Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Improve handling when enabling/disabling server TLS policy in global target HTTPS proxies #19233

Conversation

modular-magician
Copy link
Collaborator

This PR implements similar behavior as in GoogleCloudPlatform/magic-modules#11184 but for global target HTTPS proxies.

Prior to this PR, you could enable a server TLS policy on a global HTTPS proxy, but disabling it would not work as removing server_tls_policy removes it from the PATCH payload entirely, so Google simply leaves the server TLS policy as is. What we actually need to do is send serverTlsPolicy = null if it's not set, which is what this PR does.

We're also adding a note about having to add the create_before_destroy = true lifecycle on google_network_security_server_tls_policy as removing the resource would make Terraform destroy the resource first before creating/updating other resources, and that would result in a "resource already in use" error. This lifecycle rule means Terraform will create/update resources (in this case it would update google_compute_target_https_proxy first and remove the association with the google_network_security_server_tls_policy resource) before destroying the resource.

I've updated the tests so that it creates the resources without a server TLS policy, then it adds the server_tls_policy and related resources, and then it removes them again. This is to ensure that we can successfully enable & disable mTLS.

Release Note Template for Downstream PRs (will be copied)

compute: allowed disabling 'server_tls_policy' during update in 'google_compute_target_https_proxy' resources

Derived from GoogleCloudPlatform/magic-modules#11496

…target HTTPS proxies (hashicorp#11496)

[upstream:55fec567f92fc3725a522d230a141dc13cea9ec9]

Signed-off-by: Modular Magician <magic-modules@google.com>
@modular-magician modular-magician merged commit 3bebbe9 into hashicorp:main Aug 22, 2024
4 checks passed
Copy link

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Sep 23, 2024
@modular-magician modular-magician deleted the downstream-pr-55fec567f92fc3725a522d230a141dc13cea9ec9 branch November 17, 2024 01:42
# for free to subscribe to this conversation on GitHub. Already have an account? #.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant