-
Notifications
You must be signed in to change notification settings - Fork 23.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
iam_role : support managing max session duration and deleting the instance profile it creates #62014
Conversation
This comment has been minimized.
This comment has been minimized.
91c6c22
to
74d3743
Compare
74d3743
to
ee67339
Compare
This comment has been minimized.
This comment has been minimized.
ee67339
to
9eea7c5
Compare
9eea7c5
to
0fab7e8
Compare
566168c
to
3389368
Compare
Note: While this should possibly be split up into multiple PRs, I chose not to for the following reasons:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Overall this lgtm, a few very minor notes. Thank you so much for all these tests @tremble!
- iam_role is changed | ||
- name: Short pause for role creation to finish | ||
pause: | ||
seconds: 10 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This pause shouldn't be necessary in check mode.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'd put the sleep in there to allow for the case of check_mode not being honoured and there being a delay before the role showed up. I don't mind removing it.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@jillr I've made the pauses optional. Interestingly I've not hit any issues yet, maybe something's been slowed down just enough, so I'm tempted to leave them all disabled.
If we remove the 'unsupported' flag we can keep an eye open for flakes and re-enable them easily.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think the pauses on the cases we expect to do real work are fine, if we can get this test suite supported I'd definitely want them disabled on the check mode tests but happy to leave them off everywhere and see how it goes. If check mode actually makes changes that's a bug, so the risk of that bug is preferable to having every CI run take longer.
# Inline Policy (test _info behaviour) | ||
|
||
# XXX Not sure if it's a bug in Ansible or a "quirk" of AWS, but these two | ||
# policies need to have at least different Sids or the second doesn't show |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The console will let me have both of these policies with the same Sid and the docs suggest uniqueness is only required within a single JSON doc so I'm going to assume it's something we're doing. Do you think this is worth a bug to investigate? My inclination is that it's still less than desirable to duplicate Sids but I could be overlooking some use case.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
After taking a quick look at the iam_policy code, I'm inclined to suspect it's a bug in iam_policy. Possibly one we've had for a while: #30071 (comment)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ergh, FYI, not a bug just annoying default behaviour:
skip_duplicates:
By default the module looks for any policies that match the document you pass in, if there is a match it will not make a new policy object with the same rules. You can override this by specifying false which would allow for two policy objects with different names but same rules.
# Cleanup | ||
|
||
# XXX iam_role fails to remove inline policies before deleting the role | ||
- name: 'Attach inline policy a' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
- name: 'Attach inline policy a' | |
- name: 'Detach inline policy a' |
And below
3389368
to
5101e44
Compare
…ts_assume_role tests - Make the iam_role tests more comprehensive - Add tests for iam_role_info
5101e44
to
bb6c47b
Compare
If the tests appear to be flakey we may need to enable standard_pauses
bb6c47b
to
04400c0
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Tests are passing, thanks again!
…tance profile it creates (ansible#62014) * iam_role: Add support for managing MaxSessionDuration * iam_role: Add support for deleting the IAM Instance Profiles we created * iam_role: migrate all boto failures to fail_json_aws for consistency * iam_role: test validity of path so we can throw a more understandable error * iam_role: (integration tests) Split iam_role integration tests from sts_assume_role tests - Make the iam_role tests more comprehensive - Add tests for iam_role_info * iam_role: (integration tests) Make some of our pauses optional If the tests appear to be flakey we may need to enable standard_pauses
SUMMARY
Add support for managing max session duration and deleting the instance profile we create
Additionally add a test suite for iam_role and iam_role_info
ISSUE TYPE
COMPONENT NAME
lib/ansible/modules/cloud/amazon/iam_role.py
lib/ansible/modules/cloud/amazon/iam_role_info.py
ADDITIONAL INFORMATION