CORS-4516: GCP: Update Required Permissions - #493
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@patrickdillon: This pull request references CORS-4516 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughThe GCP ChangesGCP IAM permissions
Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@manifests/0000_26_cloud-controller-manager-operator_16_credentialsrequest-gcp.yaml`:
- Around line 21-25: Add the missing compute.addresses.deleteInternal permission
alongside the existing internal address permissions in the credentials manifest,
preserving the current address permission entries.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 0cb770e6-8ca8-4bf0-b7ec-c070b93169c1
📒 Files selected for processing (1)
manifests/0000_26_cloud-controller-manager-operator_16_credentialsrequest-gcp.yaml
|
/test unit |
|
/test e2e-gcp-ovn Currently these credentials are unused, which is why things are working fine without the adequate permissions that this PR adds. To use them, we need either openshift/cloud-provider-gcp#131 or to set token-url to nil in the cloud config. So this test verifies only basic regression testing. |
barbacbd
left a comment
barbacbd
left a comment
There was a problem hiding this comment.
/lgtm
I don't know that this is going to test anything new though
|
The reason we need this is because openshift/cloud-provider-gcp#131 makes it to that the mounted credentials will actually be used. The e2e-gcp-ovn test on that PR is failing but the adequate permissions should make it pass /testwith openshift/cloud-provider-gcp/main/e2e-gcp-ovn openshift/cloud-provider-gcp#131 |
|
testwith is not triggerring right now. install succeeded with this pr on gcd! |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: damdo The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/testwith openshift/cloud-provider-gcp/main/e2e-gcp-ovn openshift/cloud-provider-gcp#131 |
|
/test e2e-gcp-ovn |
|
Sigkilled /testwith openshift/cloud-provider-gcp/main/e2e-gcp-ovn openshift/cloud-provider-gcp#131 |
| - "compute.httpHealthChecks.create" | ||
| - "compute.httpHealthChecks.delete" | ||
| - "compute.httpHealthChecks.get" | ||
| - "compute.httpHealthChecks.update" |
There was a problem hiding this comment.
needs
compute.httpHealthChecks.useReadOnly
Updates the credentialsrequests to include the minimal permissions required to provision a cluster in GCP. With the current implementation OpenShift does not use the mounted crdentials, provisioned from the credentials request. Instead it authenticates using the service account attached to the VM. When the mounted credentials are actually used, the cloud provider will fail due to the missing permissions which are added in this commit.
|
/testwith openshift/cloud-provider-gcp/main/e2e-gcp-ovn openshift/cloud-provider-gcp#131 |
|
/test e2e-gcp-ovn |
|
/test e2e-gcp-ovn It's that time of the year where CI is fighting for its life 😅 |
|
@patrickdillon: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
5 participants
Updates the credentialsrequests to include the minimal permissions required to provision a cluster in GCP. With the current implementation OpenShift does not use the mounted credentials, provisioned from the credentials request. Instead it authenticates using the service account attached to the VM. When the mounted credentials are actually used, the cloud provider will fail due to the missing permissions which are added in this commit.
Summary by CodeRabbit
compute.addressesoperations.