Feat/account region protection #203
Conversation
Change test files from `runtime_test` to `runtime` package to enable testing of package private functions. Remove ackrt import alias as tests now have direct access to runtime package symbols.
a-hilaly
force-pushed
the
feat/account-region-protection
branch
from
513c7b4 to
1ca522a
Compare
|
/test unit-test |
… resources Adds protection against attempting to manage AWS resources that exist in a different region or account than the controller is configured to use. This prevents accidental resource hijacking and provides clear error messages. - Add `regionDrifted()` and `accountDrifted()` helper functions - Check for drift before creating resource manager in Reconcile - Return terminal errors when drift is detected - Add comprehensive tests for both region and account drift scenarios
a-hilaly
force-pushed
the
feat/account-region-protection
branch
from
1ca522a to
4cf28f2
Compare
| } | ||
| parsedARN, err := arn.Parse(string(roleARN)) | ||
| if err != nil { | ||
| return ctrlrt.Result{}, fmt.Errorf("parsing role ARN %q from %q configmap: %v", roleARN, ackrtcache.ACKRoleTeamMap, err) |
There was a problem hiding this comment.
should we use https://github.com/aws-controllers-k8s/runtime/blob/main/pkg/runtime/reconciler.go#L1146-L1167 to return here? so that this error can be patched to the resource status
| region := r.getRegion(desired) | ||
| endpointURL := r.getEndpointURL(desired) | ||
| gvk := r.rd.GroupVersionKind() | ||
|
|
||
| // If the user has specified a region that is different from the | ||
| // region the resource currently exists in, we need to fail the | ||
| // reconciliation with a terminal error. | ||
| if r.regionDrifted(desired) { |
There was a problem hiding this comment.
should we use the region in line 267? It already parses resource annotation - namespace annotation - config
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: a-hilaly, michaelhtm The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/retest |
2 similar comments
|
/retest |
|
/retest |
|
@a-hilaly: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
Adds protection against attempting to manage AWS resources that exist in a
different region or account than the controller is configured to use. This
prevents accidental resource hijacking and provides clear error messages.
regionDrifted()andaccountDrifted()helper functionsBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.