feat: set team/squad variable defaults to 'unknown' (#1020)

## Summary

Set default values for `team` and `squad` variables to "unknown" across
all Terraform modules.

## Impact

This lets us distinguish between:

- could be labeled with a team but we haven't set the value yet, and
- haven't done the work to make it label-able

## Follow-up

The "is required" variables are no longer meaningful. My plan is to do
one pass to strip out the logic, then find all our call sites & remove
it there, then remove it here and release as a breaking change.

---------

Co-authored-by: Claude <[email protected]>

Author: jml

modules/alerting/README.md

@@ -74,7 +74,7 @@ No modules.
 | <a name="input_project_id"></a> [project\_id](#input\_project\_id) | n/a | `string` | n/a | yes |
 | <a name="input_scaling_issue_filter"></a> [scaling\_issue\_filter](#input\_scaling\_issue\_filter) | additional filter to apply to scaling issue alert policy | `string` | `""` | no |
 | <a name="input_signal_filter"></a> [signal\_filter](#input\_signal\_filter) | additional filter to apply to signal alert policy | `string` | `""` | no |
-| <a name="input_squad"></a> [squad](#input\_squad) | squad to filter on if non-empty | `string` | `""` | no |
+| <a name="input_squad"></a> [squad](#input\_squad) | squad to filter on if non-empty | `string` | `"unknown"` | no |
 | <a name="input_timeout_filter"></a> [timeout\_filter](#input\_timeout\_filter) | additional filter to apply to timeout alert policy | `string` | `""` | no |
 
 ## Outputs

modules/alerting/variables.tf

@@ -124,7 +124,7 @@ EOT
 variable "squad" {
   description = "squad to filter on if non-empty"
   type        = string
-  default     = ""
+  default     = "unknown"
 }
 
 variable "global_only_alerts" {

modules/bastion/README.md

@@ -160,7 +160,7 @@ No modules.
 | <a name="input_patch_time_utc"></a> [patch\_time\_utc](#input\_patch\_time\_utc) | Time of day in HH:MM (UTC) when patching runs. | `string` | `"03:00"` | no |
 | <a name="input_product"></a> [product](#input\_product) | Product label to apply to the service. | `string` | `"unknown"` | no |
 | <a name="input_project_id"></a> [project\_id](#input\_project\_id) | Project in which to deploy the bastion host. | `string` | n/a | yes |
-| <a name="input_squad"></a> [squad](#input\_squad) | Squad or team label applied to the instance (required). | `string` | n/a | yes |
+| <a name="input_squad"></a> [squad](#input\_squad) | Squad or team label applied to the instance (required). | `string` | `"unknown"` | no |
 | <a name="input_startup_script"></a> [startup\_script](#input\_startup\_script) | additional startup script snippet to execute on bastion. | `string` | `""` | no |
 | <a name="input_subnetwork"></a> [subnetwork](#input\_subnetwork) | Subnetwork name the bastion joins (must be private). | `string` | n/a | yes |
 | <a name="input_zone"></a> [zone](#input\_zone) | Compute Engine zone for the bastion VM (e.g. us-central1-a). | `string` | n/a | yes |

modules/bastion/variables.tf

@@ -36,6 +36,7 @@ variable "dev_principals" {
 variable "squad" {
   description = "Squad or team label applied to the instance (required)."
   type        = string
+  default     = "unknown"
 
   validation {
     condition     = length(trim(var.squad, " \t\n\r")) > 0

modules/bucket-events/README.md

@@ -129,7 +129,7 @@ No requirements.
 | <a name="input_project_id"></a> [project\_id](#input\_project\_id) | n/a | `string` | n/a | yes |
 | <a name="input_regions"></a> [regions](#input\_regions) | A map from region names to a network and subnetwork. The bucket must be in one of these regions. | <pre>map(object({<br/>    network = string<br/>    subnet  = string<br/>  }))</pre> | n/a | yes |
 | <a name="input_require_squad"></a> [require\_squad](#input\_require\_squad) | Whether to require squad variable to be specified | `bool` | `false` | no |
-| <a name="input_squad"></a> [squad](#input\_squad) | squad label to apply to the service. | `string` | `""` | no |
+| <a name="input_squad"></a> [squad](#input\_squad) | squad label to apply to the service. | `string` | `"unknown"` | no |
 
 ## Outputs
 

modules/bucket-events/variables.tf

@@ -55,6 +55,7 @@ variable "deletion_protection" {
   default     = true
 }
 
+
 variable "require_squad" {
   description = "Whether to require squad variable to be specified"
   type        = bool
@@ -64,12 +65,8 @@ variable "require_squad" {
 variable "squad" {
   description = "squad label to apply to the service."
   type        = string
-  default     = ""
+  default     = "unknown"
 
-  validation {
-    condition     = !var.require_squad || var.squad != ""
-    error_message = "squad needs to specified or disable check by setting require_squad = false"
-  }
 }
 
 variable "labels" {

modules/cloudevent-broker/README.md

@@ -120,7 +120,7 @@ No requirements.
 | <a name="input_regions"></a> [regions](#input\_regions) | A map from region names to a network and subnetwork.  A pub/sub topic and ingress service (publishing to the respective topic) will be created in each region, with the ingress service configured to egress all traffic via the specified subnetwork. | <pre>map(object({<br/>    network = string<br/>    subnet  = string<br/>  }))</pre> | n/a | yes |
 | <a name="input_require_squad"></a> [require\_squad](#input\_require\_squad) | Whether to require squad variable to be specified | `bool` | `false` | no |
 | <a name="input_scaling"></a> [scaling](#input\_scaling) | The scaling configuration for the service. | <pre>object({<br/>    min_instances                    = optional(number, 0)<br/>    max_instances                    = optional(number, 100)<br/>    max_instance_request_concurrency = optional(number)<br/>  })</pre> | `{}` | no |
-| <a name="input_squad"></a> [squad](#input\_squad) | squad label to apply to the service. | `string` | `""` | no |
+| <a name="input_squad"></a> [squad](#input\_squad) | squad label to apply to the service. | `string` | `"unknown"` | no |
 
 ## Outputs
 

modules/cloudevent-broker/variables.tf

@@ -44,6 +44,7 @@ variable "enable_profiler" {
   description = "Enable cloud profiler."
 }
 
+
 variable "require_squad" {
   description = "Whether to require squad variable to be specified"
   type        = bool
@@ -53,12 +54,8 @@ variable "require_squad" {
 variable "squad" {
   description = "squad label to apply to the service."
   type        = string
-  default     = ""
+  default     = "unknown"
 
-  validation {
-    condition     = !var.require_squad || var.squad != ""
-    error_message = "squad needs to specified or disable check by setting require_squad = false"
-  }
 }
 
 variable "labels" {

modules/cloudevent-pull-trigger/README.md

@@ -115,7 +115,7 @@ No modules.
 | <a name="input_project_id"></a> [project\_id](#input\_project\_id) | n/a | `string` | n/a | yes |
 | <a name="input_raw_filter"></a> [raw\_filter](#input\_raw\_filter) | Raw PubSub filter to apply, ignores other variables. https://cloud.google.com/pubsub/docs/subscription-message-filter#filtering_syntax | `string` | `""` | no |
 | <a name="input_require_team"></a> [require\_team](#input\_require\_team) | Whether to require team variable to be specified | `bool` | `true` | no |
-| <a name="input_team"></a> [team](#input\_team) | team label to apply to the service. | `string` | `""` | no |
+| <a name="input_team"></a> [team](#input\_team) | team label to apply to the service. | `string` | `"unknown"` | no |
 
 ## Outputs
 

modules/cloudevent-pull-trigger/variables.tf

@@ -103,6 +103,7 @@ variable "ack_deadline_seconds" {
   default     = 300
 }
 
+
 variable "require_team" {
   description = "Whether to require team variable to be specified"
   type        = bool
@@ -112,12 +113,8 @@ variable "require_team" {
 variable "team" {
   description = "team label to apply to the service."
   type        = string
-  default     = ""
+  default     = "unknown"
 
-  validation {
-    condition     = !var.require_team || var.team != ""
-    error_message = "team needs to specified or disable check by setting require_team = false"
-  }
 }
 
 variable "allowed_persistence_regions" {