Added support for restoring default organization policies #1477

ortaman · 2018-05-11T17:17:53Z

To the enhancement: #1239

emilymye

Does this get read in after a change? i.e. after I change my config to restore_default and run terraform apply to edit the org policy, does running terraform plan show changes?

emilymye · 2018-05-14T22:00:29Z

google/resource_google_folder_organization_policy.go

+	}
+
+	if restore_default != nil {
+


nit - remove line

refactored code

emilymye · 2018-05-14T22:11:18Z

google/resource_google_organization_policy.go

@@ -32,7 +32,8 @@ var schemaOrganizationPolicy = map[string]*schema.Schema{
 		Type:          schema.TypeList,
 		Optional:      true,
 		MaxItems:      1,
-		ConflictsWith: []string{"boolean_policy"},
+		ConflictsWith: []string{"boolean_policy", "restore_policy"},
+


emilymye · 2018-05-14T22:11:35Z

google/resource_google_organization_policy.go

+		}).Do()
+
+	} else {
+


refactored code

emilymye · 2018-05-14T22:11:40Z

google/resource_google_organization_policy.go

+				RestoreDefault: restore_default,
+			},
+		}).Do()
+


refactored code

emilymye · 2018-05-14T22:11:44Z

google/resource_google_organization_policy.go

-		},
-	}).Do()
+	if restore_default != nil {
+


refactored code

emilymye · 2018-05-14T22:13:04Z

google/resource_google_project_organization_policy.go

+		}).Do()
+
+	} else {
+


refactored code

emilymye · 2018-05-14T22:13:08Z

google/resource_google_project_organization_policy.go

+	}
+
+	if restore_default != nil {
+


refactored code

emilymye · 2018-05-14T22:13:15Z

google/resource_google_project_organization_policy.go

+				RestoreDefault: restore_default,
+			},
+		}).Do()
+


code refactored

ortaman · 2018-05-15T01:41:23Z

Hi @emilymye, I updated the PR with some refactored code, in another hand is not showing changes if the example is ok.

[root@localhost dev-org-policy]# terraform apply
google_organization_policy.services_policy: Refreshing state... (ID: 65779779009:serviceuser.services)
google_organization_policy.services_policy: Modifying... (ID: 65779779009:serviceuser.services)
list_policy.#: "1" => "0"
list_policy.0.allow.#: "1" => "0"
list_policy.0.allow.0.all: "true" => "false"
restore_policy.#: "0" => "1"
restore_policy.0.default: "" => "true"
google_organization_policy.services_policy: Modifications complete after 1s (ID: 65779779009:serviceuser.services)

Apply complete! Resources: 0 added, 1 changed, 0 destroyed.
[root@localhost dev-org-policy]# terraform plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.

google_organization_policy.services_policy: Refreshing state... (ID: 65779779009:serviceuser.services)

No changes. Infrastructure is up-to-date.

This means that Terraform did not detect any differences between your
configuration and real physical resources that exist. As a result, no
actions need to be performed.
[root@localhost dev-org-policy]#

emilymye

LGTM, assigning to @danawillow to check tests for orgs

danawillow · 2018-05-23T21:56:55Z

google/resource_google_folder_organization_policy.go

 	listPolicy, err := expandListOrganizationPolicy(d.Get("list_policy").([]interface{}))
 	if err != nil {
 		return err
 	}

+	restore_default, err := expandRestoreOrganizationPolicy(d.Get("restore_policy").([]interface{}))


nit: please camelCase your variable names

danawillow · 2018-05-23T21:59:47Z

google/resource_google_folder_organization_policy_test.go

+
+resource "google_folder_organization_policy" "restore" {
+    folder     = "${google_folder.orgpolicy.name}"
+	constraint = "serviceuser.services"


nit: some of these lines use tabs, others use spaces

Fixed to use only spaces

danawillow · 2018-05-23T22:00:53Z

google/resource_google_organization_policy.go

@@ -227,6 +248,20 @@ func flattenBooleanOrganizationPolicy(policy *cloudresourcemanager.BooleanPolicy
 	return bPolicies
 }

