@intentius/chant-lexicon-gcp 0.124.38 → 0.124.40

package/src/health.ts

@@ -1,5 +1,7 @@
 /**
- * Runtime health for GCP (#4177): Cloud Run services.
+ * Runtime health for GCP (#4177): Cloud Run services; and (#4239) backend
+ * services, from `getHealth` on each backend group, and IAM policy members,
+ * healthy when the member holds the role in the target's policy.
  *
  * A Cloud Run v2 service carries its `Ready` condition as `terminalCondition`
  * (`CONDITION_SUCCEEDED`, `CONDITION_FAILED`, pending or reconciling). The v1
@@ -10,10 +12,10 @@
  */
 
 import type { HealthEntry, HealthReadOptions, HealthReadResult, UnobservedEntity } from "@intentius/chant/lexicon";
-import { getResource, GcpReadError, isNotFound, type GcpReadHttp } from "./api/read-client";
-import { deriveGVK, manifestProjectAnnotations, readTargets, resolveReadProject } from "./describe-resources";
+import { getResource, GcpReadError, isNotFound, readUrl, type GcpReadHttp } from "./api/read-client";
+import { deriveGVK, manifestProjectAnnotations, readManifest, readTargets, resolveReadProject } from "./describe-resources";
 
-export const GCP_HEALTH_TYPES = ["GCP::Run::Service"] as const;
+export const GCP_HEALTH_TYPES = ["GCP::Run::Service", "GCP::Compute::BackendService", "GCP::Iam::PolicyMember"] as const;
 
 export interface GcpHealthOptions extends HealthReadOptions {
   http?: GcpReadHttp;
@@ -68,6 +70,77 @@ export function cloudRunEntry(body: CloudRunServiceState, observedAt: string): H
   };
 }
 
+/** One backend group's `getHealth` answer: `healthStatus[].healthState` per endpoint. */
+export interface BackendGroupHealth {
+  group: string;
+  healthStatus?: Array<{ healthState?: string }>;
+  /** Set when the call failed; the group then counts as unknown. */
+  error?: string;
+}
+
+/**
+ * A backend service's verdict from its groups: any endpoint `UNHEALTHY` is
+ * unhealthy; every endpoint `HEALTHY`, with at least one, is healthy; anything
+ * else (no backends, a group that reports no status, as a serverless NEG
+ * does, a failed call) is unknown.
+ */
+export function backendServiceEntry(groups: readonly BackendGroupHealth[], observedAt: string): HealthEntry {
+  const type = "GCP::Compute::BackendService";
+  if (groups.length === 0) return { type, state: "unknown", detail: "no backends", observedAt };
+  let healthy = 0;
+  let unhealthy = 0;
+  let unknown = 0;
+  for (const g of groups) {
+    const states = g.error ? [] : (g.healthStatus ?? []).map((h) => (h.healthState ?? "").toUpperCase());
+    if (states.length === 0) unknown++;
+    else if (states.some((st) => st === "UNHEALTHY")) unhealthy++;
+    else if (states.every((st) => st === "HEALTHY")) healthy++;
+    else unknown++;
+  }
+  const state = unhealthy > 0 ? "unhealthy" : healthy === groups.length ? "healthy" : "unknown";
+  const parts = [`${healthy} of ${groups.length} backend${groups.length === 1 ? "" : "s"} healthy`];
+  if (unhealthy) parts.push(`${unhealthy} unhealthy`);
+  if (unknown) parts.push(`${unknown} with no health status`);
+  return { type, state, detail: parts.join(", "), observedAt };
+}
+
+/** A binding the read found in its target's policy. A missing one is `absent`, never here. */
+export function policyMemberEntry(binding: { role?: string; member?: string; resource?: string }, observedAt: string): HealthEntry {
+  return {
+    type: "GCP::Iam::PolicyMember",
+    state: "healthy",
+    detail: `${binding.member ?? "member"} holds ${binding.role ?? "the role"}${binding.resource ? ` on ${binding.resource}` : ""}`,
+    observedAt,
+  };
+}
+
+const defaultReadHttp: GcpReadHttp = async (method, url, body) => {
+  const res = await fetch(url, {
+    method,
+    ...(body === undefined ? {} : { headers: { "content-type": "application/json" }, body: JSON.stringify(body) }),
+  });
+  return { status: res.status, text: await res.text() };
+};
+
+/** `getHealth` for each of a backend service's groups, at the service's own read URL. */
+async function backendGroupsHealth(url: string, body: Record<string, unknown>, http: GcpReadHttp): Promise<BackendGroupHealth[]> {
+  const backends = Array.isArray(body.backends) ? (body.backends as Array<{ group?: unknown }>) : [];
+  return Promise.all(
+    backends
+      .map((b) => b.group)
+      .filter((g): g is string => typeof g === "string")
+      .map(async (group) => {
+        try {
+          const res = await http("POST", `${url}/getHealth`, { group });
+          if (res.status < 200 || res.status >= 300) return { group, error: `getHealth ${res.status}` };
+          return { group, ...(JSON.parse(res.text) as { healthStatus?: Array<{ healthState?: string }> }) };
+        } catch (err) {
+          return { group, error: err instanceof Error ? err.message : String(err) };
+        }
+      }),
+  );
+}
+
 export async function observeHealthGcp(options: GcpHealthOptions): Promise<HealthReadResult> {
   const observedAt = (options.now?.() ?? new Date()).toISOString();
   const endpoint = process.env.GCP_ENDPOINT_URL;
@@ -76,6 +149,7 @@ export async function observeHealthGcp(options: GcpHealthOptions): Promise<Healt
   const unobserved: Record<string, UnobservedEntity> = {};
   const absent: string[] = [];
   const targets = readTargets(options.entities);
+  const manifest = readManifest(options.entities, targets);
 
   await Promise.all(
     [...options.entities].map(async ([entityName, { entityType }]) => {
@@ -94,13 +168,16 @@ export async function observeHealthGcp(options: GcpHealthOptions): Promise<Healt
         return;
       }
       try {
-        const body = await getResource(
-          { project, ...(endpoint ? { endpoint } : {}), ...(options.http ? { http: options.http } : {}) },
-          gvk.kind,
-          name,
-          props,
-        );
-        entities[entityName] = cloudRunEntry(body as CloudRunServiceState, observedAt);
+        const client = { project, ...(endpoint ? { endpoint } : {}), ...(options.http ? { http: options.http } : {}), manifest };
+        const body = await getResource(client, gvk.kind, name, props);
+        if (gvk.kind === "ComputeBackendService") {
+          const groups = await backendGroupsHealth(readUrl(client, gvk.kind, name, props), body, options.http ?? defaultReadHttp);
+          entities[entityName] = backendServiceEntry(groups, observedAt);
+        } else if (gvk.kind === "IAMPolicyMember") {
+          entities[entityName] = policyMemberEntry(body as { role?: string; member?: string; resource?: string }, observedAt);
+        } else {
+          entities[entityName] = cloudRunEntry(body as CloudRunServiceState, observedAt);
+        }
       } catch (err) {
         if (isNotFound(err)) {
           absent.push(entityName);

package/src/index.ts

@@ -32,7 +32,7 @@ export * from "./generated/index";
 export {
   GkeCluster, CloudRunServiceComposite, CloudSqlInstance, GcsBucket, VpcNetwork,
   PubSubPipeline, CloudFunctionWithTrigger, PrivateService, ManagedCertificate, SecureProject,
-  MemorystoreRedis, MultiRegionVpc, GkeCrdbRegion, GpuNodePool,
+  MemorystoreRedis, MultiRegionVpc, GkeCrdbRegion, GpuNodePool, PrivateEgressNetwork, PublicCloudRun,
   GovernanceFoundation, LocationRestriction, OrganizationAuditConfig,
 } from "./composites/index";
 export type {
@@ -50,6 +50,7 @@ export type {
   MultiRegionVpcConfig, MultiRegionVpcRegion,
   GkeCrdbRegionConfig, GkeCrdbRegionNodeConfig,
   GpuNodePoolProps, GpuNodePoolTaint,
+  PrivateEgressNetworkProps, PublicCloudRunProps,
   GovernanceFoundationProps, LocationRestrictionProps, OrganizationAuditConfigProps,
 } from "./composites/index";
 
