Skip to content

Commit 5ed992c

Browse files
michaelhtmmichaelhtm
authored
Add permission association update operation (#6)
Description of changes: * include association for permission * add extra tests By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
1 parent 0be109e commit 5ed992c

16 files changed

+404
-20
lines changed

‎apis/v1alpha1/ack-generate-metadata.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
ack_generate_info:
2-
build_date: "2024-09-12T18:34:16Z"
2+
build_date: "2024-09-19T23:44:11Z"
33
build_hash: f8f98563404066ac3340db0a049d2e530e5c51cc
44
go_version: go1.23.0
55
version: v0.38.1
6-
api_directory_checksum: 19270bb8fa89ed2776f8700ce02abfdc3ef1a002
6+
api_directory_checksum: 0156ad977aa0dd2b311f1064cb8520b8d8a490c1
77
api_version: v1alpha1
88
aws_sdk_go_version: v1.49.0
99
generator_config_info:
10-
file_checksum: e58ff8e517224d3dbbeaaa3cc8b0d084e06a2e50
10+
file_checksum: 63d687c51f31cd6876aa96904116ed9dc135f3b2
1111
original_file_name: generator.yaml
1212
last_modification:
1313
reason: API generation

‎apis/v1alpha1/generator.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@ ignore:
99
resources:
1010
ResourceShare:
1111
fields:
12+
PermissionARNs:
13+
references:
14+
resource: Permission
15+
path: Status.ACKResourceMetadata.ARN
1216
Tags:
1317
from:
1418
operation: TagResource
@@ -22,6 +26,8 @@ resources:
2226
template_path: hooks/resource_share/sdk_update_pre_build_request.go.tpl
2327
sdk_read_many_post_build_request:
2428
template_path: hooks/resource_share/sdk_find_read_many_post_build_request.go.tpl
29+
sdk_read_many_post_set_output:
30+
template_path: hooks/resource_share/sdk_read_many_post_set_output.go.tpl
2531
sdk_file_end:
2632
template_path: hooks/resource_share/sdk_file_end.go.tpl
2733
Permission:

‎apis/v1alpha1/resource_share.go

+2-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎apis/v1alpha1/zz_generated.deepcopy.go

+11
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/ram.services.k8s.aws_resourceshares.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,25 @@ spec:
6464
items:
6565
type: string
6666
type: array
67+
permissionRefs:
68+
items:
69+
description: "AWSResourceReferenceWrapper provides a wrapper around
70+
*AWSResourceReference\ntype to provide more user friendly syntax
71+
for references using 'from' field\nEx:\nAPIIDRef:\n\n\n\tfrom:\n\t
72+
\ name: my-api"
73+
properties:
74+
from:
75+
description: |-
76+
AWSResourceReference provides all the values necessary to reference another
77+
k8s resource for finding the identifier(Id/ARN/Name)
78+
properties:
79+
name:
80+
type: string
81+
namespace:
82+
type: string
83+
type: object
84+
type: object
85+
type: array
6786
principals:
6887
description: |-
6988
Specifies a list of one or more principals to associate with the resource

‎generator.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@ ignore:
99
resources:
1010
ResourceShare:
1111
fields:
12+
PermissionARNs:
13+
references:
14+
resource: Permission
15+
path: Status.ACKResourceMetadata.ARN
1216
Tags:
1317
from:
1418
operation: TagResource
@@ -22,6 +26,8 @@ resources:
2226
template_path: hooks/resource_share/sdk_update_pre_build_request.go.tpl
2327
sdk_read_many_post_build_request:
2428
template_path: hooks/resource_share/sdk_find_read_many_post_build_request.go.tpl
29+
sdk_read_many_post_set_output:
30+
template_path: hooks/resource_share/sdk_read_many_post_set_output.go.tpl
2531
sdk_file_end:
2632
template_path: hooks/resource_share/sdk_file_end.go.tpl
2733
Permission:

‎helm/crds/ram.services.k8s.aws_resourceshares.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,25 @@ spec:
6464
items:
6565
type: string
6666
type: array
67+
permissionRefs:
68+
items:
69+
description: "AWSResourceReferenceWrapper provides a wrapper around
70+
*AWSResourceReference\ntype to provide more user friendly syntax
71+
for references using 'from' field\nEx:\nAPIIDRef:\n\n\n\tfrom:\n\t
72+
\ name: my-api"
73+
properties:
74+
from:
75+
description: |-
76+
AWSResourceReference provides all the values necessary to reference another
77+
k8s resource for finding the identifier(Id/ARN/Name)
78+
properties:
79+
name:
80+
type: string
81+
namespace:
82+
type: string
83+
type: object
84+
type: object
85+
type: array
6786
principals:
6887
description: |-
6988
Specifies a list of one or more principals to associate with the resource

‎pkg/resource/permission/hooks.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -48,13 +48,13 @@ func (rm *resourceManager) customUpdatePermission(
4848
}
4949
ackcondition.SetSynced(&resource{ko}, corev1.ConditionTrue, nil, nil)
5050
}
51-
51+
5252
if delta.DifferentAt("Spec.PolicyTemplate") {
5353
err := rm.updatePermission(ctx, desired)
5454
if err != nil {
5555
return nil, err
5656
}
57-
// resource takes time to retrieve the latest version. Syncing after
57+
// resource takes time to retrieve the latest version. Syncing after
5858
// 30 seconds gets the job done
5959
ackcondition.SetSynced(&resource{ko}, corev1.ConditionFalse, nil, nil)
6060
}
@@ -325,4 +325,4 @@ func (rm *resourceManager) newTag(
325325
res.SetValue(*c.Value)
326326
}
327327
return res
328-
}
328+
}

‎pkg/resource/resource_share/delta.go

+3
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/resource/resource_share/hooks.go

+115
Original file line numberDiff line numberDiff line change
@@ -117,3 +117,118 @@ func compareTags(
117117
}
118118
}
119119
}
120+
121+
func (rm *resourceManager) syncPermissions(
122+
ctx context.Context,
123+
desired *resource,
124+
latest *resource,
125+
) (err error) {
126+
rlog := ackrtlog.FromContext(ctx)
127+
exit := rlog.Trace("rm.syncPermissions")
128+
defer func() {
129+
exit(err)
130+
}()
131+
132+
resourceArn := latest.ko.Status.ACKResourceMetadata.ARN
133+
134+
desiredPermissions := desired.ko.Spec.PermissionARNs
135+
latestPermissions := latest.ko.Spec.PermissionARNs
136+
137+
toAdd, toDelete := comparePermissionArns(desiredPermissions, latestPermissions)
138+
139+
if len(toDelete) > 0 {
140+
rlog.Debug("disassociating permissions from ResourceShare resource", "permissionArns", toDelete)
141+
for _, permission := range toDelete {
142+
_, err = rm.sdkapi.DisassociateResourceSharePermissionWithContext(
143+
ctx,
144+
&svcsdk.DisassociateResourceSharePermissionInput{
145+
ResourceShareArn: (*string)(resourceArn),
146+
PermissionArn: permission,
147+
},
148+
)
149+
rm.metrics.RecordAPICall("UPDATE", "DisassociateResourceSharePermission", err)
150+
if err != nil {
151+
return err
152+
}
153+
}
154+
}
155+
156+
if len(toAdd) > 0 {
157+
rlog.Debug("associating permissions to ResourceShare resource", "permissionArns", toAdd)
158+
for _, permission := range toAdd {
159+
_, err = rm.sdkapi.AssociateResourceSharePermissionWithContext(
160+
ctx,
161+
&svcsdk.AssociateResourceSharePermissionInput{
162+
ResourceShareArn: (*string)(resourceArn),
163+
PermissionArn: permission,
164+
},
165+
)
166+
rm.metrics.RecordAPICall("UPDATE", "AssociateResourceSharePermission", err)
167+
if err != nil {
168+
return err
169+
}
170+
}
171+
}
172+
173+
return nil
174+
}
175+
176+
func comparePermissionArns(a, b []*string) ([]*string, []*string) {
177+
toAdd := make([]*string, 0, len(a))
178+
toDelete := make([]*string, 0, len(a))
179+
180+
am := make(map[string]bool)
181+
182+
for _, v := range a {
183+
am[*v] = true
184+
}
185+
186+
for _, v := range b {
187+
if _, ok := am[*v]; !ok {
188+
toDelete = append(toDelete, v)
189+
}
190+
}
191+
192+
bm := make(map[string]bool)
193+
for _, v := range b {
194+
bm[*v] = true
195+
}
196+
197+
for _, v := range a {
198+
if _, ok := bm[*v]; !ok {
199+
toAdd = append(toDelete, v)
200+
}
201+
}
202+
203+
return toAdd, toDelete
204+
}
205+
206+
func (rm *resourceManager) getPermissionArns(ctx context.Context, r *resource) (err error) {
207+
rlog := ackrtlog.FromContext(ctx)
208+
exit := rlog.Trace("rm.getPermissions")
209+
defer func() {
210+
exit(err)
211+
}()
212+
if r == nil || r.ko == nil || r.ko.Status.ACKResourceMetadata == nil || r.ko.Status.ACKResourceMetadata.ARN == nil {
213+
return nil
214+
}
215+
resp, err := rm.sdkapi.ListResourceSharePermissions(
216+
&svcsdk.ListResourceSharePermissionsInput{
217+
ResourceShareArn: (*string)(r.ko.Status.ACKResourceMetadata.ARN),
218+
},
219+
)
220+
rm.metrics.RecordAPICall("READ_MANY", "ListResourceSharePermissions", err)
221+
if err != nil {
222+
return err
223+
}
224+
225+
if resp.Permissions != nil {
226+
permissionArns := make([]*string, 0, len(resp.Permissions))
227+
for _, p := range resp.Permissions {
228+
permissionArns = append(permissionArns, p.Arn)
229+
}
230+
r.ko.Spec.PermissionARNs = permissionArns
231+
}
232+
233+
return nil
234+
}

0 commit comments

Comments
 (0)