HOSTEDCP-1402: cmd/infra/aws/destroy: allow using component credentials #3975
Conversation
|
@stevekuznetsov: This pull request references HOSTEDCP-1402 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.16.0" version, but no target version was set. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/valid-reference
openshift-ci
bot
added
area/cli
|
Lots of failures on /retest |
|
/retest |
stevekuznetsov
force-pushed
the
skuznets/cleanup-job
branch
from
0ca019c
to
b4ac15f
Compare
✅ Deploy Preview for hypershift-docs ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: csrwng, stevekuznetsov The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
stevekuznetsov
force-pushed
the
skuznets/cleanup-job
branch
from
b4ac15f
to
8576bcd
Compare
|
Verify just needed |
|
/lgtm |
|
/retest |
|
/hold Revision 8576bcd was retested 3 times: holding |
openshift-ci
bot
added
the
do-not-merge/hold
|
/hold cancel |
|
@stevekuznetsov: This pull request references HOSTEDCP-1402 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.17.0" version, but no target version was set. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
bot
removed
the
do-not-merge/hold
|
/hold Revision 8576bcd was retested 3 times: holding |
openshift-ci
bot
added
the
do-not-merge/hold
The policies in this file are statically associated with the service account names and the user agents, and these associations are stable. This refactor exposes the association to a) enforce the connections and b) allow other consumers to understand it. Signed-off-by: Steve Kuznetsov <skuznets@redhat.com>
When we run a cleanup task using the myriad credentials that cluster components have, we need to delegate each call to an AWS service API to the correct credential that has permissions to use it. We can generate the delegating client directly from our policy documents to allow us to keep consumer code from having to know that there are many different clients operating under the hood in this mode. Signed-off-by: Steve Kuznetsov <skuznets@redhat.com>
Signed-off-by: Steve Kuznetsov <skuznets@redhat.com>
stevekuznetsov
force-pushed
the
skuznets/cleanup-job
branch
from
8576bcd
to
5461016
Compare
|
/lgtm |
|
/retest |
|
/hold cancel |
openshift-ci
bot
removed
the
do-not-merge/hold
|
@stevekuznetsov: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/hold Revision 5461016 was retested 3 times: holding |
openshift-ci
bot
added
the
do-not-merge/hold
cmd/infra/aws/iam: refactor static data
The policies in this file are statically associated with the service
account names and the user agents, and these associations are stable.
This refactor exposes the association to a) enforce the connections and
b) allow other consumers to understand it.
Signed-off-by: Steve Kuznetsov skuznets@redhat.com
cmd/infra/aws: generate a delegating AWS client
When we run a cleanup task using the myriad credentials that cluster
components have, we need to delegate each call to an AWS service API to
the correct credential that has permissions to use it. We can generate
the delegating client directly from our policy documents to allow us to
keep consumer code from having to know that there are many different
clients operating under the hood in this mode.
Signed-off-by: Steve Kuznetsov skuznets@redhat.com
cmd/infra/aws/destroy: allow using component credentials
Signed-off-by: Steve Kuznetsov skuznets@redhat.com