ci: Add TF configs for SSM #1790

Camila-B · 2025-07-11T22:51:43Z

This PR adds the TF configs that are needed to provision the resources needed to test SSM

google-oss-prow · 2025-07-11T22:51:46Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

google-oss-prow · 2025-07-11T22:51:47Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from camila-b. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

gemini-code-assist

Summary of Changes

Hello @Camila-B, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces the necessary Terraform configurations to provision Google Cloud Secure Source Manager (SSM) resources for end-to-end testing. This includes creating an SSM instance, enabling the required API, and setting up a dedicated service account with appropriate permissions. A significant refactoring of the service account module was also performed to support assigning multiple roles, and the Google Terraform provider was updated to a newer version.

Highlights

Add Secure Source Manager (SSM) Instance: I've added a new google_secure_source_manager_instance resource named ssm-instance to e2e/testinfra/terraform/common/registries.tf. This instance is configured for us-central1 and has prevent_destroy enabled to avoid accidental deletion.
Enable Secure Source Manager API: The securesourcemanager.googleapis.com service has been added to the list of enabled services in e2e/testinfra/terraform/common/services.tf, which is a prerequisite for using SSM.
Refactor Service Account Role Assignment: I've updated the service_account module to allow assigning multiple roles to a service account. This involved changing the role variable type from string to list(string) in e2e/testinfra/terraform/modules/service_account/variables.tf and modifying the google_project_iam_member resource in e2e/testinfra/terraform/modules/service_account/service_account.tf to use for_each to iterate over the list of roles.
Add SSM Reader Service Account: A new service account, e2e-ssm-reader-sa, has been introduced in e2e/testinfra/terraform/common/service_accounts.tf. This service account is granted roles/securesourcemanager.repoReader and roles/securesourcemanager.instanceAccessor to allow reading from SSM repositories.
Update Google Terraform Provider Version: The hashicorp/google Terraform provider version has been upgraded from 4.36.0 to 6.43.0 in e2e/testinfra/terraform/main.tf. This update likely provides compatibility with the new SSM resources and other recent Google Cloud features.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request adds Terraform configurations to support Secure Source Manager (SSM) for e2e tests. This includes adding a new SSM instance, a service account with appropriate permissions, and enabling the necessary GCP service. The changes also refactor the service account module to support multiple IAM roles.

My review has identified a critical issue with an invalid Google provider version that will block Terraform initialization. I've also pointed out a potential issue with a prevent_destroy lifecycle setting that could interfere with test environment cleanup, and a minor formatting inconsistency. Overall, the changes are in the right direction to add SSM support.

gemini-code-assist · 2025-07-11T22:53:34Z

e2e/testinfra/terraform/main.tf

@@ -18,7 +18,7 @@ terraform {
  required_providers {
    google = {
      source = "hashicorp/google"
-      version = "4.36.0"
+      version = "6.43.0"


The specified Google Provider version 6.43.0 is invalid. The hashicorp/google provider does not have a version in the 6.x range, which will cause terraform init to fail.

The google_secure_source_manager_instance resource requires provider version 5.1.0 or newer. Please update this to a valid version. Pinning to a recent, specific version is recommended for stability.

version = "5.30.0"

@gemini-code-assist This is incorrect https://registry.terraform.io/providers/hashicorp/google/latest

Thank you for providing the link, @Camila-B. Upon reviewing the Terraform Registry page you linked (https://registry.terraform.io/providers/hashicorp/google/latest), it confirms that the latest stable version of the hashicorp/google provider is currently in the 5.x series (e.g., 5.30.0 or newer 5.x versions). There is no 6.x release for this provider, which means version = "6.43.0" would indeed lead to a terraform init failure.

To resolve this, please update the version to a valid 5.x release. My previous suggestion of 5.30.0 is a good candidate, or you can choose the absolute latest 5.x version available on the registry for the google_secure_source_manager_instance resource, which requires 5.1.0 or newer.

Suggested change

version = "6.43.0"

version = "5.30.0"

gemini-code-assist · 2025-07-11T22:53:34Z

e2e/testinfra/terraform/common/registries.tf

+    # Prevent accidental deletions.
+    lifecycle {
+      prevent_destroy = "true"
+    }


Using prevent_destroy = true in a test environment is likely to cause issues with automated cleanup, as it will cause terraform destroy to fail. For ephemeral e2e resources, this lifecycle rule should typically be omitted to allow for proper teardown.

If this resource is not meant to be ephemeral, please add a comment explaining why it needs to be preserved. Otherwise, please remove this lifecycle block.

gemini-code-assist · 2025-07-11T22:53:34Z

e2e/testinfra/terraform/common/service_accounts.tf

+  role = ["roles/storage.objectViewer"]
+}
+
+ module "e2e-ssm-reader-sa" {


There's an extra space at the beginning of this line, which is inconsistent with the formatting of other module blocks in this file. Please remove it for consistency. Running terraform fmt should fix this.

module "e2e-ssm-reader-sa" {

sdowell

This change generally LGTM. Ideally I'd like to see the followup test PR ready for review before we merge this

Camila-B · 2025-07-15T21:07:01Z

/hold SGTM

Copilot

Pull Request Overview

This PR adds Terraform configurations to provision resources needed for SSM (Secure Source Manager) testing in the e2e test infrastructure. The changes refactor the service account module to support multiple roles and add the necessary SSM resources and permissions.

