OCM-8256 | feat: add methods to attach policies

Merge branch 'main' into new-methods

.github/workflows/publish-release.yml

@@ -1,86 +1,32 @@
-#
-# Copyright (c) 2023 Red Hat, Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-name: Publish release
+name: goreleaser
 
 on:
   push:
     tags:
       - v*
 
-jobs:
 
-  release:
-    name: Publish release
+permissions:
+  contents: write
+
+jobs:
+  goreleaser:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout the source
-        uses: actions/checkout@v3
-
-      - name: Setup Python
-        uses: actions/setup-python@v2
+      -
+        name: Checkout
+        uses: actions/checkout@v4
         with:
-          python-version: '3.10'
-          cache: 'pip'
-
-      - name: Install Python modules
-        run: pip install -r .github/workflows/requirements.txt
-
-      - name: Create release
-        shell: python
-        run: |
-          import re
-          import requests
-          
-          # Get the context and secret data that we will need:
-          repository = "${{ github.repository }}"
-          reference = "${{ github.ref }}"
-          token = "${{ secrets.GITHUB_TOKEN }}"
-          
-          # Calculate the version number:
-          version = re.sub(r"^refs/tags/v(.*)$", r"\1", reference)
-          
-          # Get the list of changes:
-          body = ""
-          with open("CHANGES.md", "r") as stream:
-              while True:
-                  line = stream.readline()
-                  if line == "" or line.startswith("## " + version):
-                      break
-              while True:
-                  line = stream.readline()
-                  if line == "" or line.startswith("## "):
-                      break
-                  body += line
-          
-          # Send the request to create the release:
-          response = requests.post(
-              headers={
-                  "Authorization": f"Bearer {token}",
-                  "Content-Type": "application/json",
-                  "Accept": "application/json",
-              },
-              json={
-                  "tag_name": f"v{version}",
-                  "name": f"Release {version}",
-                  "body": body,
-              },
-              url=(
-                  "https://api.github.com"
-                  f"/repos/{repository}/releases"
-              ),
-          )
-          response.raise_for_status()
+          fetch-depth: 0
+      -
+        name: Set up Go
+        uses: actions/setup-go@v5
+      -
+        name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser
+          version: '~> v2'
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -6,4 +6,5 @@ ocm-common
 .envrc
 .env
 cover.out
+dist/
 

.goreleaser.yaml

@@ -0,0 +1,24 @@
+version: 1
+
+builds:
+  - skip: true
+
+release:
+  prerelease: auto
+  mode: append
+
+changelog:
+  sort: asc
+  groups:
+    - title: Features
+      regexp: '^.*?(?:[a-zA-Z]+-\d+ \| )?feat(?:\([[:word:]]+\))??!?:.+'
+      order: 0
+    - title: "Bug fixes"
+      regexp: '^.*?(?:[a-zA-Z]+-\d+ \| )?fix(?:\([[:word:]]+\))??!?:.+'
+      order: 1
+    - title: Others
+      order: 999
+  filters:
+    exclude:
+      - '^Merge pull request #'
+      - '^Merge branch '

CONTRIBUTING.md

@@ -69,23 +69,9 @@ This repository uses GitHub actions which are configured at `./github/workflows`
 
 ## Releasing a new OCM-Common Version
 
-Releasing a new version requires submitting an MR for review/merge with an update to the `Version` constant in
-[version.go](version.go). Additionally, update the [CHANGES.md](CHANGES.md) file to include the new version and
-describe all changes included.
+Releases are handled via GitHub action and goreleaser. Simply push a version tag to create a release.
 
-Below is an example CHANGES.md update:
-
-```
-## 0.1.39 Jul 3 2023
-
-- Bump github.com/onsi/ginkgo/v2 from 2.8.1 to 2.9.1
-- Update CONTRIBUTING.md contribution instructions
-- Added new unit test in sample_test.go
-```
-
-Submit an MR for review/merge with the CHANGES.md and version.go update.
-
-Finally, create and submit a new tag with the new version following the below example:
+Create and submit a new tag with the new version following the below example:
 
 ```shell
 git checkout main

go.mod

@@ -14,14 +14,14 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/kms v1.30.0
 	github.com/aws/aws-sdk-go-v2/service/route53 v1.40.3
 	github.com/aws/aws-sdk-go-v2/service/sts v1.28.5
+	github.com/go-jose/go-jose/v4 v4.0.2
 	github.com/hashicorp/go-version v1.6.0
 	github.com/onsi/ginkgo/v2 v2.17.1
 	github.com/onsi/gomega v1.30.0
 	github.com/openshift-online/ocm-sdk-go v0.1.421
 	github.com/sirupsen/logrus v1.9.3
 	go.uber.org/mock v0.3.0
 	golang.org/x/crypto v0.22.0
-	gopkg.in/square/go-jose.v2 v2.6.0
 )
 
 require github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2 // indirect

go.sum

@@ -48,6 +48,8 @@ github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMn
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/go-jose/go-jose/v4 v4.0.2 h1:R3l3kkBds16bO7ZFAEEcofK0MkrAJt3jlJznWZG0nvk=
+github.com/go-jose/go-jose/v4 v4.0.2/go.mod h1:WVf9LFMHh/QVrmqrOfqun0C45tMe3RoiKJMPvgWwLfY=
 github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
 github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
@@ -117,8 +119,6 @@ google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqw
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI=
-gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=

pkg/aws/aws_client/policy.go

@@ -161,3 +161,28 @@ func (client *AWSClient) CleanPolicies(cleanRule func(types.Policy) bool) error
 	}
 	return nil
 }
+
+func (client *AWSClient) TagPolicy(policyArn string, tags map[string]string) error {
+	var policyTags []types.Tag
+	for tagKey, tagValue := range tags {
+		policyTags = append(policyTags, types.Tag{
+			Key:   &tagKey,
+			Value: &tagValue,
+		})
+	}
+	input := &iam.TagPolicyInput{
+		PolicyArn: &policyArn,
+		Tags:      policyTags,
+	}
+	_, err := client.IamClient.TagPolicy(context.TODO(), input)
+	return err
+}
+
+func (client *AWSClient) UntagPolicy(policyArn string, tagKeys []string) error {
+	input := &iam.UntagPolicyInput{
+		PolicyArn: &policyArn,
+		TagKeys:   tagKeys,
+	}
+	_, err := client.IamClient.UntagPolicy(context.TODO(), input)
+	return err
+}

pkg/aws/aws_client/role.go

@@ -371,3 +371,27 @@ func (client *AWSClient) ListRoleAttachedPolicies(roleName string) ([]types.Atta
 	policies = policyOut.AttachedPolicies
 	return policies, nil
 }
+func (client *AWSClient) TagRole(roleName string, tags map[string]string) error {
+	var roleTags []types.Tag
+	for tagKey, tagValue := range tags {
+		roleTags = append(roleTags, types.Tag{
+			Key:   &tagKey,
+			Value: &tagValue,
+		})
+	}
+	input := &iam.TagRoleInput{
+		RoleName: &roleName,
+		Tags:     roleTags,
+	}
+	_, err := client.IamClient.TagRole(context.TODO(), input)
+	return err
+}
+
+func (client *AWSClient) UntagRole(roleName string, tagKeys []string) error {
+	input := &iam.UntagRoleInput{
+		RoleName: &roleName,
+		TagKeys:  tagKeys,
+	}
+	_, err := client.IamClient.UntagRole(context.TODO(), input)
+	return err
+}

pkg/aws/validations/iam_helpers.go

@@ -2,11 +2,22 @@ package validations
 
 import (
 	"fmt"
+	"maps"
 
 	"github.com/aws/aws-sdk-go-v2/aws"
+
 	iamtypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
 	semver "github.com/hashicorp/go-version"
 	. "github.com/openshift-online/ocm-common/pkg/aws/consts"
+	. "github.com/openshift-online/ocm-common/pkg/rosa/accountroles"
+	. "github.com/openshift-online/ocm-common/pkg/rosa/operatorroles"
+	cmv1 "github.com/openshift-online/ocm-sdk-go/clustersmgmt/v1"
+)
+
+const (
+	duplicateIamRoleArnErrorMsg = "ROSA IAM roles must have unique ARNs " +
+		"and should not be shared with other IAM roles within the same cluster. " +
+		"Duplicated role arn: %s"
 )
 
 func GetRoleName(prefix string, role string) string {
@@ -62,3 +73,17 @@ func IamResourceHasTag(iamTags []iamtypes.Tag, tagKey string, tagValue string) b
 
 	return false
 }
+
+func IamRoleArnsValidator(cluster *cmv1.Cluster) error {
+	validatingMap := map[string]struct{}{}
+	clusterIamRoles := GetAccountRolesArnsMap(cluster)
+	maps.Copy(clusterIamRoles, GetOperatorRolesArnsMap(cluster))
+
+	for _, arn := range clusterIamRoles {
+		if _, exist := validatingMap[arn]; exist {
+			return fmt.Errorf(duplicateIamRoleArnErrorMsg, arn)
+		}
+		validatingMap[arn] = struct{}{}
+	}
+	return nil
+}

pkg/aws/validations/iam_helpers_test.go

@@ -2,11 +2,13 @@ package validations
 
 import (
 	"fmt"
+
 	"github.com/aws/aws-sdk-go-v2/aws"
 	iamtypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
+	cmv1 "github.com/openshift-online/ocm-sdk-go/clustersmgmt/v1"
 )
 
 var _ = Describe("AWS iamtypes Functions", func() {
@@ -141,4 +143,49 @@ var _ = Describe("AWS iamtypes Functions", func() {
 			Expect(result).To(BeFalse())
 		})
 	})
+
+	var _ = Describe("IamRoleArnsValidator", func() {
+		It("should return error if duplicate arns exist", func() {
+			fakeCluster, err := cmv1.NewCluster().
+				AWS(
+					cmv1.NewAWS().
+						STS(
+							cmv1.NewSTS().
+								RoleARN("installer").
+								SupportRoleARN("support").
+								InstanceIAMRoles(
+									cmv1.NewInstanceIAMRoles().
+										MasterRoleARN("installer").
+										WorkerRoleARN("worker"),
+								),
+						),
+				).Build()
+			Expect(err).ToNot(HaveOccurred())
+			err = IamRoleArnsValidator(fakeCluster)
+			Expect(err).To(HaveOccurred())
+			Expect(err.Error()).To(Equal(
+				fmt.Sprintf(duplicateIamRoleArnErrorMsg, "installer"),
+			))
+		})
+
+		It("should return nil no duplicate arns are detected", func() {
+			fakeCluster, err := cmv1.NewCluster().
+				AWS(
+					cmv1.NewAWS().
+						STS(
+							cmv1.NewSTS().
+								RoleARN("installer").
+								SupportRoleARN("support").
+								InstanceIAMRoles(
+									cmv1.NewInstanceIAMRoles().
+										MasterRoleARN("controlplane").
+										WorkerRoleARN("worker"),
+								),
+						),
+				).Build()
+			Expect(err).ToNot(HaveOccurred())
+			err = IamRoleArnsValidator(fakeCluster)
+			Expect(err).ToNot(HaveOccurred())
+		})
+	})
 })

pkg/rosa/oidcconfigs/oidcconfigs.go

@@ -16,8 +16,7 @@ import (
 	"regexp"
 	"strings"
 
-	"gopkg.in/square/go-jose.v2"
-
+	"github.com/go-jose/go-jose/v4"
 	"github.com/openshift-online/ocm-common/pkg/utils"
 )
 

pkg/rosa/operatorroles/operatorroles.go

@@ -0,0 +1,13 @@
+package operatorroles
+
+import (
+	cmv1 "github.com/openshift-online/ocm-sdk-go/clustersmgmt/v1"
+)
+
+func GetOperatorRolesArnsMap(cluster *cmv1.Cluster) map[string]string {
+	operatorRolesMap := map[string]string{}
+	for _, role := range cluster.AWS().STS().OperatorIAMRoles() {
+		operatorRolesMap[role.Name()] = role.RoleARN()
+	}
+	return operatorRolesMap
+}