Add support for the custom project variable set permission #1565

mkam · 2025-01-14T18:31:27Z

Description

This PR adds variable_sets to the project_access of tfe_team_project_access, allowing users to set the project variable set permission of a team when access is set to custom.

This feature has not been released to GA yet, so I've labeled it as do not merge for now.

Remember to:

Update the Change Log
Update the Documentation

Testing plan

Create a team and a project.
Assign the team custom access and set variable_sets.
Get the team project access as a data source and output it.
Validate for the expected outputted value for variable_sets
Validate in the UI or API that variable_sets is set to the expected value.

resource "tfe_project" "test" {
  name         = "TeamProjectVarSetProvider"
  organization = data.tfe_organization.test.name
}


resource "tfe_team" "custom" {
  name         = "custom-project-varset-permission-provider-team"
  organization = data.tfe_organization.test.name
}

resource "tfe_team_project_access" "custom" {
  access     = "custom"
  team_id    = tfe_team.custom.id
  project_id = tfe_project.test.id

  project_access {
    variable_sets = "write"
  }
}

data "tfe_team_project_access" "custom" {
  team_id    = tfe_team.custom.id
  project_id = tfe_project.test.id
  depends_on = [ tfe_team_project_access.custom ]
}

output "custom_team_project_access" {
  value = data.tfe_team_project_access.custom
  depends_on = [ data.tfe_team_project_access.custom ]
}

Setting the new permission

-> % terraform apply
╷
│ Warning: Provider development overrides are in effect
│
│ The following provider development overrides are set in the CLI configuration:
│  - hashicorp/tfe in /Users/mkam/hashicorp/terraform-provider-tfe
│
│ The behavior may therefore not match any released version of the provider and applying changes may cause the state to become incompatible with published releases.
╵
data.tfe_organization.test: Reading...
data.tfe_organization.test: Read complete after 0s [id=org-uXyx3dqZekFuhw4B]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create
 <= read (data resources)

Terraform will perform the following actions:

  # data.tfe_team_project_access.custom will be read during apply
  # (config refers to values not yet known)
 <= data "tfe_team_project_access" "custom" {
      + access           = (known after apply)
      + id               = (known after apply)
      + project_access   = (known after apply)
      + project_id       = (known after apply)
      + team_id          = (known after apply)
      + workspace_access = (known after apply)
    }

  # tfe_project.test will be created
  + resource "tfe_project" "test" {
      + id           = (known after apply)
      + name         = "TeamProjectVarSetProvider"
      + organization = "hashicorp"
    }

  # tfe_team.custom will be created
  + resource "tfe_team" "custom" {
      + allow_member_token_management = true
      + id                            = (known after apply)
      + name                          = "custom-project-varset-permission-provider-team"
      + organization                  = "hashicorp"
      + visibility                    = (known after apply)

      + organization_access {
          + access_secret_teams        = (known after apply)
          + manage_agent_pools         = (known after apply)
          + manage_membership          = (known after apply)
          + manage_modules             = (known after apply)
          + manage_organization_access = (known after apply)
          + manage_policies            = (known after apply)
          + manage_policy_overrides    = (known after apply)
          + manage_projects            = (known after apply)
          + manage_providers           = (known after apply)
          + manage_run_tasks           = (known after apply)
          + manage_teams               = (known after apply)
          + manage_vcs_settings        = (known after apply)
          + manage_workspaces          = (known after apply)
          + read_projects              = (known after apply)
          + read_workspaces            = (known after apply)
        }
    }

  # tfe_team_project_access.custom will be created
  + resource "tfe_team_project_access" "custom" {
      + access     = "custom"
      + id         = (known after apply)
      + project_id = (known after apply)
      + team_id    = (known after apply)

      + project_access {
          + settings      = (known after apply)
          + teams         = (known after apply)
          + variable_sets = "write"
        }

      + workspace_access {
          + create         = (known after apply)
          + delete         = (known after apply)
          + locking        = (known after apply)
          + move           = (known after apply)
          + run_tasks      = (known after apply)
          + runs           = (known after apply)
          + sentinel_mocks = (known after apply)
          + state_versions = (known after apply)
          + variables      = (known after apply)
        }
    }

Plan: 3 to add, 0 to change, 0 to destroy.

