namespace of the kubernetes secret.
 - `persistence`  - (Bool) Persist the secret data in your cluster. If the secret is later deleted from the command line or OpenShift web console, the secret is automatically re-created in your cluster.
+- `update_secret` - (Optional, Integer) This argument is used to force update from upstream secrets manager instance that stores secret. Increment the value to force an update to your Ingress secret for changes made to the upstream secrets manager secret. 


do you mind adding a dash before the fields below this? I think I forgot to in the initial documentation so it's running into the next line

You can fix the "fields" argument indentation

fixed to be consistent with other definitions that have nested structs

hkantare · 2023-10-19T06:11:37Z

ibm/service/kubernetes/resource_ibm_container_ingress_secret_tls.go

+			"update_secret": {
+				Type:        schema.TypeInt,
+				Optional:    true,
+				Default:     false,


Default can't be false for int type

removed - field now has exact same structure as others that fulfill same purpose

z0za · 2023-10-24T09:00:56Z

ibm/service/kubernetes/resource_ibm_container_ingress_secret_opaque.go

+			"update_secret": {
+				Type:        schema.TypeInt,
+				Optional:    true,
+				Description: "Updates secret from secrets manager if value is changed (increment each usage)",
+			},


update_secret is never set in the code with d.Set. if I get it right, terraform will detect this field as changed on every apply, if the field is not empty.
this can be verified with a test, where you apply the same testAccCheckIBMContainerIngressSecretOpaqueForceUpdate configuration twice.

you can to use d.Set and update the state after the ingressAPI.UpdateIngressSecret .

( or if this behaviour works for you, the field can be modified to a boolean. )

I was unable to replicate the behavior you mentioned either by running the test in the code with the same config again or by manually using my own terraform plan/resources. I see the update_secret field reflected in the state file and terraform doesn't execute an update on a repeat apply of the same config should the variable remain unchanged. I also took a look at the above mentioned field retry_patch_version whose pattern update_secret was modeled after and I didn't see any instances of that implementation using the d.set either. Although even in the case it did update every time that would be acceptable behavior. Please let me know if there are any other concerns.

I also went ahead and updated the tests to validate this behavior:

make testacc TEST=./ibm/service/kubernetes TESTARGS='-run=TestAccIBMContainerIngressSecretOpaque_ForceUpdate' ==> Checking that code complies with gofmt requirements... TF_ACC=1 go test ./ibm/service/kubernetes -v -run=TestAccIBMContainerIngressSecretOpaque_ForceUpdate -timeout 700m === RUN TestAccIBMContainerIngressSecretOpaque_ForceUpdate --- PASS: TestAccIBMContainerIngressSecretOpaque_ForceUpdate (84.83s) PASS ok github.com/IBM-Cloud/terraform-provider-ibm/ibm/service/kubernetes 86.414s

make testacc TEST=./ibm/service/kubernetes TESTARGS='-run=TestAccIBMContainerIngressSecretTLS_BasicForceUpdate' ==> Checking that code complies with gofmt requirements... TF_ACC=1 go test ./ibm/service/kubernetes -v -run=TestAccIBMContainerIngressSecretTLS_BasicForceUpdate -timeout 700m === RUN TestAccIBMContainerIngressSecretTLS_BasicForceUpdate --- PASS: TestAccIBMContainerIngressSecretTLS_BasicForceUpdate (63.88s) PASS ok github.com/IBM-Cloud/terraform-provider-ibm/ibm/service/kubernetes 65.472s

I wasn't sure about this one.
thank you Jared for looking into it!

Jared Hayes and others added 2 commits October 3, 2023 14:22

update + validate

59ca57e

Merge branch 'IBM-Cloud:master' into terraform-ingress-update-secret-…

bd91c17

…validate-name

Jared Hayes added 2 commits October 16, 2023 14:25

invalid name tests

13cba28

updated to add new tf only flag for update + tests

49702b6

theodoracheng approved these changes Oct 17, 2023

View reviewed changes

update false positives

58180d6

hkantare reviewed Oct 18, 2023

View reviewed changes

Jared Hayes added 4 commits October 18, 2023 08:32

update secret int

28ddaa2

update docs

cdbd195

fetch upstream

e24be7d

secrets audit

3b0bce8

theodoracheng reviewed Oct 18, 2023

View reviewed changes

hkantare reviewed Oct 19, 2023

View reviewed changes

pr comments

3a75909

z0za reviewed Oct 24, 2023

View reviewed changes

Jared Hayes and others added 2 commits October 24, 2023 10:57

updated tests

45555b7

Merge branch 'master' into terraform-ingress-update-secret-validate-name

d815ea8

hkantare merged commit 0e15cb1 into IBM-Cloud:master Oct 25, 2023
1 of 2 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add path to invoke update without determining changed CRN data, add validator for name of secrets #4859

Add path to invoke update without determining changed CRN data, add validator for name of secrets #4859

jared-hayes-dev commented Oct 11, 2023 •

edited

jared-hayes-dev commented Oct 16, 2023 •

edited

hkantare Oct 18, 2023

jared-hayes-dev Oct 18, 2023

hkantare commented Oct 18, 2023

theodoracheng Oct 18, 2023

hkantare Oct 19, 2023

jared-hayes-dev Oct 19, 2023

hkantare Oct 19, 2023

jared-hayes-dev Oct 19, 2023 •

edited

z0za Oct 24, 2023

jared-hayes-dev Oct 24, 2023

z0za Oct 25, 2023

Add path to invoke update without determining changed CRN data, add validator for name of secrets #4859

Add path to invoke update without determining changed CRN data, add validator for name of secrets #4859

Conversation

jared-hayes-dev commented Oct 11, 2023 • edited

Community Note

jared-hayes-dev commented Oct 16, 2023 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hkantare commented Oct 18, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jared-hayes-dev Oct 19, 2023 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jared-hayes-dev commented Oct 11, 2023 •

edited

jared-hayes-dev commented Oct 16, 2023 •

edited

jared-hayes-dev Oct 19, 2023 •

edited