@@ -77,3 +78,14 @@ export type { PackageOptions, PackageResult } from "./codegen/package";
 // LSP providers
 export { gcpCompletions } from "./lsp/completions";
 export { gcpHover } from "./lsp/hover";
+
+// Component capabilities (#4273): core loads `gcpCapabilityPlugin` when a
+// project's chant.config lists this lexicon, which registers `gcp-apply`.
+export { gcpCapabilityPlugin, GCP_VERB_FAMILIES } from "./components/capability-plugin";
+export {
+  gcpApplyCapability,
+  createGcpApplyCapability,
+  GcpPlanMovedError,
+  type GcpApplyStepInput,
+  type GcpApplyStepOutput,
+} from "./components/gcp-apply";

package/src/op/activities/gcp-apply.ts

@@ -5,6 +5,7 @@ import { hasOwnershipMarker, OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant
 import { GCP_RESOURCE_OWNERSHIP_KEYS } from "../../ownership";
 import { iamPolicyMemberMapper } from "./gcp-iam";
 import {
+  changedFields,
   backendServiceMapper,
   computeAddressMapper,
   forwardingRuleMapper,
@@ -104,8 +105,21 @@ export interface ApplyPlan {
   getUrl: string;
   create: { method: "POST" | "PUT"; url: string; body: unknown };
   update?: { method: "PATCH" | "PUT"; url: string; body: unknown };
+  /**
+   * In place of `update`, for a resource whose update depends on the live body
+   * (#4238): compute updates carry the live `fingerprint`, and some fields only
+   * change through a setter (`setTarget`, `setLabels`). Returns the requests to
+   * send, none when the live resource already matches, or `replace` naming what
+   * differs on a field that can't change in place.
+   */
+  reconcile?(live: unknown, http: GcpHttp, signal?: AbortSignal): Promise<ReconcileStep>;
 }
 
+/** What {@link ApplyPlan.reconcile} decided for an existing resource. */
+export type ReconcileStep =
+  | { requests: Array<{ method: "POST" | "PATCH" | "PUT"; url: string; body: unknown }> }
+  | { replace: string };
+
 /**
  * Handles an async create whose response is a long-running operation. Present
  * only on mappers for resources that provision asynchronously (Cloud Run, GKE,
@@ -626,10 +640,62 @@ const defaultHttp: GcpHttp = async (method, url, body, signal) => {
 };
 
 /**
- * Reconcile one resource via its mapper: `GET` it; if present, PATCH it to the
- * desired state (when the mapper supports `update`, else leave it); if absent,
- * create it. Async create/update return an operation that is polled to
- * completion. `http` is injectable for tests.
+ * What apply does to one existing-or-absent resource, decided from a read
+ * (#4273). `applyResource` acts on it and a `gcp-apply` plan reports it, so
+ * the two cannot disagree:
+ *
+ * - `create`: the GET did not answer 200 (`readStatus` says what it did).
+ * - `update`: the resource exists and the desired body holds a value the live
+ *   one does not. `fields` names those top-level fields, `requests` are what
+ *   apply sends.
+ * - `unchanged`: the resource exists and holds every desired value, or its
+ *   kind has no in-place update.
+ * - `replace-required`: a field differs that can't change in place. Apply
+ *   reports it and leaves the resource alone.
+ *
+ * `http` is only read through, except by a mapper's `reconcile`, which may GET
+ * a referenced resource. A kind with `custom` ops decides from its `read`.
+ */
+export type ResourceDecision =
+  | { action: "create"; readStatus: number }
+  | { action: "update"; fields: string[]; requests: Array<{ method: string; url: string; body: unknown }>; live: unknown }
+  | { action: "unchanged"; live: unknown }
+  | { action: "replace-required"; reason: string; live: unknown };
+
+export async function decideResource(
+  mapper: ResourceMapper,
+  resource: GcpResource,
+  ctx: MapperCtx,
+  http: GcpHttp = defaultHttp,
+  signal?: AbortSignal,
+): Promise<ResourceDecision> {
+  if (mapper.custom) {
+    const read = await mapper.custom.read(resource, ctx, http, signal);
+    return read.status === 200 ? { action: "unchanged", live: parseJson(read.text) } : { action: "create", readStatus: read.status };
+  }
+  const plan = mapper.plan(resource, ctx);
+  const get = await http("GET", plan.getUrl, undefined, signal);
+  if (get.status !== 200) return { action: "create", readStatus: get.status };
+  const live = parseJson(get.text);
+  const liveObj = live !== null && typeof live === "object" && !Array.isArray(live) ? (live as Record<string, unknown>) : {};
+  const desired = plan.create.body !== null && typeof plan.create.body === "object" ? (plan.create.body as Record<string, unknown>) : {};
+  const fields = changedFields(desired, liveObj);
+  if (plan.reconcile) {
+    const step = await plan.reconcile(live, http, signal);
+    if ("replace" in step) return { action: "replace-required", reason: step.replace, live };
+    return step.requests.length > 0 ? { action: "update", fields, requests: step.requests, live } : { action: "unchanged", live };
+  }
+  // A kind with an in-place update sends it only when a desired field differs:
+  // a PATCH that changes nothing still costs a Cloud Run revision.
+  if (!plan.update || fields.length === 0) return { action: "unchanged", live };
+  return { action: "update", fields, requests: [plan.update], live };
+}
+
+/**
+ * Reconcile one resource via its mapper: decide from a GET what it needs
+ * ({@link decideResource}), then create it, send its updates, or leave it.
+ * Async create/update return an operation that is polled to completion.
+ * `http` is injectable for tests.
  */
 export async function applyResource(
   mapper: ResourceMapper,
@@ -637,34 +703,39 @@ export async function applyResource(
   ctx: MapperCtx,
   http: GcpHttp = defaultHttp,
   signal?: AbortSignal,
-): Promise<{ kind: string; name: string; created: boolean; updated: boolean }> {
+): Promise<{ kind: string; name: string; created: boolean; updated: boolean; replaceRequired?: string }> {
   const name = resource.metadata?.name ?? "?";
   if (mapper.custom) {
     const result = await mapper.custom.apply(resource, ctx, http, signal);
     return { kind: mapper.kind, name, ...result };
   }
-  const plan = mapper.plan(resource, ctx);
-  const get = await http("GET", plan.getUrl, undefined, signal);
-
-  if (get.status === 200) {
-    // Exists. Reconcile to desired if the mapper supports it; otherwise leave it.
-    if (!plan.update) {
+  const decision = await decideResource(mapper, resource, ctx, http, signal);
+  switch (decision.action) {
+    case "replace-required":
+      // Reported, not attempted: replacing deletes the resource, which apply never does on its own.
+      console.log(`replace required: ${mapper.kind}/${name}: ${decision.reason}`);
+      return { kind: mapper.kind, name, created: false, updated: false, replaceRequired: decision.reason };
+    case "unchanged":
       return { kind: mapper.kind, name, created: false, updated: false };
+    case "update":
+      for (const req of decision.requests) {
+        const res = await http(req.method, req.url, req.body, signal);
+        if (res.status >= 300) {
+          throw new Error(`${mapper.kind} ${name} update failed (${res.status}): ${res.text}`);
+        }
+        await pollIfAsync(mapper, res.text, ctx, http, signal);
+      }
+      return { kind: mapper.kind, name, created: false, updated: true };
+    case "create": {
+      const plan = mapper.plan(resource, ctx);
+      const res = await http(plan.create.method, plan.create.url, plan.create.body, signal);
+      if (res.status >= 300) {
+        throw new Error(`${mapper.kind} ${name} create failed (${res.status}): ${res.text}`);
+      }
+      await pollIfAsync(mapper, res.text, ctx, http, signal);
+      return { kind: mapper.kind, name, created: true, updated: false };
     }
-    const res = await http(plan.update.method, plan.update.url, plan.update.body, signal);
-    if (res.status >= 300) {
-      throw new Error(`${mapper.kind} ${name} update failed (${res.status}): ${res.text}`);
-    }
-    await pollIfAsync(mapper, res.text, ctx, http, signal);
-    return { kind: mapper.kind, name, created: false, updated: true };
-  }
-
-  const res = await http(plan.create.method, plan.create.url, plan.create.body, signal);
-  if (res.status >= 300) {
-    throw new Error(`${mapper.kind} ${name} create failed (${res.status}): ${res.text}`);
   }
-  await pollIfAsync(mapper, res.text, ctx, http, signal);
-  return { kind: mapper.kind, name, created: true, updated: false };
 }
 
 /**

package/src/op/activities/gcp-compute-reconcile.test.ts

@@ -0,0 +1,150 @@
+import { beforeEach, describe, expect, test } from "vitest";
+import { applyResource, MAPPERS, type GcpHttp, type GcpResource } from "./gcp-apply";
+import { changedFields, computeLabels, holds } from "./gcp-compute";
+
+beforeEach(() => {
+  delete process.env.GCP_REGION;
+});
+
+const base = "https://compute.googleapis.com";
+const lb: GcpResource[] = [
+  {
+    kind: "ComputeForwardingRule",
+    metadata: { name: "web-fr" },
+    spec: {
+      location: "global",
+      portRange: "80",
+      ipAddress: { addressRef: { name: "web-ip" } },
+      target: { targetHTTPProxyRef: { name: "web-proxy" } },
+    },
+  },
+  { kind: "ComputeTargetHTTPProxy", metadata: { name: "web-proxy" }, spec: { location: "global", urlMapRef: { name: "web-map" } } },
+  { kind: "ComputeURLMap", metadata: { name: "web-map" }, spec: { location: "global", defaultService: { backendServiceRef: { name: "web" } } } },
+  {
+    kind: "ComputeBackendService",
+    metadata: { name: "web" },
+    spec: { location: "global", protocol: "HTTPS", timeoutSec: 30, backend: [{ group: { networkEndpointGroupRef: { name: "web" } } }] },
+  },
+  {
+    kind: "ComputeRegionNetworkEndpointGroup",
+    metadata: { name: "web" },
+    spec: { region: "europe-west1", networkEndpointType: "SERVERLESS", cloudRun: { serviceRef: { name: "web" } } },
+  },
+  { kind: "ComputeAddress", metadata: { name: "web-ip" }, spec: { location: "global" } },
+];
+const ctx = { base, project: "p1", manifest: lb };
+const byKind = (kind: string) => lb.find((r) => r.kind === kind)!;
+const url = (path: string) => `${base}/compute/v1/projects/p1/${path}`;
+const OP = JSON.stringify({ kind: "compute#operation", selfLink: url("global/operations/op-1"), status: "DONE" });
+
+/** A fake compute API: GETs answer from `live`, every write is recorded and returns a finished operation. */
+function fakeCompute(live: Record<string, unknown>) {
+  const writes: Array<{ method: string; url: string; body: unknown }> = [];
+  const http: GcpHttp = async (method, u, body) => {
+    if (method === "GET") {
+      const hit = live[u];
+      if (hit !== undefined) return { status: 200, text: JSON.stringify(hit) };
+      if (u.includes("/operations/")) return { status: 200, text: OP };
+      return { status: 404, text: "" };
+    }
+    writes.push({ method, url: u, body });
+    return { status: 200, text: OP };
+  };
+  return { http, writes };
+}
+
+describe("compute reconcile against the live resource (#4238)", () => {
+  test("holds: a full compute URL holds its partial form, and live-only fields don't count", () => {
+    expect(holds("projects/p1/global/urlMaps/m", url("global/urlMaps/m"))).toBe(true);
+    expect(holds({ a: 1 }, { a: 1, b: 2 })).toBe(true);
+    expect(holds([{ group: "projects/p1/x" }], [{ group: `${base}/compute/v1/projects/p1/x`, balancingMode: "UTILIZATION" }])).toBe(true);
+    expect(holds([1], [1, 2])).toBe(false);
+    expect(changedFields({ name: "n", a: 1, b: 2 }, { name: "other", a: 1, b: 3 })).toEqual(["b"]);
+  });
+
+  test("a backend service that matches is left alone; a change is a PATCH carrying the live fingerprint", async () => {
+    const liveBody = {
+      name: "web",
+      fingerprint: "fp-1",
+      protocol: "HTTPS",
+      timeoutSec: 30,
+      backends: [{ group: url("regions/europe-west1/networkEndpointGroups/web"), balancingMode: "UTILIZATION" }],
+    };
+    const same = fakeCompute({ [url("global/backendServices/web")]: liveBody });
+    await expect(applyResource(MAPPERS.ComputeBackendService, byKind("ComputeBackendService"), ctx, same.http)).resolves.toMatchObject({ updated: false });
+    expect(same.writes).toEqual([]);
+
+    const drifted = fakeCompute({ [url("global/backendServices/web")]: { ...liveBody, timeoutSec: 10 } });
+    await expect(applyResource(MAPPERS.ComputeBackendService, byKind("ComputeBackendService"), ctx, drifted.http)).resolves.toMatchObject({ updated: true });
+    expect(drifted.writes).toHaveLength(1);
+    expect(drifted.writes[0]).toMatchObject({ method: "PATCH", url: url("global/backendServices/web"), body: { timeoutSec: 30, fingerprint: "fp-1" } });
+  });
+
+  test("a URL map's new default service is a PATCH with the fingerprint", async () => {
+    const f = fakeCompute({ [url("global/urlMaps/web-map")]: { name: "web-map", fingerprint: "fp-m", defaultService: url("global/backendServices/old") } });
+    await applyResource(MAPPERS.ComputeURLMap, byKind("ComputeURLMap"), ctx, f.http);
+    expect(f.writes).toEqual([
+      { method: "PATCH", url: url("global/urlMaps/web-map"), body: expect.objectContaining({ defaultService: "projects/p1/global/backendServices/web", fingerprint: "fp-m" }) },
+    ]);
+  });
+
+  test("a proxy's URL map changes through setUrlMap", async () => {
+    const f = fakeCompute({ [url("global/targetHttpProxies/web-proxy")]: { name: "web-proxy", urlMap: url("global/urlMaps/old") } });
+    await applyResource(MAPPERS.ComputeTargetHTTPProxy, byKind("ComputeTargetHTTPProxy"), ctx, f.http);
+    expect(f.writes).toEqual([{ method: "POST", url: url("global/targetHttpProxies/web-proxy/setUrlMap"), body: { urlMap: "projects/p1/global/urlMaps/web-map" } }]);
+  });
+
+  test("a forwarding rule: the declared address's IP holds, the target changes by setTarget, labels by setLabels", async () => {
+    const f = fakeCompute({
+      [url("global/forwardingRules/web-fr")]: {
+        name: "web-fr",
+        portRange: "80",
+        IPAddress: "34.1.2.3",
+        target: url("global/targetHttpProxies/old"),
+        labels: {},
+        labelFingerprint: "lf-1",
+      },
+      [url("global/addresses/web-ip")]: { name: "web-ip", address: "34.1.2.3" },
+    });
+    await applyResource(MAPPERS.ComputeForwardingRule, byKind("ComputeForwardingRule"), ctx, f.http);
+    expect(f.writes).toEqual([
+      { method: "POST", url: url("global/forwardingRules/web-fr/setTarget"), body: { target: "projects/p1/global/targetHttpProxies/web-proxy" } },
+      { method: "POST", url: url("global/forwardingRules/web-fr/setLabels"), body: { labels: computeLabels(undefined), labelFingerprint: "lf-1" } },
+    ]);
+  });
+
+  test("a forwarding rule on another IP, a changed address and a changed NEG are reported for replacement, not written", async () => {
+    const fr = fakeCompute({
+      [url("global/forwardingRules/web-fr")]: {
+        name: "web-fr",
+        portRange: "80",
+        IPAddress: "10.0.0.9",
+        target: url("global/targetHttpProxies/web-proxy"),
+        labels: computeLabels(undefined),
+      },
+      [url("global/addresses/web-ip")]: { name: "web-ip", address: "34.1.2.3" },
+    });
+    const r = await applyResource(MAPPERS.ComputeForwardingRule, byKind("ComputeForwardingRule"), ctx, fr.http);
+    expect(r).toMatchObject({ updated: false, replaceRequired: expect.stringContaining("IPAddress") });
+    expect(fr.writes).toEqual([]);
+
+    const neg = fakeCompute({
+      [url("regions/europe-west1/networkEndpointGroups/web")]: { name: "web", networkEndpointType: "SERVERLESS", cloudRun: { service: "other" } },
+    });
+    const n = await applyResource(MAPPERS.ComputeRegionNetworkEndpointGroup, byKind("ComputeRegionNetworkEndpointGroup"), ctx, neg.http);
+    expect(n.replaceRequired).toMatch(/cloudRun/);
+    expect(neg.writes).toEqual([]);
+
+    const addr = fakeCompute({ [url("global/addresses/web-ip")]: { name: "web-ip", address: "34.1.2.3", labels: computeLabels(undefined), addressType: "INTERNAL" } });
+    const changed = { ...byKind("ComputeAddress"), spec: { location: "global", addressType: "EXTERNAL" } };
+    const a = await applyResource(MAPPERS.ComputeAddress, changed, ctx, addr.http);
+    expect(a.replaceRequired).toMatch(/addressType/);
+    expect(addr.writes).toEqual([]);
+  });
+
+  test("an address's labels change through setLabels", async () => {
+    const f = fakeCompute({ [url("global/addresses/web-ip")]: { name: "web-ip", address: "34.1.2.3", labels: {}, labelFingerprint: "lf-a" } });
+    await applyResource(MAPPERS.ComputeAddress, byKind("ComputeAddress"), ctx, f.http);
+    expect(f.writes).toEqual([{ method: "POST", url: url("global/addresses/web-ip/setLabels"), body: { labels: computeLabels(undefined), labelFingerprint: "lf-a" } }]);
+  });
+});

