Skip to content

Conversation

@shemau
Copy link
Contributor

@shemau shemau commented Jan 28, 2025

Description

There is an issue on the main branch with the complete example where both the data store encryption key and backup encryption key are the same. The authorization has been moved from KMS instance to the key, so when only one key is used the policy will conflict (duplicate policy).

This in the example/test code and thus no release is required.
Since it is on the main branch, the upgrade should fail; which will require running the tests without an upgrade for this.

Historically, AFAIK, it was possible to use the same key for both the instance and the backup. This means a previous change must have been a breaking change, in that if the same key was used for both it is now broken. You can not use the same key on redeploy/upgrade of an existing deployment. You either hit the conflicting auth policy, or you have to change the backup key, which I don't think is allowed. Further investigation required.

Release required?

  • No release
  • Patch release (x.x.X)
  • Minor release (x.X.x)
  • Major release (X.x.x)
Release notes content

Run the pipeline

If the CI pipeline doesn't run when you create the PR, the PR requires a user with GitHub collaborators access to run the pipeline.

Run the CI pipeline when the PR is ready for review and you expect tests to pass. Add a comment to the PR with the following text:

/run pipeline

Checklist for reviewers

  • If relevant, a test for the change is included or updated with this PR.
  • If relevant, documentation for the change is included or updated with this PR.

For mergers

  • Use a conventional commit message to set the release level. Follow the guidelines.
  • Include information that users need to know about the PR in the commit message. The commit message becomes part of the GitHub release notes.
  • Use the Squash and merge option.

@shemau
Copy link
Contributor Author

shemau commented Jan 28, 2025

/run pipeline

@shemau
Copy link
Contributor Author

shemau commented Jan 28, 2025

As expected the problem is on the main branch and the upgrade test will have to be skipped.

TestRunCompleteUpgradeExample 2025-01-28T15:52:27Z retry.go:99: Returning due to fatal error: FatalError{Underlying: error while running command: exit status 1; ╷
Error: [0m Error: [ERROR] Error creating authorization policy: The policy wasn't created because an access policy with identical attributes and roles already exists. Please update the rule in the existing policy (f925a045-264c-4e7c-98db-668ecee49f75), or update the one you're trying to assign to include a different attribute assignment. {

@shemau
Copy link
Contributor Author

shemau commented Jan 28, 2025

/run pipeline

@shemau
Copy link
Contributor Author

shemau commented Jan 28, 2025

/run pipeline

3 similar comments
@shemau
Copy link
Contributor Author

shemau commented Jan 28, 2025

/run pipeline

@shemau
Copy link
Contributor Author

shemau commented Jan 28, 2025

/run pipeline

@shemau
Copy link
Contributor Author

shemau commented Jan 31, 2025

/run pipeline

@ocofaigh ocofaigh merged commit 18a0d17 into main Jan 31, 2025
2 checks passed
@ocofaigh ocofaigh deleted the deduplicate-auth-policy branch January 31, 2025 12:48
@terraform-ibm-modules-ops
Copy link
Contributor

🎉 This PR is included in version 2.14.1 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants