feat(INT-53): bring in tf module from existing repo #1
Conversation
- The goal of this PR is setup the tf module, add a basic README, setup testing, and get user/group basics working - add `googleworkspace`.`user` with tests for email and password - add `googleworkspace`.`group` - with tests for email - [INT-53](https://www.notion.so/masterpoint/Managing-GSuite-Users-via-IaC-1d0859758a568029b956f2ab8c9a2651) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> - **New Features** - Introduced automation for managing Google Workspace users and groups via new input variables. - Added support for configuring user and group attributes, including validation for emails, passwords, and hash functions. - **Bug Fixes** - Improved input validation to ensure correct email formats and password constraints. - **Documentation** - Updated README to reflect the new module name, purpose, usage instructions, and provider requirements. - Removed outdated changelog content. - **Tests** - Added comprehensive tests for user and group variable validation, including email, password, and hash function checks. - **Chores** - Updated provider version requirements for compatibility and stability. - Removed obsolete outputs and variables. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot <[email protected]>
## what - add group settings, `googleworkspace_group_settings` - enable users to be members of groups, `googleworkspace_group_member` ## why ## references - [INT-53](https://www.notion.so/masterpoint/Managing-GSuite-Users-via-IaC-1d0859758a568029b956f2ab8c9a2651) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Introduced comprehensive support for managing Google Workspace users, groups, group settings, and group memberships via new input variables and resources. - Added detailed input validation for user and group attributes, including email formats, password requirements, and group roles. - Provided example configurations and provider setup for Google Workspace automation. - **Documentation** - Updated README with complete usage instructions, authentication methods, input variable schemas, and example usage. - Replaced all template references with Google Workspace-specific documentation. - **Tests** - Added extensive test cases for user and group variable validation, covering email, password, hash function, and group role scenarios. - **Chores** - Updated provider requirements to use the Google Workspace provider. - Cleaned up and reorganized example files and removed obsolete outputs and changelog content. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot <[email protected]>
## what - New Example: added `examples/import-existing-org` showing the nuances of importing `group_settings` and user to member group relationships. ## why - Provider better examples ## references <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Updated the README example to demonstrate managing both users and groups, including group membership roles. - **New Features** - Added comprehensive example configurations for importing existing Google Workspace users and groups using YAML and Terraform. - Introduced sample YAML files for defining users and groups with reusable templates and settings. - Provided Terraform files for provider setup, version constraints, and import logic for existing organization data. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot <[email protected]>
WalkthroughThis change replaces a generic Terraform module template with a comprehensive module for managing Google Workspace users, groups, and group settings. It introduces detailed variable schemas for users and groups, extensive input validation, and resource definitions for users, groups, group settings, and group memberships using the Possibly related PRs
Tip ⚡️ Faster reviews with caching
Enjoy the performance boost—your workflow just got faster. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🔭 Outside diff range comments (1)
outputs.tf (1)
1-2: 🛠️ Refactor suggestionRemove empty
outputs.tffile
Since all outputs have been deleted, this empty file can be removed to avoid confusion and keep the module tree tidy.
♻️ Duplicate comments (1)
examples/import-existing-org/providers.tf (1)
7-8: Duplicate provider credential suggestion.
As noted inexamples/complete/providers.tf, avoid hardcoding the credentials file path and impersonated user; parameterize via variables or environment variables to improve reuse and security.
🧹 Nitpick comments (17)
examples/import-existing-org/users.yaml (1)
2-6: YAML clarity: quote string values explicitly
Consider quoting the role value to ensure it’s parsed as a string and improve consistency. You can also expand the inline flow mapping into block style for better readability:groups: team: role: "member".gitignore (2)
12-14: Consolidate lock file ignore rules
You’ve addedexamples/**/*.terraform.lock.hclto ignore all example-level lock files. If you intend to ignore these consistently, you can remove any commented legacy rules and add a brief comment explaining why examples should not track lock files.
17-18: Remove commented-out negation rule
The line# !examples/**/.terraform.lock.hclis now redundant and can be deleted to keep the.gitignoreclean.examples/import-existing-org/versions.tf (2)
2-2: Specify an upper bound for Terraform version.
Consider constraining Terraform versions to avoid breaking changes from v2.x by using a version range, for example:required_version = ">= 1.0, < 2.0"
6-7: Allow patch-level updates for the provider.
Instead of pinning exactly to0.7.0, use the pessimistic constraint to permit patch releases while preventing breaking minor versions:version = "~> 0.7.0"examples/import-existing-org/main.tf (1)
2-3: Make file paths explicit and module-friendly.
Usepath.moduleto ensure Terraform resolves these files correctly when invoked from different working directories:_all_groups = yamldecode(file("${path.module}/groups.yaml")) _all_users = yamldecode(file("${path.module}/users.yaml"))examples/complete/providers.tf (1)
7-8: Avoid hardcoding credential paths in examples.
Instead of embedding an absolute path, parameterizecredentials(e.g. viavar.credentials_path) or encourage use of theGOOGLE_APPLICATION_CREDENTIALSenvironment variable. Likewise, consider makingimpersonated_user_emaila variable for flexibility.examples/import-existing-org/groups.yaml (1)
15-22: Use descriptive resource keys.
The keyteamis quite generic. Renaming it to something likeengineering_teamor another identifier that reflects its purpose will improve readability and avoid collisions if additional groups are added.tests/variables_groups.tftest.hcl (1)
26-43: Enhance failure assertion
Consider adding anexpect_failure_messageto assert on the specific validation error (e.g.,"Invalid group email address") so the test fails for the intended reason.README.md (2)
17-22: Use proper Markdown list formatting
Switch from1 -/2 -to standard ordered list syntax (1./2.) for consistency and better rendering.
25-25: Address the TODO before release
A step-by-step authentication guide is marked TODO – consider adding those instructions now or plan a follow-up.variables.tf (1)
100-110: Simplifygroup.typevalidation
Sincegroup.typedefaults to"USER", checking fornullis redundant and can be removed for clarity.examples/import-existing-org/imports.tf (1)
17-28: Flatten logic is functional but can be simplified
You can inline the user filtering and flatten steps without the_user_with_groupsintermediate or leverage Terraform 1.5’sflattenenhancements.main.tf (4)
1-4: Consider defaultingsettingsto avoid null merges
Usingmerge(v.settings, { email = v.email })assumesv.settingsis always a map. Ifsettingsmay be omitted ornull, uselookup(v, "settings", {})to prevent merge errors.
6-9: Rename local variable for clarity
Rename_user_with_groupstousers_with_groups(dropping the leading underscore) for consistency with Terraform naming conventions and improved readability.
12-21: Decouple locals from resource attributes
Referencinggoogleworkspace_group.defaults[group_key].emailin a local creates an implicit dependency on that resource. You can instead usevar.groups[group_key].emailto obtain the same value and avoid unexpected ordering constraints.
24-27: Remove unnecessary user→group dependency
Thedepends_on = [googleworkspace_group.defaults]in the user resource is not needed since users can be created independently of groups. Dropping this will allow parallel resource creation and speed up plans.
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (21)
.github/renovate.json5(1 hunks).gitignore(2 hunks)CHANGELOG.md(0 hunks)README.md(5 hunks)examples/complete/main.tf(1 hunks)examples/complete/outputs.tf(0 hunks)examples/complete/providers.tf(1 hunks)examples/complete/variables.tf(0 hunks)examples/complete/versions.tf(1 hunks)examples/import-existing-org/groups.yaml(1 hunks)examples/import-existing-org/imports.tf(1 hunks)examples/import-existing-org/main.tf(1 hunks)examples/import-existing-org/providers.tf(1 hunks)examples/import-existing-org/users.yaml(1 hunks)examples/import-existing-org/versions.tf(1 hunks)main.tf(1 hunks)outputs.tf(1 hunks)tests/variables_groups.tftest.hcl(1 hunks)tests/variables_users.tftest.hcl(1 hunks)variables.tf(1 hunks)versions.tf(1 hunks)
💤 Files with no reviewable changes (3)
- examples/complete/variables.tf
- CHANGELOG.md
- examples/complete/outputs.tf
🧰 Additional context used
📓 Path-based instructions (1)
`**/*.tf`: You're a Terraform expert who has thoroughly studied all the documentation from Hashicorp https://developer.hashicorp.com/terraform/docs and OpenTofu https://opentofu.or...
**/*.tf: You're a Terraform expert who has thoroughly studied all the documentation from Hashicorp https://developer.hashicorp.com/terraform/docs and OpenTofu https://opentofu.org/docs/.
You have a strong grasp of Terraform syntax and prioritize providing accurate and insightful code suggestions.
