Add support for legacyAbac to google_container_cluster

google/resource_container_cluster.go

@@ -149,6 +149,21 @@ func resourceContainerCluster() *schema.Resource {
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
 
+			"legacy_abac": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"enabled": {
+							Type:     schema.TypeBool,
+							Required: true,
+						},
+					},
+				},
+			},
+
 			"logging_service": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -409,6 +424,12 @@ func resourceContainerClusterCreate(d *schema.ResourceData, meta interface{}) er
 		cluster.Description = v.(string)
 	}
 
+	if _, ok := d.GetOk("legacy_abac"); ok {
+		cluster.LegacyAbac = &container.LegacyAbac{
+			Enabled: d.Get("legacy_abac.0.enabled").(bool),
+		}
+	}
+
 	if v, ok := d.GetOk("logging_service"); ok {
 		cluster.LoggingService = v.(string)
 	}
@@ -610,6 +631,7 @@ func resourceContainerClusterRead(d *schema.ResourceData, meta interface{}) erro
 	d.Set("node_version", cluster.CurrentNodeVersion)
 	d.Set("cluster_ipv4_cidr", cluster.ClusterIpv4Cidr)
 	d.Set("description", cluster.Description)
+	d.Set("legacy_abac", flattenLegacyAbac(cluster))
 	d.Set("logging_service", cluster.LoggingService)
 	d.Set("monitoring_service", cluster.MonitoringService)
 	d.Set("network", d.Get("network").(string))
@@ -692,6 +714,29 @@ func resourceContainerClusterUpdate(d *schema.ResourceData, meta interface{}) er
 
 		log.Printf("[INFO] GKE cluster %s locations have been updated to %v", d.Id(),
 			locations)
+
+		d.SetPartial("additional_zones")
+	}
+
+	if d.HasChange("legacy_abac.0.enabled") {
+		enabled := d.Get("legacy_abac.0.enabled").(bool)
+		req := &container.SetLegacyAbacRequest{
+			Enabled: enabled,
+		}
+		op, err := config.clientContainer.Projects.Zones.Clusters.LegacyAbac(project, zoneName, clusterName, req).Do()
+		if err != nil {
+			return err
+		}
+
+		// Wait until it's updated
+		waitErr := containerOperationWait(config, op, project, zoneName, "updating GKE legacy ABAC", timeoutInMinutes, 2)
+		if waitErr != nil {
+			return waitErr
+		}
+
+		log.Printf("[INFO] GKE cluster %s legacy ABAC has been updated to %v", d.Id(), enabled)
+
+		d.SetPartial("legacy_abac")
 	}
 
 	d.Partial(false)
@@ -755,6 +800,14 @@ func getInstanceGroupUrlsFromManagerUrls(config *Config, igmUrls []string) ([]st
 	return instanceGroupURLs, nil
 }
 
+func flattenLegacyAbac(c *container.Cluster) []map[string]interface{} {
+	return []map[string]interface{}{
+		{
+			"enabled": c.LegacyAbac.Enabled,
+		},
+	}
+}
+
 func flattenClusterNodeConfig(c *container.NodeConfig) []map[string]interface{} {
 	config := []map[string]interface{}{
 		{

google/resource_container_cluster_test.go

@@ -91,6 +91,32 @@ func TestAccContainerCluster_withAdditionalZones(t *testing.T) {
 	})
 }
 
+func TestAccContainerCluster_withLegacyAbac(t *testing.T) {
+	clusterName := fmt.Sprintf("cluster-test-%s", acctest.RandString(10))
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckContainerClusterDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccContainerCluster_withLegacyAbac(clusterName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckContainerCluster(
+						"google_container_cluster.with_legacy_abac"),
+				),
+			},
+			{
+				Config: testAccContainerCluster_updateLegacyAbac(clusterName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckContainerCluster(
+						"google_container_cluster.with_legacy_abac"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccContainerCluster_withVersion(t *testing.T) {
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
@@ -291,6 +317,7 @@ func testAccCheckContainerCluster(n string) resource.TestCheckFunc {
 			{"description", cluster.Description},
 			{"endpoint", cluster.Endpoint},
 			{"instance_group_urls", igUrls},
+			{"legacy_abac.0.enabled", strconv.FormatBool(cluster.LegacyAbac.Enabled)},
 			{"logging_service", cluster.LoggingService},
 			{"monitoring_service", cluster.MonitoringService},
 			{"subnetwork", cluster.Subnetwork},
@@ -520,6 +547,32 @@ resource "google_container_cluster" "with_additional_zones" {
 }`, clusterName)
 }
 
+func testAccContainerCluster_withLegacyAbac(clusterName string) string {
+	return fmt.Sprintf(`
+resource "google_container_cluster" "with_legacy_abac" {
+	name = "cluster-test-%s"
+	zone = "us-central1-a"
+	initial_node_count = 1
+
+	legacy_abac {
+		enabled = true
+	}
+}`, clusterName)
+}
+
+func testAccContainerCluster_updateLegacyAbac(clusterName string) string {
+	return fmt.Sprintf(`
+resource "google_container_cluster" "with_legacy_abac" {
+	name = "cluster-test-%s"
+	zone = "us-central1-a"
+	initial_node_count = 1
+
+	legacy_abac {
+		enabled = false
+	}
+}`, clusterName)
+}
+
 var testAccContainerCluster_withVersion = fmt.Sprintf(`
 data "google_container_engine_versions" "central1a" {
 	zone = "us-central1-a"