Changes to Outputs:
  + custom_team_project_access = {
      + access           = (known after apply)
      + id               = (known after apply)
      + project_access   = (known after apply)
      + project_id       = (known after apply)
      + team_id          = (known after apply)
      + workspace_access = (known after apply)
    }

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

tfe_project.test: Creating...
tfe_team.custom: Creating...
tfe_team.custom: Creation complete after 1s [id=team-UuMJNXYL9nyYzHgL]
tfe_project.test: Creation complete after 1s [id=prj-QBh7ydm2j6JVRkGD]
tfe_team_project_access.custom: Creating...
tfe_team_project_access.custom: Creation complete after 1s [id=tprj-U9kKxuebyxkuNtwA]
data.tfe_team_project_access.custom: Reading...
data.tfe_team_project_access.custom: Read complete after 0s [id=tprj-U9kKxuebyxkuNtwA]

Apply complete! Resources: 3 added, 0 changed, 0 destroyed.

Outputs:

custom_team_project_access = {
  "access" = "custom"
  "id" = "tprj-U9kKxuebyxkuNtwA"
  "project_access" = tolist([
    {
      "settings" = "read"
      "teams" = "none"
      "variable_sets" = "write"
    },
  ])
  "project_id" = "prj-QBh7ydm2j6JVRkGD"
  "team_id" = "team-UuMJNXYL9nyYzHgL"
  "workspace_access" = tolist([
    {
      "create" = false
      "delete" = false
      "locking" = false
      "move" = false
      "run_tasks" = false
      "runs" = "read"
      "sentinel_mocks" = "none"
      "state_versions" = "none"
      "variables" = "none"
    },
  ])
}

