Skip to content

cloudidentity: fix post-test destruction errors for Group and GroupMembership - #18792

Open
SirGitsalot wants to merge 3 commits into
GoogleCloudPlatform:mainfrom
SirGitsalot:fix-cloudidentity-group
Open

cloudidentity: fix post-test destruction errors for Group and GroupMembership#18792
SirGitsalot wants to merge 3 commits into
GoogleCloudPlatform:mainfrom
SirGitsalot:fix-cloudidentity-group

Conversation

@SirGitsalot

@SirGitsalot SirGitsalot commented Aug 25, 2026

Copy link
Copy Markdown
Member

Fixes nightly acceptance test failures for Cloud Identity Group test cases:

  • TestAccCloudIdentityGroup/update
  • TestAccCloudIdentityGroup/membership_dne

Root Cause & Fix

  1. Cloud Identity Group Membership 403 on Deletion/Teardown:
    When deleting a google_cloud_identity_group_membership that no longer exists (e.g. during post-test destroy or cleanup), Cloud Identity returns googleapi: Error 403: Error(2028): Permission denied for resource ... (or it may not exist).
    Because Terraform standard deletion expects a 404 for nonexistent resources, the 403 error caused destroy operations to fail.
    This change adds a custom_delete template in mmv1/templates/terraform/custom_delete/cloud_identity_group_membership.go.tmpl that applies the existing transformCloudIdentityGroupMembershipReadError helper during deletion, properly converting the ambiguous 403 to a 404 so HandleNotFoundError treats the resource as removed.

  2. Cloud Identity Group 409 Aborted on Deletion:
    When deleting a google_cloud_identity_group, concurrent updates or backend state transitions can cause the API to return googleapi: Error 409: The operation was aborted. before async polling begins.
    This change introduces IsCloudIdentityGroup409 in mmv1/third_party/terraform/transport/error_retry_predicates.go and attaches it to error_retry_predicates in mmv1/products/cloudidentity/Group.yaml to retry transient 409 abort errors during deletion.

@modular-magician

modular-magician commented Aug 25, 2026

Copy link
Copy Markdown
Collaborator

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 4911c70:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository Diff Link Changes
google provider View Diff 3 files changed, 63 insertions(+), 36 deletions(-)
google-beta provider View Diff 3 files changed, 63 insertions(+), 36 deletions(-)
terraform-google-conversion View Diff 1 file changed, 9 insertions(+)

Errors

google provider:

  • The diff processor failed to build. This is usually due to the downstream provider failing to compile.

google-beta provider:

  • The diff processor failed to build. This is usually due to the downstream provider failing to compile.

Step 1: Replaying Mode

Caution

Build Failure during VCR tests

🔴 REPLAYING mode: The following packages failed to build:

