From 8b578e0214fc818d6f9537667387c83345c478b3 Mon Sep 17 00:00:00 2001 From: Charles Ma Date: Wed, 9 Sep 2026 04:43:41 +0000 Subject: [PATCH] workstations: add creator policy admin setting Expose the WorkstationConfig API field in both provider variants and generate create-to-update acceptance coverage. --- .../workstations/WorkstationConfig.yaml | 19 +++++++++++ ...t_workstation_admin_role_on_create.tf.tmpl | 32 +++++++++++++++++++ ...tation_admin_role_on_create_update.tf.tmpl | 32 +++++++++++++++++++ 3 files changed, 83 insertions(+) create mode 100644 mmv1/templates/terraform/samples/services/workstations/workstation_config_grant_workstation_admin_role_on_create.tf.tmpl create mode 100644 mmv1/templates/terraform/samples/services/workstations/workstation_config_grant_workstation_admin_role_on_create_update.tf.tmpl diff --git a/mmv1/products/workstations/WorkstationConfig.yaml b/mmv1/products/workstations/WorkstationConfig.yaml index 62b9ee53e545..a79f76db2f21 100644 --- a/mmv1/products/workstations/WorkstationConfig.yaml +++ b/mmv1/products/workstations/WorkstationConfig.yaml @@ -64,6 +64,21 @@ samples: key_short_name: '"tf-test-key-" + acctest.RandString(t, 10)' value_short_name: '"tf-test-value-" + acctest.RandString(t, 10)' org_id: envvar.GetTestOrgFromEnv(t) + - name: workstation_config_grant_workstation_admin_role_on_create + primary_resource_id: default + steps: + - name: workstation_config_grant_workstation_admin_role_on_create + resource_id_vars: + workstation_cluster_name: workstation-cluster + workstation_config_name: workstation-config + vars: + grant_workstation_admin_role_on_create: 'false' + - name: workstation_config_grant_workstation_admin_role_on_create_update + resource_id_vars: + workstation_cluster_name: workstation-cluster + workstation_config_name: workstation-config + vars: + grant_workstation_admin_role_on_create: 'true' - name: workstation_config_container primary_resource_id: default steps: @@ -639,6 +654,10 @@ properties: type: Boolean description: | Disables support for plain TCP connections in the workstation. By default the service supports TCP connections via a websocket relay. Setting this option to true disables that relay, which prevents the usage of services that require plain tcp connections, such as ssh. When enabled, all communication must occur over https or wss. + - name: grantWorkstationAdminRoleOnCreate + type: Boolean + description: | + Whether to grant the creator of a workstation the `roles/workstations.policyAdmin` role in addition to the default `roles/workstations.user` role on the workstation they create. This allows workstation users to share access to either their entire workstation or individual ports. Defaults to false. - name: maxUsableWorkstations type: Integer description: | diff --git a/mmv1/templates/terraform/samples/services/workstations/workstation_config_grant_workstation_admin_role_on_create.tf.tmpl b/mmv1/templates/terraform/samples/services/workstations/workstation_config_grant_workstation_admin_role_on_create.tf.tmpl new file mode 100644 index 000000000000..567e071db991 --- /dev/null +++ b/mmv1/templates/terraform/samples/services/workstations/workstation_config_grant_workstation_admin_role_on_create.tf.tmpl @@ -0,0 +1,32 @@ +resource "google_compute_network" "default" { + name = "{{index $.ResourceIdVars "workstation_cluster_name"}}" + auto_create_subnetworks = false +} + +resource "google_compute_subnetwork" "default" { + name = "{{index $.ResourceIdVars "workstation_cluster_name"}}" + ip_cidr_range = "10.0.0.0/24" + region = "us-central1" + network = google_compute_network.default.name +} + +resource "google_workstations_workstation_cluster" "{{$.PrimaryResourceId}}" { + workstation_cluster_id = "{{index $.ResourceIdVars "workstation_cluster_name"}}" + network = google_compute_network.default.id + subnetwork = google_compute_subnetwork.default.id + location = "us-central1" +} + +resource "google_workstations_workstation_config" "{{$.PrimaryResourceId}}" { + workstation_config_id = "{{index $.ResourceIdVars "workstation_config_name"}}" + workstation_cluster_id = google_workstations_workstation_cluster.{{$.PrimaryResourceId}}.workstation_cluster_id + location = "us-central1" + + grant_workstation_admin_role_on_create = {{index $.Vars "grant_workstation_admin_role_on_create"}} + + host { + gce_instance { + machine_type = "e2-standard-4" + } + } +} diff --git a/mmv1/templates/terraform/samples/services/workstations/workstation_config_grant_workstation_admin_role_on_create_update.tf.tmpl b/mmv1/templates/terraform/samples/services/workstations/workstation_config_grant_workstation_admin_role_on_create_update.tf.tmpl new file mode 100644 index 000000000000..567e071db991 --- /dev/null +++ b/mmv1/templates/terraform/samples/services/workstations/workstation_config_grant_workstation_admin_role_on_create_update.tf.tmpl @@ -0,0 +1,32 @@ +resource "google_compute_network" "default" { + name = "{{index $.ResourceIdVars "workstation_cluster_name"}}" + auto_create_subnetworks = false +} + +resource "google_compute_subnetwork" "default" { + name = "{{index $.ResourceIdVars "workstation_cluster_name"}}" + ip_cidr_range = "10.0.0.0/24" + region = "us-central1" + network = google_compute_network.default.name +} + +resource "google_workstations_workstation_cluster" "{{$.PrimaryResourceId}}" { + workstation_cluster_id = "{{index $.ResourceIdVars "workstation_cluster_name"}}" + network = google_compute_network.default.id + subnetwork = google_compute_subnetwork.default.id + location = "us-central1" +} + +resource "google_workstations_workstation_config" "{{$.PrimaryResourceId}}" { + workstation_config_id = "{{index $.ResourceIdVars "workstation_config_name"}}" + workstation_cluster_id = google_workstations_workstation_cluster.{{$.PrimaryResourceId}}.workstation_cluster_id + location = "us-central1" + + grant_workstation_admin_role_on_create = {{index $.Vars "grant_workstation_admin_role_on_create"}} + + host { + gce_instance { + machine_type = "e2-standard-4" + } + } +}