Skip to content

Commit 1120ef3

Browse files
modular-magicianmodular-magician
authored
Fixes issue #18911 for Eventarc test flakiness due to IAM races (#13200) (#21680)
[upstream:e5ccde7726d6b74cc15976ecd7623dab0e991042] Signed-off-by: Modular Magician <magic-modules@google.com>
1 parent 2c2c91c commit 1120ef3

4 files changed

+49
-123
lines changed

‎.changelog/13200.txt

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
```release-note:none
2+
```

‎google/services/eventarc/resource_eventarc_google_channel_config_test.go

+23-74
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,13 @@ func testAccEventarcGoogleChannelConfig_basic(t *testing.T) {
4040
"project_number": envvar.GetTestProjectNumberFromEnv(),
4141
"region": region,
4242
"random_suffix": acctest.RandString(t, 10),
43-
"key1": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", region, "tf-bootstrap-eventarc-google-channel-config-key1").CryptoKey.Name,
44-
"key2": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", region, "tf-bootstrap-eventarc-google-channel-config-key2").CryptoKey.Name,
4543
}
44+
acctest.BootstrapIamMembers(t, []acctest.IamMember{
45+
{
46+
Member: "serviceAccount:service-{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com",
47+
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
48+
},
49+
})
4650

4751
acctest.VcrTest(t, resource.TestCase{
4852
PreCheck: func() { acctest.AccTestPreCheck(t) },
@@ -62,22 +66,9 @@ func testAccEventarcGoogleChannelConfig_basic(t *testing.T) {
6266

6367
func testAccEventarcGoogleChannelConfig_basicCfg(context map[string]interface{}) string {
6468
return acctest.Nprintf(`
65-
resource "google_kms_crypto_key_iam_member" "key1_member" {
66-
crypto_key_id = "%{key1}"
67-
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
68-
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
69-
}
70-
71-
resource "google_kms_crypto_key_iam_member" "key2_member" {
72-
crypto_key_id = "%{key2}"
73-
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
74-
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
75-
}
76-
7769
resource "google_eventarc_google_channel_config" "primary" {
78-
location = "%{region}"
79-
name = "googleChannelConfig"
80-
depends_on = [google_kms_crypto_key_iam_member.key1_member, google_kms_crypto_key_iam_member.key2_member]
70+
location = "%{region}"
71+
name = "googleChannelConfig"
8172
}
8273
`, context)
8374
}
@@ -89,9 +80,13 @@ func testAccEventarcGoogleChannelConfig_longForm(t *testing.T) {
8980
"project_number": envvar.GetTestProjectNumberFromEnv(),
9081
"region": region,
9182
"random_suffix": acctest.RandString(t, 10),
92-
"key1": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", region, "tf-bootstrap-eventarc-google-channel-config-key1").CryptoKey.Name,
93-
"key2": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", region, "tf-bootstrap-eventarc-google-channel-config-key2").CryptoKey.Name,
9483
}
84+
acctest.BootstrapIamMembers(t, []acctest.IamMember{
85+
{
86+
Member: "serviceAccount:service-{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com",
87+
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
88+
},
89+
})
9590

9691
acctest.VcrTest(t, resource.TestCase{
9792
PreCheck: func() { acctest.AccTestPreCheck(t) },
@@ -112,23 +107,10 @@ func testAccEventarcGoogleChannelConfig_longForm(t *testing.T) {
112107

