Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Bug] 0-bootstrap: essentialcontacts.managed.allowedContactDomains parameters are double-encoded (organization.tf jsonencode()s the JSON string from platform_policy.yaml) — the post-migration apply fails

Cerrado Apto para principiantes
  • ¿Algo no está bien?
#256 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 3 días

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
88/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
google-cloud, terraform
Área
cloud, infrastructure

Línea de trabajo

Comienza por fast/stages-aw/0-bootstrap/organization.tf:139 y el valor del parámetro en fast/stages-aw/0-bootstrap/data/custom-org-policies/platform_policy.yaml:101; compara la ruta de Stage custom-org-policies con modules/organization-se/organization-policies.tf:72-74. Reprodúcelo con el segundo apply de Stage 0 de docs/ddg.md y confirma que terraform plan ya no muestra una doble codificación y que el apply tiene éxito para essentialcontacts.managed.allowedContactDomains.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Bug Level of Effort - Low Priority - High

Bug Description

Since PR #210 (7a326393, first shipped in v4.0.0) the managed constraint's parameters in fast/stages-aw/0-bootstrap/data/custom-org-policies/platform_policy.yaml:101 are written as a JSON string:

essentialcontacts.managed.allowedContactDomains:
  rules:
  - enforce: true
    parameters: '{"allowedDomains":["@${domain_name}"]}'

The stage renders that file with templatefile and formalizes each rule in 0-bootstrap/organization.tf:139:

parameters = try(jsonencode(r.parameters), null)

jsonencode of a value that is already a JSON string produces a JSON string literal — "{\"allowedDomains\":[\"@example.com\"]}" — not the object. The provider's google_org_policy_policy validates spec.rules.parameters as JSON (a string literal is valid JSON), so terraform plan accepts it, and the apply fails when the provider unmarshals the value into a map:

Error: json: cannot unmarshal string into Go value of type map[string]interface {}

  with module.organization.google_org_policy_policy.default["essentialcontacts.managed.allowedContactDomains"],
  on ../../../modules/organization-se/organization-policies.tf line 105, in resource "google_org_policy_policy" "default":

Because organization.tf:325 applies org policies only once bootstrap_user is unset (org_policies = var.bootstrap_user != null ? null : local.org_policies), the failure lands on the second Stage 0 apply — the one docs/ddg.md runs after the state migration and import.sh — on every deployment that follows the guide. Where the policy already exists (an organization redeployed under a new prefix), terraform plan shows it "updated in-place" from the object to the string literal, which is the clearest way to see the double encoding:

~ parameters = jsonencode(
      {
        - allowedDomains = [
            - "@example.com",
          ]
      }
  ) -> "\"{\\\"allowedDomains\\\":[\\\"@example.com\\\"]}\""

The module's own factory path (modules/organization-se/organization-policies.tf:72-74) passes templatestring(r.parameters, …) through untouched; only the stage's custom-org-policies path applies jsonencode. The essential-contacts policy is the only entry in the tree with a parameters key, so nothing else is affected.

Environment and Deployment Context

  • Stellar Engine Version/Commit: v4.0.0 (6d7d08c0); the same two lines on main (20830097, 2026-09-18). Introduced by PR #210 (2026-08-31). Provider hashicorp/google v6.50.0.
  • Deployment Type:
    • US Region Restricted (e.g., Access Policy constraint)
    • FedRAMP Moderate
    • FedRAMP High
    • DoD IL4
    • DoD IL5
    • Stand-alone / Custom
  • FAST Stage (if applicable):
    • Stage 0 (Bootstrap)
    • Stage 1 (Resource Management)
    • Stage 2 (Networking)
    • Stage 3 (Security)

Steps to Reproduce

  1. Follow docs/ddg.md through Stage 0: the first terraform apply -var bootstrap_user=…, the state migration, ./import.sh.
  2. terraform apply (the "one more time" apply of the guide).
  3. Observe the error above on google_org_policy_policy.default["essentialcontacts.managed.allowedContactDomains"]. In an organization where the policy already exists, terraform plan first shows the in-place update from the object to the string literal.

Expected Behavior

The second Stage 0 apply completes, and the policy is set with parameters = {"allowedDomains": ["@<domain>"]} — the outcome PR #210 intended for #108.

Actual Behavior

The apply fails; the policy is not set (fresh organization) or is left as it was (redeployment). The rest of the stage's org policies apply.

Relevant Logs and Errors

See above.

Additional Context

  • Fix, either form (one line): organization.tf:139 → parameters = try(r.parameters, null); or keep the jsonencode and write the YAML value as a map, parameters: {allowedDomains: ["@${domain_name}"]}, which is presumably what the jsonencode was written for. The first form was verified on a live deployment: terraform plan then reports no change to the policy.
  • Related: #108 / PR #210 (the parameters were added to fix contacts being blocked org-wide); this report is about how they are encoded, not whether they are present.
Lenguaje dominante
HCL
Estrellas
55
Forks
21
Merge medio
1 d 22 h
PR fusionados (30 d)
24

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de google/stellar-engine

Todos los issues de google/stellar-engine

Issues similares

Más issues de Cloud

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.