Skip to content

Commit e435dc2

Browse files
hunterkepleyhunterkepley
committed
OCM-12775 | feat: by_cluster_key operator role creation hcpsharedvpc
1 parent 6cf97df commit e435dc2

File tree

3 files changed

+90
-44
lines changed

3 files changed

+90
-44
lines changed

‎cmd/create/cluster/cmd.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3461,6 +3461,13 @@ func run(cmd *cobra.Command, _ []string) {
34613461
if permissionsBoundary != "" {
34623462
rolesCMD = fmt.Sprintf("%s --permissions-boundary %s", rolesCMD, permissionsBoundary)
34633463
}
3464+
// HCP Shared VPC
3465+
if route53RoleArn != "" {
3466+
rolesCMD = fmt.Sprintf("%s --%s %s --hosted-cp", rolesCMD, route53RoleArnFlag, route53RoleArn)
3467+
}
3468+
if vpcEndpointRoleArn != "" {
3469+
rolesCMD = fmt.Sprintf("%s --%s %s", rolesCMD, vpcEndpointRoleArnFlag, vpcEndpointRoleArn)
3470+
}
34643471
output = fmt.Sprintf("%s\t%s\n", output, rolesCMD)
34653472
}
34663473
oidcEndpointURL := cluster.AWS().STS().OIDCEndpointURL()

‎cmd/create/operatorroles/by_clusterkey.go

Lines changed: 82 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,29 @@ import (
1818
"github.com/openshift/rosa/pkg/rosa"
1919
)
2020

21+
type operatorRolesInput struct {
22+
prefix string
23+
permissionsBoundary string
24+
cluster *cmv1.Cluster
25+
accountRoleVersion string
26+
policies map[string]*cmv1.AWSSTSPolicy
27+
defaultVersion string
28+
credRequests map[string]*cmv1.STSOperator
29+
managedPolicies bool
30+
hostedCPPolicies bool
31+
isHcpSharedVpc bool
32+
route53RoleArn string
33+
vpcEndpointRoleArn string
34+
}
35+
2136
func handleOperatorRoleCreationByClusterKey(r *rosa.Runtime, env string,
2237
permissionsBoundary string, mode string,
2338
policies map[string]*cmv1.AWSSTSPolicy,
24-
defaultPolicyVersion string) error {
39+
defaultPolicyVersion string, isHcpSharedVpc bool) error {
2540
clusterKey := r.GetClusterKey()
2641
cluster := r.FetchCluster()
42+
route53RoleArn := args.sharedVpcRoleArn
43+
vpcEndpointRoleArn := args.vpcEndpointRoleArn
2744
if cluster.AWS().STS().RoleARN() == "" {
2845
r.Reporter.Errorf("Cluster '%s' is not an STS cluster.", clusterKey)
2946
os.Exit(1)
@@ -101,8 +118,20 @@ func handleOperatorRoleCreationByClusterKey(r *rosa.Runtime, env string,
101118
r.Reporter.Errorf("Error getting account role version '%v'", err)
102119
os.Exit(1)
103120
}
104-
err = createRoles(r, operatorRolePolicyPrefix, permissionsBoundary, cluster,
105-
accountRoleVersion, policies, defaultPolicyVersion, credRequests, managedPolicies, hostedCPPolicies)
121+
err = createRoles(r, operatorRolesInput{
122+
prefix: operatorRolePolicyPrefix,
123+
permissionsBoundary: permissionsBoundary,
124+
cluster: cluster,
125+
accountRoleVersion: accountRoleVersion,
126+
policies: policies,
127+
defaultVersion: defaultPolicyVersion,
128+
credRequests: credRequests,
129+
managedPolicies: managedPolicies,
130+
hostedCPPolicies: hostedCPPolicies,
131+
isHcpSharedVpc: isHcpSharedVpc,
132+
route53RoleArn: route53RoleArn,
133+
vpcEndpointRoleArn: vpcEndpointRoleArn,
134+
})
106135
if err != nil {
107136
r.Reporter.Errorf("There was an error creating the operator roles: '%v'", err)
108137
isThrottle := "false"
@@ -147,23 +176,12 @@ func handleOperatorRoleCreationByClusterKey(r *rosa.Runtime, env string,
147176
return nil
148177
}
149178

150-
func createRoles(
151-
r *rosa.Runtime,
152-
prefix string,
153-
permissionsBoundary string,
154-
cluster *cmv1.Cluster,
155-
accountRoleVersion string,
156-
policies map[string]*cmv1.AWSSTSPolicy,
157-
defaultVersion string,
158-
credRequests map[string]*cmv1.STSOperator,
159-
managedPolicies bool,
160-
hostedCPPolicies bool,
161-
) error {
162-
sharedVpcRoleArn := cluster.AWS().PrivateHostedZoneRoleARN()
179+
func createRoles(r *rosa.Runtime, createInput operatorRolesInput) error {
180+
sharedVpcRoleArn := createInput.cluster.AWS().PrivateHostedZoneRoleARN()
163181
isSharedVpc := sharedVpcRoleArn != ""
164182

165-
for credrequest, operator := range credRequests {
166-
ver := cluster.Version()
183+
for credrequest, operator := range createInput.credRequests {
184+
ver := createInput.cluster.Version()
167185
if ver != nil && operator.MinVersion() != "" {
168186
isSupported, err := ocm.CheckSupportedVersion(ocm.GetVersionMinor(ver.ID()), operator.MinVersion())
169187
if err != nil {
@@ -174,30 +192,48 @@ func createRoles(
174192
continue
175193
}
176194
}
177-
roleName, _ := aws.FindOperatorRoleNameBySTSOperator(cluster, operator)
195+
roleName, _ := aws.FindOperatorRoleNameBySTSOperator(createInput.cluster, operator)
178196
if roleName == "" {
179197
return fmt.Errorf("Failed to find operator IAM role")
180198
}
181199

182-
path, err := aws.GetPathFromAccountRole(cluster, aws.AccountRoles[aws.InstallerAccountRole].Name)
200+
path, err := aws.GetPathFromAccountRole(createInput.cluster, aws.AccountRoles[aws.InstallerAccountRole].Name)
183201
if err != nil {
184202
return err
185203
}
186204

187205
var policyArn string
188-
filename := aws.GetOperatorPolicyKey(credrequest, hostedCPPolicies, isSharedVpc)
189-
if managedPolicies {
190-
policyArn, err = aws.GetManagedPolicyARN(policies, filename)
206+
var policyArns []string
207+
filename := aws.GetOperatorPolicyKey(credrequest, createInput.hostedCPPolicies, isSharedVpc)
208+
if createInput.managedPolicies {
209+
policyArn, err = aws.GetManagedPolicyARN(createInput.policies, filename)
191210
if err != nil {
192211
return err
193212
}
213+
if createInput.isHcpSharedVpc {
214+
if credrequest == aws.IngressOperatorCloudCredentialsRoleType {
215+
sharedVpcPolicyArn, err := getHcpSharedVpcPolicy(r, sharedVpcRoleArn, createInput.defaultVersion)
216+
if err != nil {
217+
return err
218+
}
219+
policyArns = append(policyArns, sharedVpcPolicyArn)
220+
} else if credrequest == aws.ControlPlaneCloudCredentialsRoleType {
221+
for _, arn := range []string{createInput.vpcEndpointRoleArn, sharedVpcRoleArn} {
222+
sharedVpcPolicyArn, err := getHcpSharedVpcPolicy(r, arn, createInput.defaultVersion)
223+
if err != nil {
224+
return err
225+
}
226+
policyArns = append(policyArns, sharedVpcPolicyArn)
227+
}
228+
}
229+
}
194230
} else {
195-
policyArn = aws.GetOperatorPolicyARN(r.Creator.Partition, r.Creator.AccountID, prefix, operator.Namespace(),
196-
operator.Name(), path)
197-
policyDetails := aws.GetPolicyDetails(policies, filename)
231+
policyArn = aws.GetOperatorPolicyARN(r.Creator.Partition, r.Creator.AccountID, createInput.prefix,
232+
operator.Namespace(), operator.Name(), path)
233+
policyDetails := aws.GetPolicyDetails(createInput.policies, filename)
198234

199235
if isSharedVpc && credrequest == aws.IngressOperatorCloudCredentialsRoleType {
200-
err = validateIngressOperatorPolicyOverride(r, policyArn, sharedVpcRoleArn, prefix)
236+
err = validateIngressOperatorPolicyOverride(r, policyArn, sharedVpcRoleArn, createInput.prefix)
201237
if err != nil {
202238
return err
203239
}
@@ -208,30 +244,31 @@ func createRoles(
208244
}
209245

210246
operatorPolicyTags := map[string]string{
211-
common.OpenShiftVersion: accountRoleVersion,
212-
tags.RolePrefix: prefix,
247+
common.OpenShiftVersion: createInput.accountRoleVersion,
248+
tags.RolePrefix: createInput.prefix,
213249
tags.RedHatManaged: helper.True,
214250
tags.OperatorNamespace: operator.Namespace(),
215251
tags.OperatorName: operator.Name(),
216252
}
217253

218254
if args.forcePolicyCreation || (isSharedVpc && credrequest == aws.IngressOperatorCloudCredentialsRoleType) {
219255
policyArn, err = r.AWSClient.ForceEnsurePolicy(policyArn, policyDetails,
220-
defaultVersion, operatorPolicyTags, path)
256+
createInput.defaultVersion, operatorPolicyTags, path)
221257
if err != nil {
222258
return err
223259
}
224260
} else {
225261
policyArn, err = r.AWSClient.EnsurePolicy(policyArn, policyDetails,
226-
defaultVersion, operatorPolicyTags, path)
262+
createInput.defaultVersion, operatorPolicyTags, path)
227263
if err != nil {
228264
return err
229265
}
230266
}
231267
}
268+
policyArns = append(policyArns, policyArn)
232269

233-
policyDetails := aws.GetPolicyDetails(policies, "operator_iam_role_policy")
234-
policy, err := aws.GenerateOperatorRolePolicyDoc(r.Creator.Partition, cluster,
270+
policyDetails := aws.GetPolicyDetails(createInput.policies, "operator_iam_role_policy")
271+
policy, err := aws.GenerateOperatorRolePolicyDoc(r.Creator.Partition, createInput.cluster,
235272
r.Creator.AccountID, operator, policyDetails)
236273
if err != nil {
237274
return err
@@ -243,29 +280,31 @@ func createRoles(
243280
tags.OperatorName: operator.Name(),
244281
tags.RedHatManaged: helper.True,
245282
}
246-
if !ocm.IsOidcConfigReusable(cluster) {
247-
tagsList[tags.ClusterID] = cluster.ID()
283+
if !ocm.IsOidcConfigReusable(createInput.cluster) {
284+
tagsList[tags.ClusterID] = createInput.cluster.ID()
248285
}
249-
if managedPolicies {
286+
if createInput.managedPolicies {
250287
tagsList[common.ManagedPolicies] = helper.True
251288
}
252-
if hostedCPPolicies {
289+
if createInput.hostedCPPolicies {
253290
tagsList[tags.HypershiftPolicies] = helper.True
254291
}
255292

256-
roleARN, err := r.AWSClient.EnsureRole(r.Reporter, roleName, policy, permissionsBoundary, accountRoleVersion,
257-
tagsList, path, managedPolicies)
293+
roleARN, err := r.AWSClient.EnsureRole(r.Reporter, roleName, policy, createInput.permissionsBoundary,
294+
createInput.accountRoleVersion, tagsList, path, createInput.managedPolicies)
258295
if err != nil {
259296
return err
260297
}
261298
if !output.HasFlag() || r.Reporter.IsTerminal() {
262299
r.Reporter.Infof("Created role '%s' with ARN '%s'", roleName, roleARN)
263300
}
264301

265-
r.Reporter.Debugf("Attaching permission policy '%s' to role '%s'", policyArn, roleName)
266-
err = r.AWSClient.AttachRolePolicy(r.Reporter, roleName, policyArn)
267-
if err != nil {
268-
return err
302+
for _, arn := range policyArns {
303+
r.Reporter.Debugf("Attaching permission policy '%s' to role '%s'", arn, roleName)
304+
err = r.AWSClient.AttachRolePolicy(r.Reporter, roleName, arn)
305+
if err != nil {
306+
return err
307+
}
269308
}
270309
}
271310

‎cmd/create/operatorroles/cmd.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -386,7 +386,7 @@ func run(cmd *cobra.Command, argv []string) {
386386
os.Exit(1)
387387
}
388388
err = handleOperatorRoleCreationByClusterKey(r, env, permissionsBoundary,
389-
mode, policies, latestPolicyVersion)
389+
mode, policies, latestPolicyVersion, isHcpSharedVpc)
390390
if err != nil {
391391
r.Reporter.Errorf("Error creating operator roles: %s", err)
392392
os.Exit(1)

0 commit comments

Comments
 (0)