  • accessapproval
  • accesscontextmanager
  • acctest
  • activedirectory
  • agenticapplications
  • agentidentity
  • agentregistry
  • alloydb
  • allservices
  • apigateway
  • apigee
  • apihub
  • apikeys
  • appengine
  • apphub
  • artifactregistry
  • assuredworkloads
  • backupdr
  • beyondcorp
  • biglake
  • biglakehive
  • biglakeiceberg
  • bigquery
  • bigqueryanalyticshub
  • bigqueryconnection
  • bigquerydatapolicy
  • bigquerydatapolicyv2
  • bigquerydatatransfer
  • bigqueryreservation
  • bigtable
  • billingbudgets
  • binaryauthorization
  • blockchainnodeengine
  • certificatemanager
  • ces
  • chronicle
  • cloudasset
  • cloudbilling
  • cloudbuild
  • cloudbuildv2
  • clouddeploy
  • cloudfunctions
  • cloudfunctions2
  • cloudidentity
  • cloudids
  • cloudquotas
  • cloudrun
  • cloudrunv2
  • cloudscheduler
  • cloudsecuritycompliance
  • cloudsupport
  • cloudtasks
  • colab
  • composer
  • compute
  • config
  • contactcenterinsights
  • container
  • containeranalysis
  • containerattached
  • containeraws
  • containerazure
  • databasemigrationservice
  • datacatalog
  • dataflow
  • dataform
  • datafusion
  • datalineage
  • datalossprevention
  • datapipeline
  • dataplex
  • dataproc
  • dataprocgdc
  • dataprocmetastore
  • datastream
  • deploymentmanager
  • developerconnect
  • dialogflow
  • dialogflowcx
  • discoveryengine
  • dns
  • documentai
  • documentaiwarehouse
  • essentialcontacts
  • eventarc
  • filestore
  • firebase
  • firebaseailogic
  • firebaseappcheck
  • firebaseapphosting
  • firebasedatabase
  • firebasedataconnect
  • firebaseextensions
  • firebasehosting
  • firebaseremoteconfig
  • firebaserules
  • firebasestorage
  • firestore
  • functions
  • fwprovider
  • fwvalidators
  • gemini
  • gkebackup
  • gkehub
  • gkehub2
  • gkeonprem
  • healthcare
  • hypercomputecluster
  • iam2
  • iam3
  • iambeta
  • iamworkforcepool
  • iap
  • identityplatform
  • integrationconnectors
  • integrations
  • kms
  • licensemanager
  • logging
  • looker
  • lustre
  • managedkafka
  • memcache
  • memorystore
  • migrationcenter
  • modelarmor
  • modelarmorglobal
  • monitoring
  • netapp
  • networkconnectivity
  • networkconnectivityv1
  • networkmanagement
  • networksecurity
  • networkservices
  • observability
  • oracledatabase
  • orgpolicy
  • osconfig
  • osconfigv2
  • oslogin
  • parallelstore
  • parametermanager
  • parametermanagerregional
  • privateca
  • privilegedaccessmanager
  • provider
  • publicca
  • pubsub
  • pubsublite
  • recaptchaenterprise
  • redis
  • resourcemanager
  • resourcemanagerv3
  • runtimeconfig
  • saasruntime
  • secretmanager
  • secretmanagerregional
  • securesourcemanager
  • securitycenter
  • securitycentermanagement
  • securitycenterv2
  • securityposture
  • securityscanner
  • servicedirectory
  • servicemanagement
  • servicenetworking
  • serviceusage
  • siteverification
  • sourcerepo
  • spanner
  • sql
  • storage
  • storagebatchoperations
  • storagecontrol
  • storageinsights
  • storagetransfer
  • sweeper
  • tags
  • terraform-provider-google-beta
  • tpuv2
  • transcoder
  • transport
  • universe
  • vectorsearch
  • vertexai
  • vertexaiaad
  • vmwareengine
  • vpcaccess
  • workbench
  • workflows
  • workloadidentity
  • workstations

Please fix the compilation errors to complete your PR.

View the build log

@SirGitsalot VCR tests complete for 4911c70!

@@ -0,0 +1,46 @@
if d.Get("deletion_policy").(string) == "PREVENT" {

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In mmv1/templates/terraform/resource.go.tmpl (lines 1294–1310), deletion_policy checks, config := meta.(*transport_tpg.Config), and userAgent, err := tpgresource.GenerateUserAgentString(...) are already rendered immediately before custom_delete is inserted.

Including lines 1–12 here causes config, userAgent, and err to be redeclared with := in the generated Go resource delete method, resulting in downstream provider compilation errors (config redeclared in this block, userAgent redeclared in this block, err redeclared in this block).

Please remove the preamble and start directly from billingProject := "":

Suggested change
if d.Get("deletion_policy").(string) == "PREVENT" {
billingProject := ""
url, err := tpgresource.ReplaceVars(d, config, transport_tpg.BaseUrl(Product, config)+"{{ "{{" }}name{{ "}}" }}")
if err != nil {
return err
}
var obj map[string]interface{}
// err == nil indicates that the billing_project value was found
if bp, err := tpgresource.GetBillingProject(d, config); err == nil {
billingProject = bp
}
headers := make(http.Header)
log.Printf("[DEBUG] Deleting GroupMembership %q", d.Id())
res, err := transport_tpg.SendRequest(transport_tpg.SendRequestOptions{
Config: config,
Method: "DELETE",
Project: billingProject,
RawURL: url,
UserAgent: userAgent,
Body: obj,
Timeout: d.Timeout(schema.TimeoutDelete),
Headers: headers,
})
if err != nil {
return transport_tpg.HandleNotFoundError(transformCloudIdentityGroupMembershipReadError(err), d, "GroupMembership")
}
log.Printf("[DEBUG] Finished deleting GroupMembership %q: %#v", d.Id(), res)
return nil

Comment thread mmv1/third_party/terraform/transport/error_retry_predicates.go Outdated
@SirGitsalot
SirGitsalot force-pushed the fix-cloudidentity-group branch from 4911c70 to 93dea1d Compare August 25, 2026 23:54
@modular-magician

modular-magician commented Aug 26, 2026

Copy link
Copy Markdown
Collaborator

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 93dea1d:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository Diff Link Changes
google provider View Diff 3 files changed, 50 insertions(+), 36 deletions(-)
google-beta provider View Diff 3 files changed, 50 insertions(+), 36 deletions(-)
terraform-google-conversion View Diff 1 file changed, 9 insertions(+)

