|
| 1 | +package google |
| 2 | + |
| 3 | +import ( |
| 4 | + "fmt" |
| 5 | + "log" |
| 6 | + "testing" |
| 7 | + |
| 8 | + cloudresourcemanager "google.golang.org/api/cloudresourcemanager/v1" |
| 9 | +) |
| 10 | + |
| 11 | +// BootstrapAllPSARoles ensures that the given project's IAM |
| 12 | +// policy grants the given service agents the given roles. |
| 13 | +// prefix is usually "service-" and indicates the service agent should have the |
| 14 | +// given prefix before the project number. |
| 15 | +// This is important to bootstrap because using iam policy resources means that |
| 16 | +// deleting them removes permissions for concurrent tests. |
| 17 | +// Return whether the bindings changed. |
| 18 | +func BootstrapAllPSARoles(t *testing.T, prefix string, agentNames, roles []string) bool { |
| 19 | + config := BootstrapConfig(t) |
| 20 | + if config == nil { |
| 21 | + t.Fatal("Could not bootstrap a config for BootstrapAllPSARoles.") |
| 22 | + } |
| 23 | + client := config.NewResourceManagerClient(config.UserAgent) |
| 24 | + |
| 25 | + // Get the project since we need its number, id, and policy. |
| 26 | + project, err := client.Projects.Get(GetTestProjectFromEnv()).Do() |
| 27 | + if err != nil { |
| 28 | + t.Fatalf("Error getting project with id %q: %s", project.ProjectId, err) |
| 29 | + } |
| 30 | + |
| 31 | + getPolicyRequest := &cloudresourcemanager.GetIamPolicyRequest{} |
| 32 | + policy, err := client.Projects.GetIamPolicy(project.ProjectId, getPolicyRequest).Do() |
| 33 | + if err != nil { |
| 34 | + t.Fatalf("Error getting project iam policy: %v", err) |
| 35 | + } |
| 36 | + |
| 37 | + members := make([]string, len(agentNames)) |
| 38 | + for i, agentName := range agentNames { |
| 39 | + members[i] = fmt.Sprintf("serviceAccount:%s%d@%s.iam.gserviceaccount.com", prefix, project.ProjectNumber, agentName) |
| 40 | + } |
| 41 | + |
| 42 | + // Create the bindings we need to add to the policy. |
| 43 | + var newBindings []*cloudresourcemanager.Binding |
| 44 | + for _, role := range roles { |
| 45 | + newBindings = append(newBindings, &cloudresourcemanager.Binding{ |
| 46 | + Role: role, |
| 47 | + Members: members, |
| 48 | + }) |
| 49 | + } |
| 50 | + |
| 51 | + mergedBindings := MergeBindings(append(policy.Bindings, newBindings...)) |
| 52 | + |
| 53 | + if !compareBindings(policy.Bindings, mergedBindings) { |
| 54 | + addedBindings := missingBindings(policy.Bindings, mergedBindings) |
| 55 | + for _, missingBinding := range addedBindings { |
| 56 | + log.Printf("[DEBUG] Adding binding: %+v", missingBinding) |
| 57 | + } |
| 58 | + // The policy must change. |
| 59 | + policy.Bindings = mergedBindings |
| 60 | + setPolicyRequest := &cloudresourcemanager.SetIamPolicyRequest{Policy: policy} |
| 61 | + policy, err = client.Projects.SetIamPolicy(project.ProjectId, setPolicyRequest).Do() |
| 62 | + if err != nil { |
| 63 | + t.Fatalf("Error setting project iam policy: %v", err) |
| 64 | + } |
| 65 | + msg := "Added the following bindings to the test project's IAM policy:\n" |
| 66 | + for _, binding := range addedBindings { |
| 67 | + msg += fmt.Sprintf("Members: %q, Role: %q\n", binding.Members, binding.Role) |
| 68 | + } |
| 69 | + msg += "Retry the test in a few minutes." |
| 70 | + t.Error(msg) |
| 71 | + return true |
| 72 | + } |
| 73 | + return false |
| 74 | +} |
| 75 | + |
| 76 | +// BootstrapAllPSARole is a version of BootstrapAllPSARoles for granting a |
| 77 | +// single role to multiple service agents. |
| 78 | +func BootstrapAllPSARole(t *testing.T, prefix string, agentNames []string, role string) bool { |
| 79 | + return BootstrapAllPSARoles(t, prefix, agentNames, []string{role}) |
| 80 | +} |
| 81 | + |
| 82 | +// BootstrapPSARoles is a version of BootstrapAllPSARoles for granting roles to |
| 83 | +// a single service agent. |
| 84 | +func BootstrapPSARoles(t *testing.T, prefix, agentName string, roles []string) bool { |
| 85 | + return BootstrapAllPSARoles(t, prefix, []string{agentName}, roles) |
| 86 | +} |
| 87 | + |
| 88 | +// BootstrapPSARole is a simplified version of BootstrapPSARoles for granting a |
| 89 | +// single role to a single service agent. |
| 90 | +func BootstrapPSARole(t *testing.T, prefix, agentName, role string) bool { |
| 91 | + return BootstrapPSARoles(t, prefix, agentName, []string{role}) |
| 92 | +} |
| 93 | + |
| 94 | +// Returns a map representing iam bindings that are in the first map but not the second. |
| 95 | +func missingBindingsMap(aMap, bMap map[iamBindingKey]map[string]struct{}) map[iamBindingKey]map[string]struct{} { |
| 96 | + results := make(map[iamBindingKey]map[string]struct{}) |
| 97 | + for key, aMembers := range aMap { |
| 98 | + if bMembers, ok := bMap[key]; ok { |
| 99 | + // The key is in both maps. |
| 100 | + resultMembers := make(map[string]struct{}) |
| 101 | + |
| 102 | + for aMember := range aMembers { |
| 103 | + if _, ok := bMembers[aMember]; !ok { |
| 104 | + // The member is in a but not in b. |
| 105 | + resultMembers[aMember] = struct{}{} |
| 106 | + } |
| 107 | + } |
| 108 | + for bMember := range bMembers { |
| 109 | + if _, ok := aMembers[bMember]; !ok { |
| 110 | + // The member is in b but not in a. |
| 111 | + resultMembers[bMember] = struct{}{} |
| 112 | + } |
| 113 | + } |
| 114 | + |
| 115 | + if len(resultMembers) > 0 { |
| 116 | + results[key] = resultMembers |
| 117 | + } |
| 118 | + } else { |
| 119 | + // The key is in map a but not map b. |
| 120 | + results[key] = aMembers |
| 121 | + } |
| 122 | + } |
| 123 | + |
| 124 | + for key, bMembers := range bMap { |
| 125 | + if _, ok := aMap[key]; !ok { |
| 126 | + // The key is in map b but not map a. |
| 127 | + results[key] = bMembers |
| 128 | + } |
| 129 | + } |
| 130 | + |
| 131 | + return results |
| 132 | +} |
| 133 | + |
| 134 | +// Returns the bindings that are in the first set of bindings but not the second. |
| 135 | +func missingBindings(a, b []*cloudresourcemanager.Binding) []*cloudresourcemanager.Binding { |
| 136 | + aMap := createIamBindingsMap(a) |
| 137 | + bMap := createIamBindingsMap(b) |
| 138 | + |
| 139 | + var results []*cloudresourcemanager.Binding |
| 140 | + for key, membersSet := range missingBindingsMap(aMap, bMap) { |
| 141 | + members := make([]string, 0, len(membersSet)) |
| 142 | + for member := range membersSet { |
| 143 | + members = append(members, member) |
| 144 | + } |
| 145 | + results = append(results, &cloudresourcemanager.Binding{ |
| 146 | + Role: key.Role, |
| 147 | + Members: members, |
| 148 | + }) |
| 149 | + } |
| 150 | + return results |
| 151 | +} |
0 commit comments