Add WorkloadIdentityConfig to Compute Instance and InstanceTemplate

Author: draksbahijakub-google

mmv1/products/compute/Instance.yaml

@@ -1007,3 +1007,15 @@ properties:
         type: String
         description: 'kms key service account'
         is_missing_in_cai: true
+  - name: 'workloadIdentityConfig'
+    type: NestedObject
+    description: 'Workload identity config.'
+    properties:
+      - name: 'identity'
+        api_name: 'identity'
+        type: String
+        description: 'Identity SPIFFE id.'
+      - name: 'identityCertificateEnabled'
+        api_name: 'identityCertificateEnabled'
+        type: Boolean
+        description: 'Specifies whether identity certificates are enabled.'

mmv1/third_party/terraform/services/compute/compute_instance_helpers.go.tmpl

@@ -1626,3 +1626,28 @@ func stripInitializeParams(instanceMap map[string]interface{}) {
 	}
 }
 
+
+func expandWorkloadIdentityConfig(d tpgresource.TerraformResourceData) *compute.WorkloadIdentityConfig {
+	iek, ok := d.GetOk("workload_identity_config")
+	if !ok {
+		return nil
+	}
+
+	wicRes := iek.([]interface{})[0].(map[string]interface{})
+	return &compute.WorkloadIdentityConfig{
+		Identity:      	            wicRes["identity"].(string),
+		IdentityCertificateEnabled: wicRes["identity_certificate_enabled"].(bool),
+	}
+}
+
+func flattenWorkloadIdentityConfig(v *compute.WorkloadIdentityConfig) []map[string]interface{} {
+	if v == nil {
+		return nil
+	}
+	return []map[string]interface{}{
+		{
+			"identity": 	                v.Identity,
+			"identity_certificate_enabled": v.IdentityCertificateEnabled,
+		},
+	}
+}

mmv1/third_party/terraform/services/compute/resource_compute_instance.go.tmpl

@@ -134,6 +134,11 @@ var (
 		"shielded_instance_config.0.enable_vtpm",
 		"shielded_instance_config.0.enable_integrity_monitoring",
 	}
+
+	workloadIdentityConfigKeys = []string{
+		"workload_identity_config.0.identity",
+		"workload_identity_config.0.identity_certificate_enabled",
+	}
 )
 
 // This checks if the project provided in subnetwork's self_link matches
@@ -1716,6 +1721,31 @@ be from 0 to 999,999,999 inclusive.`,
 				Description: `Specifies whether the disks restored from source snapshots or source machine image should erase Windows specific VSS signature.`,
 			},
 			{{- end }}
+			"workload_identity_config": {
+				Type:        schema.TypeList,
+				MaxItems:    1,
+				Optional:    true,
+				Description: `Workload identity config.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"identity": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							ForceNew:     true,
+							AtLeastOneOf: workloadIdentityConfigKeys,
+							Description:  `Identity SPIFFE id.`,
+						},
+						"identity_certificate_enabled": {
+							Type:         schema.TypeBool,
+							Optional:     true,
+							ForceNew:     true,
+							Computed:     true,
+							AtLeastOneOf: workloadIdentityConfigKeys,
+							Description:  `Specifies whether identity certificates are enabled.`,
+						},
+					},
+				},
+			},
 //UDP schema start
             "deletion_policy": tpgresource.DeletionPolicySchemaEntry("DELETE"),
 //UDP schema end
@@ -1968,6 +1998,7 @@ func expandComputeInstance(project string, d *schema.ResourceData, config *trans
 		{{- if ne $.TargetVersionName `ga` }}
 		EraseWindowsVssSignature:   d.Get("erase_windows_vss_signature").(bool),
 		{{- end }}
+		WorkloadIdentityConfig:     expandWorkloadIdentityConfig(d),
 	}
 	if cic := expandConfidentialInstanceConfig(d); cic != nil {
 		instance.ConfidentialInstanceConfig = &compute.ConfidentialInstanceConfig{
@@ -2571,6 +2602,17 @@ func populateComputeInstanceResourceData(d *schema.ResourceData, instance *compu
     }
     {{- end }}
 
+	d.SetId(fmt.Sprintf("projects/%s/zones/%s/instances/%s", project, zone, instance.Name))
+
+                
+    if err := tpgresource.DeletionPolicyReadDefault(d, config, "DELETE"); err != nil{
+        return err
+    }
+
+	if err := d.Set("workload_identity_config", flattenWorkloadIdentityConfig(instance.WorkloadIdentityConfig)); err != nil {
+		return fmt.Errorf("Error setting workload_identity_config: %s", err)
+	}
+    
 	return nil
 }
 

mmv1/third_party/terraform/services/compute/resource_compute_instance_from_machine_image_meta.yaml.tmpl

@@ -266,6 +266,8 @@ fields:
     field: 'tags_fingerprint'
   - field: 'terraform_labels'
     provider_only: true
+  - api_field: 'workloadIdentityConfig.identity'
+  - api_field: 'workloadIdentityConfig.identityCertificateEnabled'
   - api_field: 'zone'
 {{- if ne $.TargetVersionName "ga" }}
   - api_field: 'eraseWindowsVssSignature'

mmv1/third_party/terraform/services/compute/resource_compute_instance_from_template_meta.yaml.tmpl

@@ -279,6 +279,8 @@ fields:
     field: 'tags_fingerprint'
   - field: 'terraform_labels'
     provider_only: true
+  - api_field: 'workloadIdentityConfig.identity'
+  - api_field: 'workloadIdentityConfig.identityCertificateEnabled'
   - api_field: 'zone'
 {{- if ne $.TargetVersionName "ga" }}
   - api_field: 'eraseWindowsVssSignature'

mmv1/third_party/terraform/services/compute/resource_compute_instance_meta.yaml.tmpl

@@ -282,6 +282,8 @@ fields:
     field: 'tags_fingerprint'
   - field: 'terraform_labels'
     provider_only: true
+  - api_field: 'workloadIdentityConfig.identity'
+  - api_field: 'workloadIdentityConfig.identityCertificateEnabled'
   - api_field: 'zone'
 {{- if ne $.TargetVersionName "ga" }}
   - api_field: 'eraseWindowsVssSignature'

mmv1/third_party/terraform/services/compute/resource_compute_instance_template.go.tmpl

@@ -1343,6 +1343,32 @@ be from 0 to 999,999,999 inclusive.`,
 				ValidateFunc: validation.StringInSlice([]string{"NONE", "STOP", ""}, false),
 				Description:  `Action to be taken when a customer's encryption key is revoked. Supports "STOP" and "NONE", with "NONE" being the default.`,
 			},
+			"workload_identity_config": {
+				Type:        schema.TypeList,
+				MaxItems:    1,
+				Optional:    true,
+				ForceNew:    true,
+				Description: `Workload identity config.`,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"identity": {
+							Type:         schema.TypeString,
+							Optional:     true,
+							ForceNew:     true,
+							AtLeastOneOf: workloadIdentityConfigKeys,
+							Description:  `Identity SPIFFE id.`,
+						},
+						"identity_certificate_enabled": {
+							Type:         schema.TypeBool,
+							Optional:     true,
+							Computed:     true,
+							ForceNew:     true,
+							AtLeastOneOf: workloadIdentityConfigKeys,
+							Description:  `Specifies whether identity certificates are enabled.`,
+						},
+					},
+				},
+			},
 		},
 		UseJSONNumber: true,
 	}
@@ -1745,6 +1771,7 @@ func resourceComputeInstanceTemplateCreate(d *schema.ResourceData, meta interfac
 		ResourcePolicies:           resourcePolicies,
 		ReservationAffinity:        reservationAffinity,
 		KeyRevocationActionType:    d.Get("key_revocation_action_type").(string),
+		WorkloadIdentityConfig:     expandWorkloadIdentityConfig(d),
 	}
 	if cic := expandConfidentialInstanceConfig(d); cic != nil {
 		instanceProperties.ConfidentialInstanceConfig = &compute.ConfidentialInstanceConfig{
@@ -2327,6 +2354,12 @@ func resourceComputeInstanceTemplateRead(d *schema.ResourceData, meta interface{
 		}
 	}
 
+	if instanceTemplate.Properties.WorkloadIdentityConfig != nil {
+		if err = d.Set("workload_identity_config", flattenWorkloadIdentityConfig(instanceTemplate.Properties.WorkloadIdentityConfig)); err != nil {
+			return fmt.Errorf("Error setting workload_identity_config: %s", err)
+		}
+	}
+
 	return nil
 }
 

mmv1/third_party/terraform/services/compute/resource_compute_instance_template_meta.yaml.tmpl

@@ -272,3 +272,7 @@ fields:
     api_field: 'properties.tags.fingerprint'
   - field: 'terraform_labels'
     provider_only: true
+  - field: 'workload_identity_config.identity'
+    api_field: 'properties.workloadIdentityConfig.identity'
+  - field: 'workload_identity_config.identity_certificate_enabled'
+    api_field: 'properties.workloadIdentityConfig.identityCertificateEnabled'

mmv1/third_party/terraform/services/compute/resource_compute_instance_template_test.go.tmpl

@@ -59,6 +59,36 @@ func TestAccComputeInstanceTemplate_basic(t *testing.T) {
 	})
 }
 
+func TestAccComputeInstanceTemplate_workloadIdentity(t *testing.T) {
+	t.Parallel()
+
+	var instanceTemplate map[string]interface{}
+	suffix := acctest.RandString(t, 10)
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckComputeInstanceTemplateDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccComputeInstanceTemplate_workloadIdentity(suffix),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckComputeInstanceTemplateExists(
+						t, "google_compute_instance_template.foobar", &instanceTemplate),
+					resource.TestCheckResourceAttr("google_compute_instance_template.foobar", "workload_identity_config.0.identity", fmt.Sprintf("ns/tf-test-ns-%s/sa/tf-test-id-%s", suffix, suffix)),
+					resource.TestCheckResourceAttr("google_compute_instance_template.foobar", "workload_identity_config.0.identity_certificate_enabled", "true"),
+				),
+			},
+			{
+				ResourceName:      "google_compute_instance_template.foobar",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{"labels", "terraform_labels"},
+			},
+		},
+	})
+}
+
 func TestAccComputeInstanceTemplate_imageShorthand(t *testing.T) {
 	t.Parallel()
 
@@ -5856,6 +5886,51 @@ resource "google_compute_instance_template" "foobar" {
 `, context)
 }
 
+func testAccComputeInstanceTemplate_workloadIdentity(suffix string) string {
+	return fmt.Sprintf(`
+data "google_compute_image" "my_image" {
+  family  = "debian-11"
+  project = "debian-cloud"
+}
+
+resource "google_iam_workload_identity_pool" "pool" {
+  workload_identity_pool_id = "tf-test-pool-%s"
+  mode                      = "TRUST_DOMAIN"
+}
+
+resource "google_iam_workload_identity_pool_namespace" "ns" {
+  workload_identity_pool_id        = google_iam_workload_identity_pool.pool.workload_identity_pool_id
+  workload_identity_pool_namespace_id = "tf-test-ns-%s"
+}
+
+resource "google_iam_workload_identity_pool_managed_identity" "id" {
+  workload_identity_pool_id            = google_iam_workload_identity_pool_namespace.ns.workload_identity_pool_id
+  workload_identity_pool_namespace_id = google_iam_workload_identity_pool_namespace.ns.workload_identity_pool_namespace_id
+  workload_identity_pool_managed_identity_id = "tf-test-id-%s"
+}
+
+resource "google_compute_instance_template" "foobar" {
+  name         = "tf-test-instance-template-%s"
+  machine_type = "e2-medium"
+
+  disk {
+    source_image = data.google_compute_image.my_image.self_link
+    auto_delete  = true
+    boot         = true
+  }
+
+  network_interface {
+    network = "default"
+  }
+
+  workload_identity_config {
+    identity = "ns/tf-test-ns-%s/sa/tf-test-id-%s"
+    identity_certificate_enabled = true
+  }
+}
+`, suffix, suffix, suffix, suffix, suffix, suffix)
+}
+
 
 {{ if ne $.TargetVersionName `ga` -}}
 func testAccComputeInstanceTemplate_aliasIpv6Range(suffix string) string {