chore(CI): add new verify (DO NOT MERGE)

examples/simple_autopilot_public/main.tf

@@ -18,7 +18,6 @@ locals {
   cluster_type           = "simple-autopilot-public"
   network_name           = "simple-autopilot-public-network"
   subnet_name            = "simple-autopilot-public-subnet"
-  master_auth_subnetwork = "simple-autopilot-public-master-subnet"
   pods_range_name        = "ip-range-pods-simple-autopilot-public"
   svc_range_name         = "ip-range-svc-simple-autopilot-public"
   subnet_names           = [for subnet_self_link in module.gcp-network.subnets_self_links : split("/", subnet_self_link)[length(split("/", subnet_self_link)) - 1]]
@@ -52,6 +51,7 @@ module "gke" {
   gcs_fuse_csi_driver             = true
   stateful_ha                     = false
   gke_backup_agent_config         = false
+  enable_gcfs                     = true
   ray_operator_config = {
     enabled            = true
     logging_enabled    = true

examples/simple_autopilot_public/network.tf

@@ -23,14 +23,10 @@ module "gcp-network" {
 
   subnets = [
     {
-      subnet_name   = local.subnet_name
-      subnet_ip     = "10.0.0.0/17"
-      subnet_region = var.region
-    },
-    {
-      subnet_name   = local.master_auth_subnetwork
-      subnet_ip     = "10.60.0.0/17"
-      subnet_region = var.region
+      subnet_name           = local.subnet_name
+      subnet_ip             = "10.0.0.0/17"
+      subnet_region         = var.region
+      subnet_private_access = true
     },
   ]
 

test/integration/simple_autopilot_public/simple_autopiliot_public_test.go

@@ -22,6 +22,7 @@ import (
 	"github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test/pkg/tft"
 	"github.com/stretchr/testify/assert"
 	"github.com/terraform-google-modules/terraform-google-kubernetes-engine/test/integration/testutils"
+	"github.com/terraform-google-modules/terraform-google-kubernetes-engine/test/integration/utils"
 )
 
 func TestSimpleAutopilotPublic(t *testing.T) {
@@ -32,6 +33,8 @@ func TestSimpleAutopilotPublic(t *testing.T) {
 	bpt.DefineVerify(func(assert *assert.Assertions) {
 		//Skipping Default Verify as the Verify Stage fails due to change in Client Cert Token
 		// bpt.DefaultVerify(assert)
+		utils.TGKEVerify(t, bpt, assert)
+		bpt.DefaultVerify(assert)
 
 		projectId := bpt.GetStringOutput("project_id")
 		location := bpt.GetStringOutput("location")

test/integration/utils/utils.go

@@ -15,10 +15,13 @@
 package utils
 
 import (
+	"slices"
 	"testing"
 	"time"
 
 	"github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test/pkg/tft"
+	tfjson "github.com/hashicorp/terraform-json"
+	"github.com/stretchr/testify/assert"
 	"github.com/terraform-google-modules/terraform-google-kubernetes-engine/test/integration/testutils"
 )
 
@@ -32,3 +35,19 @@ func GetTestProjectFromSetup(t *testing.T, idx int) string {
 	}
 	return projectIDs[idx]
 }
+
+var (
+	// TGKEVerify Exempt Resources. e.g. google_container_cluster.primary
+	verifyExemptResources = []string{}
+)
+
+func TGKEVerify(t *testing.T, b *tft.TFBlueprintTest, assert *assert.Assertions) {
+	_, ps := b.PlanAndShow()
+	for _, r := range ps.ResourceChangesMap {
+		if slices.Contains(verifyExemptResources, r.Address) {
+			t.Logf("Exempt plan address: %s", r.Address)
+			continue
+		}
+		assert.Equal(tfjson.Actions{tfjson.ActionNoop}, r.Change.Actions, "plan must be no-op for resource: %s", r.Address)
+	}
+}