Make bootstrapping use VCR configs when possible

[trodge]

Background

Certain VCR tests are flaky because bootstrapping uses libraries that violate the assumptions of VCR replaying. They do this by pulling credentials from environment variables.

For example, IAM bootstrapping uses google.golang.org/api/cloudresourcemanager/v1 to read the policy on test projects and modify it if needed permissions are missing. This is problematic because tests run in VCR REPLAYING mode could still potentially make calls that return 409 (unavailable) errors and consume resources needed to run other tests.

What kind of contribution is this issue about?

• test fixes
• general contributions

Related PR(s), if any:

• Failing VCR test(s): TestAccDataSourceGoogleServiceAccount*Token_* #16247

Details

The proposed solution is to use the cached config from VCR to perform bootstrapping. This will prevent the test from making any real changes to configuration when it is run in REPLAYING mode.

[melinath]

@trodge assigning to you because you had been working on this but please unassign if you've moved on to other things.

[melinath]

Note from discussion with @trodge: this could potentially be replaced in terms of CI by automating deployment of CI infra with Terraform. However, this would potentially make it harder for folks to run tests locally (unless they apply our CI infra Terraform as well, which could be tricky because it not split out by service / resource.)

We should think about what the expected UX for contributors should be.

[melinath]

Note from discussion with @trodge: IAM bootstrapping will generally give clear error messages and would probably be okay to handle with bootstrapping (though we should think through the implications more fully before proceeding.)

Adding here: That doesn't necessarily mean that we should stop using bootstrapping for other types of resources, which would not be as easy for contributors to provision correctly based on error messages.