-
Notifications
You must be signed in to change notification settings - Fork 1.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
AccessContextManager - Add dry run version of Ingress / Egress policy resources. #10990
Conversation
Hello! I am a robot. Tests will require approval from a repository maintainer to run. @rileykarson, a repository maintainer, has been assigned to review your changes. If you have not received review feedback within 2 business days, please leave a comment on this PR asking them to take a look. You can help make sure that review is quick by doing a self-review and by running impacted tests locally. |
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
Missing test reportYour PR includes resource fields which are not covered by any test. Resource: resource "google_access_context_manager_service_perimeter_dry_run_egress_policy" "primary" {
egress_from {
identities = # value needed
identity_type = # value needed
source_restriction = # value needed
sources {
access_level = # value needed
}
}
egress_to {
external_resources = # value needed
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
Resource: resource "google_access_context_manager_service_perimeter_dry_run_ingress_policy" "primary" {
ingress_from {
identities = # value needed
identity_type = # value needed
sources {
access_level = # value needed
resource = # value needed
}
}
ingress_to {
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
|
Tests analyticsTotal tests: Click here to see the affected service packages
|
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
Missing test reportYour PR includes resource fields which are not covered by any test. Resource: resource "google_access_context_manager_service_perimeter_dry_run_egress_policy" "primary" {
egress_from {
identities = # value needed
identity_type = # value needed
source_restriction = # value needed
sources {
access_level = # value needed
}
}
egress_to {
external_resources = # value needed
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
Resource: resource "google_access_context_manager_service_perimeter_dry_run_ingress_policy" "primary" {
ingress_from {
identities = # value needed
identity_type = # value needed
sources {
access_level = # value needed
resource = # value needed
}
}
ingress_to {
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
|
Tests analyticsTotal tests: Click here to see the affected service packages
|
c0367c5
to
e857648
Compare
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
Missing test reportYour PR includes resource fields which are not covered by any test. Resource: resource "google_access_context_manager_service_perimeter_dry_run_egress_policy" "primary" {
egress_from {
identities = # value needed
identity_type = # value needed
source_restriction = # value needed
sources {
access_level = # value needed
}
}
egress_to {
external_resources = # value needed
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
Resource: resource "google_access_context_manager_service_perimeter_dry_run_ingress_policy" "primary" {
ingress_from {
identities = # value needed
identity_type = # value needed
sources {
access_level = # value needed
resource = # value needed
}
}
ingress_to {
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
|
2 similar comments
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
Missing test reportYour PR includes resource fields which are not covered by any test. Resource: resource "google_access_context_manager_service_perimeter_dry_run_egress_policy" "primary" {
egress_from {
identities = # value needed
identity_type = # value needed
source_restriction = # value needed
sources {
access_level = # value needed
}
}
egress_to {
external_resources = # value needed
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
Resource: resource "google_access_context_manager_service_perimeter_dry_run_ingress_policy" "primary" {
ingress_from {
identities = # value needed
identity_type = # value needed
sources {
access_level = # value needed
resource = # value needed
}
}
ingress_to {
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
|
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
Missing test reportYour PR includes resource fields which are not covered by any test. Resource: resource "google_access_context_manager_service_perimeter_dry_run_egress_policy" "primary" {
egress_from {
identities = # value needed
identity_type = # value needed
source_restriction = # value needed
sources {
access_level = # value needed
}
}
egress_to {
external_resources = # value needed
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
Resource: resource "google_access_context_manager_service_perimeter_dry_run_ingress_policy" "primary" {
ingress_from {
identities = # value needed
identity_type = # value needed
sources {
access_level = # value needed
resource = # value needed
}
}
ingress_to {
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
|
Tests analyticsTotal tests: Click here to see the affected service packages
|
Tests analyticsTotal tests: Click here to see the affected service packages
|
Tests analyticsTotal tests: Click here to see the affected service packages
|
@rileykarson This PR has been waiting for review for 3 weekdays. Please take a look! Use the label |
@GoogleCloudPlatform/terraform-team @rileykarson This PR has been waiting for review for 1 week. Please take a look! Use the label |
@GoogleCloudPlatform/terraform-team @rileykarson This PR has been waiting for review for 2 weeks. Please take a look! Use the label |
mmv1/products/accesscontextmanager/ServicePerimeterDryRunEgressPolicy.yaml
Show resolved
Hide resolved
...ntextmanager/resource_access_context_manager_service_perimeter_dry_run_egress_policy_test.go
Show resolved
Hide resolved
e857648
to
6034a6b
Compare
@rileykarson I added |
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
Missing test reportYour PR includes resource fields which are not covered by any test. Resource: resource "google_access_context_manager_service_perimeter_dry_run_egress_policy" "primary" {
egress_from {
identities = # value needed
identity_type = # value needed
source_restriction = # value needed
sources {
access_level = # value needed
}
}
egress_to {
external_resources = # value needed
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
Resource: resource "google_access_context_manager_service_perimeter_dry_run_ingress_policy" "primary" {
ingress_from {
identities = # value needed
identity_type = # value needed
sources {
access_level = # value needed
resource = # value needed
}
}
ingress_to {
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
|
1 similar comment
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
Missing test reportYour PR includes resource fields which are not covered by any test. Resource: resource "google_access_context_manager_service_perimeter_dry_run_egress_policy" "primary" {
egress_from {
identities = # value needed
identity_type = # value needed
source_restriction = # value needed
sources {
access_level = # value needed
}
}
egress_to {
external_resources = # value needed
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
Resource: resource "google_access_context_manager_service_perimeter_dry_run_ingress_policy" "primary" {
ingress_from {
identities = # value needed
identity_type = # value needed
sources {
access_level = # value needed
resource = # value needed
}
}
ingress_to {
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
|
Tests analyticsTotal tests: 4 Click here to see the affected service packages
View the build log |
Tests analyticsTotal tests: 4 Click here to see the affected service packages
View the build log |
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
Missing test reportYour PR includes resource fields which are not covered by any test. Resource: resource "google_access_context_manager_service_perimeter_dry_run_egress_policy" "primary" {
egress_from {
identities = # value needed
identity_type = # value needed
source_restriction = # value needed
sources {
access_level = # value needed
}
}
egress_to {
external_resources = # value needed
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
Resource: resource "google_access_context_manager_service_perimeter_dry_run_ingress_policy" "primary" {
ingress_from {
identities = # value needed
identity_type = # value needed
sources {
access_level = # value needed
resource = # value needed
}
}
ingress_to {
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
Resource: resource "google_access_context_manager_service_perimeter_egress_policy" "primary" {
egress_from {
source_restriction = # value needed
}
}
Resource: resource "google_access_context_manager_service_perimeters" "primary" {
service_perimeters {
spec {
egress_policies {
egress_from {
source_restriction = # value needed
}
}
}
}
}
|
Tests analyticsTotal tests: 4 Click here to see the affected service packages
View the build log |
Tests analyticsTotal tests: 4 Click here to see the affected service packages
View the build log |
mmv1/products/accesscontextmanager/ServicePerimeterDryRunIngressPolicy.yaml
Outdated
Show resolved
Hide resolved
mmv1/products/accesscontextmanager/ServicePerimeterDryRunEgressPolicy.yaml
Outdated
Show resolved
Hide resolved
name: 'sourceRestriction' | ||
description: 'Whether to enforce traffic restrictions based on `sources` field. If the `sources` field is non-empty, then this field must be set to `SOURCE_RESTRICTION_ENABLED`.' | ||
values: | ||
- :SOURCE_RESTRICTION_UNSPECIFIED |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm still seeing this one
// can exist, they need to be run serially. See AccessPolicy for the test runner. | ||
|
||
func testAccAccessContextManagerServicePerimeterDryRunEgressPolicy_basicTest(t *testing.T) { | ||
// Multiple fine-grained resources |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It's useful to see that they can both exist at the same time without interfering with each other.
dc9cdf3
to
8bd5408
Compare
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
Missing test reportYour PR includes resource fields which are not covered by any test. Resource: resource "google_access_context_manager_service_perimeter_dry_run_egress_policy" "primary" {
egress_from {
identities = # value needed
identity_type = # value needed
source_restriction = # value needed
sources {
access_level = # value needed
}
}
egress_to {
external_resources = # value needed
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
Resource: resource "google_access_context_manager_service_perimeter_dry_run_ingress_policy" "primary" {
ingress_from {
identities = # value needed
identity_type = # value needed
sources {
access_level = # value needed
resource = # value needed
}
}
ingress_to {
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
Resource: resource "google_access_context_manager_service_perimeter_egress_policy" "primary" {
egress_from {
source_restriction = # value needed
}
}
Resource: resource "google_access_context_manager_service_perimeters" "primary" {
service_perimeters {
spec {
egress_policies {
egress_from {
source_restriction = # value needed
}
}
}
}
}
|
Tests analyticsTotal tests: 4 Click here to see the affected service packages
Action takenFound 1 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
|
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
Missing test reportYour PR includes resource fields which are not covered by any test. Resource: resource "google_access_context_manager_service_perimeter_dry_run_egress_policy" "primary" {
egress_from {
identities = # value needed
identity_type = # value needed
source_restriction = # value needed
sources {
access_level = # value needed
}
}
egress_to {
external_resources = # value needed
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
Resource: resource "google_access_context_manager_service_perimeter_dry_run_ingress_policy" "primary" {
ingress_from {
identities = # value needed
identity_type = # value needed
sources {
access_level = # value needed
resource = # value needed
}
}
ingress_to {
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
Resource: resource "google_access_context_manager_service_perimeter_egress_policy" "primary" {
egress_from {
source_restriction = # value needed
}
}
|
Tests analyticsTotal tests: 4 Click here to see the affected service packages
Action takenFound 1 affected test(s) by replaying old test recordings. Starting RECORDING based on the most recent commit. Click here to see the affected tests
|
|
|
Hello @slevenick, can you please run the VCR tests again. |
/gcbrun |
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
Missing test reportYour PR includes resource fields which are not covered by any test. Resource: resource "google_access_context_manager_service_perimeter_dry_run_egress_policy" "primary" {
egress_from {
identities = # value needed
identity_type = # value needed
source_restriction = # value needed
sources {
access_level = # value needed
}
}
egress_to {
external_resources = # value needed
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
Resource: resource "google_access_context_manager_service_perimeter_dry_run_ingress_policy" "primary" {
ingress_from {
identities = # value needed
identity_type = # value needed
sources {
access_level = # value needed
resource = # value needed
}
}
ingress_to {
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
Resource: resource "google_access_context_manager_service_perimeter_egress_policy" "primary" {
egress_from {
source_restriction = # value needed
}
}
|
Tests analyticsTotal tests: 4 Click here to see the affected service packages
View the build log |
8bd5408
to
f62e901
Compare
f62e901
to
9f75f7e
Compare
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
Missing test reportYour PR includes resource fields which are not covered by any test. Resource: resource "google_access_context_manager_service_perimeter_dry_run_egress_policy" "primary" {
egress_from {
identities = # value needed
identity_type = # value needed
source_restriction = # value needed
sources {
access_level = # value needed
}
}
egress_to {
external_resources = # value needed
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
Resource: resource "google_access_context_manager_service_perimeter_dry_run_ingress_policy" "primary" {
ingress_from {
identities = # value needed
identity_type = # value needed
sources {
access_level = # value needed
resource = # value needed
}
}
ingress_to {
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
Resource: resource "google_access_context_manager_service_perimeter_egress_policy" "primary" {
egress_from {
source_restriction = # value needed
}
}
|
Tests analyticsTotal tests: 4 Click here to see the affected service packages
View the build log |
Hi there, I'm the Modular magician. I've detected the following information about your changes: Diff reportYour PR generated some diffs in downstreams - here they are.
Missing test reportYour PR includes resource fields which are not covered by any test. Resource: resource "google_access_context_manager_service_perimeter_dry_run_egress_policy" "primary" {
egress_from {
identities = # value needed
identity_type = # value needed
source_restriction = # value needed
sources {
access_level = # value needed
}
}
egress_to {
external_resources = # value needed
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
Resource: resource "google_access_context_manager_service_perimeter_dry_run_ingress_policy" "primary" {
ingress_from {
identities = # value needed
identity_type = # value needed
sources {
access_level = # value needed
resource = # value needed
}
}
ingress_to {
operations {
method_selectors {
method = # value needed
permission = # value needed
}
service_name = # value needed
}
resources = # value needed
}
perimeter = # value needed
}
|
@slevenick I believe all issues have been addressed now and tests are passing |
Tests analyticsTotal tests: 4 Click here to see the affected service packages
View the build log |
… resources. (GoogleCloudPlatform#10990) Co-authored-by: Charlesleonius <[email protected]>
… resources. (GoogleCloudPlatform#10990) Co-authored-by: Charlesleonius <[email protected]>
Added
ServicePerimeterDryRunEgressPolicy
andServicePerimeterDryRunIngressPolicy
to support managing individual ingress and egress policies in the dry-run configuration of service perimeters.Addresses:
b/335474574 - #17864