Cover top 20 resources with upgrade tests

[iwahbe]

We need to add upgrade tests for:

• [X] gcp:container/cluster:Cluster
• [X] gcp:serviceAccount/account:Account
• [X] gcp:projects/iAMBinding:IAMBinding
• [X] gcp:container/nodePool:NodePool
• [X] gcp:serviceAccount/iAMMember:IAMMember
• [X] gcp:projects/iAMCustomRole:IAMCustomRole
• [X] gcp:compute/subnetwork:Subnetwork
• [X] gcp:projects/iAMMember:IAMMember
• [X] gcp:pubsub/topicIAMBinding:TopicIAMBinding
• [X] gcp:logging/projectSink:ProjectSink
• [X] gcp:storage/bucketIAMMember:BucketIAMMember
• [X] gcp:compute/router:Router

We already have upgrade tests for:

• [X] gcp:storage/bucket:Bucket
• [X] gcp:projects/service:Service
• [X] gcp:dns/recordSet:RecordSet
• [X] gcp:storage/bucketObject:BucketObject
• [X] gcp:compute/firewall:Firewall
• [X] gcp:cloudfunctions/function:Function
• [X] gcp:compute/network:Network
• [X] gcp:pubsub/topic:Topic

[t0yv0]

Does this overlap with https://github.com/pulumi/pulumi-gcp/issues/1330 ? Add this to the epic?

[t0yv0]

I had some trouble getting the right permissions to test IAM*, curious if we find a way forward here.

[iwahbe]

I missed https://github.com/pulumi/pulumi-gcp/issues/1330, so probably. @VenelinMartinov you can leave off the IAM* resources if they are not working.

[t0yv0]

✅ TestUpgradeCoverage (0s)
      provider_test.go:19: Resources covered: 21
      provider_test.go:19: - gcp:bigquery/dataset:Dataset
      provider_test.go:19: - gcp:bigquery/datasetAccess:DatasetAccess
      provider_test.go:19: - gcp:bigquery/routine:Routine
      provider_test.go:19: - gcp:bigquery/table:Table
      provider_test.go:19: - gcp:cloudfunctions/function:Function
      provider_test.go:19: - gcp:cloudrunv2/job:Job
      provider_test.go:19: - gcp:cloudrunv2/service:Service
      provider_test.go:19: - gcp:compute/disk:Disk
      provider_test.go:19: - gcp:compute/firewall:Firewall
      provider_test.go:19: - gcp:compute/instance:Instance
      provider_test.go:19: - gcp:compute/network:Network
      provider_test.go:19: - gcp:dns/managedZone:ManagedZone
      provider_test.go:19: - gcp:dns/recordSet:RecordSet
      provider_test.go:19: - gcp:monitoring/alertPolicy:AlertPolicy
      provider_test.go:19: - gcp:pubsub/subscription:Subscription
      provider_test.go:19: - gcp:pubsub/topic:Topic
      provider_test.go:19: - gcp:secretmanager/secret:Secret
      provider_test.go:19: - gcp:sql/databaseInstance:DatabaseInstance
      provider_test.go:19: - gcp:sql/user:User
      provider_test.go:19: - gcp:storage/bucket:Bucket
      provider_test.go:19: - gcp:storage/bucketObject:BucketObject

[t0yv0]

This is the current cov btw... so technically >20 though maybe not the right 20.

[t0yv0]

The epic is https://github.com/pulumi/home/issues/3061

[VenelinMartinov]

gcp:logging/projectSink:ProjectSink seems to also yield 403s upon creation with our current credentials.

[VenelinMartinov]

Is there a reason not to change the current credentials to ones with full permissions and just use that for tests?

IIUC, that's basically what we do for AWS.

[t0yv0]

It may be worht looking into, thinking through security implications and double-checking we don't rack up bills (there is some form of cleanup).

[t0yv0]

Going to reopen this because https://github.com/pulumi/pulumi-gcp/pull/1511 tests aren't actually running, which manifests in a louder failure when upgrading to later providertest.. Looks like we need to check in the snapshotted grpcs logs and state for the new programs.

[iwahbe]

I'm surprised that this failed silently. Should we open an issue in providertest about this?

Are the silent failures fixed in the current version of providertest?

[t0yv0]

https://github.com/pulumi/pulumi-gcp/pull/1579 new version will try to record a baseline if it does not find one it seems.

[t0yv0]

🚢