Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow custom AWS tags in iamrole annotation #88

Merged
merged 5 commits into from
Mar 16, 2022

Conversation

nrosenberg1
Copy link
Collaborator

@nrosenberg1 nrosenberg1 commented Mar 9, 2022

Could you share the solution in high level?

  1. Allow specifying custom tags to be applied to Iamrole in AWS along with default tags
  2. User can annotate Iamrole with key "iammanager.keikoproj.io/tags" with value in format "key1=value1;;key2=value2" and controller will tag AWS role accordingly

Could you share the test results?
Screen Shot 2022-03-14 at 3 20 56 PM
Screen Shot 2022-03-09 at 12 11 05 PM

Nathan Rosenberg added 3 commits March 9, 2022 14:14
Signed-off-by: Nathan Rosenberg <[email protected]>
@nvandanapu nvandanapu requested a review from mnkg561 March 14, 2022 17:14
Copy link
Contributor

@mnkg561 mnkg561 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, Make sure you are not allowing people to overwrite default tags like namespace, cluster, managedBy using annotations. Those are reserved tags and should not be allowed to edited by the user

@@ -298,6 +298,21 @@ func (r *IamroleReconciler) ConstructCreateIAMRoleInput(ctx context.Context, iam
tags["Cluster"] = config.Props.ClusterName()
}

// Custom tags value should be a string of comma seperated key/value pairs
// example annotation: "iamroles.iammanager.keikoproj.io/tags": "key1=value1,key2=value2"
if customTagsString, ok := iamRole.GetAnnotations()["iamroles.iammanager.keikoproj.io/tags"]; ok {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is a common utility function to read the annotation. Please use that

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, will change this

@@ -168,6 +174,34 @@ func CompareAssumeRolePolicy(ctx context.Context, request string, target string)
return true
}

//CompareTags compares tags from request and response
func CompareTags(ctx context.Context, request map[string]string, target []*iam.Tag) bool {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this handle the default tags in the comparison? Default tags(managedBy, Namespace, cluster) is not coming in the request annotation so it is always returns that there is a diff

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is checking roleInput tags so default tags are included in request map, unit tests validate the same

@nrosenberg1
Copy link
Collaborator Author

Also, Make sure you are not allowing people to overwrite default tags like namespace, cluster, managedBy using annotations. Those are reserved tags and should not be allowed to edited by the user

Sure, I will add this validation

…t tags from overwrite

Signed-off-by: Nathan Rosenberg <[email protected]>
Copy link
Contributor

@mnkg561 mnkg561 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you already taken care of protecting reserved tags, its good to go

@nrosenberg1
Copy link
Collaborator Author

@mnkg561 is travis-ci status check no longer needed since moving to github actions? #85

@mnkg561
Copy link
Contributor

mnkg561 commented Mar 16, 2022

There is no travis.yaml file in the repo. I also removed travis web hook just now. Try with a dummy commit and see whether it gets refreshed

Signed-off-by: Nathan Rosenberg <[email protected]>
@nrosenberg1
Copy link
Collaborator Author

@mnkg561 looks like dummy commit didn't refresh it, guess I will just administrator merge

@nrosenberg1 nrosenberg1 merged commit ad071d7 into keikoproj:master Mar 16, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants