OCM-23343 | feat: Added support for --no-console to rosa create ocm-role#3252
OCM-23343 | feat: Added support for --no-console to rosa create ocm-role#3252andclt wants to merge 1 commit into
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds a no-console OCM role profile end-to-end: new OCMRoleProfile constants and CreateOCMRole, a --no-console CLI flag with interactive prompts and mutual exclusion with --admin, propagate isNoConsole to buildCommands and createRoles, enforce variant compatibility in checkRoleExists, add AWS helpers (IsNoConsoleRole, GetNoConsolePolicyName/GetNoConsolePolicyARN), add rosa_no_console_role tag constant, update mocks and CLI metadata, and include unit tests for command generation, policy file output, and IsNoConsoleRole. Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 2 warnings)
✅ Passed checks (12 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: andclt The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
cmd/create/ocmrole/cmd.go (1)
619-656:⚠️ Potential issue | 🟠 Major | ⚡ Quick winManual mode doesn’t generate the no-console permission policy file.
generateOcmRolePolicyFilesacceptsisNoConsolebut always writessts_ocm_permission_policy.json. For--no-console,buildCommandsexpectssts_ocm_no_console_permission_policy.json, so generated commands can reference a missing file.🔧 Suggested fix
- filename = fmt.Sprintf("sts_%s_permission_policy", aws.OCMRolePolicyFile) + policyFile := aws.OCMRolePolicyFile + if isNoConsole { + policyFile = aws.OCMNoConsoleRolePolicyFile + } + filename = fmt.Sprintf("sts_%s_permission_policy", policyFile) policyDetail = aws.GetPolicyDetails(policies, filename)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cmd/create/ocmrole/cmd.go` around lines 619 - 656, The function generateOcmRolePolicyFiles currently ignores the isNoConsole flag and always writes the standard permission file name; update the filename selection so when isNoConsole is true you use the "sts_%s_no_console_permission_policy" pattern (format with aws.OCMRolePolicyFile) and call aws.GetPolicyDetails/SaveDocument with that detail, otherwise keep the existing "sts_%s_permission_policy" behavior; ensure the r.Reporter.Debugf and filename formatting (aws.GetFormattedFileName) use the chosen name so buildCommands can find "sts_ocm_no_console_permission_policy.json" when --no-console is used.
🧹 Nitpick comments (1)
cmd/create/ocmrole/ocmrole.go (1)
25-33: ⚡ Quick winAdd doc comments for new exported API symbols.
Please add Go doc comments for
OCMRoleProfile, exported profile constants, andCreateOCMRole.As per coding guidelines `**/*.go`: "Use exported symbol doc comments when new public types or functions are introduced".✍️ Suggested update
+// OCMRoleProfile defines the OCM role permission profile. type OCMRoleProfile string const ( + // ProfileStandard creates a standard OCM role. ProfileStandard OCMRoleProfile = "standard" + // ProfileAdmin creates an OCM role with admin permissions. ProfileAdmin OCMRoleProfile = "admin" + // ProfileNoConsole creates an OCM role with minimal permissions and no console compatibility. ProfileNoConsole OCMRoleProfile = "no-console" ) +// CreateOCMRole creates the OCM role according to the selected profile. func CreateOCMRole(r *rosa.Runtime, prefix string, orgID string, profile OCMRoleProfile, permissionsBoundary string, rolePath string, policies map[string]*cmv1.AWSSTSPolicy, env string, managedPolicies bool) (string, error) {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cmd/create/ocmrole/ocmrole.go` around lines 25 - 33, Add Go doc comments for the exported symbols: the type OCMRoleProfile, the exported constants ProfileStandard, ProfileAdmin, ProfileNoConsole, and the function CreateOCMRole; for each, add a short sentence starting with the symbol name that describes its purpose and behavior (e.g., "OCMRoleProfile represents ...", "ProfileStandard is ...", etc.), and for CreateOCMRole document its parameters and return values succinctly (what the function does, key params like r *rosa.Runtime, prefix, orgID, profile, permissionsBoundary, rolePath, policies, env, managedPolicies, and the returned string and error). Ensure comments are placed immediately above each declaration and follow Go doc comment style (start with the symbol name).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cmd/create/ocmrole/cmd.go`:
- Around line 600-607: When unmanaged (managedPolicies == false) and the
"no-console" flow is active, the code currently uses
aws.GetPolicyArnWithSuffix(...) which diverges from manual mode; change the else
branch so that when no-console is requested it calls
aws.GetNoConsolePolicyARN(...) (keeping the same inputs used in manual mode)
instead of aws.GetPolicyArnWithSuffix(r.Creator.Partition, r.Creator.AccountID,
roleName, rolePath); keep aws.GetManagedPolicyARN(policies, filename) for the
managedPolicies==true path and fall back to GetPolicyArnWithSuffix only when
no-console is not active.
