Skip to content

Commit 924fb13

Browse files
PanSpagetkaPanSpagetka
committed
Expose functionality for creating Account/Operator roles and OIDC config/provider
1 parent 87ffb7a commit 924fb13

File tree

32 files changed

+204
-48
lines changed

32 files changed

+204
-48
lines changed

‎cmd/create/accountroles/cmd.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -511,6 +511,7 @@ func run(cmd *cobra.Command, argv []string) {
511511

512512
switch mode {
513513
case interactive.ModeAuto:
514+
// !!!!!!!!!!!!!!!!!!!!!!!!!!! HERE !!!!!!!!!!!
514515
err = rolesCreator.createRoles(r, input)
515516
if err != nil {
516517
r.Reporter.Errorf("There was an error creating the account roles: %s", err)

‎cmd/create/accountroles/creators.go

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package accountroles
22

33
import (
44
"fmt"
5+
"os"
56

67
common "github.com/openshift-online/ocm-common/pkg/aws/validations"
78
cmv1 "github.com/openshift-online/ocm-sdk-go/clustersmgmt/v1"
@@ -86,6 +87,7 @@ func (mp *managedPoliciesCreator) createRoles(r *rosa.Runtime, input *accountRol
8687

8788
for file, role := range aws.AccountRoles {
8889
accRoleName := common.GetRoleName(input.prefix, role.Name)
90+
8991
assumeRolePolicy := getAssumeRolePolicy(r.Creator.Partition, file, input)
9092

9193
r.Reporter.Debugf("Creating role '%s'", accRoleName)
@@ -271,6 +273,7 @@ func (db *doubleRolesCreator) getAccountRolesMap() map[string]aws.AccountRole {
271273
func createRoleUnmanagedPolicy(r *rosa.Runtime, input *accountRolesCreationInput, accRoleName string,
272274
assumeRolePolicy string, tagsList map[string]string, filename string) error {
273275
r.Reporter.Debugf("Creating role '%s'", accRoleName)
276+
274277
roleARN, err := r.AWSClient.EnsureRole(r.Reporter, accRoleName, assumeRolePolicy, input.permissionsBoundary,
275278
input.defaultPolicyVersion, tagsList, input.path, false)
276279
if err != nil {
@@ -307,17 +310,45 @@ func getAssumeRolePolicy(partition string, file string, input *accountRolesCreat
307310
})
308311
}
309312

313+
func CreateHCPRoles(r *rosa.Runtime, prefix string, managedPolicies bool, permissionsBoundary string, env string, policies map[string]*cmv1.AWSSTSPolicy, policyVersion string, path string, isSharedVpc bool) error {
314+
315+
// rolesCreator, createRoles := initCreator(r, managedPolicies, createClassic, createHostedCP, isClassicValueSet, isHostedCPValueSet)
316+
rolesCreator, createRoles := initCreator(r, managedPolicies, false, true, false, true)
317+
318+
if !createRoles {
319+
os.Exit(1)
320+
}
321+
322+
input := buildRolesCreationInput(prefix, permissionsBoundary, r.Creator.AccountID, env, policies, policyVersion, path, isSharedVpc)
323+
324+
// input := &accountRolesCreationInput{
325+
// prefix: prefix,
326+
// permissionsBoundary: permissionsBoundary,
327+
// accountID: accountID,
328+
// env: env,
329+
// policies: policies,
330+
// defaultPolicyVersion: defaultPolicyVersion,
331+
// path: path,
332+
// isSharedVpc: isSharedVpc,
333+
// }
334+
// hcp := &hcpManagedPoliciesCreator{}
335+
err := rolesCreator.createRoles(r, input)
336+
return err
337+
}
338+
310339
type hcpManagedPoliciesCreator struct{}
311340

312341
func (hcp *hcpManagedPoliciesCreator) createRoles(r *rosa.Runtime, input *accountRolesCreationInput) error {
313342
r.Reporter.Infof("Creating hosted CP account roles using '%s'", r.Creator.ARN)
314343

315344
for file, role := range aws.HCPAccountRoles {
316345
accRoleName := common.GetRoleName(input.prefix, role.Name)
346+
317347
assumeRolePolicy := getAssumeRolePolicy(r.Creator.Partition, file, input)
318348

319349
r.Reporter.Debugf("Creating role '%s'", accRoleName)
320350
tagsList := hcp.getRoleTags(file, input)
351+
321352
roleARN, err := r.AWSClient.EnsureRole(r.Reporter, accRoleName, assumeRolePolicy, input.permissionsBoundary,
322353
input.defaultPolicyVersion, tagsList, input.path, true)
323354
if err != nil {

‎cmd/create/cluster/cmd.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,9 @@ import (
4141

4242
"github.com/openshift/rosa/cmd/create/admin"
4343
"github.com/openshift/rosa/cmd/create/idp"
44-
"github.com/openshift/rosa/cmd/create/oidcprovider"
4544
"github.com/openshift/rosa/cmd/create/operatorroles"
4645
clusterdescribe "github.com/openshift/rosa/cmd/describe/cluster"
46+
"github.com/openshift/rosa/cmd/dlt/oidcprovider"
4747
installLogs "github.com/openshift/rosa/cmd/logs/install"
4848
"github.com/openshift/rosa/pkg/arguments"
4949
"github.com/openshift/rosa/pkg/aws"
@@ -3550,7 +3550,7 @@ func run(cmd *cobra.Command, _ []string) {
35503550
// clusterConfigFor builds the cluster spec for the OCM API from our command-line options.
35513551
// TODO: eventually, this method signature should be func(args) ocm.Spec.
35523552
func clusterConfigFor(
3553-
reporter *reporter.Object,
3553+
reporter reporter.Logger,
35543554
clusterConfig ocm.Spec,
35553555
awsCreator *aws.Creator,
35563556
awsCredentialsGetter aws.AccessKeyGetter,

‎cmd/create/cmd.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,11 +33,11 @@ import (
3333
"github.com/openshift/rosa/cmd/create/network"
3434
"github.com/openshift/rosa/cmd/create/ocmrole"
3535
"github.com/openshift/rosa/cmd/create/oidcconfig"
36-
"github.com/openshift/rosa/cmd/create/oidcprovider"
3736
"github.com/openshift/rosa/cmd/create/operatorroles"
3837
"github.com/openshift/rosa/cmd/create/service"
3938
"github.com/openshift/rosa/cmd/create/tuningconfigs"
4039
"github.com/openshift/rosa/cmd/create/userrole"
40+
"github.com/openshift/rosa/cmd/dlt/oidcprovider"
4141
"github.com/openshift/rosa/pkg/arguments"
4242
"github.com/openshift/rosa/pkg/interactive/confirm"
4343
)

‎cmd/create/machinepool/options.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ import (
88
const instanceType = "m5.xlarge"
99

1010
type CreateMachinepoolOptions struct {
11-
reporter *reporter.Object
11+
reporter reporter.Logger
1212

1313
args *mpOpts.CreateMachinepoolUserOptions
1414
}

‎cmd/create/network/options.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ import (
66
)
77

88
type Options struct {
9-
reporter *reporter.Object
9+
reporter reporter.Logger
1010

1111
args *opts.NetworkUserOptions
1212
}

‎cmd/create/oidcconfig/cmd.go

Lines changed: 73 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ import (
2929
"github.com/spf13/cobra"
3030
"github.com/zgalor/weberr"
3131

32-
"github.com/openshift/rosa/cmd/create/oidcprovider"
32+
"github.com/openshift/rosa/cmd/dlt/oidcprovider"
3333
"github.com/openshift/rosa/pkg/arguments"
3434
"github.com/openshift/rosa/pkg/aws"
3535
awscb "github.com/openshift/rosa/pkg/aws/commandbuilder"
@@ -316,6 +316,21 @@ func run(cmd *cobra.Command, _ []string) {
316316
}
317317
}
318318

319+
func CreateOIDCConfig(r *rosa.Runtime, managed bool, userPrefix, region string) (string, error) {
320+
// userPrefix, region are used only for unmanaged
321+
oidcConfigInput, err := oidcconfigs.BuildOidcConfigInput(userPrefix, region)
322+
if err != nil {
323+
return "", nil
324+
}
325+
if managed {
326+
strategy := CreateManagedOidcConfigAutoStrategy{oidcConfigInput: &oidcConfigInput}
327+
return strategy.executeNoExit(r)
328+
}
329+
330+
strategy := CreateUnmanagedOidcConfigAutoStrategy{oidcConfig: &oidcConfigInput}
331+
return strategy.executeNoExit(r)
332+
}
333+
319334
type CreateOidcConfigStrategy interface {
320335
execute(r *rosa.Runtime) string
321336
}
@@ -364,6 +379,50 @@ const (
364379
jwksKey = "keys.json"
365380
)
366381

382+
func (s *CreateUnmanagedOidcConfigAutoStrategy) executeNoExit(r *rosa.Runtime) (string, error) {
383+
bucketUrl := s.oidcConfig.IssuerUrl
384+
bucketName := s.oidcConfig.BucketName
385+
discoveryDocument := s.oidcConfig.DiscoveryDocument
386+
jwks := s.oidcConfig.Jwks
387+
privateKey := s.oidcConfig.PrivateKey
388+
privateKeySecretName := s.oidcConfig.PrivateKeySecretName
389+
installerRoleArn := args.installerRoleArn
390+
err := r.AWSClient.CreateS3Bucket(bucketName, args.region)
391+
if err != nil {
392+
return "", fmt.Errorf("There was a problem creating S3 bucket '%s': %s", bucketName, err)
393+
}
394+
err = r.AWSClient.PutPublicReadObjectInS3Bucket(bucketName, strings.NewReader(discoveryDocument), discoveryDocumentKey)
395+
if err != nil {
396+
return "", fmt.Errorf("There was a problem populating discovery "+
397+
"document to S3 bucket '%s': %s", bucketName, err)
398+
}
399+
err = r.AWSClient.PutPublicReadObjectInS3Bucket(bucketName, bytes.NewReader(jwks), jwksKey)
400+
if err != nil {
401+
return "", fmt.Errorf("There was a problem populating JWKS "+
402+
"to S3 bucket '%s': %s", bucketName, err)
403+
}
404+
secretARN, err := r.AWSClient.CreateSecretInSecretsManager(privateKeySecretName, string(privateKey[:]))
405+
if err != nil {
406+
r.Reporter.Errorf("There was a problem saving private key to secrets manager: %s", err)
407+
}
408+
oidcConfig, err := v1.NewOidcConfig().
409+
Managed(false).
410+
SecretArn(secretARN).
411+
IssuerUrl(bucketUrl).
412+
InstallerRoleArn(installerRoleArn).
413+
Build()
414+
if err == nil {
415+
oidcConfig, err = r.OCMClient.CreateOidcConfig(oidcConfig)
416+
}
417+
if err != nil {
418+
return "", fmt.Errorf("There was a problem building your unmanaged OIDC Configuration %v.\n"+
419+
"Please refer to documentation and try again through:\n"+
420+
"\trosa register oidc-config --issuer-url %s --secret-arn %s --role-arn %s",
421+
err, bucketUrl, secretARN, installerRoleArn)
422+
}
423+
return oidcConfig.ID(), nil
424+
}
425+
367426
func (s *CreateUnmanagedOidcConfigAutoStrategy) execute(r *rosa.Runtime) string {
368427
bucketUrl := s.oidcConfig.IssuerUrl
369428
bucketName := s.oidcConfig.BucketName
@@ -598,6 +657,19 @@ func (s *CreateManagedOidcConfigAutoStrategy) execute(r *rosa.Runtime) string {
598657
return oidcConfig.ID()
599658
}
600659

660+
func (s *CreateManagedOidcConfigAutoStrategy) executeNoExit(r *rosa.Runtime) (string, error) {
661+
oidcConfig, err := v1.NewOidcConfig().Managed(true).Build()
662+
if err != nil {
663+
return "", fmt.Errorf("There was a problem building the managed OIDC Configuration: %v", err)
664+
}
665+
oidcConfig, err = r.OCMClient.CreateOidcConfig(oidcConfig)
666+
if err != nil {
667+
return "", fmt.Errorf("There was a problem building the managed OIDC Configuration: %v", err)
668+
}
669+
s.oidcConfigInput.IssuerUrl = oidcConfig.IssuerUrl()
670+
return oidcConfig.ID(), nil
671+
}
672+
601673
func getOidcConfigStrategy(mode string, input *oidcconfigs.OidcConfigInput) (CreateOidcConfigStrategy, error) {
602674
if args.rawFiles {
603675
return &CreateUnmanagedOidcConfigRawStrategy{oidcConfig: input}, nil

‎cmd/create/oidcprovider/cmd.go

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
1414
limitations under the License.
1515
*/
1616

17-
package oidcprovider
17+
package oidcprovideru
1818

1919
import (
2020
"fmt"
@@ -228,6 +228,18 @@ func run(cmd *cobra.Command, argv []string) {
228228
}
229229
}
230230

231+
func CreateOIDCProvider(r *rosa.Runtime, oidcConfigId string, clusterId string, isProgrammaticallyCalled bool) error {
232+
fmt.Println("CreateOIDCProvider")
233+
args.oidcConfigId = oidcConfigId
234+
oidcConfig, err := r.OCMClient.GetOidcConfig(oidcConfigId)
235+
if err != nil {
236+
r.Reporter.Errorf("There was a problem retrieving OIDC Config '%s': %v", oidcConfigId, err)
237+
return err
238+
}
239+
oidcEndpointURL := oidcConfig.IssuerUrl()
240+
return createProvider(r, oidcEndpointURL, clusterId, isProgrammaticallyCalled)
241+
}
242+
231243
func createProvider(r *rosa.Runtime, oidcEndpointUrl string, clusterId string, isProgrammaticallyCalled bool) error {
232244
inputBuilder := cmv1.NewOidcThumbprintInput()
233245
if (isProgrammaticallyCalled || clusterId == "") && args.oidcConfigId != "" {

‎cmd/create/operatorroles/by_prefix.go

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,22 @@ func handleOperatorRolesPrefixOptions(r *rosa.Runtime, cmd *cobra.Command) {
7676
}
7777
}
7878

79-
func handleOperatorRoleCreationByPrefix(r *rosa.Runtime, env string,
79+
func Knedlik(r *rosa.Runtime, env string, permissionsBoundary string, mode string, policies map[string]*cmv1.AWSSTSPolicy, defaultPolicyVersion string, isSharedVpc bool,
80+
prefix string, hostedCp bool, installerRoleArn string, forcePolicyCreation bool, oidcConfigId string, sharedVpcRoleArn string, channelGroup string, vpcEndpointRoleArn string) error {
81+
args.prefix = prefix
82+
args.hostedCp = hostedCp
83+
args.installerRoleArn = installerRoleArn
84+
args.permissionsBoundary = permissionsBoundary
85+
args.forcePolicyCreation = forcePolicyCreation
86+
args.oidcConfigId = oidcConfigId
87+
args.sharedVpcRoleArn = sharedVpcRoleArn
88+
args.channelGroup = channelGroup
89+
args.vpcEndpointRoleArn = vpcEndpointRoleArn
90+
91+
return HandleOperatorRoleCreationByPrefix(r, env, permissionsBoundary, mode, policies, defaultPolicyVersion, isSharedVpc)
92+
}
93+
94+
func HandleOperatorRoleCreationByPrefix(r *rosa.Runtime, env string,
8095
permissionsBoundary string, mode string,
8196
policies map[string]*cmv1.AWSSTSPolicy,
8297
defaultPolicyVersion string, isSharedVpc bool) error {
@@ -99,6 +114,7 @@ func handleOperatorRoleCreationByPrefix(r *rosa.Runtime, env string,
99114
r.Reporter.Errorf("%s", err)
100115
os.Exit(1)
101116
}
117+
102118
path, err := aws.GetPathFromARN(installerRoleArn)
103119
if err != nil {
104120
r.Reporter.Errorf("Expected a valid path for '%s': %v", installerRoleArn, err)
@@ -117,16 +133,19 @@ func handleOperatorRoleCreationByPrefix(r *rosa.Runtime, env string,
117133
os.Exit(1)
118134
}
119135
operatorRolePolicyPrefix := installerRolePrefix
136+
120137
credRequests, err := r.OCMClient.GetCredRequests(includeHostedCpSet)
121138
if err != nil {
122139
r.Reporter.Errorf("Error getting operator credential request from OCM %s", err)
123140
os.Exit(1)
124141
}
142+
125143
managedPolicies, err := r.AWSClient.HasManagedPolicies(installerRoleArn)
126144
if err != nil {
127145
r.Reporter.Errorf("Failed to determine if cluster has managed policies: %v", err)
128146
os.Exit(1)
129147
}
148+
130149
awsCreator, err := r.AWSClient.GetCreator()
131150
if err != nil {
132151
r.Reporter.Errorf("Unable to get IAM credentials: %v", err)
@@ -161,6 +180,7 @@ func handleOperatorRoleCreationByPrefix(r *rosa.Runtime, env string,
161180
r.Reporter.Errorf("%v", err)
162181
os.Exit(1)
163182
}
183+
164184
err = ocm.ValidateOperatorRolesMatchOidcProvider(r.Reporter, r.AWSClient,
165185
operatorRolesList, oidcConfig.IssuerUrl(), "4.0", path, managedPolicies, true)
166186
if err != nil && !awserr.IsNoSuchEntityException(err) {
@@ -259,6 +279,7 @@ func convertCredRequestsOperatorRolesIntoV1OperatorIAMRole(credRequests map[stri
259279

260280
func validateArgumentsOperatorRolesCreationByPrefix(r *rosa.Runtime, operatorRolesPrefix string,
261281
oidcEndpointUrl string, installerRoleArn string) {
282+
fmt.Println("validateArgumentsOperatorRolesCreationByPrefix")
262283
if len(operatorRolesPrefix) == 0 {
263284
r.Reporter.Errorf("Expected a prefix for the operator IAM roles")
264285
os.Exit(1)
@@ -296,6 +317,7 @@ func createRolesByPrefix(r *rosa.Runtime, prefix string, permissionsBoundary str
296317

297318
isSharedVpc := sharedVpcRoleArn != ""
298319

320+
fmt.Println("createRolesByPrefix IN")
299321
for credrequest, operator := range credRequests {
300322
roleArn := aws.FindOperatorRoleBySTSOperator(operatorIAMRoleList, operator)
301323
roleName, err := aws.GetResourceIdFromARN(roleArn)

‎cmd/create/operatorroles/cmd.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -371,7 +371,7 @@ func run(cmd *cobra.Command, argv []string) {
371371
r.Reporter.Errorf("Error getting latest version: %s", err)
372372
os.Exit(1)
373373
}
374-
err = handleOperatorRoleCreationByPrefix(r, env, permissionsBoundary,
374+
err = HandleOperatorRoleCreationByPrefix(r, env, permissionsBoundary,
375375
mode, policies, latestPolicyVersion, isHcpSharedVpc)
376376
if err != nil {
377377
r.Reporter.Errorf("Error creating operator roles: %s", err)

‎cmd/create/userrole/cmd.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ import (
3232
"github.com/openshift/rosa/pkg/interactive"
3333
"github.com/openshift/rosa/pkg/interactive/confirm"
3434
"github.com/openshift/rosa/pkg/ocm"
35-
rprtr "github.com/openshift/rosa/pkg/reporter"
35+
"github.com/openshift/rosa/pkg/reporter"
3636
"github.com/openshift/rosa/pkg/rosa"
3737
)
3838

@@ -312,7 +312,7 @@ func createRoles(r *rosa.Runtime,
312312
return roleARN, nil
313313
}
314314

315-
func generateUserRolePolicyFiles(reporter *rprtr.Object, env string, partition string, accountID string,
315+
func generateUserRolePolicyFiles(reporter reporter.Logger, env string, partition string, accountID string,
316316
policies map[string]*cmv1.AWSSTSPolicy) error {
317317
filename := fmt.Sprintf("sts_%s_trust_policy", aws.OCMUserRolePolicyFile)
318318
policyDetail := aws.GetPolicyDetails(policies, filename)

‎cmd/describe/ingress/options.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ type DescribeIngressUserOptions struct {
1111
}
1212

1313
type DescribeIngressOptions struct {
14-
reporter *reporter.Object
14+
reporter reporter.Logger
1515
args DescribeIngressUserOptions
1616
}
1717

‎cmd/describe/machinepool/options.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ type DescribeMachinepoolUserOptions struct {
1111
}
1212

1313
type DescribeMachinepoolOptions struct {
14-
reporter *reporter.Object
14+
reporter reporter.Logger
1515

1616
args *DescribeMachinepoolUserOptions
1717
}

‎cmd/dlt/machinepool/options.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ type DeleteMachinepoolUserOptions struct {
1212
}
1313

1414
type DeleteMachinepoolOptions struct {
15-
reporter *reporter.Object
15+
reporter reporter.Logger
1616

1717
args *DeleteMachinepoolUserOptions
1818
}

‎cmd/edit/machinepool/options.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ type EditMachinepoolUserOptions struct {
2424
}
2525

2626
type EditMachinepoolOptions struct {
27-
reporter *reporter.Object
27+
reporter reporter.Logger
2828

2929
args *EditMachinepoolUserOptions
3030
}

0 commit comments

Comments
 (0)