pkg/asset/installconfig/aws: Make base-domain a select widget

[wking]

This used to be covered in the docs from fa7c9e3 (#353), but in order to see those you'd need to have a moment of doubt and think to hit ?. Even if you read the docs, it's possible you'd typo the base domain or add a trailing period (theoretically trailing periods would be fine, but they may have some issues at the moment).

With this commit, we go ahead and fetch available public zones ourselves, so AWS users don't have to. And it also reduces the help noise on the base-domain input for users targeting non-AWS platforms.

[wking]

The select widget looks like:

$ AWS_PROFILE=openshift-dev openshift-install --dir=wking create install-config
? SSH Public Key <none>
? Platform aws
? Region us-west-1
? Base Domain  [Use arrows to move, type to filter, ? for more help]
  akamra-ocp.com
> devcluster.openshift.com
  mhicks-openshift.com

[abhinavdahiya]

I would like the user to be able to call create install-config without requiring them having correct creds for making cloud api calls.

@wking @crawford

[wking]

So in the no-creds case, would you like me to fall back to the free-form input instead of prompting for creds? Or should I ask the user to choose between entering creds and the free-form input?

[crawford]

@abhinavdahiya as much as I would also prefer that, we are seeing too many failures due to this being free-form. I think this is okay for now. We may need to allow for free-form input in cases where we can't find valid credentials.

@wking what happens if we find multiple sets of credentials?

[crawford]

/approve

[wking]

@wking what happens if we find multiple sets of credentials?

I don't think that's possible. The AWS logic we're using to load credentials probably stops at the first set it finds (the same way it works for the aws command-line client). Folks can set AWS_PROFILE and/or all the other usual stuff to point us at the creds they want to use.

[abhinavdahiya]

so with this change

1. if i have creds setup and i am authorized -> we give user the list
2. if i have creds setup and i am not authorized -> we fail
3. if i don't have creds setup, it asks for (key,secret) setup the creds and then back to 1/2

I don't think we should be failing in 2.

@crawford @wking

[wking]

2. if i have creds setup and i am not authorized -> we fail
   ...
   I don't think we should be failing in 2.

I've pushed 68368e7 -> 390cf77 to address this. If you restrict your user's privileges (thanks @cuppett for the hint):

$ cat <<EOF >policy
{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "VisualEditor0",
          "Effect": "Deny",
          "Action": "route53:ListHostedZones",
          "Resource": "*"
      }
  ]
}
EOF
$ aws iam create-policy --policy-name deny-list-hosted-zones --policy-document file://policy
{
   "Policy": {
       "PolicyName": "deny-list-hosted-zones",
       "CreateDate": "2018-12-19T21:21:29Z",
       "AttachmentCount": 0,
       "IsAttachable": true,
       "PolicyId": "AN...LS",
       "DefaultVersionId": "v1",
       "Path": "/",
       "Arn": "arn:aws:iam::...:policy/deny-list-hosted-zones",
       "UpdateDate": "2018-12-19T21:21:29Z"
   }
}
$ aws iam attach-user-policy --user-name trking --policy-arn arn:aws:iam::...:policy/deny-list-hosted-zones

you can see the fallback in action:

$ openshift-install --dir=wking create install-config
? SSH Public Key <none>
? Platform aws
? Region us-west-1
ERROR list hosted zones: AccessDenied: User: arn:aws:iam::...:user/trking is not authorized to perform: route53:ListHostedZones with an explicit deny
        status code: 403, request id: 1d..29
? Base Domain [? for help]

[abhinavdahiya]

/lgtm

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: abhinavdahiya, crawford, wking

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [abhinavdahiya,crawford,wking]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment