-
Notifications
You must be signed in to change notification settings - Fork 82
fix(iaas): read write only field correctly from the config model #1694
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
SerseusWasTaken
wants to merge
2
commits into
main
Choose a base branch
from
fix/fix-iaas-write-only-fields
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
+445
−50
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
202 changes: 202 additions & 0 deletions
202
stackit/internal/services/iaas/volume/resource_create_test.go
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,202 @@ | ||
| package volume | ||
|
|
||
| import ( | ||
| "context" | ||
| "encoding/json" | ||
| "fmt" | ||
| "io" | ||
| "net/http" | ||
| "net/http/httptest" | ||
| "testing" | ||
|
|
||
| "github.com/hashicorp/terraform-plugin-framework/resource" | ||
| "github.com/hashicorp/terraform-plugin-framework/tfsdk" | ||
| "github.com/hashicorp/terraform-plugin-framework/types" | ||
| "github.com/hashicorp/terraform-plugin-go/tftypes" | ||
| sdkConfig "github.com/stackitcloud/stackit-sdk-go/core/config" | ||
| iaas "github.com/stackitcloud/stackit-sdk-go/services/iaas/v2api" | ||
|
|
||
| "github.com/stackitcloud/terraform-provider-stackit/stackit/internal/core" | ||
| ) | ||
|
|
||
| const ( | ||
| testProjectId = "4e684f79-a12c-449d-aa89-bcd9d8aafaf2" | ||
| testRegion = "eu01" | ||
| testVolumeId = "3dee3fb9-59f0-4f97-8eeb-a4da37d05a00" | ||
| testKeyPayloadBase64 = "VGhlIHF1aWNrIGJyb3duIGZveCBqdW1wcyBvdmVyIDEzIGxhenkgZG9ncy4=" | ||
| ) | ||
|
|
||
| // buildCreateRequest builds a resource.CreateRequest from a plan and a config model. | ||
| // Terraform populates write-only attribute values only in the config model - never in the plan or state model. | ||
| // That's why we need both, the plan model AND config model to build the request. | ||
| func buildCreateRequest(ctx context.Context, t *testing.T, schemaResp *resource.SchemaResponse, planModel, configModel *Model) resource.CreateRequest { | ||
| t.Helper() | ||
|
|
||
| req := resource.CreateRequest{} | ||
| req.Plan = tfsdk.Plan{ | ||
| Schema: schemaResp.Schema, | ||
| Raw: tftypes.NewValue(tftypes.DynamicPseudoType, nil), | ||
| } | ||
| if diags := req.Plan.Set(ctx, planModel); diags.HasError() { | ||
| t.Fatalf("Failed to set plan: %v", diags.Errors()) | ||
| } | ||
|
|
||
| configScratch := tfsdk.Plan{ | ||
| Schema: schemaResp.Schema, | ||
| Raw: tftypes.NewValue(tftypes.DynamicPseudoType, nil), | ||
| } | ||
| if diags := configScratch.Set(ctx, configModel); diags.HasError() { | ||
| t.Fatalf("Failed to set config: %v", diags.Errors()) | ||
| } | ||
| req.Config = tfsdk.Config{ | ||
| Schema: schemaResp.Schema, | ||
| Raw: configScratch.Raw, | ||
| } | ||
|
|
||
| return req | ||
| } | ||
|
|
||
| type volumeFixture struct { | ||
| server *httptest.Server | ||
| capturedKeyPayload *string | ||
| createCalled bool | ||
| } | ||
|
|
||
| // newVolumeFixture spins up a mock IaaS API server handling volume creation and the subsequent | ||
| // polling of the wait handler. The create handler decodes the request body and records the | ||
| // encryption key payload that the provider sent to the API. | ||
| func newVolumeFixture(t *testing.T) *volumeFixture { | ||
| t.Helper() | ||
| fixture := &volumeFixture{} | ||
|
|
||
| mux := http.NewServeMux() | ||
| // Create volume | ||
| mux.HandleFunc(fmt.Sprintf("POST /v2/projects/%s/regions/%s/volumes", testProjectId, testRegion), func(w http.ResponseWriter, r *http.Request) { | ||
| fixture.createCalled = true | ||
| body, err := io.ReadAll(r.Body) | ||
| if err != nil { | ||
| t.Errorf("Failed to read create request body: %v", err) | ||
| w.WriteHeader(http.StatusBadRequest) | ||
| return | ||
| } | ||
| var payload iaas.CreateVolumePayload | ||
| if err := json.Unmarshal(body, &payload); err != nil { | ||
| t.Errorf("Failed to unmarshal create request body: %v", err) | ||
| w.WriteHeader(http.StatusBadRequest) | ||
| return | ||
| } | ||
| if payload.EncryptionParameters != nil { | ||
| fixture.capturedKeyPayload = payload.EncryptionParameters.KeyPayload | ||
| } | ||
|
|
||
| w.Header().Set("content-type", "application/json") | ||
| volumeId := testVolumeId | ||
| _ = json.NewEncoder(w).Encode(iaas.Volume{Id: &volumeId}) | ||
| }) | ||
| // Get volume (used by the create wait handler and by mapFields via the response of the wait handler) | ||
| mux.HandleFunc(fmt.Sprintf("GET /v2/projects/%s/regions/%s/volumes/%s", testProjectId, testRegion, testVolumeId), func(w http.ResponseWriter, _ *http.Request) { | ||
| w.Header().Set("content-type", "application/json") | ||
| volumeId := testVolumeId | ||
| status := "AVAILABLE" | ||
| _ = json.NewEncoder(w).Encode(iaas.Volume{ | ||
| Id: &volumeId, | ||
| Status: &status, | ||
| AvailabilityZone: "eu01-1", | ||
| }) | ||
| }) | ||
|
|
||
| fixture.server = httptest.NewServer(mux) | ||
| t.Cleanup(fixture.server.Close) | ||
| return fixture | ||
| } | ||
|
|
||
| // newTestVolumeResource builds a volumeResource with the client's URL being set to the mock URL | ||
| func newTestVolumeResource(t *testing.T, server *httptest.Server) *volumeResource { | ||
| t.Helper() | ||
| client, err := iaas.NewAPIClient( | ||
| sdkConfig.WithEndpoint(server.URL), | ||
| sdkConfig.WithoutAuthentication(), | ||
| ) | ||
| if err != nil { | ||
| t.Fatalf("Failed to initialize client: %v", err) | ||
| } | ||
| return &volumeResource{ | ||
| client: client, | ||
| providerData: core.ProviderData{ | ||
| DefaultRegion: testRegion, | ||
| }, | ||
| } | ||
| } | ||
|
|
||
| func encryptionParametersTestModel() *encryptionParametersModel { | ||
| return &encryptionParametersModel{ | ||
| KekKeyId: types.StringValue("11111111-1111-1111-1111-111111111111"), | ||
| KekKeyVersion: types.Int64Value(1), | ||
| KekKeyringId: types.StringValue("22222222-2222-2222-2222-222222222222"), | ||
| KeyPayloadBase64: types.StringNull(), | ||
| KeyPayloadBase64WriteOnly: types.StringNull(), // will be set manually for the config model | ||
| KeyPayloadBase64WriteOnlyVersion: types.Int64Value(1), | ||
| ServiceAccount: types.StringValue("test-sa@sa.stackit.cloud"), | ||
| } | ||
| } | ||
|
|
||
| func baseTestModel() Model { | ||
| return Model{ | ||
| ProjectId: types.StringValue(testProjectId), | ||
| Region: types.StringValue(testRegion), | ||
| AvailabilityZone: types.StringValue("eu01-1"), | ||
| Name: types.StringValue("test-volume"), | ||
| Size: types.Int64Value(16), | ||
| Labels: types.MapNull(types.StringType), | ||
| Source: types.ObjectNull(sourceTypes), | ||
| } | ||
| } | ||
|
|
||
| // TestCreate_WriteOnlyKeyPayload is a regression test for the bug where the write-only key payload | ||
| // was read from the plan model instead of the config model. | ||
| // The test asserts that the value configured via key_payload_base64_wo is actually | ||
| // sent to the API in the create request. | ||
| func TestCreate_WriteOnlyKeyPayload(t *testing.T) { | ||
| ctx := context.Background() | ||
|
|
||
| // Usually terraform will only ever write write-only fields in the config model, not the plan. | ||
| // Since we're setting the models manually here, we have to ensure this is done correctly. | ||
| // Ensuring that the write-only fields never go into the state/plan model is not part of this test's scope here | ||
| planModel := baseTestModel() | ||
| planModel.EncryptionParameters = encryptionParametersTestModel() | ||
|
|
||
| configModel := baseTestModel() | ||
| configEncryptionParams := encryptionParametersTestModel() | ||
| configEncryptionParams.KeyPayloadBase64WriteOnly = types.StringValue(testKeyPayloadBase64) | ||
| configModel.EncryptionParameters = configEncryptionParams | ||
|
|
||
| fixture := newVolumeFixture(t) | ||
| iaasRessource := newTestVolumeResource(t, fixture.server) | ||
|
|
||
| schemaResp := &resource.SchemaResponse{} | ||
| iaasRessource.Schema(ctx, resource.SchemaRequest{}, schemaResp) | ||
|
|
||
| req := buildCreateRequest(ctx, t, schemaResp, &planModel, &configModel) | ||
| // we have to set an initial empty state so it is != nil | ||
| resp := &resource.CreateResponse{} | ||
| resp.State = tfsdk.State{ | ||
| Schema: schemaResp.Schema, | ||
| Raw: tftypes.NewValue(tftypes.DynamicPseudoType, nil), | ||
| } | ||
|
|
||
| iaasRessource.Create(ctx, req, resp) | ||
|
|
||
| if resp.Diagnostics.HasError() { | ||
| t.Fatalf("Create should succeed, but got errors: %v", resp.Diagnostics.Errors()) | ||
| } | ||
| if !fixture.createCalled { | ||
| t.Fatalf("Expected the create endpoint to be called") | ||
| } | ||
|
|
||
| if fixture.capturedKeyPayload == nil { | ||
| t.Fatalf("Expected key payload %q to be sent to the API, but none was sent", testKeyPayloadBase64) | ||
| } | ||
| if *fixture.capturedKeyPayload != testKeyPayloadBase64 { | ||
| t.Fatalf("Wrong key payload sent to the API: expected %q, got %q", testKeyPayloadBase64, *fixture.capturedKeyPayload) | ||
| } | ||
| } | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would actually prefer to have this tested via resource.UnitTest like e.g. here:
terraform-provider-stackit/stackit/internal/services/sqlserverflex/sqlserverflex_test.go
Line 59 in de961ad
This is hard to mock then (I know), that's why I worked on #1663 . Will make your life easier in that regard 😅