-
Notifications
You must be signed in to change notification settings - Fork 0
feat: aws package, so builder and signet_node are isolated to k8s resources #4
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
rswanson
wants to merge
1
commit into
swanny/utils-are-dry
Choose a base branch
from
swanny/aws-for-now
base: swanny/utils-are-dry
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
+178
−144
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,115 @@ | ||
| package aws | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
| "fmt" | ||
|
|
||
| "github.com/pulumi/pulumi-aws/sdk/v6/go/aws/iam" | ||
| "github.com/pulumi/pulumi/sdk/v3/go/pulumi" | ||
| ) | ||
|
|
||
| // IAMResources contains AWS IAM resources created for a component | ||
| type IAMResources struct { | ||
| Role *iam.Role | ||
| Policy *iam.Policy | ||
| PolicyAttachment *iam.RolePolicyAttachment | ||
| } | ||
|
|
||
| // CreateIAMResources creates IAM resources (role, policy, and policy attachment) for a component | ||
| func CreateIAMResources( | ||
| ctx *pulumi.Context, | ||
| name string, | ||
| serviceName string, | ||
| keyArn pulumi.StringInput, | ||
| parent pulumi.Resource, | ||
| ) (*IAMResources, error) { | ||
| // Create IAM role | ||
| assumeRolePolicy := IAMPolicy{ | ||
| Version: "2012-10-17", | ||
| Statement: []IAMStatement{ | ||
| { | ||
| Sid: "AllowEksAuthToAssumeRoleForPodIdentity", | ||
| Effect: "Allow", | ||
| Principal: struct { | ||
| Service []string `json:"Service"` | ||
| }{ | ||
| Service: []string{ | ||
| "pods.eks.amazonaws.com", | ||
| "ec2.amazonaws.com", | ||
| }, | ||
| }, | ||
| Action: []string{ | ||
| "sts:AssumeRole", | ||
| "sts:TagSession", | ||
| }, | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| assumeRolePolicyJSON, err := json.Marshal(assumeRolePolicy) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("failed to marshal assume role policy: %w", err) | ||
| } | ||
|
|
||
| role, err := iam.NewRole(ctx, fmt.Sprintf("%s-role", name), &iam.RoleArgs{ | ||
| AssumeRolePolicy: pulumi.String(assumeRolePolicyJSON), | ||
| Description: pulumi.String(fmt.Sprintf("Role for %s pod to assume", serviceName)), | ||
| Tags: pulumi.StringMap{ | ||
| "Name": pulumi.String(fmt.Sprintf("%s-role", name)), | ||
| }, | ||
| }, pulumi.Parent(parent)) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("failed to create IAM role: %w", err) | ||
| } | ||
|
|
||
| // Create KMS policy | ||
| policyJSON := CreateKMSPolicy(keyArn) | ||
|
|
||
| policy, err := iam.NewPolicy(ctx, fmt.Sprintf("%s-policy", name), &iam.PolicyArgs{ | ||
| Policy: policyJSON, | ||
| }, pulumi.Parent(parent)) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("failed to create IAM policy: %w", err) | ||
| } | ||
|
|
||
| // Attach policy to role | ||
| policyAttachment, err := iam.NewRolePolicyAttachment(ctx, fmt.Sprintf("%s-role-policy-attachment", name), &iam.RolePolicyAttachmentArgs{ | ||
| Role: role.Name, | ||
| PolicyArn: policy.Arn, | ||
| }, pulumi.Parent(parent)) | ||
| if err != nil { | ||
| return nil, fmt.Errorf("failed to attach policy to role: %w", err) | ||
| } | ||
|
|
||
| return &IAMResources{ | ||
| Role: role, | ||
| Policy: policy, | ||
| PolicyAttachment: policyAttachment, | ||
| }, nil | ||
| } | ||
|
|
||
| // CreateKMSPolicy creates a KMS policy for the given key | ||
| func CreateKMSPolicy(key pulumi.StringInput) pulumi.StringOutput { | ||
| policy := KMSPolicy{ | ||
| Version: "2012-10-17", | ||
| Statement: []KMSStatement{ | ||
| { | ||
| Effect: "Allow", | ||
| Action: []string{ | ||
| "kms:Sign", | ||
| "kms:GetPublicKey", | ||
| }, | ||
| Resource: key, | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| // Convert to JSON string output | ||
| return pulumi.All(key).ApplyT(func(_ []interface{}) (string, error) { | ||
