feat(TPG>=6.39)!: Fleet app operator permissions custom roles

[tonybayvas]

This PR introduces custom roles to the Terraform module that bundles different permissions (IAM and RBAC Role Bindings) required for Fleet team management.

[apeabody]

Thanks @tonybayvas!

I've added a few notes below, also be sure to review the LINT output.

[apeabody]

Thanks @tonybayvas!

From the most recent test:

        	Error:      	Received unexpected error:
        	            	FatalError{Underlying: error while running command: exit status 1; 
        	            	Error: Failed to retrieve project, pid: , err: project: required field is not set
        	            	
        	            	  with module.example.google_gke_hub_feature.rbacrolebindingactuation,
        	            	  on ../../../examples/simple_fleet_app_operator_permissions/main.tf line 39, in resource "google_gke_hub_feature" "rbacrolebindingactuation":
        	            	  39: resource "google_gke_hub_feature" "rbacrolebindingactuation" {
        	            	
        	            	
        	            	Error: Invalid combination of arguments
        	            	
        	            	  with module.example.module.permissions.google_gke_hub_scope_rbac_role_binding.scope_rbac_user_role_bindings["app-operator-id@ci-gke-fleet-bb1669a9-a31b.iam.gserviceaccount.com"],
        	            	  on ../../../modules/fleet-app-operator-permissions/main.tf line 82, in resource "google_gke_hub_scope_rbac_role_binding" "scope_rbac_user_role_bindings":
        	            	  82:     custom_role     = (var.custom_role != "" ? var.custom_role : null)
        	            	
        	            	"role.0.custom_role": one of `role.0.custom_role,role.0.predefined_role` must
        	            	be specified
        	            	
        	            	Error: Invalid combination of arguments
        	            	
        	            	  with module.example.module.permissions.google_gke_hub_scope_rbac_role_binding.scope_rbac_user_role_bindings["app-operator-id@ci-gke-fleet-bb1669a9-a31b.iam.gserviceaccount.com"],
        	            	  on ../../../modules/fleet-app-operator-permissions/main.tf line 83, in resource "google_gke_hub_scope_rbac_role_binding" "scope_rbac_user_role_bindings":
        	            	  83:     predefined_role = (var.custom_role != "" ? null : var.role)
        	            	
        	            	"role.0.predefined_role": one of `role.0.custom_role,role.0.predefined_role`
        	            	must be specified}
        	Test:       	TestSimpleFleetAppOperatorPermissions

[tonybayvas]

/gcbrun

[tonybayvas]

/gcbrun

[apeabody]

Almost! :)

    simple_fleet_app_operator_permissions_test.go:69: 
        	Error:      	Not equal: 
        	            	expected: false
        	            	actual  : true
        	Test:       	TestSimpleFleetAppOperatorPermissions
        	Messages:   	custom app operator Scope role should be in the project IAM policy

[tonybayvas]

/gcbrun

[tonybayvas]

/gcbrun

[tonybayvas]

/gcbrun

[tonybayvas]

The latest test failures don't seem related to the app-operator tests.

[apeabody]

The latest test failures don't seem related to the app-operator tests.

Could be transitory, or it's possible the API/TPG behavior recently changed.

[apeabody]

The latest test failures don't seem related to the app-operator tests.

Could be transitory, or it's possible the API/TPG behavior recently changed.

Reproduced in #2368, so it's an API/TPG change:

Step #76 - "verify private-zonal-with-networking":         	Error:      	Not equal: 
Step #76 - "verify private-zonal-with-networking":         	            	expected: map[string]interface {}{"diskSizeGb":100, "diskType":"pd-standard", "effectiveCgroupMode":"EFFECTIVE_CGROUP_MODE_V2", "imageType":"COS_CONTAINERD", "kubeletConfig":map[string]interface {}{"insecureKubeletReadonlyPortEnabled":false}, "labels":map[string]interface {}{"cluster_name":"CLUSTER_NAME", "node_pool":"default-node-pool"}, "loggingConfig":map[string]interface {}{"variantConfig":map[string]interface {}{"variant":"DEFAULT"}}, "machineType":"e2-medium", "metadata":map[string]interface {}{"cluster_name":"CLUSTER_NAME", "disable-legacy-endpoints":"true", "node_pool":"default-node-pool"}, "oauthScopes":[]interface {}{"https://www.googleapis.com/auth/cloud-platform"}, "resourceLabels":map[string]interface {}{"goog-gke-node-pool-provisioning-model":"on-demand"}, "serviceAccount":"SERVICE_ACCOUNT", "shieldedInstanceConfig":map[string]interface {}{"enableIntegrityMonitoring":true}, "tags":[]interface {}{"gke-CLUSTER_NAME", "gke-CLUSTER_NAME-default-node-pool"}, "windowsNodeConfig":map[string]interface {}{}, "workloadMetadataConfig":map[string]interface {}{"mode":"GKE_METADATA"}}
Step #76 - "verify private-zonal-with-networking":         	            	actual  : map[string]interface {}{"bootDisk":map[string]interface {}{"diskType":"pd-standard", "sizeGb":"100"}, "diskSizeGb":100, "diskType":"pd-standard", "effectiveCgroupMode":"EFFECTIVE_CGROUP_MODE_V2", "imageType":"COS_CONTAINERD", "kubeletConfig":map[string]interface {}{"insecureKubeletReadonlyPortEnabled":false}, "labels":map[string]interface {}{"cluster_name":"CLUSTER_NAME", "node_pool":"default-node-pool"}, "loggingConfig":map[string]interface {}{"variantConfig":map[string]interface {}{"variant":"DEFAULT"}}, "machineType":"e2-medium", "metadata":map[string]interface {}{"cluster_name":"CLUSTER_NAME", "disable-legacy-endpoints":"true", "node_pool":"default-node-pool"}, "oauthScopes":[]interface {}{"https://www.googleapis.com/auth/cloud-platform"}, "resourceLabels":map[string]interface {}{"goog-gke-node-pool-provisioning-model":"on-demand"}, "serviceAccount":"SERVICE_ACCOUNT", "shieldedInstanceConfig":map[string]interface {}{"enableIntegrityMonitoring":true}, "tags":[]interface {}{"gke-CLUSTER_NAME", "gke-CLUSTER_NAME-default-node-pool"}, "windowsNodeConfig":map[string]interface {}{}, "workloadMetadataConfig":map[string]interface {}{"mode":"GKE_METADATA"}}

I made the described changes

[apeabody]

Thanks @tonybayvas!

This will be a breaking change due to the bump in minimum provider version, so we'll merge after v37.1 is released.

[apeabody]

Thanks @tonybayvas!