Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(secure-onboarding) Fix resource update operation #435

Merged
merged 4 commits into from
Oct 27, 2023

Conversation

ravinadhruve10
Copy link
Contributor

The TF provider’s knowledge of cloud account object is older and different from the actual BE cloud account. This is because BE has modified the account object with fields like organization_id during org onboarding. Hence, during intended PUTs, TF overwrites these fields resulting in unexpected state.

Fix summary:

  1. Add and expose the organization_id in provider's account resource schema (as a computed field only). This is to let the customers know if their onboarded account is part of any org when they fetch the real existing infrastructure objects using GET calls.
  2. During resource updates (PUT API calls) restrict and reject with error when the customer tries to update any non-updatable resource fields.
  3. Minor refactoring for cleaner code.

Testing done:

Validated the scenarios :-

  • During tf apply again --> it returns and updates organization_id on the account.
  • No unnecessary PUTs
  • On triggering an intended PUT :-
    • restricts any non-updatable fields
    • PUT works as expected, doesn't overwrite organization_id to ""

The TF provider’s knowledge of cloud account object is older and
different from the actual BE cloud account. This is because BE has
modified the account object with fields like organization_id during
org onboarding. Hence, during intended PUTs, TF overwrites these
fields resulting in unexpected state.

Fix summary:
------------
1. Add and expose the organization_id in provider's account resource schema
   (as a computed field only). This is to let the customers know if their
   onboarded account is part of any org when they fetch the real existing
   infrastructure objects using GET calls.
2. During resource updates (PUT API calls) restrict and reject with error
   when the customer tries to update any non-updatable resource fields.
3. Minor refactoring for cleaner code.

Testing done:
---------------
Validated the scenarios :-
- During tf apply again --> it returns and updates organization_id on the account.
- No unnecessary PUTs
- On triggering an intended PUT :-
  - restricts any non-updatable fields
  - PUT works as expected, doesn't oevrwrite organization_id to ""
@ravinadhruve10 ravinadhruve10 marked this pull request as ready for review October 25, 2023 01:10
@ravinadhruve10
Copy link
Contributor Author

ravinadhruve10 commented Oct 25, 2023

The secure acceptance test failing in the CI above is not related to this PR or resource: --- FAIL: TestAccDataUser (1.87s) which is flaky because in the rerun it passed, and another test fails instead :-

=== NAME  TestAccCustomRoleResource
    resource_sysdig_custom_role_test.go:17: Step 4/5 error: Check failed: Check 1/1 error: sysdig_custom_role.custom-role: Attribute 'name' expected "custom-role-67c8gramz1-updated", got "custom-role-67c8gramz1"
--- FAIL: TestAccCustomRoleResource (10.20s)

The acceptance tests related to resources in this PR have all passed.

@ravinadhruve10 ravinadhruve10 merged commit 59e69cb into master Oct 27, 2023
23 checks passed
@ravinadhruve10 ravinadhruve10 deleted the fix/secure-onboarding-update-op branch October 27, 2023 00:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants