Skip to content

Fix get iamserviceaccount returning error for unrelated CloudFormation Stack #8350

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 15 commits into from
Apr 17, 2025
Merged

Fix get iamserviceaccount returning error for unrelated CloudFormation Stack #8350

Show file tree
Hide file tree
Changes from 11 commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
d632e10
Filter by name and namespace in GetIAMServiceAccounts
Apr 8, 2025
965364e
update other calls to GetIAMServiceAccounts
Apr 8, 2025
c8d17ea
wip tests
Apr 9, 2025
2fc2989
wip tests
Apr 9, 2025
1fccf5b
Update aws-sdk-go-v2 dependencies
Apr 9, 2025
53748dd
Update mock files comments with new mockery version number
Apr 9, 2025
50bfc58
run go mod tidy
Apr 9, 2025
f1b5f63
Merge branch 'chore-update-mockery-version' into bug-serviceaccounts-…
Apr 9, 2025
009bd85
Merge branch 'main' into bug-serviceaccounts-list-error
Apr 14, 2025
68cae20
WIP add test cases for GetIAMServiceAccounts
Apr 14, 2025
b4a7cb9
rm Get actions tests that covered logic which is now in iam.go
Apr 16, 2025
f6f5694
go mod tidy
Apr 16, 2025
3c37507
Merge branch 'main' into bug-serviceaccounts-list-error
Apr 17, 2025
eea3915
rerun go install mod tidy
Apr 17, 2025
6a1bb35
go mod tidy
Apr 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,19 +11,19 @@ require (
github.com/aws/aws-sdk-go-v2 v1.36.3
github.com/aws/aws-sdk-go-v2/config v1.29.12
github.com/aws/aws-sdk-go-v2/credentials v1.17.65
github.com/aws/aws-sdk-go-v2/service/autoscaling v1.52.2
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.59.1
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.48.3
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.47.2
github.com/aws/aws-sdk-go-v2/service/autoscaling v1.52.3
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.59.2
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.48.4
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.47.3
github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider v1.51.3
github.com/aws/aws-sdk-go-v2/service/ec2 v1.210.1
github.com/aws/aws-sdk-go-v2/service/eks v1.63.1
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.29.2
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.45.1
github.com/aws/aws-sdk-go-v2/service/eks v1.63.2
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.29.3
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.45.2
github.com/aws/aws-sdk-go-v2/service/iam v1.41.1
github.com/aws/aws-sdk-go-v2/service/kms v1.38.1
github.com/aws/aws-sdk-go-v2/service/outposts v1.50.1
github.com/aws/aws-sdk-go-v2/service/ssm v1.58.1
github.com/aws/aws-sdk-go-v2/service/ssm v1.58.2
github.com/aws/aws-sdk-go-v2/service/sts v1.33.17
github.com/aws/smithy-go v1.22.3
github.com/awslabs/amazon-eks-ami/nodeadm v0.0.0-20250219002025-c3b5cd3d2fd9
Expand Down
16 changes: 16 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,22 +126,36 @@ github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.33 h1:/frG8aV09yhCVSOEC2pzktflJJO
github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.33/go.mod h1:8vwASlAcV366M+qxZnjNzCjeastk1Rt1bpSRaGZanGU=
github.com/aws/aws-sdk-go-v2/service/autoscaling v1.52.2 h1:OA5uEC/SrjRLhNGHgF/iS6YQz1bjlrCje9sERyLlGro=
github.com/aws/aws-sdk-go-v2/service/autoscaling v1.52.2/go.mod h1:CDqMoc3KRdZJ8qziW96J35lKH01Wq3B2aihtHj2JbRs=
github.com/aws/aws-sdk-go-v2/service/autoscaling v1.52.3 h1:QsKdBxtC8csnKt5BbV7D1op4Nf13p2YkTJIkppaCakw=
github.com/aws/aws-sdk-go-v2/service/autoscaling v1.52.3/go.mod h1:CDqMoc3KRdZJ8qziW96J35lKH01Wq3B2aihtHj2JbRs=
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.59.1 h1:VaXjN6szl50hbLMfSOKBKl3bEOb805aHe8j1yv0fKhU=
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.59.1/go.mod h1:penaZKzGmqHGZId4EUCBIW/f9l4Y7hQ5NKd45yoCYuI=
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.59.2 h1:o9cuZdZlI9VWMqsNa2mnf2IRsFAROHnaYA1BW3lHGuY=
github.com/aws/aws-sdk-go-v2/service/cloudformation v1.59.2/go.mod h1:penaZKzGmqHGZId4EUCBIW/f9l4Y7hQ5NKd45yoCYuI=
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.48.3 h1:nTKHvvDTsS6SqAqu/fDhpmbNmDz+0ONh8niPoCkhPtM=
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.48.3/go.mod h1:/BibEr5ksr34abqBTQN213GrNG6GCKCB6WG7CH4zH2w=
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.48.4 h1:pQpinmWv9jEisDR6/DccOf2cXdAf/CAwQ39nfJfJDlE=
github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.48.4/go.mod h1:/BibEr5ksr34abqBTQN213GrNG6GCKCB6WG7CH4zH2w=
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.47.2 h1:caIDFGKezQQA/kali05x3NF2DVwzjtOFjvNvFnEeCm4=
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.47.2/go.mod h1:uo14VBn5cNk/BPGTPz3kyLBxgpgOObgO8lmz+H7Z4Ck=
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.47.3 h1:3y0jkGtsaZLCg+n73BoSXOAkLFtgmD/+4prXW1pzovc=
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.47.3/go.mod h1:uo14VBn5cNk/BPGTPz3kyLBxgpgOObgO8lmz+H7Z4Ck=
github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider v1.51.3 h1:4U9dpQZTvJ0Mi1qn8L1hRJ4igFCQYEjwUuOmYkWM5tE=
github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider v1.51.3/go.mod h1:ygltZT++6Wn2uG4+tqE0NW1MkdEtb5W2O/CFc0xJX/g=
github.com/aws/aws-sdk-go-v2/service/ec2 v1.210.1 h1:+4A9SDduLZFlDeXWRmfQ6r8kyEJZQfK6lcg+KwdvWrI=
github.com/aws/aws-sdk-go-v2/service/ec2 v1.210.1/go.mod h1:ouvGEfHbLaIlWwpDpOVWPWR+YwO0HDv3vm5tYLq8ImY=
github.com/aws/aws-sdk-go-v2/service/eks v1.63.1 h1:oI4AHf3K7cA+ukczcNwYsE8A7trMQiTRZTsgfkSS9BE=
github.com/aws/aws-sdk-go-v2/service/eks v1.63.1/go.mod h1:v1xXy6ea0PHtWkjFUvAUh6B/5wv7UF909Nru0dOIJDk=
github.com/aws/aws-sdk-go-v2/service/eks v1.63.2 h1:ymoK/RrNf6SAzWCPUk9EdyUAshlmBeF6ZWe6GcS8XBg=
github.com/aws/aws-sdk-go-v2/service/eks v1.63.2/go.mod h1:v1xXy6ea0PHtWkjFUvAUh6B/5wv7UF909Nru0dOIJDk=
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.29.2 h1:Zlfmpg4QsduBeiK0vTc8WjnHZoYVGe64FcwuCsipjWE=
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.29.2/go.mod h1:H232HdqVlSUoqy0cMJYW1TKjcxvGFGFZ20xQG8fOAPw=
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.29.3 h1:DpyV8LeDf0y7iDaGZ3h1Y+Nh5IaBOR+xj44vVgEEegY=
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing v1.29.3/go.mod h1:H232HdqVlSUoqy0cMJYW1TKjcxvGFGFZ20xQG8fOAPw=
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.45.1 h1:USXR7nfl+bu7HnR/M3KtnPD3wjlCXM72kYX+2PaIgEI=
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.45.1/go.mod h1:xnCC3vFBfOKpU6PcsCKL2ktgBTZfOwTGxj6V8/X3IS4=
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.45.2 h1:vX70Z4lNSr7XsioU0uJq5yvxgI50sB66MvD+V/3buS4=
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.45.2/go.mod h1:xnCC3vFBfOKpU6PcsCKL2ktgBTZfOwTGxj6V8/X3IS4=
github.com/aws/aws-sdk-go-v2/service/eventbridge v1.36.12 h1:uH6GOnGSvVN9MCk6o3+HvZFpdqL7AzJKNOTM/6l+3/s=
github.com/aws/aws-sdk-go-v2/service/eventbridge v1.36.12/go.mod h1:6qtp53AQg7KEeYrsp430PNlmVVO9qK0Xw8nddE1y+ow=
github.com/aws/aws-sdk-go-v2/service/iam v1.41.1 h1:Kq3R+K49y23CGC5UQF3Vpw5oZEQk5gF/nn+MekPD0ZY=
Expand All @@ -168,6 +182,8 @@ github.com/aws/aws-sdk-go-v2/service/sqs v1.37.15 h1:KRXf9/NWjoRgj2WJbX13GNjBPQ1
github.com/aws/aws-sdk-go-v2/service/sqs v1.37.15/go.mod h1:1CY54O4jz8BzgH2d6KyrzKWr2bAoqKsqUv2YZUGwMLE=
github.com/aws/aws-sdk-go-v2/service/ssm v1.58.1 h1:GLyAQEth2SljkC2DP5iK2GMkzgrGvURD+NEBVgQer3I=
github.com/aws/aws-sdk-go-v2/service/ssm v1.58.1/go.mod h1:PUWUl5MDiYNQkUHN9Pyd9kgtA/YhbxnSnHP+yQqzrM8=
github.com/aws/aws-sdk-go-v2/service/ssm v1.58.2 h1:uXy3QGAw3xv0RS+OlbeMEAnOA3vFFsf7yvjUswV6N/k=
github.com/aws/aws-sdk-go-v2/service/ssm v1.58.2/go.mod h1:PUWUl5MDiYNQkUHN9Pyd9kgtA/YhbxnSnHP+yQqzrM8=
github.com/aws/aws-sdk-go-v2/service/sso v1.25.2 h1:pdgODsAhGo4dvzC3JAG5Ce0PX8kWXrTZGx+jxADD+5E=
github.com/aws/aws-sdk-go-v2/service/sso v1.25.2/go.mod h1:qs4a9T5EMLl/Cajiw2TcbNt2UNo/Hqlyp+GiuG4CFDI=
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.0 h1:90uX0veLKcdHVfvxhkWUQSCi5VabtwMLFutYiRke4oo=
Expand Down
31 changes: 1 addition & 30 deletions pkg/actions/irsa/get.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,38 +14,9 @@ type GetOptions struct {
}

func (m *Manager) Get(ctx context.Context, options GetOptions) ([]*api.ClusterIAMServiceAccount, error) {
remoteServiceAccounts, err := m.stackManager.GetIAMServiceAccounts(ctx)
remoteServiceAccounts, err := m.stackManager.GetIAMServiceAccounts(ctx, options.Name, options.Namespace)
if err != nil {
return nil, fmt.Errorf("getting iamserviceaccounts: %w", err)
}

if options.Namespace != "" {
remoteServiceAccounts = filterByNamespace(remoteServiceAccounts, options.Namespace)
}

if options.Name != "" {
remoteServiceAccounts = filterByName(remoteServiceAccounts, options.Name)
}

return remoteServiceAccounts, nil
}

func filterByNamespace(serviceAccounts []*api.ClusterIAMServiceAccount, namespace string) []*api.ClusterIAMServiceAccount {
var serviceAccountsMatching []*api.ClusterIAMServiceAccount
for _, sa := range serviceAccounts {
if sa.Namespace == namespace {
serviceAccountsMatching = append(serviceAccountsMatching, sa)
}
}
return serviceAccountsMatching
}

func filterByName(serviceAccounts []*api.ClusterIAMServiceAccount, name string) []*api.ClusterIAMServiceAccount {
var serviceAccountsMatching []*api.ClusterIAMServiceAccount
for _, sa := range serviceAccounts {
if sa.Name == name {
serviceAccountsMatching = append(serviceAccountsMatching, sa)
}
}
return serviceAccountsMatching
}
109 changes: 2 additions & 107 deletions pkg/actions/irsa/get_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,8 @@ var _ = Describe("Get", func() {
irsaManager = irsa.New("my-cluster", fakeStackManager, nil, nil)
})

When("no options are specified", func() {
It("returns all service accounts", func() {
When("no error occurs", func() {
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Most of the logic that these tests covered is now in GetIAMServiceAccounts, with test coverage in iam_test.go.

It("returns service accounts from GetIAMServiceAccounts", func() {
fakeStackManager.GetIAMServiceAccountsReturns([]*api.ClusterIAMServiceAccount{
{
ClusterIAMMeta: api.ClusterIAMMeta{
Expand Down Expand Up @@ -65,109 +65,4 @@ var _ = Describe("Get", func() {
}))
})
})

When("name option is specified", func() {
It("returns only the service account matching the name", func() {
fakeStackManager.GetIAMServiceAccountsReturns([]*api.ClusterIAMServiceAccount{
{
ClusterIAMMeta: api.ClusterIAMMeta{
Name: "test-sa",
Namespace: "default",
},
AttachPolicyARNs: []string{"arn-123"},
},
{
ClusterIAMMeta: api.ClusterIAMMeta{
Name: "test-sa-2",
Namespace: "not-default",
},
AttachPolicyARNs: []string{"arn-123"},
},
}, nil)

serviceAccounts, err := irsaManager.Get(context.Background(), irsa.GetOptions{Name: "test-sa"})
Expect(err).NotTo(HaveOccurred())

Expect(fakeStackManager.GetIAMServiceAccountsCallCount()).To(Equal(1))
Expect(serviceAccounts).To(Equal([]*api.ClusterIAMServiceAccount{
{
ClusterIAMMeta: api.ClusterIAMMeta{
Name: "test-sa",
Namespace: "default",
},
AttachPolicyARNs: []string{"arn-123"},
},
}))
})
})

When("namespace option is specified", func() {
It("returns only the service account matching the name", func() {
fakeStackManager.GetIAMServiceAccountsReturns([]*api.ClusterIAMServiceAccount{
{
ClusterIAMMeta: api.ClusterIAMMeta{
Name: "test-sa",
Namespace: "default",
},
AttachPolicyARNs: []string{"arn-123"},
},
{
ClusterIAMMeta: api.ClusterIAMMeta{
Name: "test-sa-2",
Namespace: "not-default",
},
AttachPolicyARNs: []string{"arn-123"},
},
}, nil)

serviceAccounts, err := irsaManager.Get(context.Background(), irsa.GetOptions{Namespace: "not-default"})
Expect(err).NotTo(HaveOccurred())

Expect(fakeStackManager.GetIAMServiceAccountsCallCount()).To(Equal(1))
Expect(serviceAccounts).To(Equal([]*api.ClusterIAMServiceAccount{
{
ClusterIAMMeta: api.ClusterIAMMeta{
Name: "test-sa-2",
Namespace: "not-default",
},
AttachPolicyARNs: []string{"arn-123"},
},
}))
})
})

When("name and namespace option is specified", func() {
It("returns only the service account matching the name", func() {
fakeStackManager.GetIAMServiceAccountsReturns([]*api.ClusterIAMServiceAccount{
{
ClusterIAMMeta: api.ClusterIAMMeta{
Name: "test-sa",
Namespace: "default",
},
AttachPolicyARNs: []string{"arn-123"},
},
{
ClusterIAMMeta: api.ClusterIAMMeta{
Name: "some-other-sa",
Namespace: "default",
},
AttachPolicyARNs: []string{"arn-123"},
},
}, nil)

serviceAccounts, err := irsaManager.Get(context.Background(), irsa.GetOptions{Namespace: "default", Name: "test-sa"})
Expect(err).NotTo(HaveOccurred())

Expect(fakeStackManager.GetIAMServiceAccountsCallCount()).To(Equal(1))
Expect(serviceAccounts).To(Equal([]*api.ClusterIAMServiceAccount{
{
ClusterIAMMeta: api.ClusterIAMMeta{
Name: "test-sa",
Namespace: "default",
},
AttachPolicyARNs: []string{"arn-123"},
},
}))
})
})
})
2 changes: 1 addition & 1 deletion pkg/actions/podidentityassociation/deleter.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ type StackLister interface {
ListPodIdentityStackNames(ctx context.Context) ([]string, error)
DescribeStack(ctx context.Context, stack *manager.Stack) (*manager.Stack, error)
GetStackTemplate(ctx context.Context, stackName string) (string, error)
GetIAMServiceAccounts(ctx context.Context) ([]*api.ClusterIAMServiceAccount, error)
GetIAMServiceAccounts(ctx context.Context, name string, namespace string) ([]*api.ClusterIAMServiceAccount, error)
}

// A StackDeleter lists and deletes CloudFormation stacks.
Expand Down
20 changes: 12 additions & 8 deletions pkg/actions/podidentityassociation/fakes/fake_stack_updater.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion pkg/actions/podidentityassociation/migrator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ func (m *Migrator) MigrateToPodIdentity(ctx context.Context, options PodIdentity
*/
resolver := IRSAv1StackNameResolver{}
if err := resolver.Populate(func() ([]*api.ClusterIAMServiceAccount, error) {
return m.stackUpdater.GetIAMServiceAccounts(ctx)
return m.stackUpdater.GetIAMServiceAccounts(ctx, "", "")
}); err != nil {
return err
}
Expand Down
30 changes: 16 additions & 14 deletions pkg/actions/podidentityassociation/mocks/StackDeleter.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading