Skip to content

[SREP-644]: added check logic to assume-initial-arn#691

Merged
openshift-merge-bot[bot] merged 1 commit intoopenshift:mainfrom
diakovnec:assume-initial-arn
May 30, 2025
Merged

[SREP-644]: added check logic to assume-initial-arn#691
openshift-merge-bot[bot] merged 1 commit intoopenshift:mainfrom
diakovnec:assume-initial-arn

Conversation

@diakovnec
Copy link
Contributor

@diakovnec diakovnec commented May 27, 2025

What type of PR is this?

  • Bug
  • Test Coverage

What this PR does / Why we need it?

This addresses a bug identified and discussed in https://redhat-internal.slack.com/archives/CCX9DB894/p1740008344309409?thread_ts=1739912990.153199&cid=CCX9DB894

bp-cli's initial checking logic here, it only sets the assume-initial-arn if it is empty (""), if user manually set an incorrect ARN, it's not empty, then, code skips the override logic and using the incorrect value.

Added logic for checking the correct ARN and returning a clear error message if the wrong ARN has been provided.

example:

/home/ydiakov/funcwork/cards/osd-28646/backplane-cli/cmd/ocm-backplane/ocm-backplane cloud console 2eigjr6f5uj8u7l6ie5ql5656ohk1nbr
WARN[0000] Your Backplane CLI is not up to date. Please run the command 'ocm backplane upgrade' to upgrade to the latest version  Current version=0.0.0-20250527071218-9286da22c149+dirty Latest version=0.1.46
WARN[0007] assume-initial-arn in backplane config is not set to a valid payer ARN, using: arn:aws:sts::811685182089:assumed-role/811685182089-sre/ydiakov 
ERRO[0008] failed to get cloud console for cluster 2eigjr6f5uj8u7l6ie5ql5656ohk1nbr: failed to assume role with isolated backplane flow: invalid assume-initial-arn: arn:aws:sts::811685182089:assumed-role/811685182089-sre/ydiakov, must be one of: prod: arn:aws:iam::922711891673:role/SRE-Support-Role, stage: arn:aws:iam::277304166082:role/SRE-Support-Role, int: arn:aws:iam::277304166082:role/SRE-Support-Role 


@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 27, 2025
@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 27, 2025
@codecov-commenter
Copy link

codecov-commenter commented May 27, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 51.15%. Comparing base (3d5d98a) to head (5c77774).
Report is 3 commits behind head on main.

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##             main     #691      +/-   ##
==========================================
+ Coverage   50.95%   51.15%   +0.20%     
==========================================
  Files          76       76              
  Lines        5764     5782      +18     
==========================================
+ Hits         2937     2958      +21     
+ Misses       2422     2420       -2     
+ Partials      405      404       -1     
Files with missing lines Coverage Δ
cmd/ocm-backplane/cloud/common.go 47.50% <100.00%> (+3.38%) ⬆️

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@diakovnec diakovnec force-pushed the assume-initial-arn branch from 9286da2 to ca26766 Compare May 28, 2025 01:37
@diakovnec diakovnec changed the title [WIP] [SREP-644]: added check logic to assume-initial-arn [SREP-644]: added check logic to assume-initial-arn May 28, 2025
@openshift-ci openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 28, 2025
@bmeng
Copy link
Contributor

bmeng commented May 28, 2025

is there a use case for us to keep this configurable in backplane cli config?

}

logger.Debugf("set assume-initial-arn to: %s", cfg.BackplaneConfiguration.AssumeInitialArn)
} else if !slices.Contains([]string{
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor nit.. The following may improve the readability. Otherwise, it's hard to find where elseif ends

	} else if !slices.Contains([]string
               {
		productionAssumeInitialArn,
		stagingAssumeInitialArn,
		integrationAssumeInitialArn,
	      }, cfg.BackplaneConfiguration.AssumeInitialArn) 
	{
	 ............
	}

Copy link
Contributor Author

@diakovnec diakovnec May 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was able to improve readability as below.


 else if !slices.Contains(
		[]string{
			productionAssumeInitialArn,
			stagingAssumeInitialArn,
			integrationAssumeInitialArn,
		},
		cfg.BackplaneConfiguration.AssumeInitialArn,
	) {
		logger.Warnf("assume-initial-arn in backplane config is not set to a valid payer ARN, using: %s", cfg.BackplaneConfiguration.AssumeInitialArn)
		return aws.Credentials{}, fmt.Errorf("invalid assume-initial-arn: %s, must be one of: prod: %s, stage: %s, int: %s",
			cfg.BackplaneConfiguration.AssumeInitialArn,
			productionAssumeInitialArn,
			stagingAssumeInitialArn,
			integrationAssumeInitialArn,
		)

	}

I didn't work as suggested due to !slices.Contains( []string{ wants its opening brace { on the same line

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for improving the readability @diakovnec , suggested solution is just an example of how elseif mixed with } brace

@samanthajayasinghe
Copy link
Contributor

I have the same feeling as @bmeng , this configuration may be able to be deleted entirely. Users should not be allowed to add random ARN's in backplane configs..

@diakovnec diakovnec force-pushed the assume-initial-arn branch from ca26766 to 5c77774 Compare May 30, 2025 04:30
@samanthajayasinghe
Copy link
Contributor

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label May 30, 2025
@openshift-ci
Copy link
Contributor

openshift-ci bot commented May 30, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: diakovnec, samanthajayasinghe

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:
  • OWNERS [diakovnec,samanthajayasinghe]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci
Copy link
Contributor

openshift-ci bot commented May 30, 2025

@diakovnec: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-bot openshift-merge-bot bot merged commit 7c5fe55 into openshift:main May 30, 2025
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants