[release-4.15] MULTIARCH-4084: Reduce the policy access scope to specific instance #3459

Neha-dot-Yadav · 2024-01-24T09:34:47Z

This is a cherry-pick of #3491

openshift-ci · 2024-01-24T09:35:27Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Neha-dot-Yadav
Once this PR has been reviewed and has the lgtm label, please assign sjenning for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2024-01-27T11:23:23Z

@Neha-dot-Yadav: This pull request references MULTIARCH-4084 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.15.0" version, but no target version was set.

In response to this:

What this PR does / why we need it:
This PR reduces the permission access scope to Service Instance for various CRs.

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #https://issues.redhat.com/browse/MULTIARCH-4084

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Neha-dot-Yadav · 2024-01-29T06:33:13Z

/assign @dharaneeshvrd

Neha-dot-Yadav · 2024-01-31T08:41:02Z

/test e2e-aws

dharaneeshvrd · 2024-01-31T08:50:39Z

cmd/infra/powervs/create.go

@@ -388,28 +384,43 @@ func (infra *Infra) SetupInfra(ctx context.Context, options *CreateInfraOptions)
 		return fmt.Errorf("cloud connection is not up: %w", err)
 	}

+	if err = infra.setupSecrets(options); err != nil {


Please comment, why it needs to be after the resources created

Added a comment,
please let me know if it is understandable?

dharaneeshvrd · 2024-01-31T08:51:42Z

cmd/infra/powervs/destroy.go

@@ -218,6 +213,11 @@ func (options *DestroyInfraOptions) DestroyInfra(ctx context.Context, infra *Inf
 		}
 	}

+	if err = deleteSecrets(options.Name, options.Namespace, powerVsCloudInstanceID, accountID, resourceGroupID); err != nil {


Any reason to move this after deleteCOS?

Yes, deleteSecrets needs powerVsCloudInstanceID value, which it is getting from the code after deleteCOS.

dharaneeshvrd · 2024-01-31T08:51:57Z

cmd/infra/powervs/destroy.go

@@ -302,14 +302,16 @@ func deleteDNSRecords(ctx context.Context, options *DestroyInfraOptions) error {
 }

 // deleteSecrets delete secrets generated for control plane components
-func deleteSecrets(name, namespace, accountID string, resourceGroupID string) error {
+func deleteSecrets(name, namespace, CloudInstanceID string, accountID string, resourceGroupID string) error {


Suggested change

func deleteSecrets(name, namespace, CloudInstanceID string, accountID string, resourceGroupID string) error {

func deleteSecrets(name, namespace, cloudInstanceID string, accountID string, resourceGroupID string) error {

dharaneeshvrd · 2024-01-31T08:53:04Z

cmd/infra/powervs/service_id.go

@@ -193,6 +203,10 @@ func extractServiceIDFromCRN(crn string) string {
 	return crnL[len(crnL)-1]
 }

+func updateCRYaml(crYaml, serviceInstanceValue string) string {
+	return fmt.Sprintf(crYaml, serviceInstanceValue)


Its good practice to use templating here.

Added the provision to use templating,
please let me know, if any further changes are required?

openshift-ci-robot · 2024-01-31T15:04:59Z

@Neha-dot-Yadav: No Jira issue is referenced in the title of this pull request.
To reference a jira issue, add 'XYZ-NNN:' to the title of this pull request and request another refresh with /jira refresh.

In response to this:

What this PR does / why we need it:
This PR reduces the permission access scope to Service Instance for various CRs.

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #https://issues.redhat.com/browse/MULTIARCH-4084

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2024-01-31T16:45:37Z

@Neha-dot-Yadav: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-ci-robot · 2024-02-06T10:16:23Z

@Neha-dot-Yadav: This pull request references MULTIARCH-4084 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.15.0" version, but no target version was set.

In response to this:

What this PR does / why we need it:
This PR reduces the permission access scope to Service Instance for various CRs.

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #https://issues.redhat.com/browse/MULTIARCH-4084

Checklist

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2024-02-06T10:17:05Z

@Neha-dot-Yadav: This pull request references MULTIARCH-4084 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.15.0" version, but no target version was set.

In response to this:

This is a cherry-pick of #3491

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. do-not-merge/needs-area labels Jan 24, 2024

openshift-ci bot requested review from enxebre and sjenning January 24, 2024 09:35

openshift-ci bot added the area/cli Indicates the PR includes changes for CLI label Jan 24, 2024

openshift-ci bot removed the do-not-merge/needs-area label Jan 24, 2024

Neha-dot-Yadav force-pushed the svcid_scope_up branch from 1e9098a to cb52fc3 Compare January 27, 2024 11:13

Neha-dot-Yadav changed the title ~~[WIP]Reduce the access scope to specific instance~~ [WIP]MULTIARCH-4084: Reduce the access scope to specific instance Jan 27, 2024

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jan 27, 2024

Neha-dot-Yadav force-pushed the svcid_scope_up branch from cb52fc3 to f37164e Compare January 28, 2024 06:55

Neha-dot-Yadav changed the title ~~[WIP]MULTIARCH-4084: Reduce the access scope to specific instance~~ MULTIARCH-4084: Reduce the access scope to specific instance Jan 29, 2024

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 29, 2024

openshift-ci bot assigned dharaneeshvrd Jan 29, 2024

Neha-dot-Yadav force-pushed the svcid_scope_up branch 3 times, most recently from 275e1fb to 2d5db05 Compare January 30, 2024 10:07

dharaneeshvrd suggested changes Jan 31, 2024

View reviewed changes

Reduce the access scope to specific instance

be491bf

Neha-dot-Yadav force-pushed the svcid_scope_up branch from 2d5db05 to be491bf Compare January 31, 2024 12:48

Neha-dot-Yadav changed the title ~~MULTIARCH-4084: Reduce the access scope to specific instance~~ Reduce the access scope to specific instance Jan 31, 2024

openshift-ci-robot removed the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jan 31, 2024

Neha-dot-Yadav changed the title ~~Reduce the access scope to specific instance~~ [release-4.15] MULTIARCH-4084: Reduce the policy access scope to specific instance Feb 6, 2024

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Feb 6, 2024

Neha-dot-Yadav closed this Feb 6, 2024

Neha-dot-Yadav deleted the svcid_scope_up branch February 6, 2024 10:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[release-4.15] MULTIARCH-4084: Reduce the policy access scope to specific instance #3459

[release-4.15] MULTIARCH-4084: Reduce the policy access scope to specific instance #3459

Neha-dot-Yadav commented Jan 24, 2024 •

edited

openshift-ci bot commented Jan 24, 2024

openshift-ci-robot commented Jan 27, 2024 •

edited by openshift-ci bot

Neha-dot-Yadav commented Jan 29, 2024

Neha-dot-Yadav commented Jan 31, 2024

dharaneeshvrd Jan 31, 2024

Neha-dot-Yadav Jan 31, 2024

dharaneeshvrd Jan 31, 2024

Neha-dot-Yadav Jan 31, 2024

dharaneeshvrd Jan 31, 2024

dharaneeshvrd Jan 31, 2024

Neha-dot-Yadav Jan 31, 2024

openshift-ci-robot commented Jan 31, 2024

openshift-ci bot commented Jan 31, 2024

openshift-ci-robot commented Feb 6, 2024 •

edited by openshift-ci bot

openshift-ci-robot commented Feb 6, 2024 •

edited by openshift-ci bot

	func deleteSecrets(name, namespace, CloudInstanceID string, accountID string, resourceGroupID string) error {
	func deleteSecrets(name, namespace, cloudInstanceID string, accountID string, resourceGroupID string) error {

[release-4.15] MULTIARCH-4084: Reduce the policy access scope to specific instance #3459

[release-4.15] MULTIARCH-4084: Reduce the policy access scope to specific instance #3459

Conversation

Neha-dot-Yadav commented Jan 24, 2024 • edited

openshift-ci bot commented Jan 24, 2024

openshift-ci-robot commented Jan 27, 2024 • edited by openshift-ci bot

Neha-dot-Yadav commented Jan 29, 2024

Neha-dot-Yadav commented Jan 31, 2024

dharaneeshvrd Jan 31, 2024

Choose a reason for hiding this comment

Neha-dot-Yadav Jan 31, 2024

Choose a reason for hiding this comment

dharaneeshvrd Jan 31, 2024

Choose a reason for hiding this comment

Neha-dot-Yadav Jan 31, 2024

Choose a reason for hiding this comment

dharaneeshvrd Jan 31, 2024

Choose a reason for hiding this comment

dharaneeshvrd Jan 31, 2024

Choose a reason for hiding this comment

Neha-dot-Yadav Jan 31, 2024

Choose a reason for hiding this comment

openshift-ci-robot commented Jan 31, 2024

openshift-ci bot commented Jan 31, 2024

openshift-ci-robot commented Feb 6, 2024 • edited by openshift-ci bot

openshift-ci-robot commented Feb 6, 2024 • edited by openshift-ci bot

Neha-dot-Yadav commented Jan 24, 2024 •

edited

openshift-ci-robot commented Jan 27, 2024 •

edited by openshift-ci bot

openshift-ci-robot commented Feb 6, 2024 •

edited by openshift-ci bot

openshift-ci-robot commented Feb 6, 2024 •

edited by openshift-ci bot