---
Outside diff comments:
In `@cmd/create/ocmrole/cmd.go`:
- Around line 619-656: The function generateOcmRolePolicyFiles currently ignores
the isNoConsole flag and always writes the standard permission file name; update
the filename selection so when isNoConsole is true you use the
"sts_%s_no_console_permission_policy" pattern (format with
aws.OCMRolePolicyFile) and call aws.GetPolicyDetails/SaveDocument with that
detail, otherwise keep the existing "sts_%s_permission_policy" behavior; ensure
the r.Reporter.Debugf and filename formatting (aws.GetFormattedFileName) use the
chosen name so buildCommands can find
"sts_ocm_no_console_permission_policy.json" when --no-console is used.
---
Nitpick comments:
In `@cmd/create/ocmrole/ocmrole.go`:
- Around line 25-33: Add Go doc comments for the exported symbols: the type
OCMRoleProfile, the exported constants ProfileStandard, ProfileAdmin,
ProfileNoConsole, and the function CreateOCMRole; for each, add a short sentence
starting with the symbol name that describes its purpose and behavior (e.g.,
"OCMRoleProfile represents ...", "ProfileStandard is ...", etc.), and for
CreateOCMRole document its parameters and return values succinctly (what the
function does, key params like r *rosa.Runtime, prefix, orgID, profile,
permissionsBoundary, rolePath, policies, env, managedPolicies, and the returned
string and error). Ensure comments are placed immediately above each declaration
and follow Go doc comment style (start with the symbol name).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 647c19b7-f66e-4662-be1c-cffb03f79c86
📒 Files selected for processing (6)
cmd/create/ocmrole/cmd.gocmd/create/ocmrole/ocmrole.gopkg/aws/client.gopkg/aws/helpers.gopkg/aws/policies.gopkg/aws/tags/tags.go
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cmd/create/ocmrole/cmd_test.go`:
- Around line 40-51: The test currently ignores errors from
cmv1.AWSSTSPolicyBuilder.Build() for standardPolicy, adminPolicy, and
noConsolePolicy; update the test to capture the error return for each Build()
call (e.g., standardPolicy, err :=
(&cmv1.AWSSTSPolicyBuilder{}).ARN(...).Details(...).Build()) and fail the test
on error (use t.Fatalf or a test helper like require.NoError) so broken fixtures
surface immediately; apply this change for all three builder invocations
(standardPolicy, adminPolicy, noConsolePolicy) in cmd_test.go.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: eca4c984-a8b5-46ab-8975-96a8c151e85f
⛔ Files ignored due to path filters (1)
assets/bindata.gois excluded by!assets/bindata.go
📒 Files selected for processing (11)
cmd/create/ocmrole/cmd.gocmd/create/ocmrole/cmd_test.gocmd/create/ocmrole/ocmrole.gocmd/create/ocmrole/ocmrole_test.gocmd/rosa/structure_test/command_args/rosa/create/ocm-role/command_args.ymlpkg/aws/client.gopkg/aws/client_mock.gopkg/aws/helpers.gopkg/aws/policies.gopkg/aws/policies_test.gopkg/aws/tags/tags.go
✅ Files skipped from review due to trivial changes (2)
- cmd/rosa/structure_test/command_args/rosa/create/ocm-role/command_args.yml
- pkg/aws/client_mock.go
🚧 Files skipped from review as they are similar to previous changes (6)
- pkg/aws/tags/tags.go
- cmd/create/ocmrole/ocmrole.go
- pkg/aws/client.go
- pkg/aws/helpers.go
- pkg/aws/policies.go
- cmd/create/ocmrole/cmd.go
openshift-ci
Bot
added
the
needs-rebase
openshift-ci
Bot
removed
the
needs-rebase
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
cmd/create/ocmrole/cmd_test.go (1)
66-190: ⚡ Quick winAdd a mutual-exclusion regression test for
isAdmin && isNoConsole.This suite validates each profile independently, but it does not assert behavior for the invalid combined profile. Add a negative case that verifies