| jsonBytes, err := json.Marshal(policy) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
| return string(jsonBytes), nil | ||
| }).(pulumi.StringOutput) | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| package aws | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/pulumi/pulumi/sdk/v3/go/pulumi" | ||
| "github.com/stretchr/testify/assert" | ||
| ) | ||
|
|
||
| func TestCreateKMSPolicy(t *testing.T) { | ||
| // Test with a simple key ARN | ||
| keyArn := "arn:aws:kms:us-west-2:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab" | ||
| key := pulumi.String(keyArn) | ||
|
|
||
| // Get the policy string | ||
| // Note: We can't directly access the string value from StringOutput in a unit test | ||
| // So we'll just verify the function returns a non-nil value and the structure will | ||
| // be tested separately when used in the actual builder component. | ||
| policy := CreateKMSPolicy(key) | ||
|
|
||
| // We can only indirectly test this by asserting the output is not nil | ||
| assert.NotNil(t, policy) | ||
|
|
||
| // Test with another key to ensure the function uses the provided key | ||
| anotherKey := pulumi.String("another-key-arn") | ||
| anotherPolicy := CreateKMSPolicy(anotherKey) | ||
| assert.NotNil(t, anotherPolicy) | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| package aws | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [nitpick] Exported types IAMStatement, IAMPolicy, KMSStatement, and KMSPolicy lack documentation. Consider adding type-level comments to clarify their structure and intended usage. Copilot uses AI. Check for mistakes. Positive FeedbackNegative Feedback |
||
|
|
||
| import ( | ||
| "github.com/pulumi/pulumi/sdk/v3/go/pulumi" | ||
| ) | ||
|
|
||
| // IAMStatement represents a statement in an IAM policy | ||
| type IAMStatement struct { | ||
| Sid string `json:"sid,omitempty"` | ||
| Effect string `json:"effect"` | ||
| Principal struct { | ||
| Service []string `json:"Service"` | ||
| } `json:"Principal"` | ||
| Action []string `json:"Action"` | ||
| } | ||
|
|
||
| // IAMPolicy represents an IAM policy document | ||
| type IAMPolicy struct { | ||
| Version string `json:"Version"` | ||
| Statement []IAMStatement `json:"Statement"` | ||
| } | ||
|
|
||
| // KMSStatement represents a statement in a KMS policy | ||
| type KMSStatement struct { | ||
| Effect string `json:"Effect"` | ||
| Action []string `json:"Action"` | ||
| Resource pulumi.StringInput `json:"Resource"` | ||
| } | ||
|
|
||
| // KMSPolicy represents a KMS policy document | ||
| type KMSPolicy struct { | ||
| Version string `json:"Version"` | ||
| Statement []KMSStatement `json:"Statement"` | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,34 +1 @@ | ||
| package builder | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
|
|
||
| "github.com/pulumi/pulumi/sdk/v3/go/pulumi" | ||
| ) | ||
|
|
||
| // CreateKMSPolicy creates a KMS policy for the builder service. | ||
| // Exported for testing. | ||
| func CreateKMSPolicy(key pulumi.StringInput) pulumi.StringOutput { | ||
| policy := KMSPolicy{ | ||
| Version: "2012-10-17", | ||
| Statement: []KMSStatement{ | ||
| { | ||
| Effect: "Allow", | ||
| Action: []string{ | ||
| "kms:Sign", | ||
| "kms:GetPublicKey", | ||
| }, | ||
| Resource: key, | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| // Convert to JSON string output | ||
| return pulumi.All(key).ApplyT(func(_ []interface{}) (string, error) { | ||
| jsonBytes, err := json.Marshal(policy) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
| return string(jsonBytes), nil | ||
| }).(pulumi.StringOutput) | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Exported function CreateIAMResources lacks a top-level doc comment. Please add a comment describing its purpose, parameters, and return values to improve API discoverability.
Copilot uses AI. Check for mistakes.