openshift-online / ocm-cli

CLI for the Red Hat OpenShift Cluster Manager
Apache License 2.0
78 stars 138 forks source link

OCM-10615 | Implement 'gcp wif-config update' command #667

Closed JakobGray closed 1 month ago

JakobGray commented 1 month ago
  1. Implement 'gcp wif-config update' command to re-apply GCP resources
  2. Filter version on 'create cluster' when using WIF
  3. Accept WIF displayName in WIF commands

Related issue: OCM-10615

renan-campos commented 1 month ago

Couple things I found while testing this out:

  1. The create.sh and apply.sh scripts have an error in them: looks like a space is missing between the project name and permissions.
  2. The logging of update needs some attention.
renan-campos commented 1 month ago
[rcampos@rcampos-thinkpadt14sgen2i ocm-cli]$ ./ocm gcp update wif-config rc-test
2024/09/25 13:27:45 Role "sre_managed_support" updated
2024/09/25 13:27:46 support access granted to sd-sre-platform-gcp-access@redhat.com
2024/09/25 13:27:46 Workload identity pool 2e0vgthhfsdl1kbrbokvakum7r8tqm24 exists
2024/09/25 13:27:46 Workload identity provider oidc exists
JakobGray commented 1 month ago

I've modified the logging so it won't log anything if no updates are done. I changed the createOrUpdateRoles so it adds missing permissions rather than replacing them. And I fixed the gcloud command and tested that it can run properly.

I tested with 3 changes:

  1. Deleted SA osd-worker-g064@sda-ccs-3.iam.gserviceaccount.com
  2. Added a permission to role osd_deployer_v4.17
  3. Removed a permission on role openshift_gcp_pd_csi_driver_operator_v4.17

Running results in these logs:

go run ./cmd/ocm gcp update wif-config kms
2024/09/26 12:41:50 IAM service account osd-worker-g064 created
2024/09/26 12:41:54 Role "openshift_gcp_pd_csi_driver_operator_v4.17" updated

The result is

  1. osd-worker-g064@sda-ccs-3.iam.gserviceaccount.com is recreated
  2. The added permission in osd_deployer_v4.17 is left
  3. The removed permission in openshift_gcp_pd_csi_driver_operator_v4.17 is added back
ckandag commented 1 month ago

I scanned to make sure all of the PR review comments were addressed. I locally verified there is no regression in the green paths i.e creation of a wif , creation of a basic gcp cluster also verified version filtering for wif is working as expected.

I have not tested the scripts though. I am merging this MR but @JakobGray pls make sure to verify all the dry run scripts and post a comment here and address any issues post-merge