Output from acceptance tests

-> % ENABLE_BETA=1 TESTARGS="-run TestAccTFETeamProject" make testacc
TF_ACC=1 TF_LOG_SDK_PROTO=OFF go test $(go list ./... |grep -v 'vendor') -v -run TestAccTFETeamProject -timeout 15m
?   	github.com/hashicorp/terraform-provider-tfe	[no test files]
testing: warning: no tests to run
PASS
ok  	github.com/hashicorp/terraform-provider-tfe/internal/client	(cached) [no tests to run]
testing: warning: no tests to run
PASS
ok  	github.com/hashicorp/terraform-provider-tfe/internal/logging	(cached) [no tests to run]
?   	github.com/hashicorp/terraform-provider-tfe/internal/provider/validators	[no test files]
?   	github.com/hashicorp/terraform-provider-tfe/version	[no test files]
=== RUN   TestAccTFETeamProjectAccessDataSource_basic
2025/01/14 14:03:09 [DEBUG] Configuring client for host "tfcdev-ac1517e2.ngrok.app"
2025/01/14 14:03:09 [DEBUG] Service discovery for tfcdev-ac1517e2.ngrok.app at https://tfcdev-ac1517e2.ngrok.app/.well-known/terraform.json
--- PASS: TestAccTFETeamProjectAccessDataSource_basic (9.38s)
=== RUN   TestAccTFETeamProjectCustomAccessDataSource_basic
--- PASS: TestAccTFETeamProjectCustomAccessDataSource_basic (8.35s)
=== RUN   TestAccTFETeamProjectCustomAccessDataSource_basic_with_project_variable_sets
--- PASS: TestAccTFETeamProjectCustomAccessDataSource_basic_with_project_variable_sets (8.27s)
=== RUN   TestAccTFETeamProjectAccess
--- PASS: TestAccTFETeamProjectAccess (24.48s)
=== RUN   TestAccTFETeamProjectCustomAccess
--- PASS: TestAccTFETeamProjectCustomAccess (6.38s)
=== RUN   TestAccTFETeamProjectCustomAccess_with_project_variable_sets
--- PASS: TestAccTFETeamProjectCustomAccess_with_project_variable_sets (6.32s)
=== RUN   TestAccTFETeamProjectAccess_import
--- PASS: TestAccTFETeamProjectAccess_import (6.46s)
=== RUN   TestAccTFETeamProjectCustomAccess_import
--- PASS: TestAccTFETeamProjectCustomAccess_import (6.55s)
=== RUN   TestAccTFETeamProjectCustomAccess_import_with_project_variable_set
--- PASS: TestAccTFETeamProjectCustomAccess_import_with_project_variable_set (6.58s)
=== RUN   TestAccTFETeamProjectCustomAccess_full_update
--- PASS: TestAccTFETeamProjectCustomAccess_full_update (9.26s)
=== RUN   TestAccTFETeamProjectCustomAccess_full_update_with_project_variable_sets
--- PASS: TestAccTFETeamProjectCustomAccess_full_update_with_project_variable_sets (9.28s)
=== RUN   TestAccTFETeamProjectCustomAccess_partial_update
--- PASS: TestAccTFETeamProjectCustomAccess_partial_update (8.85s)
=== RUN   TestAccTFETeamProjectCustomAccess_partial_update_with_project_variable_sets
--- PASS: TestAccTFETeamProjectCustomAccess_partial_update_with_project_variable_sets (9.65s)
=== RUN   TestAccTFETeamProjectCustomAccess_invalid_custom_access
--- PASS: TestAccTFETeamProjectCustomAccess_invalid_custom_access (0.27s)
PASS
ok  	github.com/hashicorp/terraform-provider-tfe/internal/provider	120.786s

Output from Documentation Preview

The doc-preview tool doesn't seem to support markdown tables, which is why the formatting looks off here.

mkam · 2025-01-21T17:14:19Z

internal/provider/resource_tfe_team_project_access_test.go

@@ -26,7 +25,7 @@ func TestAccTFETeamProjectAccess(t *testing.T) {
 			CheckDestroy: testAccCheckTFETeamProjectAccessDestroy,
 			Steps: []resource.TestStep{
 				{
-					Config: testAccTFETeamProjectAccess(rInt, access),
+					Config: testAccTFETeamProjectAccess(rand.New(rand.NewSource(time.Now().UnixNano())).Int(), access),


I made this change because it otherwise wasn't passing for me locally. It would fail because the organization name (which is based on this random integer) already exists from the previous test case run.

Not sure why it was failing locally but not in CI, though! The change seemed simple enough that I didn't bother digging any further.

Weird, seems like the cleanup call has time to finish in CI but not locally. In any case this change is fine with me.

mkam · 2025-01-21T17:17:19Z

internal/provider/resource_tfe_stack.go

@@ -157,7 +157,7 @@ func (r *resourceTFEStack) Create(ctx context.Context, req resource.CreateReques

 	options := tfe.StackCreateOptions{
 		Name: plan.Name.ValueString(),
-		VCSRepo: &tfe.StackVCSRepo{
+		VCSRepo: &tfe.StackVCSRepoOptions{


This change was required as part of updating go-tfe to 1.74.0.

Maed223

Changes are looking good! Feel free to merge when GA

hs26gill · 2025-01-23T17:13:04Z

internal/provider/data_source_team_project_access_test.go

+  workspace_access {
+    state_versions = "write"
+    sentinel_mocks = "read"
+		runs					 = "apply"


nit: spacing

hs26gill

Looking good!

mkam · 2025-01-23T17:59:23Z

Rebased to fix merge conflict with changelog and fixed a few spacing/formatting issues while I was at it. No changes otherwise.

jbonhag

Tested it out locally, works great! 👍

mkam · 2025-02-04T20:36:16Z

Rebased to fix merge conflicts with go.mod and the changelog. No changes otherwise.

brandonc

👍

mkam added the DO NOT MERGE label Jan 14, 2025

mkam force-pushed the mkam/TF-22971/team-project-access-variable-sets branch 3 times, most recently from f8200e2 to 7d32e18 Compare January 14, 2025 20:07

mkam requested a review from a team January 14, 2025 20:39

mkam marked this pull request as ready for review January 14, 2025 20:40

mkam requested a review from a team as a code owner January 14, 2025 20:40

mkam force-pushed the mkam/TF-22971/team-project-access-variable-sets branch from 7d32e18 to c484634 Compare January 16, 2025 15:59

mkam commented Jan 21, 2025

View reviewed changes

Maed223 previously approved these changes Jan 21, 2025

View reviewed changes

netramali previously approved these changes Jan 23, 2025

View reviewed changes

hs26gill reviewed Jan 23, 2025

View reviewed changes

hs26gill previously approved these changes Jan 23, 2025

View reviewed changes

mkam dismissed stale reviews from hs26gill, netramali, and Maed223 via c722cb2 January 23, 2025 17:58

mkam force-pushed the mkam/TF-22971/team-project-access-variable-sets branch from c484634 to c722cb2 Compare January 23, 2025 17:58

jbonhag previously approved these changes Jan 23, 2025

View reviewed changes

mkam added 4 commits February 4, 2025 14:31

Add variable sets to team project access

00b84a5

Update documentation for project varset permission

0f3b9c6

Use a different org name for each test case

644fbee

Add changelog entry

14a92c6

mkam dismissed jbonhag’s stale review via 14a92c6 February 4, 2025 20:35

mkam force-pushed the mkam/TF-22971/team-project-access-variable-sets branch from c722cb2 to 14a92c6 Compare February 4, 2025 20:35

mkam requested review from Maed223, netramali and jbonhag February 4, 2025 21:56

mkam requested a review from hs26gill February 5, 2025 18:42

mkam removed the DO NOT MERGE label Feb 5, 2025

netramali approved these changes Feb 5, 2025

View reviewed changes

brandonc approved these changes Feb 5, 2025

View reviewed changes

mkam merged commit b6a2998 into main Feb 5, 2025
5 checks passed

mkam deleted the mkam/TF-22971/team-project-access-variable-sets branch February 5, 2025 19:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for the custom project variable set permission #1565

Add support for the custom project variable set permission #1565

mkam commented Jan 14, 2025 •

edited

Loading

mkam Jan 21, 2025 •

edited

Loading

Maed223 Jan 21, 2025

mkam Jan 21, 2025

Maed223 left a comment

hs26gill Jan 23, 2025

hs26gill left a comment

mkam commented Jan 23, 2025

jbonhag left a comment

mkam commented Feb 4, 2025

brandonc left a comment

Add support for the custom project variable set permission #1565

Add support for the custom project variable set permission #1565

Conversation

mkam commented Jan 14, 2025 • edited Loading

Description

Testing plan

Output from acceptance tests

Output from Documentation Preview

mkam Jan 21, 2025 • edited Loading

Choose a reason for hiding this comment

Maed223 Jan 21, 2025

Choose a reason for hiding this comment

mkam Jan 21, 2025

Choose a reason for hiding this comment

Maed223 left a comment

Choose a reason for hiding this comment

hs26gill Jan 23, 2025

Choose a reason for hiding this comment

hs26gill left a comment

Choose a reason for hiding this comment

mkam commented Jan 23, 2025

jbonhag left a comment

Choose a reason for hiding this comment

mkam commented Feb 4, 2025

brandonc left a comment

Choose a reason for hiding this comment

mkam commented Jan 14, 2025 •

edited

Loading

mkam Jan 21, 2025 •

edited

Loading