package/src/op/activities/gcp-compute.test.ts

@@ -60,7 +60,7 @@ describe("compute load balancer mappers (#4233)", () => {
   });
 
   test("a serverless NEG is regional and names its Cloud Run service", () => {
-    expect(plan("ComputeRegionNetworkEndpointGroup")).toEqual({
+    expect(plan("ComputeRegionNetworkEndpointGroup")).toMatchObject({
       getUrl: "https://compute.googleapis.com/compute/v1/projects/p1/regions/europe-west1/networkEndpointGroups/web",
       create: {
         method: "POST",
@@ -138,7 +138,9 @@ describe("compute operations (#4233)", () => {
     let exists = false;
     const http: GcpHttp = async (method, url) => {
       calls.push(`${method} ${url}`);
-      if (method === "GET" && url.endsWith("/addresses/web-ip")) return exists ? { status: 200, text: "{}" } : { status: 404, text: "" };
+      if (method === "GET" && url.endsWith("/addresses/web-ip")) {
+        return exists ? { status: 200, text: JSON.stringify({ name: "web-ip", labels: computeLabels(undefined) }) } : { status: 404, text: "" };
+      }
       if (method === "POST") {
         exists = true;
         return { status: 200, text: JSON.stringify({ kind: "compute#operation", selfLink: "https://compute.googleapis.com/compute/v1/projects/p1/global/operations/op-1", status: "PENDING" }) };