+func flattenRestoreOrganizationPolicy(restore_policy *cloudresourcemanager.RestoreDefault) []map[string]interface{} {
+	bRestore_policy := make([]map[string]interface{}, 0, 1)


I'm not sure what the b prefix means here. Maybe just call it rp or something simple like that?

changed to rp (prefix doesnt mean anything)

danawillow · 2018-05-23T22:07:23Z

google/resource_google_organization_policy.go

+		return nil, nil
+	}
+
+	if len(configured) > 0 {


This if statement isn't necessary since we already checked above if it's equal to 0

because there are three escenarios there:
1.- when we doesnt have the restore_policy argument.
2.-when we have the restore_policy argument, but the default value is not true.
3.-when we have the restore_policy argument and the default value is true.

Right, it could look like this:

if len(configured) == 0 { return nil, nil } restoreDefaultMap := configured[0].(map[string]interface{}) default_value := restoreDefaultMap["default"].(bool) if default_value { return &cloudresourcemanager.RestoreDefault{}, nil } return nil, fmt.Errorf("Invalid value for restore_policy. Expecting default = true")

yeah, one 'if' is not necessary and looks cleaner, good catch (changed).

danawillow · 2018-05-23T22:09:56Z

google/resource_google_organization_policy.go

+			Schema: map[string]*schema.Schema{
+				"default": {
+					Type:     schema.TypeBool,
+					Required: true,


I'm a bit confused about the structure of this. The API requires an empty object, so default is just a construct here- what made you decide to go for a nested object with a boolean that has to be set to true, instead of just top-leveling that boolean (i.e. restore_default = true)?

only because in the requirements give me the next structure:
restore_policy {
default = true
}

@morgante, this was your idea I believe. What do you think?

The reason I specified it that way was for equivalence with the other constraint types, which use a nested structure. boolean_policy, for example, also only has a single boolean value but is also nested. Does that make sense?

Yeah, it makes sense. It's a little different in this case because the others are mirroring the API exactly as it is, whereas this one is adding a field into an object, even though that field doesn't exist. I do think it's probably less confusing than just requiring an empty object though, and a bit more future proof anyway, so sure. I'm down.

danawillow · 2018-05-23T22:12:39Z

Also as an fyi, if in your commit message you say "fixes #___" then it'll automatically close the issue once the PR is merged :)

danawillow · 2018-05-29T23:24:51Z

google/resource_google_organization_policy.go

+		return &cloudresourcemanager.RestoreDefault{}, nil
+	}
+
+	return nil, fmt.Errorf("Invalid value for restore_policy. Expecting default = true")


Instead of this, what do you think about adding a ValidateFunc to the field? That way, if someone sets the default to false, it would get caught at plan-time instead of apply-time.

Added ValidateFunc

danawillow · 2018-05-29T23:25:46Z

google/resource_google_project_organization_policy_test.go

+  project    = "%s"
+  constraint = "constraints/serviceuser.services"
+
+    restore_policy {


nit: this is indented a bit too far

danawillow · 2018-05-29T23:26:15Z

website/docs/r/google_folder_organization_policy.html.markdown

@@ -96,6 +112,10 @@ The `allow` or `deny` blocks support:

 * `values` - (Optional) The policy can define specific values that are allowed or denied.

+The `restore_policy` block supports:
+
+* `default` - (Required) If true, then the default Policy is restored. If false, then any configuration is acceptable.


Actually, if it's set to false then it throws an error.

danawillow · 2018-05-29T23:27:26Z

google/resource_google_project_organization_policy.go

 	listPolicy, err := expandListOrganizationPolicy(d.Get("list_policy").([]interface{}))
 	if err != nil {
 		return err
 	}

+	restore_default, err := expandRestoreOrganizationPolicy(d.Get("restore_policy").([]interface{}))


nit: This should be camelcase

danawillow · 2018-05-29T23:28:27Z

google/resource_google_organization_policy.go

+	}
+
+	restoreDefaultMap := configured[0].(map[string]interface{})
+	default_value := restoreDefaultMap["default"].(bool)


nit: camelcase

danawillow · 2018-05-29T23:28:43Z

google/resource_google_organization_policy.go

@@ -227,6 +248,20 @@ func flattenBooleanOrganizationPolicy(policy *cloudresourcemanager.BooleanPolicy
 	return bPolicies
 }

+func flattenRestoreOrganizationPolicy(restore_policy *cloudresourcemanager.RestoreDefault) []map[string]interface{} {


nit: camelcase

danawillow · 2018-05-29T23:29:18Z

google/resource_google_folder_organization_policy_test.go

@@ -249,7 +283,7 @@ resource "google_folder" "orgpolicy" {
 }

 resource "google_folder_organization_policy" "bool" {
-	# Test numeric folder ID.
+    # Test numeric folder ID.


nit: can you revert the extra indents here?

danawillow

Thanks @ortaman! Looks good!

…1477) * Added support for restoring default organization policies * Added support for restoring default folder/project organization policies * Refactored code * Fixes hashicorp#1239 * Clarify docs * Clarify docs * Clarify docs

ghost · 2018-11-18T13:59:24Z

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 hashibot-feedback@hashicorp.com. Thanks!

josemanuelt added 2 commits May 11, 2018 11:44

Added support for restoring default organization policies

2ac78fc

Added support for restoring default folder/project organization policies

b49b6ec

emilymye suggested changes May 14, 2018

View reviewed changes

ortaman force-pushed the master branch 2 times, most recently from 1afcaed to 739251a Compare May 15, 2018 01:00

ortaman force-pushed the master branch from 739251a to 8547f5e Compare May 15, 2018 15:22

Refactored code

4722e12

ortaman force-pushed the master branch from 8547f5e to 4722e12 Compare May 15, 2018 16:33

emilymye reviewed May 23, 2018

View reviewed changes

emilymye requested a review from danawillow May 23, 2018 19:49

emilymye approved these changes May 23, 2018

View reviewed changes

danawillow suggested changes May 23, 2018

View reviewed changes

ortaman force-pushed the master branch 2 times, most recently from 8fb6670 to 484d6dd Compare May 23, 2018 23:47

ortaman pushed a commit to ortaman/terraform-provider-google that referenced this pull request May 23, 2018

fixes hashicorp#1477

484d6dd

ortaman force-pushed the master branch from 484d6dd to 896b1c8 Compare May 23, 2018 23:56

ortaman pushed a commit to ortaman/terraform-provider-google that referenced this pull request May 23, 2018

fixes hashicorp#1477

896b1c8

ortaman force-pushed the master branch from 896b1c8 to a2ff5ba Compare May 24, 2018 00:29

ortaman pushed a commit to ortaman/terraform-provider-google that referenced this pull request May 24, 2018

fixes hashicorp#1477

a2ff5ba

Fixes hashicorp#1239

deeaac5

ortaman force-pushed the master branch from a2ff5ba to deeaac5 Compare May 24, 2018 14:28

danawillow reviewed May 29, 2018

View reviewed changes

ortaman force-pushed the master branch 3 times, most recently from b9f3b97 to deeaac5 Compare May 30, 2018 22:28

danawillow added 3 commits May 30, 2018 15:31

Clarify docs

0ee0f59

Clarify docs

11d5f19

Clarify docs

00e2b6c

danawillow approved these changes May 30, 2018

View reviewed changes

danawillow merged commit 8a77e42 into hashicorp:master May 30, 2018

ghost locked and limited conversation to collaborators Nov 18, 2018

Added support for restoring default organization policies #1477

Added support for restoring default organization policies #1477

Conversation

ortaman commented May 11, 2018

emilymye left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ortaman May 15, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ortaman May 15, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ortaman May 15, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ortaman commented May 15, 2018

emilymye left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ortaman May 23, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

morgante May 24, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

danawillow commented May 23, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

danawillow left a comment

Choose a reason for hiding this comment

ghost commented Nov 18, 2018

ortaman May 15, 2018 •

edited

Loading

ortaman May 15, 2018 •

edited

Loading

ortaman May 15, 2018 •

edited

Loading

ortaman May 23, 2018 •

edited

Loading

morgante May 24, 2018 •

edited

Loading