Update google provider to latest 5.x version

[theferrit32]

This includes features of GCP Workflows necessary for our use case.

There is one change required in google_secret_manager_secret:

replication {
    automatic = true
}

becomes

replication {
    auto {}
}

Given the current use of external-secrets and cloudbuild-firebase modules across the 3 dev stage and prod environments, we need to update the google module simultaneously across the 3 environments.

One additional configuration change suggested on the call today is to remove the use of terragrunt and just put the module versions in a config file in each environment directory.

Other google terraform resource types that we are using seem to be fully backwards compatible, meaning we don't need to make changes.

Verified these terraform directories under terraform/ work with google version 5.12.0.

• dev
• stage
• prod
• shared/iam
• shared/mondo_notifier
• shared/clinvar_sync_cron
• shared/kafka_backups
  • terraform thinks it needs to add label: "bucket: clingen-confluent-backups" to the bucket
  • This label already exists on the bucket, so re-applying it is probably fine. I'm not sure why it thinks it needs to be added.

[theferrit32]

terraform thinks it needs to add this label to the bucket even though it already exists. The field in the terraform resource schema is called labels, and it's called labels on the bucket too, but here in the plan it calls it terraform_labels, not sure if that is causing the issue.

kafka_backups $ terraform plan
google_storage_bucket.confluent_backups: Refreshing state... [id=clingen-confluent-backups]
google_service_account.confluent_cloud_backups_owner: Refreshing state... [id=projects/clingen-dx/serviceAccounts/confluent-cloud-kakfa-backups@clingen-dx.iam.gserviceaccount.com]
google_storage_bucket_iam_binding.backups_sa_binding: Refreshing state... [id=b/clingen-confluent-backups/roles/storage.admin]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the
following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # google_storage_bucket.confluent_backups will be updated in-place
  ~ resource "google_storage_bucket" "confluent_backups" {
        id                          = "clingen-confluent-backups"
        name                        = "clingen-confluent-backups"
      ~ terraform_labels            = {
          + "bucket" = "clingen-confluent-backups"
        }
        # (13 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

[theferrit32]

I think we can just remove that label though, it's just the bucket name

[theferrit32]

Done in #607