Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[OSD-21438] Remove the fallback to old flow #402

Merged
merged 2 commits into from
Apr 25, 2024
Merged

[OSD-21438] Remove the fallback to old flow #402

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c45c03a
Remove the fallback to old flow
xiaoyu74 Apr 23, 2024
9fbf06a
Remove the unused old flow functions
xiaoyu74 Apr 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
100 changes: 7 additions & 93 deletions cmd/ocm-backplane/cloud/common.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,6 @@ import (
"github.com/aws/aws-sdk-go-v2/service/sts"
ocmsdk "github.com/openshift-online/ocm-sdk-go"
cmv1 "github.com/openshift-online/ocm-sdk-go/clustersmgmt/v1"
BackplaneApi "github.com/openshift/backplane-api/pkg/client"
"github.com/openshift/backplane-cli/pkg/awsutil"
"github.com/openshift/backplane-cli/pkg/backplaneapi"
"github.com/openshift/backplane-cli/pkg/cli/config"
Expand Down Expand Up @@ -70,20 +69,14 @@ func (cfg *QueryConfig) GetCloudConsole() (*ConsoleResponse, error) {

isolatedBackplane, err := isIsolatedBackplaneAccess(cfg.Cluster, cfg.OcmConnection)
if err != nil {
logger.Infof("failed to determine if the cluster is using isolated backplane access: %v", err)
logger.Infof("for more information, try ocm get /api/clusters_mgmt/v1/clusters/%s/sts_support_jump_role", cfg.Cluster.ID())
logger.Infof("attempting to fallback to %s", OldFlowSupportRole)
return nil, fmt.Errorf("failed to determine if the cluster is using isolated backplane access: %v", err)
}

if isolatedBackplane {
logger.Debugf("cluster is using isolated backplane")
targetCredentials, err := cfg.getIsolatedCredentials(ocmToken)
if err != nil {
// TODO: This fallback should be removed in the future
// TODO: when we are more confident in our ability to access clusters using the isolated flow
logger.Infof("failed to assume role with isolated backplane flow: %v", err)
logger.Infof("attempting to fallback to %s", OldFlowSupportRole)
return cfg.getCloudConsoleFromPublicAPI(ocmToken)
return nil, fmt.Errorf("failed to assume role with isolated backplane flow: %v", err)
}

resp, err := awsutil.GetSigninToken(targetCredentials, cfg.Cluster.Region().ID())
Expand All @@ -98,64 +91,26 @@ func (cfg *QueryConfig) GetCloudConsole() (*ConsoleResponse, error) {
return &ConsoleResponse{ConsoleLink: signinFederationURL.String()}, nil
}

return cfg.getCloudConsoleFromPublicAPI(ocmToken)
}

// GetCloudConsole returns console response calling to public Backplane API
func (cfg *QueryConfig) getCloudConsoleFromPublicAPI(ocmToken string) (*ConsoleResponse, error) {
logger.Debugln("Getting Cloud Console")

client, err := backplaneapi.DefaultClientUtils.GetBackplaneClient(cfg.BackplaneConfiguration.URL, ocmToken, cfg.BackplaneConfiguration.ProxyURL)
if err != nil {
return nil, err
}
resp, err := client.GetCloudConsole(context.TODO(), cfg.Cluster.ID())
if err != nil {
return nil, err
}

if resp.StatusCode != http.StatusOK {
return nil, utils.TryPrintAPIError(resp, false)
}

credsResp, err := BackplaneApi.ParseGetCloudConsoleResponse(resp)
if err != nil {
return nil, fmt.Errorf("unable to parse response body from backplane:\n Status Code: %d", resp.StatusCode)
}

if len(credsResp.Body) == 0 {
return nil, fmt.Errorf("empty response from backplane")
}

cliResp := &ConsoleResponse{}
cliResp.ConsoleLink = *credsResp.JSON200.ConsoleLink

return cliResp, nil
return nil, fmt.Errorf("cluster is not using isolated backplane access")
}

// GetCloudCredentials returns Cloud Credentials Response
func (cfg *QueryConfig) GetCloudCredentials() (bpCredentials.Response, error) {
ocmToken, _, err := cfg.OcmConnection.Tokens()
if err != nil {
return nil, fmt.Errorf("unable to get token for ocm connection")
return nil, fmt.Errorf("unable to get token for ocm connection: %w", err)
}

isolatedBackplane, err := isIsolatedBackplaneAccess(cfg.Cluster, cfg.OcmConnection)
if err != nil {
logger.Infof("failed to determine if the cluster is using isolated backplane access: %v", err)
logger.Infof("for more information, try ocm get /api/clusters_mgmt/v1/clusters/%s/sts_support_jump_role", cfg.Cluster.ID())
logger.Infof("attempting to fallback to %s", OldFlowSupportRole)
return nil, fmt.Errorf("failed to determine if the cluster is using isolated backplane access: %v", err)
}

if isolatedBackplane {
logger.Debugf("cluster is using isolated backplane")
targetCredentials, err := cfg.getIsolatedCredentials(ocmToken)
if err != nil {
// TODO: This fallback should be removed in the future
// TODO: when we are more confident in our ability to access clusters using the isolated flow
logger.Infof("failed to assume role with isolated backplane flow: %v", err)
logger.Infof("attempting to fallback to %s", OldFlowSupportRole)
return cfg.getCloudCredentialsFromBackplaneAPI(ocmToken)
return nil, fmt.Errorf("failed to assume role with isolated backplane flow: %v", err)
}

return &bpCredentials.AWSCredentialsResponse{
Expand All @@ -167,48 +122,7 @@ func (cfg *QueryConfig) GetCloudCredentials() (bpCredentials.Response, error) {
}, nil
}

return cfg.getCloudCredentialsFromBackplaneAPI(ocmToken)
}

func (cfg *QueryConfig) getCloudCredentialsFromBackplaneAPI(ocmToken string) (bpCredentials.Response, error) {
client, err := backplaneapi.DefaultClientUtils.GetBackplaneClient(cfg.BackplaneConfiguration.URL, ocmToken, cfg.BackplaneConfiguration.ProxyURL)
if err != nil {
return nil, err
}

resp, err := client.GetCloudCredentials(context.TODO(), cfg.Cluster.ID())
if err != nil {
return nil, err
}

if resp.StatusCode != http.StatusOK {
return nil, utils.TryPrintAPIError(resp, false)
}

logger.Debugln("Parsing response")

credsResp, err := BackplaneApi.ParseGetCloudCredentialsResponse(resp)
if err != nil {
return nil, fmt.Errorf("unable to parse response body from backplane:\n Status Code: %d : err: %v", resp.StatusCode, err)
}

switch cfg.Cluster.CloudProvider().ID() {
case "aws":
cliResp := &bpCredentials.AWSCredentialsResponse{}
if err := json.Unmarshal([]byte(*credsResp.JSON200.Credentials), cliResp); err != nil {
return nil, fmt.Errorf("unable to unmarshal AWS credentials response from backplane %s: %w", *credsResp.JSON200.Credentials, err)
}
cliResp.Region = cfg.Cluster.Region().ID()
return cliResp, nil
case "gcp":
cliResp := &bpCredentials.GCPCredentialsResponse{}
if err := json.Unmarshal([]byte(*credsResp.JSON200.Credentials), cliResp); err != nil {
return nil, fmt.Errorf("unable to unmarshal GCP credentials response from backplane %s: %w", *credsResp.JSON200.Credentials, err)
}
return cliResp, nil
default:
return nil, fmt.Errorf("unsupported cloud provider: %s", cfg.Cluster.CloudProvider().ID())
}
return nil, fmt.Errorf("cluster is not using isolated backplane access")
}

type assumeChainResponse struct {
Expand Down