From ba781d78e64dc851acad9f500a4f708dc8ac422c Mon Sep 17 00:00:00 2001 From: Nikolaus Schuetz Date: Thu, 30 Jul 2026 08:09:11 -0700 Subject: [PATCH 1/2] Add failing tests for workload identity pool ID suffix handling These cases fail under the current strings.TrimRight suffix stripping: a valid ID whose base name ends in a suffix character ('goods.svc.id.goog') is wrongly rejected, and an over-length ID whose base ends in a suffix character ('a'*32+'g'+suffix) is wrongly accepted because TrimRight eats the trailing 'g' too. --- .../iambeta/resource_iam_workload_identity_pool_id_test.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mmv1/third_party/terraform/services/iambeta/resource_iam_workload_identity_pool_id_test.go b/mmv1/third_party/terraform/services/iambeta/resource_iam_workload_identity_pool_id_test.go index 4af09f36862f..e2a44e4e8613 100644 --- a/mmv1/third_party/terraform/services/iambeta/resource_iam_workload_identity_pool_id_test.go +++ b/mmv1/third_party/terraform/services/iambeta/resource_iam_workload_identity_pool_id_test.go @@ -17,6 +17,7 @@ func TestValidateIAMBetaWorkloadIdentityPoolId(t *testing.T) { {TestName: "long", Value: "12345678901234567890123456789012"}, {TestName: "has a hyphen", Value: "foo-bar"}, {TestName: "default pool format", Value: "foo-bar.svc.id.goog"}, + {TestName: "default pool format with base name ending in a suffix character", Value: "goods.svc.id.goog"}, // With errors {TestName: "empty", Value: "", ExpectError: true}, @@ -26,6 +27,7 @@ func TestValidateIAMBetaWorkloadIdentityPoolId(t *testing.T) { {TestName: "has an backslash", Value: "foo\bar", ExpectError: true}, {TestName: "too short", Value: "foo", ExpectError: true}, {TestName: "too long", Value: strings.Repeat("f", 33), ExpectError: true}, + {TestName: "too long with suffix", Value: strings.Repeat("a", 32) + "g.svc.id.goog", ExpectError: true}, } es := verify.TestStringValidationCases(x, iambeta.ValidateWorkloadIdentityPoolId) From 0fb0bd9ada5e423f21e668a2d67318dfdab9ddfe Mon Sep 17 00:00:00 2001 From: Nikolaus Schuetz Date: Thu, 30 Jul 2026 08:09:22 -0700 Subject: [PATCH 2/2] Use TrimSuffix to strip the workload identity pool ID suffix strings.TrimRight treats its argument as a cutset of characters, not a literal suffix, so it removed every trailing character in {. s v c i d g o} rather than the '.svc.id.goog' suffix. Use strings.TrimSuffix so exactly that suffix is removed; the HasSuffix guard is then redundant and dropped. Makes the tests added in the previous commit pass. --- .../terraform/constants/iam_workload_identity_pool.go.tmpl | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/mmv1/templates/terraform/constants/iam_workload_identity_pool.go.tmpl b/mmv1/templates/terraform/constants/iam_workload_identity_pool.go.tmpl index 7a0fbb128b03..565b5996ae75 100644 --- a/mmv1/templates/terraform/constants/iam_workload_identity_pool.go.tmpl +++ b/mmv1/templates/terraform/constants/iam_workload_identity_pool.go.tmpl @@ -9,9 +9,7 @@ func ValidateWorkloadIdentityPoolId(v interface{}, k string) (ws []string, error "%q (%q) can not start with \"gcp-\"", k, value)) } - if strings.HasSuffix(value, defaultWorkloadIdentityPoolIdSuffix) { - value = strings.TrimRight(value, defaultWorkloadIdentityPoolIdSuffix) - } + value = strings.TrimSuffix(value, defaultWorkloadIdentityPoolIdSuffix) if !regexp.MustCompile(workloadIdentityPoolIdRegexp).MatchString(value) { errors = append(errors, fmt.Errorf(