Cluster bot org auth #564

hoxhaeris · 2025-07-31T14:46:26Z

/cc @bradmwilliams
/cc @jupierce

bradmwilliams · 2025-08-04T13:47:26Z

/retest-required

hoxhaeris · 2025-08-11T15:04:37Z

/retest

bradmwilliams · 2025-08-28T15:23:45Z

/label tide/merge-method-squash

hoxhaeris · 2025-09-30T08:34:46Z

/hold
We need to set up the cron job generating the org dump first.

bradmwilliams · 2025-10-09T16:38:29Z

Makefile

+# Use standard GO_BUILD_FLAGS for build tags (e.g., -tags gcs)
+GO_BUILD_FLAGS ?=


After our standup, I took a look at this again and I think that you should probably just change this line to:
GO_BUILD_FLAGS=-tags gcs -trimpath

The current issue is that GO_BUILD_FLAGS is imported directly from build-machinery and using ?= doesn't work unless passed in on the command line. That's silly when we can force the issue ourselves and then we won't have to make any changes to openshift/release.

Each of us will have to update our IDE specific builds to add the tags accordingly, but for production we always produce the GCS version.

openshift-ci · 2025-10-09T16:38:51Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hoxhaeris

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [hoxhaeris]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

the index is not being built anymore in the service here, only consumed

…anges

update README to reflect the new changes (gcs) and link the new MD files

improve the auth data source, use a similar pluggable approach like in the orgdata-code; update documentation to reflect the auth config loading changes

update Makefile to use Openshift Builder

…rce method

change the gcs bucket references

…ands Extend authorization coverage to all commands that create or delete resources. Previously only launch, rosa create, workflow-launch, and mce create were protected. Commands now protected with authorization: - done: Deletes user's cluster resources - test upgrade: Creates test job resources - test: Creates test job resources - build: Creates build job resources - workflow-test: Creates test job resources - workflow-upgrade: Creates upgrade job resources - catalog build: Creates catalog build job resources - mce delete: Deletes MCE cluster resources Read-only commands remain unprotected: - list, auth, lookup, version, whoami (query only) - rosa lookup, rosa describe (query only) - mce auth, mce list, mce lookup (query only) - refresh (retries credentials fetch for existing cluster)

openshift-ci · 2025-11-21T13:12:52Z

@hoxhaeris: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/security	`f8a2142`	link	false	`/test security`
ci/prow/govulncheck	`f8a2142`	link	false	`/test govulncheck`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

bradmwilliams · 2025-11-21T14:43:36Z

cmd/ci-chat-bot/main.go

+	gcsBucket          string
+	gcsObjectPath      string
+	gcsProjectID       string


I would add default values for these, since we know that they won't be changing. That way it keeps the command line from getting any more unwieldy.

bradmwilliams · 2025-11-21T14:43:47Z

cmd/ci-chat-bot/main.go

+	gcsObjectPath      string
+	gcsProjectID       string
+	gcsCredentialsJSON string
+	gcsCheckInterval   time.Duration


Default value

This comment was specifically for the gcsCheckInterval variable

bradmwilliams · 2025-11-21T14:52:43Z

cmd/ci-chat-bot/main.go

+		if err := orgdata.SetupGCSDataSource(ctx, gcsConfig, orgDataService); err != nil {
+			klog.Warningf("GCS setup failed: %v. Running without authorization data (permit all mode)", err)
+			orgDataService = nil // Clear the service since we couldn't load any data
+		}
+
+		// Initialize authorization service if config is provided
+		if opt.authorizationConfigPath != "" {
+			klog.Infof("Initializing authorization service with config: %s", opt.authorizationConfigPath)
+			authService = orgdata.NewAuthorizationService(orgDataService, opt.authorizationConfigPath)
+			if err := authService.LoadConfig(ctx); err != nil {
+				klog.Warningf("Failed to load authorization config: %v", err)
+				// Keep the authService even if config fails to load - it will allow all commands
+			} else {
+				klog.Infof("Authorization service successfully initialized with config: %s", opt.authorizationConfigPath)
+			}
+
+			// Start config watcher regardless of initial load success - it will detect file creation
+			go func() {
+				if err := authService.StartConfigWatcher(ctx); err != nil {
+					klog.Infof("Authorization config watcher stopped: %v", err)
+				}
+			}()
+		} else {


If there is no orgDataService, why bother setting up the authService at all?

bradmwilliams · 2025-11-21T14:54:36Z

config/authorization.yaml

@@ -0,0 +1,103 @@
+# Authorization configuration for ci-chat-bot


I would make sure that this is referenced as an "Example" or "Sample" file and not the real configuration (to avoid any confusion)

openshift-ci bot requested review from bradmwilliams and jupierce July 31, 2025 14:46

openshift-ci bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Jul 31, 2025

hoxhaeris force-pushed the cluster_bot_org_auth_poc branch 2 times, most recently from 7515bb3 to 0847735 Compare August 13, 2025 20:14

openshift-ci bot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Aug 28, 2025

hoxhaeris force-pushed the cluster_bot_org_auth_poc branch from 98956a7 to 01f559a Compare August 29, 2025 09:52

hoxhaeris force-pushed the cluster_bot_org_auth_poc branch 2 times, most recently from 048be25 to 5ac51f6 Compare September 30, 2025 08:30

hoxhaeris changed the title ~~[WIP] Cluster bot org auth~~ Cluster bot org auth Sep 30, 2025

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 30, 2025

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 30, 2025

hoxhaeris force-pushed the cluster_bot_org_auth_poc branch from 5ac51f6 to 516fd35 Compare September 30, 2025 10:03

bradmwilliams approved these changes Oct 9, 2025

View reviewed changes

openshift-ci bot assigned bradmwilliams Oct 9, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 9, 2025

bradmwilliams suggested changes Oct 9, 2025

View reviewed changes

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Oct 9, 2025

hoxhaeris added 6 commits November 21, 2025 09:50

authorization POC

b1c3fae

several bugfixes, add a few debug lines

82c686d

add an AI generated readme, based on the code change

eab3925

improve whoami output, note the org type

ad76005

fix lint

db6bcfc

change logic to use the pre-indexed data;

bdcba9a

the index is not being built anymore in the service here, only consumed

hoxhaeris added 14 commits November 21, 2025 09:50

update the AUTHORIZATION.md AI-generated readme to reflect the gcs ch…

62c7b93

…anges

remove references to my local paths on hack run scripts;

dc29b36

update README to reflect the new changes (gcs) and link the new MD files

fix lint

ceb71f7

clean up the orgdata package, remove duplicated types definitions;

6b1a158

improve the auth data source, use a similar pluggable approach like in the orgdata-code; update documentation to reflect the auth config loading changes

move orgdata-core to a new repository

1de600d

update Makefile to use Openshift Builder

add SOURCE_GIT_TAG on Makefile

fd81e15

update cyborg-data

f289c02

remove usage of deprecated LoadFromFiles, use the new LoadFromDataSou…

e76d4f6

…rce method

gsc stub: fail fast when gcs support is not enabled

fdf5983

remove the unnecessary wrapper interface on the orgdata pkg

6429a1e

update vendor, remove replace to personal fork

2f34bda

update vendor

a9c789c

standardize logging;

2dd3e45

change the gcs bucket references

Rebuild vendor directory after rebase with main

311d08f

hoxhaeris force-pushed the cluster_bot_org_auth_poc branch from 516fd35 to 41c9a9f Compare November 21, 2025 08:52

hoxhaeris added 2 commits November 21, 2025 10:30

standardize GCS object path naming in documentation

f71d6b5

make GCS support enabled by default

11c3508

hoxhaeris force-pushed the cluster_bot_org_auth_poc branch from 41c9a9f to 11c3508 Compare November 21, 2025 09:30

hoxhaeris added 7 commits November 21, 2025 10:34

update vendor

9b42ebb

gracefully handle missing GCS/orgdata files

6a9c91d

update cyborg-data and remove deprecated file-based data sources

187a7b2

fix SetupGCSDataSource to use updated cyborg-data API

b5decc6

add auth for modals

3858d7f

clean up file mode docs

1e33ee3

hoxhaeris force-pushed the cluster_bot_org_auth_poc branch from a723403 to 1e33ee3 Compare November 21, 2025 11:47

hoxhaeris added 2 commits November 21, 2025 13:04

remove local reverence on cyborg-data

f371025

clean up

f8a2142

bradmwilliams suggested changes Nov 21, 2025

View reviewed changes

		# Use standard GO_BUILD_FLAGS for build tags (e.g., -tags gcs)
		GO_BUILD_FLAGS ?=

		@@ -0,0 +1,103 @@
		# Authorization configuration for ci-chat-bot

Cluster bot org auth #564

Are you sure you want to change the base?

Cluster bot org auth #564

Uh oh!

Conversation

hoxhaeris commented Jul 31, 2025

Uh oh!

bradmwilliams commented Aug 4, 2025

Uh oh!

hoxhaeris commented Aug 11, 2025

Uh oh!

bradmwilliams commented Aug 28, 2025

Uh oh!

hoxhaeris commented Sep 30, 2025

Uh oh!

bradmwilliams Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

bradmwilliams Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Oct 9, 2025

Uh oh!

openshift-ci bot commented Nov 21, 2025

Uh oh!

bradmwilliams Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

bradmwilliams Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

bradmwilliams Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

bradmwilliams Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

bradmwilliams Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants