Adding `access_rules_options` to `google_lustre_instance` #15898

NA2047 · 2025-12-05T22:21:06Z

Add accessRulesOptions support to google_lustre_instance resource

This PR adds support for accessRulesOptions configuration to the google_lustre_instance resource, enabling users to configure root squashing behavior and IP-based access control rules for Managed Lustre instances.

Changes Made:

Resource Schema (mmv1/products/lustre/Instance.yaml):

Added accessRulesOptions nested object with the following fields:
- defaultSquashMode (Enum): Set default root squashing mode (ROOT_SQUASH or NO_SQUASH)
- defaultSquashUid (Integer): UID to map root user to when squashing is enabled
- defaultSquashGid (Integer): GID to map root user to when squashing is enabled
- accessRules (Array): List of access rule exceptions with:
  - name: Unique identifier for the rule
  - ipAddressRanges: Array of IP addresses or CIDR ranges
  - squashMode: Squash mode for the specific rule (currently NO_SQUASH for exceptions)

Release Note Template for Downstream PRs (will be copied)

See Write release notes for guidance.

lustre: added `access_rules_options` field to `google_lustre_instance` resource to support root squashing and IP-based access control configuration

github-actions · 2025-12-05T22:22:08Z

Hello! I am a robot. Tests will require approval from a repository maintainer to run.

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@shuyama1, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

modular-magician · 2025-12-05T22:38:14Z

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 4 files changed, 450 insertions(+))
google-beta provider: Diff ( 4 files changed, 450 insertions(+))
terraform-google-conversion: Diff ( 1 file changed, 112 insertions(+))

modular-magician · 2025-12-05T22:38:28Z

Hi there, I'm the Modular magician. I've detected the following information about your changes:

Diff report

Your PR generated some diffs in downstreams - here they are.

google provider: Diff ( 4 files changed, 450 insertions(+))
google-beta provider: Diff ( 4 files changed, 450 insertions(+))
terraform-google-conversion: Diff ( 1 file changed, 112 insertions(+))

modular-magician · 2025-12-05T22:41:46Z

Tests analytics

Total tests: 6
Passed tests: 5
Skipped tests: 0
Affected tests: 1

Click here to see the affected service packages

lustre

Action taken

Found 1 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

TestAccLustreInstance_withAccessRulesOptions

Get to know how VCR tests work

modular-magician · 2025-12-05T22:43:08Z

Tests analytics

Total tests: 6
Passed tests: 5
Skipped tests: 0
Affected tests: 1

Click here to see the affected service packages

lustre

Action taken

Found 1 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests

TestAccLustreInstance_withAccessRulesOptions

Get to know how VCR tests work

modular-magician · 2025-12-05T23:11:12Z

🟢 Tests passed during RECORDING mode:
TestAccLustreInstance_withAccessRulesOptions [Debug log]

🟢 No issues found for passed tests after REPLAYING rerun.

🟢 All tests passed!

View the build log or the debug log for each test

modular-magician · 2025-12-05T23:12:35Z

🟢 Tests passed during RECORDING mode:
TestAccLustreInstance_withAccessRulesOptions [Debug log]

🟢 No issues found for passed tests after REPLAYING rerun.

🟢 All tests passed!

View the build log or the debug log for each test

shuyama1 · 2025-12-09T23:49:57Z

mmv1/third_party/terraform/services/lustre/resource_lustre_instance_test.go

+    access_rules {
+      name = "another_admin"
+      ip_address_ranges = [
+        "172.16.5.0/24"


Can we try multiple values for this list, just want to ensure, it will return the same order as sent

shuyama1 · 2025-12-09T23:51:37Z

mmv1/products/lustre/Instance.yaml

+      Access control rules for the Lustre instance. Configures default root
+      squashing behavior and specific access rules based on IP addresses.
+    properties:
+      - name: defaultSquashMode


Looks like this is required according to the API doc

shuyama1 · 2025-12-09T23:53:06Z

mmv1/products/lustre/Instance.yaml

+            - name: name
+              type: String
+              description: |-
+                A unique identifier for the access rule.
+            - name: ipAddressRanges
+              type: Array
+              description: |-
+                An array of IP address strings or CIDR ranges that this rule applies to.
+              item_type:
+                type: String
+            - name: squashMode
+              type: Enum
+              description: |-
+                The squash mode for this specific rule. Currently, only "NO_SQUASH"
+                is supported for exceptions.
+              enum_values:
+                - 'NO_SQUASH'


Looks like all these fields are required
https://docs.cloud.google.com/managed-lustre/docs/reference/rest/v1/projects.locations.instances#accessrule

shuyama1 · 2025-12-09T23:55:22Z

mmv1/third_party/terraform/services/lustre/resource_lustre_instance_test.go

+    default_squash_uid  = 0
+    default_squash_gid  = 0


Can we add a step omit these fields? Just want to double check if the API returns values for these fields when access_rules_options block is explicitly set

shuyama1 · 2025-12-10T00:02:37Z

mmv1/third_party/terraform/services/lustre/resource_lustre_instance_test.go

+  per_unit_storage_throughput = 1000
+  
+  access_rules_options {
+    default_squash_mode = "NO_SQUASH"


Also just want to double check - as mentioned in the API doc, when default_squash_mode = "NO_SQUASH" is set, do not set the defaultSquashUid or defaultSquashGid, or an invalid argument error is returned.

and = 0 just means unset in this case?

First Commit

4b082f6

github-actions bot requested a review from shuyama1 December 5, 2025 22:22

fixing lint

2847be2

modular-magician added the service/lustre label Dec 5, 2025

shuyama1 reviewed Dec 10, 2025

View reviewed changes

Adding access_rules_options to google_lustre_instance #15898

Are you sure you want to change the base?

Adding access_rules_options to google_lustre_instance #15898

Uh oh!

Conversation

NA2047 commented Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Add accessRulesOptions support to google_lustre_instance resource

Changes Made:

Uh oh!

github-actions bot commented Dec 5, 2025

Uh oh!

modular-magician commented Dec 5, 2025

Diff report

Uh oh!

modular-magician commented Dec 5, 2025

Diff report

Uh oh!

modular-magician commented Dec 5, 2025

Tests analytics

Action taken

Uh oh!

modular-magician commented Dec 5, 2025

Tests analytics

Action taken

Uh oh!

modular-magician commented Dec 5, 2025

Uh oh!

modular-magician commented Dec 5, 2025

Uh oh!

shuyama1 Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

shuyama1 Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

shuyama1 Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

shuyama1 Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

shuyama1 Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Adding `access_rules_options` to `google_lustre_instance` #15898

Adding `access_rules_options` to `google_lustre_instance` #15898

NA2047 commented Dec 5, 2025 •

edited

Loading