user: handle unknown superuser passwords

[bendrucker]

Currently, it's not possible to define configuration like this:

resource "redshift_user" "terraform" {
  name      = "terraform"
  superuser = true
  password  = random_password.terraform.result
}

resource "random_password" "terraform" {
  length      = 64
  min_lower   = 1
  min_upper   = 1
  min_numeric = 1
}

Given this configuration, the provider returns an error:

Users that are superusers must define a password.

Upon further investigation, this error is returned from CustomizeDiff. This hook runs before a plan is rendered. This means that on first run, before the Create method for random_password has run, the value for result is not yet known.

GetOk will still return _, true, because it is known that some value is set. When the value is unknown, Get will return the zero value. Any plan time inspection can only occur when the new value is known at plan time.

While I didn't set up real cluster credentials to run the acceptance tests to success for this, I did execute them to ensure that the added test case fails with the original error and proceeds to a connection error with the fix.

[mtesch-um]

does this also fix #56 ?

[bendrucker]

This only changes the behavior when password is unknown, not when it is unset.

I did find the validation implemented in the CustomizeDiff helpful. Originally I planned to use IAM auth only for the superuser but added a generated password as above since it's required. A viable approach to #56 that doesn't remove this plan-time validation might be something like this:

old, _ := d.GetChange(userPasswordAttr)
if d.Id() != "" && old.(string) == "" {
  // valid: resource is not being created (has id) and no existing password is in state (was imported)
}

Where d is ResourceDiff.

[bendrucker]

There's probably some logic missing there though. Like you'd also need to check whether superuser's value has changed. If the user was previously not a superuser and had no password but is being converted, a password is presumably required.