datastream: fix perpetual replacement of postgresql connection profiles using server_verification

[mvegter]

The Datastream API marks serverVerification.caCertificate as "Input only" and returns serverVerification as an empty object on read. The generated flatten nils the empty parent block (len(original) == 0) before the field-level ignore_read can apply, so every refresh empties the block in state and — the field being immutable — forces replacement of the connection profile and any dependent google_datastream_stream, triggering a full re-backfill on every apply.

serverAndClientVerification already carries block-level ignore_read and is unaffected; this applies the same to serverVerification. Also adds the previously missing server_verification-only example, whose generated test's post-apply plan check reproduces the bug (fails without this fix, passes with it).

Verified against the live API with a locally generated GA provider: with a healthy state, the released provider wipes the block on refresh and plans destroy/create; the patched provider preserves it and plans no changes.

Related to hashicorp/terraform-provider-google#17352 (same defect class for MySQL, where per-field workarounds suffice because *Set marker booleans keep the block non-empty; PostgreSQL's API has no marker fields, so the block-level form is required).

Release Note Template for Downstream PRs (will be copied)

datastream: fixed perpetual diff and resource replacement on `google_datastream_connection_profile` for `postgresql_profile.ssl_config.server_verification`

[github-actions]

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@malhotrasagar2212, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

[modular-magician]

Hi there, I'm the Modular magician. I've detected the following information about your changes for commit 1a61020:

Diff report

Your PR generated the following diffs in downstream repositories:

Repository	Diff Link	Changes
google provider	View Diff	3 files changed, 185 insertions(+), 16 deletions(-)
google-beta provider	View Diff	3 files changed, 185 insertions(+), 16 deletions(-)
terraform-google-conversion	View Diff	1 file changed, 4 insertions(+)
Open in Cloud Shell	View Diff	4 files changed, 163 insertions(+)

Test report

Important

Manual Verification Required

VCR cannot automatically execute the following tests added in this PR. Please verify them manually:

🔴 TestAccDatastreamConnectionProfile_datastreamConnectionProfilePostgresqlSslconfigServerVerificationExample

Analytics

Total Tests	Passed	Skipped	Affected
21	10	11	0

Affected Service Packages

• datastream

Learn how VCR tests work

---

Step 1: Replaying Mode

🟢 All tests passed in Replaying mode! No Recording was needed.

Caution

Issues requiring attention before PR completion

🔴 Manual Verification Required: New tests were added that are skipped in presubmit tests. See the "Manual Verification Required" section at the top for details.

Please address these issues to complete your PR. If you believe these detections are incorrect or unrelated to your change, please raise the concern with your reviewer.

View the replaying VCR build log

@mvegter, @malhotrasagar2212 VCR tests complete for 1a61020!

[github-actions]

Googlers: For automatic test runs see go/terraform-auto-test-runs.

@SirGitsalot, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look.

You can help make sure that review is quick by doing a self-review and by running impacted tests locally.

[mvegter]

I have added tgc_skip_test: ssl_config examples are not supported in the TGC suite due to the terraform-google-conversion-test-integration failure. Similar to the other case in the file, let me know if this was an actual failure on my end or if it is now resolvable!