OCPBUGS-35262: Skip firewall rule creation if permission is missing #8706
Conversation
openshift-ci-robot
added
jira/severity-important
|
@barbacbd: This pull request references Jira Issue OCPBUGS-35262, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
Requesting review from QA contact: The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/cc @bfournie |
|
/label platform/google |
| const ( | ||
| // GCPFirewallPermission is the role/permission to create or skip the creation of | ||
| // firewall rules for GCP during a xpn installation. | ||
| GCPFirewallPermission = "compute.firewalls.create" |
There was a problem hiding this comment.
Maybe it doesn't need to be exported or there is a better place for it (like pkg/types/gcp)?
| @@ -209,6 +217,25 @@ func deleteFirewallRule(ctx context.Context, name, projectID string) error { | |||
|
|
|||
| // createFirewallRules creates the rules needed between the worker and master nodes. | |||
| func createFirewallRules(ctx context.Context, in clusterapi.InfraReadyInput, network string) error { | |||
| if in.InstallConfig.Config.GCP.NetworkProjectID != "" { | |||
There was a problem hiding this comment.
| if in.InstallConfig.Config.GCP.NetworkProjectID != "" { | |
| if projID := in.InstallConfig.Config.GCP.NetworkProjectID; projID != "" { |
| permissions, err := client.GetProjectPermissions(context.Background(), in.InstallConfig.Config.GCP.NetworkProjectID, []string{ | ||
| GCPFirewallPermission, | ||
| }) |
There was a problem hiding this comment.
| permissions, err := client.GetProjectPermissions(context.Background(), in.InstallConfig.Config.GCP.NetworkProjectID, []string{ | |
| GCPFirewallPermission, | |
| }) | |
| permissions, err := client.GetProjectPermissions(ctx, projID, []string{GCPFirewallPermission}) |
barbacbd
force-pushed
the
capg-xpn-skip-firewall-creation
branch
from
209d465 to
7462849
Compare
** When the "compute.firewalls.create" permission is missing, do not fail. Instead, skip the creation of firewall rules during xpn installs with capg.
barbacbd
force-pushed
the
capg-xpn-skip-firewall-creation
branch
from
7462849 to
9f7e393
Compare
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bfournie The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
/hold Revision 9f7e393 was retested 3 times: holding |
openshift-ci
bot
added
the
do-not-merge/hold
|
/hold cancel |
|
/test golint |
openshift-ci
bot
removed
the
do-not-merge/hold
|
@barbacbd: all tests passed! Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
@barbacbd: Jira Issue OCPBUGS-35262: All pull requests linked via external trackers have merged: Jira Issue OCPBUGS-35262 has been moved to the MODIFIED state. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[ART PR BUILD NOTIFIER] This PR has been included in build ose-installer-altinfra-container-v4.17.0-202407100341.p0.g9526425.assembly.stream.el9 for distgit ose-installer-altinfra. |
** When the "compute.firewalls.create" permission is missing, do not fail. Instead, skip the creation of firewall rules during xpn installs with capg.