buildCommandsrejectsisAdmin=truewithisNoConsole=true(or asserts the expected contract) to prevent silent mixed-profile regressions.As per coding guidelines,
**/*_test.go: "Flag weak tests that only restate implementation or changes that weaken existing assertions".🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cmd/create/ocmrole/cmd_test.go` around lines 66 - 190, Add a negative test inside the existing "Manual mode command generation" Context that calls buildCommands with isAdmin=true and isNoConsole=true and asserts the expected rejection (either Expect(err).To(HaveOccurred()) or the specific contract your code enforces), e.g. an It block named "should reject combined isAdmin and isNoConsole" that invokes buildCommands("test","test-OCM-Role",... , true, true, ...) and validates the function returns an error or fails the contract rather than silently producing mixed-profile commands; place the test alongside the other It cases so it covers the regression where both flags are set.cmd/create/ocmrole/cmd.go (1)
419-437: 💤 Low valueConsider simplifying the policy ARN resolution logic.
Since
policyKeyis already computed correctly based onisNoConsole(line 418), the managed-policy branch is identical in both cases. This could be flattened to reduce duplication:♻️ Suggested simplification
- if isNoConsole { - if managedPolicies { - policyARN, err = aws.GetManagedPolicyARN(policies, policyKey) - if err != nil { - return "", err - } - } else { - policyARN = aws.GetNoConsolePolicyARN(creator.Partition, creator.AccountID, roleName, rolePath) - } + if managedPolicies { + policyARN, err = aws.GetManagedPolicyARN(policies, policyKey) + if err != nil { + return "", err + } + } else if isNoConsole { + policyARN = aws.GetNoConsolePolicyARN(creator.Partition, creator.AccountID, roleName, rolePath) } else { - if managedPolicies { - policyARN, err = aws.GetManagedPolicyARN(policies, policyKey) - if err != nil { - return "", err - } - } else { - policyARN = aws.GetPolicyArnWithSuffix(creator.Partition, creator.AccountID, roleName, rolePath) - } + policyARN = aws.GetPolicyArnWithSuffix(creator.Partition, creator.AccountID, roleName, rolePath) }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cmd/create/ocmrole/cmd.go` around lines 419 - 437, The current nested if/else duplicates the managedPolicies branch; refactor the policy ARN resolution so you first check managedPolicies once (call aws.GetManagedPolicyARN(policies, policyKey) and handle error), and otherwise choose between aws.GetNoConsolePolicyARN(creator.Partition, creator.AccountID, roleName, rolePath) and aws.GetPolicyArnWithSuffix(creator.Partition, creator.AccountID, roleName, rolePath) based on isNoConsole, assigning to policyARN accordingly; this removes the duplicated managedPolicies logic while preserving use of policyKey, creator.Partition, creator.AccountID, roleName, and rolePath.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@cmd/create/ocmrole/cmd.go`:
- Around line 724-752: Fix the punctuation in the three error fmt.Errorf
messages that mention "role" so they end with a period to match the existing
style: update the error returned when isExistingRoleNoConsole is true ("the
existing role is a no-console role..."), the error returned when
isExistingRoleAdmin is true while isNoConsole is requested ("the existing role
is an admin role..."), and the error for existing standard role when isNoConsole
is requested ("the existing role is a standard role...") — locate these in
cmd/create/ocmrole/cmd.go around the checks using isExistingRoleNoConsole,
isExistingRoleAdmin and isNoConsole and add a period after "role" in each
fmt.Errorf string while preserving the rest of the text and spacing.
---
Nitpick comments:
In `@cmd/create/ocmrole/cmd_test.go`:
- Around line 66-190: Add a negative test inside the existing "Manual mode
command generation" Context that calls buildCommands with isAdmin=true and
isNoConsole=true and asserts the expected rejection (either
Expect(err).To(HaveOccurred()) or the specific contract your code enforces),
e.g. an It block named "should reject combined isAdmin and isNoConsole" that
invokes buildCommands("test","test-OCM-Role",... , true, true, ...) and
validates the function returns an error or fails the contract rather than
silently producing mixed-profile commands; place the test alongside the other It
cases so it covers the regression where both flags are set.
In `@cmd/create/ocmrole/cmd.go`:
- Around line 419-437: The current nested if/else duplicates the managedPolicies
branch; refactor the policy ARN resolution so you first check managedPolicies
once (call aws.GetManagedPolicyARN(policies, policyKey) and handle error), and
otherwise choose between aws.GetNoConsolePolicyARN(creator.Partition,
creator.AccountID, roleName, rolePath) and
aws.GetPolicyArnWithSuffix(creator.Partition, creator.AccountID, roleName,
rolePath) based on isNoConsole, assigning to policyARN accordingly; this removes
the duplicated managedPolicies logic while preserving use of policyKey,
creator.Partition, creator.AccountID, roleName, and rolePath.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 2a48e7e9-6a64-4f8d-963c-237321ec069a
⛔ Files ignored due to path filters (1)
assets/bindata.gois excluded by!assets/bindata.go
📒 Files selected for processing (11)
cmd/create/ocmrole/cmd.gocmd/create/ocmrole/cmd_test.gocmd/create/ocmrole/ocmrole.gocmd/create/ocmrole/ocmrole_test.gocmd/rosa/structure_test/command_args/rosa/create/ocm-role/command_args.ymlpkg/aws/client.gopkg/aws/client_mock.gopkg/aws/helpers.gopkg/aws/policies.gopkg/aws/policies_test.gopkg/aws/tags/tags.go
✅ Files skipped from review due to trivial changes (2)
- cmd/rosa/structure_test/command_args/rosa/create/ocm-role/command_args.yml
- pkg/aws/client_mock.go
🚧 Files skipped from review as they are similar to previous changes (7)
- cmd/create/ocmrole/ocmrole_test.go
- pkg/aws/tags/tags.go
- cmd/create/ocmrole/ocmrole.go
- pkg/aws/client.go
- pkg/aws/policies_test.go
- pkg/aws/policies.go
- pkg/aws/helpers.go
andclt
force-pushed
the
master
branch
3 times, most recently
from
1c3e97f to
7ca2a51
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
cmd/create/ocmrole/cmd_test.go (1)
203-213: ⚡ Quick winProtect these specs from parallel execution side effects.
Lines 203–213 and 248–254 mutate process-global working directory via
os.Chdir, which can make specs flaky when running in parallel. Consider marking thisDescribeasSerial(or refactor file generation to avoid cwd mutation).Also applies to: 248-254
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@cmd/create/ocmrole/cmd_test.go` around lines 203 - 213, The tests call os.Chdir in the BeforeEach (using tempDir, originalWd variables) which mutates process-wide CWD and can cause flakiness in parallel runs; fix it by making the enclosing Describe run serially (add the Ginkgo Serial option to the Describe that contains these BeforeEach/AfterEach blocks, e.g. change Describe("…", func() { to Describe("…", Serial, func() {) so the os.Chdir/restore (originalWd) pair is not executed concurrently, or alternatively refactor the BeforeEach to avoid calling os.Chdir at all by using absolute tempDir paths in file operations instead of changing the process working directory.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@cmd/create/ocmrole/cmd_test.go`:
- Around line 203-213: The tests call os.Chdir in the BeforeEach (using tempDir,
originalWd variables) which mutates process-wide CWD and can cause flakiness in
parallel runs; fix it by making the enclosing Describe run serially (add the
Ginkgo Serial option to the Describe that contains these BeforeEach/AfterEach
blocks, e.g. change Describe("…", func() { to Describe("…", Serial, func() {) so
the os.Chdir/restore (originalWd) pair is not executed concurrently, or
alternatively refactor the BeforeEach to avoid calling os.Chdir at all by using
absolute tempDir paths in file operations instead of changing the process
working directory.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 83b80cb6-f17f-43c7-b421-90cc96a83b91
⛔ Files ignored due to path filters (1)
assets/bindata.gois excluded by!assets/bindata.go
📒 Files selected for processing (12)
cmd/create/ocmrole/cmd.gocmd/create/ocmrole/cmd_test.gocmd/create/ocmrole/ocmrole.gocmd/create/ocmrole/ocmrole.testcmd/create/ocmrole/ocmrole_test.gocmd/rosa/structure_test/command_args/rosa/create/ocm-role/command_args.ymlpkg/aws/client.gopkg/aws/client_mock.gopkg/aws/helpers.gopkg/aws/policies.gopkg/aws/policies_test.gopkg/aws/tags/tags.go
✅ Files skipped from review due to trivial changes (1)
- pkg/aws/client_mock.go
🚧 Files skipped from review as they are similar to previous changes (7)
- cmd/rosa/structure_test/command_args/rosa/create/ocm-role/command_args.yml
- cmd/create/ocmrole/ocmrole.go
- pkg/aws/tags/tags.go
- cmd/create/ocmrole/ocmrole_test.go
- pkg/aws/policies_test.go
- pkg/aws/client.go
- pkg/aws/helpers.go
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
|
@andclt I left some comments but I didnt review everything since one of them might change things here, please feel free to ping me if you want to discuss about it. |
| // Check if no-console policy is available | ||
| if isNoConsole { | ||
| if _, ok := policies[filename]; !ok { | ||
| return fmt.Errorf("no-console OCM role is not yet enabled") |
There was a problem hiding this comment.
@andclt This check is happening after the IAM role has been created in AWS, which leaves an orphaned IAM role with no policies attached. This makes it look like the OCM Role exists, but just hasn't been linked as it shows up when you run rosa list ocm-role.
We shouldn't attempt the role creation at all if the required permission policy is not available.
There was a problem hiding this comment.
@andclt Also wondering if we adjust the message a little to be more user friendly e.g.
The no-console OCM role profile is not yet enabled for your Organization
There was a problem hiding this comment.
Good point! Thanks, fixed!
There was a problem hiding this comment.
This is closer, but the preflight still only checks map membership. If the no-console STSPolicy comes back without ARN/details, auto mode can still create and tag the role before failing, so it would be safer to validate the exact data needed for the selected mode up front.
There was a problem hiding this comment.
As discussed offline, this applies to every profile and policies in the file, but for this PR we are tackling no-console only.
There was a problem hiding this comment.
Scoping the upfront validation to no-console makes sense for this PR because that’s the new rollout-gated path and the Jira acceptance criteria call it out explicitly. I’d still capture the broader standard/admin validation as follow-up, since the same late-failure pattern exists outside no-console too.
andclt
force-pushed
the
master
branch
2 times, most recently
from
ba578aa to
48f12e5
Compare
|
Last comment: could you add some tests covering the checkRoleExists? Like when requesting No-Console profile, should succeed if existing role is No-Console and it should error if existing role is Admin or Standard. |
|
@andclt: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
| filename = fmt.Sprintf("sts_%s_permission_policy", aws.OCMNoConsoleRolePolicyFile) | ||
|
|
||
| // tag role with no-console tag | ||
| err = r.AWSClient.AddRoleTag(roleName, tags.NoConsoleRole, tags.True) |
There was a problem hiding this comment.
This tags the role as no-console before the policy is attached. If the create or attach fails after tagging, a retry will treat the role as complete, so can we tag only after the policy attach succeeds or verify the attached policy in checkRoleExists?
4 participants
PR Summary
Adds
--no-consoleflag torosa create ocm-rolefor creating OCM roles with minimal permissions for customers not using console.redhat.com.Detailed Description of the Issue
This PR adds support for creating OCM roles with minimal permissions (
no-console).Related Issues and PRs
Type of Change
Previous Behavior
Users could only create standard or admin OCM roles. All OCM roles had permissions suitable for console.redhat.com usage.
Behavior After This Change
Users can create three OCM role profiles:
--admin): Enhanced permissions for administrative operations--no-console): Minimal permissionsThe
--adminand--no-consoleflags are mutually exclusive. No-console roles are tagged withrosa_no_console_role:trueand attach thests_ocm_no_console_permission_policyinstead of the standard policy.User-Facing Changes
New --no-console flag for OCM role creation:
rosa create ocm-role --no-console--no-consoleand--adminflags are mutually exclusiveInteractive mode behavior:
Role conflict detection:
Manual mode (--mode manual):
sts_ocm_no_console_permission_policy.jsoninstead of the standard policy fileGraceful degradation:
How to Test (Step-by-Step)
Preconditions
make rosarosa loginTest Results
Test 1: Mutual Exclusivity
Command:
./rosa create ocm-role --prefix test --admin --no-consoleExpected: Error about mutually exclusive flags
Result: PASS
Test 2: Standard Role Creation
Command:
Expected: Role created with no special tags (no admin, no no-console)
Result: PASS
Test 3: Admin Role Creation
Command:
Expected: Admin tag present, two policies attached
Result: PASS
Test 4: No-Console - Graceful Degradation (Production OCM)
Command:
Expected: Warning + error when policy not available, no AWS resources created
Result: PASS
Test 5: No-Console - Full End-to-End (Local OCM with Policy)
Command:
Expected: Warning + full role creation with no-console policy
Result: PASS
Test 6: Manual Mode - Graceful Degradation (Production OCM)
Command:
Expected: Warning + error, no empty files
Result: PASS
Test 7: Manual Mode - Full Success (Local OCM with Policy)
Command:
Expected: Policy files with content, correct commands
Result: PASS
Test 8: Interactive Mode - No Console
Command:
./rosa create ocm-role --prefix test-interactive -i # Prompts: admin=No, no-console=Yes, mode=autoExpected: No-console prompt shown after admin=No
Result: PASS
Test 9: Interactive Mode - Admin
Command:
./rosa create ocm-role --prefix test-admin-interactive -i # Prompts: admin=Yes, mode=autoExpected: No-console prompt skipped (mutual exclusivity)
Result: PASS
Test 10: Conflict Detection - Standard → No Console
Command:
Expected: Error preventing conversion
Result: PASS
Test 11: Conflict Detection - Admin → No Console
Command:
Expected: Error preventing conversion
Result: PASS
Test 12: Upgrade Path - Standard → Admin
Command:
Expected: Idempotent upgrade allowed
Result: PASS
Test 13: Custom Path
Command:
Expected: Custom path in both role and policy ARNs
Result: PASS
Summary
Automated Tests: 11/11 passing
Manual Tests: 13/13 passed
Key Validations:
rosa_no_console_role:trueBreaking Changes
Breaking Change Details / Migration Plan
N/A
Developer Verification Checklist
[JIRA-TICKET] | [TYPE]: <MESSAGE>.make install-hookshas been run in this clone.make testpasses.make lintpasses.make rosapasses.Summary by CodeRabbit
New Features
Improvements
Tests