CNTRLPLANE-2205: Auto-detect shared role use and enable for e2e - #7356
Conversation
|
Skipping CI for Draft Pull Request. |
WalkthroughRefactored IAM role destruction by removing the SharedRole boolean flag from DestroyIAMOptions and replacing conditional deletion logic with a unified approach that attempts shared role deletion first, then falls back to component roles. Updated DestroyOIDCRole method signature to return a boolean removal indicator alongside error. Added conditional ROSA managed policy attachment in policy binding logic. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro Cache: Disabled due to data retention organization setting Knowledge base: Disabled due to 📒 Files selected for processing (5)
💤 Files with no reviewable changes (1)
🧰 Additional context used📓 Path-based instructions (1)**⚙️ CodeRabbit configuration file
Files:
🧬 Code graph analysis (1)test/e2e/create_cluster_test.go (2)
🪛 golangci-lint (2.5.0)cmd/infra/aws/destroy_iam.go[error] 228-228: : # github.com/openshift/hypershift/sync-global-pullsecret [github.com/openshift/hypershift/sync-global-pullsecret.test] (typecheck) ⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
🔇 Additional comments (6)
Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: sjenning The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@sjenning: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Enable the use of a single shared IAM role for all test clusters except TestCreateCluster.
Original commit that introduced the shared role did not include handling for using ROSA managed policies. The commit adds code to handle it.
We added a --shared-role flag to the iam destroy path, but this creates and issue where the create and destroy must be run with the same flags, otherwise the cluster doesn't clean up properly. We can detect if a cluster was created with --shared-role in the destory path so just Do The Right Thing and remove the flag.
53b47d5 to
74f3691
Compare
|
/test verify |
|
@sjenning: This pull request references CNTRLPLANE-2205 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Confirmed that Creating per-component roles: Destroying per-component roles: |
|
/lgtm Hold for Cesar and/or others to review as well. |
|
/verified by @sjenning with presub e2e artifacts |
|
@sjenning: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@sjenning: This pull request references CNTRLPLANE-2205 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@sjenning: This pull request references CNTRLPLANE-2205 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/hold cancel |
|
/override ci/prow/e2e-aks |
|
@sjenning: Overrode contexts on behalf of sjenning: ci/prow/e2e-aks DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@sjenning: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Follow on to #7331
This PR improves the AWS IAM role management by making the shared role detection automatic during cluster destruction and enabling shared roles by default in e2e tests. The changes eliminate the need for users to manually specify whether a cluster uses a shared role when destroying it.
Key Changes
Removed --shared-role flag: The --shared-role flag has been removed from the destroy iam command since detection is now automatic. This simplifies the user experience and reduces the chance of errors from mismatched flags.
Technical Details
Note
Auto-detects shared-role usage during IAM destroy (removing the flag), updates role deletion API, attaches ROSA managed policies for shared roles, and defaults e2e AWS clusters to shared roles (with a targeted per-component test).
"<infraID>-shared-role"first; short-circuit if removed.SharedRolefromDestroyIAMOptionsand drop--shared-roleininfra aws destroy-iam.DestroyOIDCRoletofunc(..., name string) (bool, error)and update all callers.UseROSAManagedPoliciesis enabled, attach ROSA managed policies to the shared role instead of creating inline policies.SharedRole: true.TestCreateCluster, explicitly setSharedRole: falseon AWS to validate per-component roles.SharedRoleto IAM destroy; behavior now inferred.Written by Cursor Bugbot for commit 74f3691. This will update automatically on new commits. Configure here.