Test report

Analytics

Total Tests Passed Skipped Affected
6912 6213 689 10
Affected Service Packages
  • All service packages are affected

Learn how VCR tests work


Step 1: Replaying Mode

Action taken

Found 10 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests
  • TestAccComputeInstanceFromMachineImage_diffProject
  • TestAccComputeSecurityPolicy_withPreconfiguredWafConfig
  • TestAccDataprocMetastoreService_dataprocMetastoreServicePrivateServiceConnectExample
  • TestAccDiscoveryEngineDataStore_discoveryengineDatastoreKmsKeyNameExample
  • TestAccManagedKafkaConnector_managedkafkaConnectorBasicExample
  • TestAccMonitoringUptimeCheckConfig_update_wo
  • TestAccMonitoringUptimeCheckConfig_uptimeCheckConfigHttpPasswordWoExample
  • TestAccOracleDatabaseDbServers_basic
  • TestAccPubsubSubscription_pubsubSubscriptionTagsExample
  • TestAccVertexAIFeatureOnlineStoreFeatureview_vertexAiFeatureonlinestoreFeatureview_featureRegistry_updated

View the replaying VCR build log


Step 2: Recording Mode

Recording Mode Replaying Rerun Test Name
✅ Log TestAccMonitoringUptimeCheckConfig_update_wo
✅ Log TestAccMonitoringUptimeCheckConfig_uptimeCheckConfigHttpPasswordWoExample
❌ Error · Log - TestAccComputeInstanceFromMachineImage_diffProject
❌ Error · Log - TestAccComputeSecurityPolicy_withPreconfiguredWafConfig
❌ Error · Log - TestAccDataprocMetastoreService_dataprocMetastoreServicePrivateServiceConnectExample
❌ Error · Log - TestAccDiscoveryEngineDataStore_discoveryengineDatastoreKmsKeyNameExample
❌ Error · Log - TestAccManagedKafkaConnector_managedkafkaConnectorBasicExample
❌ Error · Log - TestAccOracleDatabaseDbServers_basic
❌ Error · Log - TestAccPubsubSubscription_pubsubSubscriptionTagsExample
❌ Error · Log - TestAccVertexAIFeatureOnlineStoreFeatureview_vertexAiFeatureonlinestoreFeatureview_featureRegistry_updated

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the recording VCR build log or the debug logs folder for detailed results.

@SirGitsalot VCR tests complete for 93dea1d!

@modular-magician

modular-magician commented Aug 26, 2026

Copy link
Copy Markdown
Collaborator

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit f6d2653:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository Diff Link Changes
google provider View Diff 3 files changed, 52 insertions(+), 50 deletions(-)
google-beta provider View Diff 3 files changed, 50 insertions(+), 36 deletions(-)
terraform-google-conversion View Diff 1 file changed, 9 insertions(+)

Errors

google provider:

  • The diff processor failed to build. This is usually due to the downstream provider failing to compile.

Test report

Analytics

Total Tests Passed Skipped Affected
6912 6208 692 12
Affected Service Packages
  • All service packages are affected

Learn how VCR tests work


Step 1: Replaying Mode

Action taken

Found 12 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests
  • TestAccCESApp_update
  • TestAccComputeInstanceFromMachineImage_diffProject
  • TestAccComputeSecurityPolicy_withPreconfiguredWafConfig
  • TestAccDataprocMetastoreService_dataprocMetastoreServicePrivateServiceConnectExample
  • TestAccDiscoveryEngineDataStore_discoveryengineDatastoreKmsKeyNameExample
  • TestAccManagedKafkaConnector_managedkafkaConnectorBasicExample
  • TestAccMonitoringUptimeCheckConfig_update_wo
  • TestAccMonitoringUptimeCheckConfig_uptimeCheckConfigHttpPasswordWoExample
  • TestAccOracleDatabaseDbServers_basic
  • TestAccPubsubSubscription_pubsubSubscriptionTagsExample
  • TestAccVertexAIFeatureOnlineStoreFeatureview_vertexAiFeatureonlinestoreFeatureview_featureRegistry_updated
  • TestAccVertexAISemanticGovernancePolicyEngine_basic

View the replaying VCR build log


Step 2: Recording Mode

Recording Mode Replaying Rerun Test Name
✅ Log TestAccCESApp_update
✅ Log TestAccMonitoringUptimeCheckConfig_update_wo
✅ Log TestAccMonitoringUptimeCheckConfig_uptimeCheckConfigHttpPasswordWoExample
❌ Error · Log - TestAccComputeInstanceFromMachineImage_diffProject
❌ Error · Log - TestAccComputeSecurityPolicy_withPreconfiguredWafConfig
❌ Error · Log - TestAccDataprocMetastoreService_dataprocMetastoreServicePrivateServiceConnectExample
❌ Error · Log - TestAccDiscoveryEngineDataStore_discoveryengineDatastoreKmsKeyNameExample
❌ Error · Log - TestAccManagedKafkaConnector_managedkafkaConnectorBasicExample
❌ Error · Log - TestAccOracleDatabaseDbServers_basic
❌ Error · Log - TestAccPubsubSubscription_pubsubSubscriptionTagsExample
❌ Error · Log - TestAccVertexAIFeatureOnlineStoreFeatureview_vertexAiFeatureonlinestoreFeatureview_featureRegistry_updated
❌ Error · Log - TestAccVertexAISemanticGovernancePolicyEngine_basic

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the recording VCR build log or the debug logs folder for detailed results.

@SirGitsalot VCR tests complete for f6d2653!

@modular-magician

modular-magician commented Aug 26, 2026

Copy link
Copy Markdown
Collaborator

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit f36f620:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository Diff Link Changes
google provider View Diff 3 files changed, 50 insertions(+), 36 deletions(-)
google-beta provider View Diff 3 files changed, 50 insertions(+), 36 deletions(-)
terraform-google-conversion View Diff 1 file changed, 9 insertions(+)

Test report

Analytics

Total Tests Passed Skipped Affected
6912 6207 692 13
Affected Service Packages
  • All service packages are affected

Learn how VCR tests work


Step 1: Replaying Mode

Action taken

Found 13 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests
  • TestAccCESApp_update
  • TestAccComputeInstanceFromMachineImage_diffProject
  • TestAccComputeRouterPeer_AddMd5AuthenticationKey
  • TestAccComputeSecurityPolicy_withPreconfiguredWafConfig
  • TestAccDataprocMetastoreService_dataprocMetastoreServicePrivateServiceConnectExample
  • TestAccDiscoveryEngineDataStore_discoveryengineDatastoreKmsKeyNameExample
  • TestAccManagedKafkaConnector_managedkafkaConnectorBasicExample
  • TestAccMonitoringUptimeCheckConfig_update_wo
  • TestAccMonitoringUptimeCheckConfig_uptimeCheckConfigHttpPasswordWoExample
  • TestAccOracleDatabaseDbServers_basic
  • TestAccPubsubSubscription_pubsubSubscriptionTagsExample
  • TestAccVertexAIFeatureOnlineStoreFeatureview_vertexAiFeatureonlinestoreFeatureview_featureRegistry_updated
  • TestAccVertexAISemanticGovernancePolicyEngine_basic

View the replaying VCR build log


Step 2: Recording Mode

Recording Mode Replaying Rerun Test Name
✅ Log TestAccCESApp_update
✅ Log TestAccComputeRouterPeer_AddMd5AuthenticationKey
✅ Log TestAccMonitoringUptimeCheckConfig_update_wo
✅ Log TestAccMonitoringUptimeCheckConfig_uptimeCheckConfigHttpPasswordWoExample
✅ Log TestAccVertexAISemanticGovernancePolicyEngine_basic
❌ Error · Log - TestAccComputeInstanceFromMachineImage_diffProject
❌ Error · Log - TestAccComputeSecurityPolicy_withPreconfiguredWafConfig
❌ Error · Log - TestAccDataprocMetastoreService_dataprocMetastoreServicePrivateServiceConnectExample
❌ Error · Log - TestAccDiscoveryEngineDataStore_discoveryengineDatastoreKmsKeyNameExample
❌ Error · Log - TestAccManagedKafkaConnector_managedkafkaConnectorBasicExample
❌ Error · Log - TestAccOracleDatabaseDbServers_basic
❌ Error · Log - TestAccPubsubSubscription_pubsubSubscriptionTagsExample
❌ Error · Log - TestAccVertexAIFeatureOnlineStoreFeatureview_vertexAiFeatureonlinestoreFeatureview_featureRegistry_updated

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the recording VCR build log or the debug logs folder for detailed results.

@SirGitsalot VCR tests complete for f36f620!

@SirGitsalot
SirGitsalot marked this pull request as ready for review August 26, 2026 14:57
@SirGitsalot

Copy link
Copy Markdown
Member Author

@modular-magician reassign-reviewer

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants