Skip to content

fix: ignore 'type' field during late initialization for IAM user support#896

Open
fahedouch wants to merge 1 commit intocrossplane-contrib:mainfrom
fahedouch:fix/sql-user-iam-type-late-initializer
Open

fix: ignore 'type' field during late initialization for IAM user support#896
fahedouch wants to merge 1 commit intocrossplane-contrib:mainfrom
fahedouch:fix/sql-user-iam-type-late-initializer

Conversation

@fahedouch
Copy link
Copy Markdown

@fahedouch fahedouch commented Mar 20, 2026

Description of your changes

Reproduction

  1. Create a Cloud SQL IAM user with type: CLOUD_IAM_USER:

    apiVersion: sql.gcp.upbound.io/v1beta2
    kind: User
    metadata:
      name: test-iam-user
    spec:
      forProvider:
        instance: my-instance
        name: user@example.com
        type: CLOUD_IAM_USER
  2. Wait for the resource to be created (Ready=True)

  3. Check the type field in the manifest after a few reconciliation cycles

Current behavior: The type field becomes empty after reconciliation because the GCP API doesn't return it and LateInitializer resets it. This turns the IAM user into a BUILT_IN user.

Expected behavior: The type field should persist with the initially specified value CLOUD_IAM_USER.

How to Fix

Adds LateInitializer.IgnoredFields for the 'type' field in google_sql_user resource to prevent it from being reset to empty during reconciliation. The 'type' field is write-only and not returned by GCP API, causing IAM users (CLOUD_IAM_USER, CLOUD_IAM_SERVICE_ACCOUNT) to be incorrectly converted to BUILT_IN users.

Fixes #

I have:

  • Read and followed Crossplane's contribution process.
  • Run make reviewable to ensure this PR is ready for review.

How has this code been tested

Signed-off-by: Fahed Dorgaa <fahed.dorgaa@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant