-
Notifications
You must be signed in to change notification settings - Fork 71
[SREP-1313] feat : Update isolation workflow to enforce policy Arn from backplane-api assume-role-sequence endpoint #748
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
874fb10
to
3a2ecb3
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #748 +/- ##
==========================================
+ Coverage 51.74% 51.78% +0.04%
==========================================
Files 80 80
Lines 5945 5965 +20
==========================================
+ Hits 3076 3089 +13
- Misses 2451 2457 +6
- Partials 418 419 +1
🚀 New features to boost your workflow:
|
9969f0e
to
83030ec
Compare
13d6d9c
to
fc8c89a
Compare
cmd/ocm-backplane/cloud/common.go
Outdated
@@ -211,6 +212,8 @@ func (cfg *QueryConfig) getCloudCredentialsFromBackplaneAPI(ocmToken string) (bp | |||
type assumeChainResponse struct { | |||
AssumptionSequence []namedRoleArn `json:"assumptionSequence"` | |||
CustomerRoleSessionName string `json:"customerRoleSessionName"` | |||
// SessionPolicyArn is the ARN of the session policy | |||
SessionPolicyArn string `json:"sessionPolicyArn"` |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
please fix the indent here to make them align
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
done
RoleSessionName string | ||
RoleArn string | ||
IsCustomerRole bool |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What is the use case for this in the struct? Only for printing the debug log?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Basically, to identify the customer role to apply the session policy ARN , otherwise we always have to check if name=CustomerRoleArn
statment
…om backplane-api assume-role-sequence endpoint
fc8c89a
to
7e9b5da
Compare
@samanthajayasinghe: all tests passed! Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
/lgtm |
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: samanthajayasinghe, smarthall The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
[SREP-1313] feat : Update isolation workflow to enforce policy Arn from backplane-api assume-role-sequence endpoint
What type of PR is this?
What this PR does / Why we need it?
Enforce the session policy Arn to the Customer AWS account on assume role chain
Which Jira/Github issue(s) does this PR fix?
https://issues.redhat.com/browse/SREP-1313
Special notes for your reviewer
Unit Test Coverage
Guidelines
Test coverage checks
Pre-checks (if applicable)
/label tide/merge-method-squash