Add new resource opsgenie_team_membership, refs #65

[arnisoph]

Signed-off-by: Arnold Bechtoldt [email protected]

[arnisoph]

old one somehow became dirty #156

[ffahri]

pr looks good i'll talk with the internal team about go-sdk-v2 membership update status
Thank you @arnisoph

[ffahri]

we don't have update support. if we introduce this users cannot change roles in their teams. I'll create a internal ticket and let you know.

maybe we can use update function to
-> get team -> update our user role -> update team flow
This way we can update our team members ?

[arnisoph]

I don't even plan to implement it, it's just a comment :D

[arnisoph]

any necessary changes pending?

[arnisoph]

@ffahri any pending changes required in this PR?

[ffahri]

@arnisoph yes for update members please use team api it takes patch and we can pass the member inside that request

[ffahri]

use team api to update members (api supports)

[arnisoph]

???

[ffahri]

https://docs.opsgenie.com/docs/team-api#update-team-partial

[arnisoph]

You need the full member list for this. I don't see how we can use this for opsgenie_team_membership

[arnisoph]

@ffahri 👋 :D

[ffahri]

You dont need the full member list for that as you can see endpoint is supported in PATCH operations so you just need to send changed user is enough

[arnisoph]

@ffahri sorry I still don't understand. Can you please show me how a PATCH request would look like when removing a member from a team?

I don't even understand this broken sentence in the docs:

This request changes team members to given list above. In other words, It is not append them as new members.

To which list does the first sentence refer?

Why can't we merge the current PR which is just working and meets the requirements of the initial feature request? We can still make it perfect afterwards if really necessary...

[jbeemster]

Hi all - sorry to revive a long dead PR - this is a feature we have wanted for some time as we cannot effectively manage team membership via Terraform for OpsGenie without segmenting out membership from the team creation.

Is there any chance of this PR being dusted of and merged or would I better off taking this PR as inspiration and submitting a new one?

[jbeemster]

As an update have solved this with the mastercard/restapi provider with the following configuration if anyone else needs a more formal solution for this.

provider "restapi" {
  alias = "opsgenie"

  uri = "https://api.opsgenie.com"

  create_method         = "POST"
  update_method         = "POST"
  read_method           = "GET"
  create_returns_object = true
  write_returns_object  = true
  destroy_method        = "DELETE"

  headers = {
    "Content-Type"  = "application/json",
    "Authorization" = "GenieKey ${var.opsgenie_api_key}"
  }

  timeout = 15
}

resource "restapi_object" "opsgenie_team_membership" {
  for_each = toset(local.team_ids)

  path = "/v2/teams/${each.value}/members"

  data = jsonencode({
    user = {
      id = opsgenie_user.user.id
    },
    role = "user"
  })

  object_id = sha256("${opsgenie_user.user.id}-${each.value}")

  create_method  = "POST"
  create_path    = "/v2/teams/${each.value}/members"
  update_method  = "POST"
  update_path    = "/v2/teams/${each.value}/members"
  read_method    = "GET"
  read_path      = "/v2/teams/${each.value}"
  destroy_method = "DELETE"
  destroy_path   = "/v2/teams/${each.value}/members/${opsgenie_user.user.id}"
}

---

One major drawback still is that it is impossible with this provider to assert that the user is attached to the team as there is no GET request for an individual membership to the team - so its needed instead to parse out the teams API member list and check for existence in there.

Its possible to check for in a bit of a difficult way like so with TF v1.2.x:

locals {
  # Extract team membership maps from api_response
  team_members = { for k, v in restapi_object.opsgenie_team_membership : k => { for x in jsondecode(v.api_response)["data"]["members"] : x["user"]["id"] => x } }
  # Verify that user is a member of all teams
  team_membership_checks = alltrue([for k, v in local.team_members : lookup(v, opsgenie_user.user.id, "") != ""])
}

output "opsgenie_user_membership_check" {
  value = local.team_membership_checks

  precondition {
    condition     = local.team_membership_checks
    error_message = "The user must be attached to all OpsGenie teams they are assigned to - please remove 'module.opsgenie_user[0].restapi_object.opsgenie_team_membership[<team_name>]' and re-apply."
  }
}

[MarcosRava]

please, someone could merge this feature? Its very important to manage team members changes