Add exclusive_tags parameter to Workspace Resource

CHANGELOG.md

@@ -45,6 +45,7 @@ FEATURES:
 
 ENHANCEMENTS:
 * `d/tfe_organization`: Make `name` argument optional if configured for the provider, by @tmatilai [1133](https://github.com/hashicorp/terraform-provider-tfe/pull/1133)
+* `r/tfe_workspace`: Add `exclusive_tags` boolean to allow the provider to ignore externally created tags, by @mbillow [1251](https://github.com/hashicorp/terraform-provider-tfe/pull/1251)
 
 ## v0.50.0
 

internal/provider/resource_tfe_workspace.go

@@ -14,6 +14,7 @@ import (
 	"fmt"
 	"log"
 	"net/url"
+	"reflect"
 	"regexp"
 	"strings"
 	"time"
@@ -209,6 +210,12 @@ func resourceTFEWorkspace() *schema.Resource {
 				Elem:     &schema.Schema{Type: schema.TypeString},
 			},
 
+			"exclusive_tags": {
+				Type:     schema.TypeBool,
+				Optional: true,
+				Default:  true,
+			},
+
 			"terraform_version": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -528,9 +535,20 @@ func resourceTFEWorkspaceRead(d *schema.ResourceData, meta interface{}) error {
 	}
 	d.Set("agent_pool_id", agentPoolID)
 
-	var tagNames []interface{}
-	for _, tagName := range workspace.TagNames {
-		tagNames = append(tagNames, tagName)
+	tagNames := make([]interface{}, 0)
+	if d.Get("exclusive_tags").(bool) {
+		for _, tagName := range workspace.TagNames {
+			tagNames = append(tagNames, tagName)
+		}
+	} else {
+		controlledTags := d.Get("tag_names").(*schema.Set).List()
+		for _, controlledTag := range controlledTags {
+			for _, apiTag := range workspace.TagNames {
+				if reflect.DeepEqual(controlledTag, apiTag) {
+					tagNames = append(tagNames, apiTag)
+				}
+			}
+		}
 	}
 	d.Set("tag_names", tagNames)
 

internal/provider/resource_tfe_workspace_test.go

@@ -1226,6 +1226,10 @@ func TestAccTFEWorkspace_patternsAndPrefixesConflicting(t *testing.T) {
 func TestAccTFEWorkspace_changeTags(t *testing.T) {
 	workspace := &tfe.Workspace{}
 	rInt := rand.New(rand.NewSource(time.Now().UnixNano())).Int()
+	tfeClient, err := getClientUsingEnv()
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
@@ -1339,6 +1343,41 @@ func TestAccTFEWorkspace_changeTags(t *testing.T) {
 				Config:      testAccTFEWorkspace_basicBadTag(rInt),
 				ExpectError: regexp.MustCompile(`"-Hello" is not a valid tag name.`),
 			},
+			{
+				Config: testAccTFEWorkspace_basicNonExclusiveTags(rInt),
+			},
+			{
+				PreConfig: func() {
+					newTags := tfe.WorkspaceAddTagsOptions{Tags: []*tfe.Tag{{Name: "external"}}}
+					err := tfeClient.Workspaces.AddTags(context.Background(), workspace.ID, newTags)
+					if err != nil {
+						t.Fatal(err)
+					}
+				},
+				Config: testAccTFEWorkspace_basicNonExclusiveTags(rInt),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckTFEWorkspaceExists(
+						"tfe_workspace.foobar", workspace, testAccProvider),
+					resource.TestCheckResourceAttr(
+						"tfe_workspace.foobar", "tag_names.#", "2"),
+					resource.TestCheckResourceAttr(
+						"tfe_workspace.foobar", "tag_names.0", "fav"),
+					resource.TestCheckResourceAttr(
+						"tfe_workspace.foobar", "tag_names.1", "test"),
+					func(state *terraform.State) error {
+						r, err := tfeClient.Workspaces.ListTags(context.Background(), workspace.ID, &tfe.WorkspaceTagListOptions{})
+						if err != nil {
+							return err
+						}
+						for _, tag := range r.Items {
+							if tag.Name == "external" {
+								return nil
+							}
+						}
+						return fmt.Errorf("externally managed tag not found on workspace")
+					},
+				),
+			},
 		},
 	})
 }
@@ -2766,6 +2805,22 @@ resource "tfe_workspace" "foobar" {
 }`, rInt)
 }
 
+func testAccTFEWorkspace_basicNonExclusiveTags(rInt int) string {
+	return fmt.Sprintf(`
+resource "tfe_organization" "foobar" {
+  name  = "tst-terraform-%d"
+  email = "[email protected]"
+}
+
+resource "tfe_workspace" "foobar" {
+  name               = "workspace-test"
+  organization       = tfe_organization.foobar.id
+  auto_apply         = true
+  tag_names          = ["fav", "test"]
+  exclusive_tags     = false
+}`, rInt)
+}
+
 func testAccTFEWorkspace_basicNoTags(rInt int) string {
 	return fmt.Sprintf(`
 resource "tfe_organization" "foobar" {

website/docs/d/workspace.html.markdown

@@ -54,6 +54,7 @@ In addition to all arguments above, the following attributes are exported:
 * `ssh_key_id` - The ID of an SSH key assigned to the workspace.
 * `structured_run_output_enabled` - Indicates whether runs in this workspace use the enhanced apply UI.
 * `tag_names` - The names of tags added to this workspace.
+* `exclusive_tags` - Toggle between controlling all tags on a workspace or just the specified `tag_names`.
 * `terraform_version` - The version (or version constraint) of Terraform used for this workspace.
 * `trigger_prefixes` - List of trigger prefixes that describe the paths Terraform Cloud monitors for changes, in addition to the working directory. Trigger prefixes are always appended to the root directory of the repository.
   Terraform Cloud or Terraform Enterprise will start a run when files are changed in any directory path matching the provided set of prefixes.