compute: add managed workload identity support to BackendService

[michallowicki]

Adds new field tls_settings.identity to the backend service resource.
Includes additional generated_authentication_config output-only field and custom encoding/decoding to handle the authentication config generated by server when identity is set.

Fixes hashicorp/terraform-provider-google#29229

Release Note Template for Downstream PRs (will be copied)

See Write release notes for guidance.

compute: added support for Backend mTLS with managed workload identity

[github-actions]

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@rileykarson, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit a1dc576:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	8 files changed, 398 insertions(+)
google-beta provider	View Diff	8 files changed, 398 insertions(+)
terraform-google-conversion	View Diff	10 files changed, 180 insertions(+)
Open in Cloud Shell	View Diff	8 files changed, 238 insertions(+)

Test report

Analytics

Total Tests	Passed	Skipped	Affected
1560	1455	95	10

Affected Service Packages

• compute

Learn how VCR tests work

---

Step 1: Replaying Mode

Action taken

Found 10 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit.

Click here to see the affected tests

• TestAccComputeBackendService_backendServiceIdentityExample
• TestAccComputeBackendService_backendServiceInFlightExample
• TestAccComputeInstanceFromMachineImage_diffProject
• TestAccComputeInstanceTemplate_gracefulShutdown
• TestAccComputeInstance_GracefulShutdownWithResetUpdate
• TestAccComputeInstance_GracefulShutdownWithoutResetUpdate
• TestAccComputeRegionBackendService_regionBackendServiceIdentityExample
• TestAccComputeRegionInstanceTemplate_gracefulShutdown
• TestAccComputeSecurityPolicy_withPreconfiguredWafConfig
• TestAccComputeTargetInstance_withSecurityPolicy

View the replaying VCR build log

---

Step 2: Recording Mode

Recording Mode	Replaying Rerun	Test Name
✅ Log	✅	TestAccComputeBackendService_backendServiceIdentityExample
✅ Log	✅	TestAccComputeRegionBackendService_regionBackendServiceIdentityExample
❌ Error · Log	-	TestAccComputeBackendService_backendServiceInFlightExample
❌ Error · Log	-	TestAccComputeInstanceFromMachineImage_diffProject
❌ Error · Log	-	TestAccComputeInstanceTemplate_gracefulShutdown
❌ Error · Log	-	TestAccComputeInstance_GracefulShutdownWithResetUpdate
❌ Error · Log	-	TestAccComputeInstance_GracefulShutdownWithoutResetUpdate
❌ Error · Log	-	TestAccComputeRegionInstanceTemplate_gracefulShutdown
❌ Error · Log	-	TestAccComputeSecurityPolicy_withPreconfiguredWafConfig
❌ Error · Log	-	TestAccComputeTargetInstance_withSecurityPolicy

Caution

Issues requiring attention before PR completion

🔴 Initial Recording Failed: Some tests failed during the recording step. See the table above for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the recording VCR build log or the debug logs folder for detailed results.

@michallowicki, @rileykarson VCR tests complete for a1dc576!