As a fan of the Cloud Posse / SweetOps ecosystem, you incorporate many of their best practices https://docs.cloudposse.com/best-practices/terraform/ while balancing them with general Terraform guidelines.
outputs.tfversions.tfexamples/complete/versions.tfexamples/import-existing-org/versions.tfexamples/import-existing-org/main.tfexamples/complete/providers.tfexamples/import-existing-org/providers.tfvariables.tfexamples/complete/main.tfexamples/import-existing-org/imports.tfmain.tf
🔇 Additional comments (24)
.github/renovate.json5 (1)
64-64: No-op change—trailing newline removal only.This update only removes the empty line at the end of the file. There are no functional or configuration changes.
.gitignore (1)
19-20: Verify ignore pattern forlive-provider.tf
Please confirm that your examples include files namedlive-provider.tf. If you meant to ignoreproviders.tfinstead, update this pattern accordingly.versions.tf (1)
5-7: Provider block updated correctly
Switching to thehashicorp/googleworkspaceprovider with>= 0.7.0aligns the root module’s requirements with the new Google Workspace functionality.examples/complete/versions.tf (1)
1-10: Example version constraints look good
Locking to Terraform>= 1.0and provider0.7.0ensures the example is reproducible.examples/import-existing-org/main.tf (1)
10-15: Example module invocation looks good.
Using a relativesource = "../../"for examples and passing the filteredusersandgroupslocals aligns well with the module’s interface.tests/variables_groups.tftest.hcl (4)
1-3: Mock provider configuration is correct
Thegoogleworkspacemock provider alias is properly set up for isolated tests.
9-23: Email success scenario validated
Theemail_successtest correctly verifies that a valid group email passes validation.
49-69: Group settings specific values scenario is solid
The test defines valid settings and expects the plan to succeed, covering key attributes.
72-89: Default settings omission handled
Omitting thesettingsblock and expecting success verifies the default behavior as intended.README.md (4)
3-3: Module title updated
The new module name accurately reflects its purpose in managing Google Workspace users and groups.
11-11: Child‐module description is clear
Explicitly stating this is a Terraform child module helps users understand integration points.
29-47: Provider example is comprehensive
The samplegoogleworkspaceprovider block with scopes and impersonation is well documented and aligns with best practices.
201-206: Badges and links updated
Release badge and contributor links correctly point to the new repository.variables.tf (3)
53-59: Email regex validations look solid
Both primary and group email validations use a robust regex pattern and align with Terraform best practices.Also applies to: 160-165
62-69: Password length validation is appropriate
The conditional allows null passwords or enforces the 8–100 character range when provided.
87-96: Group role validation covers defaults
Uppercasing and allowed values ensure roles conform to Terraform metadata requirements.examples/complete/main.tf (2)
26-33: Example user configuration is clear
The example covers key user attributes and demonstrates nested group definitions effectively.
35-58: Group configuration merging is effective
Usingmerge(local.default_group_settings, {...})showcases how to override defaults cleanly.main.tf (2)
45-53: Verifylifecycle.ignore_changestargets
You ignore changes tolanguages,password,recovery_email,recovery_phone, andsuspended. Double-check whetherlanguagesis ever set or managed by this module—if not, consider removing it to avoid inadvertently ignoring legitimate updates.
112-113: Enforce uppercase for role and type
Usingupper()onroleandtypenormalizes casing for API calls. This is a good practice to ensure consistency with the provider’s expectations.tests/variables_users.tftest.hcl (4)
9-45: Comprehensive email validation test suite
Theemail_successandemail_invalid_missing_at_symbolruns accurately cover both valid and invalid email scenarios against the variable schema. Well done.
52-114: Robust password length and hash function validation
The password-related tests (password_success,password_too_short,password_too_long) effectively validate length constraints. The hash function tests (hash_function_md5_success,hash_function_invalid,hash_function_can_be_null_with_password_set) correctly cover valid, invalid, and null cases. Nice coverage.
187-245: Group membership role validation tests
Thegroups_member_role_successandgroups_member_role_invalidruns properly test the allowed set of group roles. The use ofexpect_failuresfor invalid roles is spot-on.
251-342: Group member type validation tests
The success and failure scenarios for membertypeare well-covered, including defaulting toUSERwhen omitted. Solid validation tests.
westonplatter
changed the title
what
Summary by CodeRabbit
New Features
Documentation
Bug Fixes
Tests
Chores