113108
func testAccEventarcGoogleChannelConfig_longFormCfg(context map[string]interface{}) string {
114109
return acctest.Nprintf(`
115-
resource "google_kms_crypto_key_iam_member" "key1_member" {
116-
crypto_key_id = "%{key1}"
117-
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
118-
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
119-
}
120-
121-
resource "google_kms_crypto_key_iam_member" "key2_member" {
122-
crypto_key_id = "%{key2}"
123-
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
124-
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
125-
}
126-
127110
resource "google_eventarc_google_channel_config" "primary" {
128-
project = "projects/%{project_name}"
129-
location = "long/form/%{region}"
130-
name = "projects/%{project_name}/locations/%{region}/googleChannelConfig"
131-
depends_on = [google_kms_crypto_key_iam_member.key1_member, google_kms_crypto_key_iam_member.key2_member]
111+
project = "projects/%{project_name}"
112+
location = "long/form/%{region}"
113+
name = "projects/%{project_name}/locations/%{region}/googleChannelConfig"
132114
}
133115
`, context)
134116
}
@@ -143,6 +125,12 @@ func testAccEventarcGoogleChannelConfig_cryptoKeyUpdate(t *testing.T) {
143125
"key1": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", region, "tf-bootstrap-eventarc-google-channel-config-key1").CryptoKey.Name,
144126
"key2": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", region, "tf-bootstrap-eventarc-google-channel-config-key2").CryptoKey.Name,
145127
}
128+
acctest.BootstrapIamMembers(t, []acctest.IamMember{
129+
{
130+
Member: "serviceAccount:service-{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com",
131+
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
132+
},
133+
})
146134

147135
acctest.VcrTest(t, resource.TestCase{
148136
PreCheck: func() { acctest.AccTestPreCheck(t) },
@@ -188,69 +176,30 @@ func testAccEventarcGoogleChannelConfig_cryptoKeyUpdate(t *testing.T) {
188176

189177
func testAccEventarcGoogleChannelConfig_setCryptoKeyCfg(context map[string]interface{}) string {
190178
return acctest.Nprintf(`
191-
resource "google_kms_crypto_key_iam_member" "key1_member" {
192-
crypto_key_id = "%{key1}"
193-
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
194-
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
195-
}
196-
197-
resource "google_kms_crypto_key_iam_member" "key2_member" {
198-
crypto_key_id = "%{key2}"
199-
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
200-
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
201-
}
202-
203179
resource "google_eventarc_google_channel_config" "primary" {
204180
location = "%{region}"
205181
name = "projects/%{project_name}/locations/%{region}/googleChannelConfig"
206182
crypto_key_name = "%{key1}"
207-
depends_on = [google_kms_crypto_key_iam_member.key1_member, google_kms_crypto_key_iam_member.key2_member]
208183
}
209184
`, context)
210185
}
211186

212187
func testAccEventarcGoogleChannelConfig_cryptoKeyUpdateCfg(context map[string]interface{}) string {
213188
return acctest.Nprintf(`
214-
resource "google_kms_crypto_key_iam_member" "key1_member" {
215-
crypto_key_id = "%{key1}"
216-
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
217-
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
218-
}
219-
220-
resource "google_kms_crypto_key_iam_member" "key2_member" {
221-
crypto_key_id = "%{key2}"
222-
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
223-
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
224-
}
225-
226189
resource "google_eventarc_google_channel_config" "primary" {
227190
location = "%{region}"
228191
name = "projects/%{project_name}/locations/%{region}/googleChannelConfig"
229192
crypto_key_name = "%{key2}"
230-
depends_on = [google_kms_crypto_key_iam_member.key1_member, google_kms_crypto_key_iam_member.key2_member]
231193
}
232194
`, context)
233195
}
234196

235197
func testAccEventarcGoogleChannelConfig_deleteCryptoKeyCfg(context map[string]interface{}) string {
236198
return acctest.Nprintf(`
237-
resource "google_kms_crypto_key_iam_member" "key1_member" {
238-
crypto_key_id = "%{key1}"
239-
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
240-
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
241-
}
242-
243-
resource "google_kms_crypto_key_iam_member" "key2_member" {
244-
crypto_key_id = "%{key2}"
245-
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
246-
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
247-
}
248-
249199
resource "google_eventarc_google_channel_config" "primary" {
250200
location = "%{region}"
251201
name = "projects/%{project_name}/locations/%{region}/googleChannelConfig"
252202
crypto_key_name = ""
253-
depends_on = [google_kms_crypto_key_iam_member.key1_member, google_kms_crypto_key_iam_member.key2_member]
254203
}
255204
`, context)
256205
}

‎google/services/eventarc/resource_eventarc_message_bus_test.go

+18-41
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,12 @@ func testAccEventarcMessageBus_basic(t *testing.T) {
4141
"region": envvar.GetTestRegionFromEnv(),
4242
"random_suffix": acctest.RandString(t, 10),
4343
}
44+
acctest.BootstrapIamMembers(t, []acctest.IamMember{
45+
{
46+
Member: "serviceAccount:service-{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com",
47+
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
48+
},
49+
})
4450

4551
acctest.VcrTest(t, resource.TestCase{
4652
PreCheck: func() { acctest.AccTestPreCheck(t) },
@@ -78,13 +84,18 @@ resource "google_eventarc_message_bus" "primary" {
7884

7985
func testAccEventarcMessageBus_cryptoKey(t *testing.T) {
8086
region := envvar.GetTestRegionFromEnv()
81-
8287
context := map[string]interface{}{
8388
"project_number": envvar.GetTestProjectNumberFromEnv(),
8489
"region": region,
8590
"key": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", region, "tf-bootstrap-eventarc-messagebus-key").CryptoKey.Name,
8691
"random_suffix": acctest.RandString(t, 10),
8792
}
93+
acctest.BootstrapIamMembers(t, []acctest.IamMember{
94+
{
95+
Member: "serviceAccount:service-{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com",
96+
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
97+
},
98+
})
8899

89100
acctest.VcrTest(t, resource.TestCase{
90101
PreCheck: func() { acctest.AccTestPreCheck(t) },
@@ -106,34 +117,32 @@ func testAccEventarcMessageBus_cryptoKey(t *testing.T) {
106117

107118
func testAccEventarcMessageBus_cryptoKeyCfg(context map[string]interface{}) string {
108119
return acctest.Nprintf(`
109-
resource "google_kms_crypto_key_iam_member" "key_member" {
110-
crypto_key_id = "%{key}"
111-
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
112-
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
113-
}
114-
115120
resource "google_eventarc_message_bus" "primary" {
116121
location = "%{region}"
117122
message_bus_id = "tf-test-messagebus%{random_suffix}"
118123
crypto_key_name = "%{key}"
119124
logging_config {
120125
log_severity = "ALERT"
121126
}
122-
depends_on = [google_kms_crypto_key_iam_member.key_member]
123127
}
124128
`, context)
125129
}
126130

127131
func testAccEventarcMessageBus_update(t *testing.T) {
128132
region := envvar.GetTestRegionFromEnv()
129-
130133
context := map[string]interface{}{
131134
"project_number": envvar.GetTestProjectNumberFromEnv(),
132135
"region": region,
133136
"key1": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", region, "tf-bootstrap-eventarc-messagebus-key1").CryptoKey.Name,
134137
"key2": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", region, "tf-bootstrap-eventarc-messagebus-key2").CryptoKey.Name,
135138
"random_suffix": acctest.RandString(t, 10),
136139
}
140+
acctest.BootstrapIamMembers(t, []acctest.IamMember{
141+
{
142+
Member: "serviceAccount:service-{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com",
143+
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
144+
},
145+
})
137146

138147
acctest.VcrTest(t, resource.TestCase{
139148
PreCheck: func() { acctest.AccTestPreCheck(t) },
@@ -183,12 +192,6 @@ func testAccEventarcMessageBus_update(t *testing.T) {
183192

184193
func testAccEventarcMessageBus_setCfg(context map[string]interface{}) string {
185194
return acctest.Nprintf(`
186-
resource "google_kms_crypto_key_iam_member" "key1_member" {
187-
crypto_key_id = "%{key1}"
188-
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
189-
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
190-
}
191-
192195
resource "google_eventarc_message_bus" "primary" {
193196
location = "%{region}"
194197
message_bus_id = "tf-test-messagebus%{random_suffix}"
@@ -197,25 +200,12 @@ resource "google_eventarc_message_bus" "primary" {
197200
logging_config {
198201
log_severity = "ALERT"
199202
}
200-
depends_on = [google_kms_crypto_key_iam_member.key1_member]
201203
}
202204
`, context)
203205
}
204206

205207
func testAccEventarcMessageBus_updateCfg(context map[string]interface{}) string {
206208
return acctest.Nprintf(`
207-
resource "google_kms_crypto_key_iam_member" "key1_member" {
208-
crypto_key_id = "%{key1}"
209-
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
210-
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
211-
}
212-
213-
resource "google_kms_crypto_key_iam_member" "key2_member" {
214-
crypto_key_id = "%{key2}"
215-
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
216-
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
217-
}
218-
219209
resource "google_eventarc_message_bus" "primary" {
220210
location = "%{region}"
221211
message_bus_id = "tf-test-messagebus%{random_suffix}"
@@ -224,25 +214,12 @@ resource "google_eventarc_message_bus" "primary" {
224214
logging_config {
225215
log_severity = "DEBUG"
226216
}
227-
depends_on = [google_kms_crypto_key_iam_member.key1_member, google_kms_crypto_key_iam_member.key2_member]
228217
}
229218
`, context)
230219
}
231220

232221
func testAccEventarcMessageBus_deleteCfg(context map[string]interface{}) string {
233222
return acctest.Nprintf(`
234-
resource "google_kms_crypto_key_iam_member" "key1_member" {
235-
crypto_key_id = "%{key1}"
236-
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
237-
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
238-
}
239-
240-
resource "google_kms_crypto_key_iam_member" "key2_member" {
241-
crypto_key_id = "%{key2}"
242-
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
243-
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
244-
}
245-
246223
resource "google_eventarc_message_bus" "primary" {
247224
location = "%{region}"
248225
message_bus_id = "tf-test-messagebus%{random_suffix}"

‎google/services/eventarc/resource_eventarc_trigger_generated_test.go

+6-8
Original file line numberDiff line numberDiff line change
@@ -162,10 +162,15 @@ resource "google_eventarc_trigger" "primary" {
162162

163163
func TestAccEventarcTrigger_eventarcTriggerWithChannelCmekExample(t *testing.T) {
164164
t.Parallel()
165+
acctest.BootstrapIamMembers(t, []acctest.IamMember{
166+
{
167+
Member: "serviceAccount:service-{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com",
168+
Role: "roles/cloudkms.cryptoKeyEncrypterDecrypter",
169+
},
170+
})
165171

166172
context := map[string]interface{}{
167173
"project_id": envvar.GetTestProjectFromEnv(),
168-
"project_number": envvar.GetTestProjectNumberFromEnv(),
169174
"service_account": envvar.GetTestServiceAccountFromEnv(t),
170175
"key_name": acctest.BootstrapKMSKeyWithPurposeInLocationAndName(t, "ENCRYPT_DECRYPT", "us-central1", "tf-bootstrap-eventarc-trigger-key").CryptoKey.Name,
171176
"random_suffix": acctest.RandString(t, 10),
@@ -191,18 +196,11 @@ func TestAccEventarcTrigger_eventarcTriggerWithChannelCmekExample(t *testing.T)
191196

192197
func testAccEventarcTrigger_eventarcTriggerWithChannelCmekExample(context map[string]interface{}) string {
193198
return acctest.Nprintf(`
194-
resource "google_kms_crypto_key_iam_member" "key_member" {
195-
crypto_key_id = "%{key_name}"
196-
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
197-
member = "serviceAccount:service-%{project_number}@gcp-sa-eventarc.iam.gserviceaccount.com"
198-
}
199-
200199
resource "google_eventarc_channel" "test_channel" {
201200
location = "us-central1"
202201
name = "tf-test-some-channel%{random_suffix}"
203202
crypto_key_name = "%{key_name}"
204203
third_party_provider = "projects/%{project_id}/locations/us-central1/providers/datadog"
205-
depends_on = [google_kms_crypto_key_iam_member.key_member]
206204
}
207205
208206
resource "google_cloud_run_service" "default" {

0 commit comments

Comments
 (0)