Refactored service account module to accept multiple roles instead of a single role
Added SSM API enablement and created dedicated service account with SSM permissions
Updated Google provider version from 4.36.0 to 6.43.0
Added SSM instance resource with lifecycle protection

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
e2e/testinfra/terraform/modules/service_account/variables.tf	Changed `role` variable to `roles` to accept list of strings
e2e/testinfra/terraform/modules/service_account/service_account.tf	Updated IAM binding to iterate over multiple roles using for_each
e2e/testinfra/terraform/main.tf	Upgraded Google provider version to 6.43.0
e2e/testinfra/terraform/common/services.tf	Added securesourcemanager.googleapis.com API
e2e/testinfra/terraform/common/service_accounts.tf	Updated existing service accounts to use roles array and added new SSM service account
e2e/testinfra/terraform/common/registries.tf	Added SSM instance resource with lifecycle protection

Copilot · 2025-07-21T23:25:43Z

e2e/testinfra/terraform/common/registries.tf

+
+    # Prevent accidental deletions.
+    lifecycle {
+      prevent_destroy = "true"


The prevent_destroy value should be a boolean (true) rather than a string ("true"). Terraform lifecycle prevent_destroy expects a boolean value.

Suggested change

prevent_destroy = "true"

prevent_destroy = true

google-oss-prow bot added the do-not-merge/work-in-progress label Jul 11, 2025

google-oss-prow bot requested review from mikebz and tiffanny29631 July 11, 2025 22:51

Camila-B removed the request for review from mikebz July 11, 2025 22:51

google-oss-prow bot added the size/M label Jul 11, 2025

Camila-B removed the request for review from tiffanny29631 July 11, 2025 22:52

gemini-code-assist bot reviewed Jul 11, 2025

View reviewed changes

Camila-B added 2 commits July 14, 2025 04:44

test: Add TF configs for SSM

a132b18

test: rename SA role variable to roles

699ea7a

Camila-B force-pushed the feat/ssm-validation-tf branch from 0d62dd9 to 699ea7a Compare July 14, 2025 04:53

Camila-B mentioned this pull request Jul 14, 2025

[WIP] test: add SSM as gitprovider #1768

Draft

Camila-B changed the title ~~[WIP] test: Add TF configs for SSM~~ [WIP] ci: Add TF configs for SSM Jul 14, 2025

Camila-B marked this pull request as ready for review July 14, 2025 17:47

google-oss-prow bot requested review from mikebz and tiffanny29631 July 14, 2025 17:47

Camila-B requested review from sdowell and removed request for mikebz July 14, 2025 17:47

Camila-B changed the title ~~[WIP] ci: Add TF configs for SSM~~ ci: Add TF configs for SSM Jul 14, 2025

google-oss-prow bot removed the do-not-merge/work-in-progress label Jul 14, 2025

sdowell reviewed Jul 15, 2025

View reviewed changes

google-oss-prow bot added the do-not-merge/hold label Jul 15, 2025

mikebz requested a review from Copilot July 21, 2025 23:25

Copilot AI reviewed Jul 21, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ci: Add TF configs for SSM #1790

ci: Add TF configs for SSM #1790

Camila-B commented Jul 11, 2025 •

edited

Loading

Uh oh!

google-oss-prow bot commented Jul 11, 2025

Uh oh!

google-oss-prow bot commented Jul 11, 2025

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Jul 11, 2025

Uh oh!

Camila-B Jul 14, 2025

Uh oh!

gemini-code-assist bot Jul 14, 2025

Uh oh!

gemini-code-assist bot Jul 11, 2025

Uh oh!

gemini-code-assist bot Jul 11, 2025

Uh oh!

sdowell left a comment

Uh oh!

Camila-B commented Jul 15, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jul 21, 2025

Uh oh!

Uh oh!

ci: Add TF configs for SSM #1790

Are you sure you want to change the base?

ci: Add TF configs for SSM #1790

Conversation

Camila-B commented Jul 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

google-oss-prow bot commented Jul 11, 2025

Uh oh!

google-oss-prow bot commented Jul 11, 2025

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Jul 11, 2025

Choose a reason for hiding this comment

Uh oh!

Camila-B Jul 14, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jul 14, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jul 11, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jul 11, 2025

Choose a reason for hiding this comment

Uh oh!

sdowell left a comment

Choose a reason for hiding this comment

Uh oh!

Camila-B commented Jul 15, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Jul 21, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Camila-B commented Jul 11, 2025 •

edited

Loading