Skip to content

compute: add name_prefix to google_compute_managed_ssl_certificate (#8889)#67

Open
jbbqqf wants to merge 12 commits into
mainfrom
feat/8889-managed-ssl-cert-name-prefix
Open

compute: add name_prefix to google_compute_managed_ssl_certificate (#8889)#67
jbbqqf wants to merge 12 commits into
mainfrom
feat/8889-managed-ssl-cert-name-prefix

Conversation

@jbbqqf
Copy link
Copy Markdown
Owner

@jbbqqf jbbqqf commented May 9, 2026

Summary

Adds name_prefix support to google_compute_managed_ssl_certificate,
mirroring the existing name_prefix on google_compute_ssl_certificate.
Users practising cert rotation typically need to recreate certs with
stable prefixes (so the new cert exists side-by-side with the old before
swap), and they want Terraform to generate the unique trailing suffix
automatically. Without name_prefix, they must use random_id
workarounds or imperative wrappers.

Fixes hashicorp/terraform-provider-google#8889 — see hashicorp/terraform-provider-google#8889

Why

The user-managed google_compute_ssl_certificate already supports
name_prefix via a shared extra_schema_entry and custom_expand
(mmv1/templates/terraform/extra_schema_entry/ssl_certificate.tmpl and
mmv1/templates/terraform/custom_expand/name_or_name_prefix.go.tmpl).
The Google-managed variant has the same lifecycle constraint
(certificates are immutable, must be rotated by replacement) and the
same underlying API resource (compute#sslCertificate) — so the same
prefix-generation logic applies as-is.

GCP API reference:

What changed

This change is to a mmv1-generated resource. Files touched in
magic-modules:

 mmv1/products/compute/ManagedSslCertificate.yaml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

The YAML edits:

  1. Added a docs.optional_properties entry documenting name_prefix (same
    wording as SslCertificate.yaml).
  2. Added extra_schema_entry: 'templates/terraform/extra_schema_entry/ssl_certificate.tmpl'
    to the custom_code block (which already had a constants entry).
  3. Added default_from_api: true and custom_expand: '.../name_or_name_prefix.go.tmpl'
    to the name property — same shape as the name field on SslCertificate.yaml.
  4. Added ignore_read_extra: ['name_prefix'] to both examples (matches the
    pattern from SslCertificate.yaml's examples — name_prefix is a
    client-side-only field with no read counterpart).

Edge cases tested

# Scenario HCL excerpt Expected Verified by
1 name set, name_prefix unset name = "my-cert" Existing behavior unchanged Regen schema diff: name is still Optional+Computed, ConflictsWith: []string{"name_prefix"}
2 name_prefix set, name unset name_prefix = "rotation-" name computed by id.PrefixedUniqueId(prefix) custom_expand template emits the same logic as SslCertificate (prefix > 37 → ReducedPrefixedUniqueId, else id.PrefixedUniqueId)
3 Both set name = "x"; name_prefix = "y-" Plan-time error from ConflictsWith validator The shared ssl_certificate.tmpl schema entry has ConflictsWith: []string{"name"}
4 name_prefix exceeds 54 chars name_prefix = strings.Repeat("a", 55) Plan-time validation error Shared ValidateFunc rejects len > 54

Test protocol

Test Result Notes
YAML lint (go run mmv1/. --output ... --version ga --no-docs) OK Regeneration completed cleanly
go build ./google/services/compute/... (TPG) OK full compute service compiles
go vet ./google/services/compute/... (TPG) OK no new findings (3 pre-existing unreachable-code warnings in firewall_policy files are unchanged by this PR)
Generated schema includes name_prefix field OK grep'd resource_compute_managed_ssl_certificate.go after regen — confirms name_prefix schema entry, ConflictsWith: []string{"name"}, and the expand-name handler
Generated name field is computed-from-prefix OK expandComputeManagedSslCertificateName follows the shared template: returns name when set, else id.PrefixedUniqueId(name_prefix), else id.UniqueId()

This is a purely additive client-side schema extension (the API
already accepts whatever name the client supplies — there is no API-side
change). Live smoke is therefore not strictly necessary for confidence,
and Google-managed cert provisioning is slow/expensive (30-min create
timeout) which makes it costly. The static evidence is identical to
what's been used for the user-managed SslCertificate name_prefix for
years.

Resources

Disclosure

This PR was implemented with assistance from Claude Code. The diff was
modeled on the existing SslCertificate.yaml name_prefix wiring — a
well-tested pattern that's been in the provider for years — and the
regenerated provider compiled and vetted cleanly. The author (a human)
reviewed the diff and the regenerated schema before opening this PR.

jcromanu and others added 12 commits May 8, 2026 16:43
…oogleCloudPlatform#8889)

Adds the same name_prefix mechanism that google_compute_ssl_certificate
already uses, so users can manage cert rotation by recreating certs
with stable prefixes. Reuses the shared ssl_certificate.tmpl
extra_schema_entry and the name_or_name_prefix.go.tmpl custom_expand
that already power the user-managed SslCertificate resource.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add name_prefix support to google_compute_managed_ssl_certificate

8 participants