Merge pull request #3003 from hunterkepley/ocm-18278

OCM-18278 | fix: Broken ARN fetching for OIDC providers

Author: hunterkepley

cmd/create/iamserviceaccount/cmd.go

@@ -78,12 +78,6 @@ func CreateIamServiceAccountRunner(userOptions *iamServiceAccountOpts.CreateIamS
 			roleName = iamserviceaccount.GenerateRoleName(cluster.Name(), userOptions.Namespace, userOptions.ServiceAccountNames[0])
 		}
 
-		// Generate trust policy using existing helpers
-		oidcConfig := cluster.AWS().STS().OidcConfig()
-		if oidcConfig == nil {
-			return fmt.Errorf("cluster '%s' does not have OIDC configuration", cluster.Name())
-		}
-
 		serviceAccounts := make([]iamserviceaccount.ServiceAccountIdentifier, len(userOptions.ServiceAccountNames))
 		for i, name := range userOptions.ServiceAccountNames {
 			serviceAccounts[i] = iamserviceaccount.ServiceAccountIdentifier{
@@ -149,19 +143,16 @@ func CreateIamServiceAccountRunner(userOptions *iamServiceAccountOpts.CreateIamS
 }
 
 func getOIDCProviderARN(r *rosa.Runtime, cluster *cmv1.Cluster) (string, error) {
-	oidcConfig := cluster.AWS().STS().OidcConfig()
-	if oidcConfig == nil {
-		return "", fmt.Errorf("cluster does not have OIDC configuration")
+	oidcConfigEndpointUrl, ok := cluster.AWS().STS().GetOIDCEndpointURL()
+	if oidcConfigEndpointUrl == "" || !ok {
+		return "", fmt.Errorf("cluster with ID '%s' does not have an OIDC configuration", cluster.ID())
 	}
 
-	providers, err := r.AWSClient.ListOidcProviders(cluster.ID(), oidcConfig)
-	if err != nil {
-		return "", fmt.Errorf("failed to list OIDC providers: %w", err)
-	}
+	providerArn, err := r.AWSClient.GetOpenIDConnectProviderByOidcEndpointUrl(oidcConfigEndpointUrl)
 
-	if len(providers) == 0 {
-		return "", fmt.Errorf("no OIDC provider found for cluster")
+	if err != nil || providerArn == "" {
+		return "", fmt.Errorf("no OIDC provider found for cluster with ID '%s'", cluster.ID())
 	}
 
-	return providers[0].Arn, nil
+	return providerArn, nil
 }

cmd/create/iamserviceaccount/cmd_test.go

@@ -61,7 +61,8 @@ var _ = Describe("Create IAM Service Account", func() {
 							RoleARN("arn:aws:iam::123456789012:role/test-role").
 							OidcConfig(cmv1.NewOidcConfig().
 								ID("test-oidc-id").
-								IssuerUrl("https://test.example.com"))))
+								IssuerUrl("https://test.example.com")).
+							OIDCEndpointURL("https://test.example.com")))
 				})
 
 				t.SetCluster(cluster.ID(), cluster)
@@ -84,8 +85,8 @@ var _ = Describe("Create IAM Service Account", func() {
 				}
 
 				mockAWS.EXPECT().
-					ListOidcProviders(cluster.ID(), cluster.AWS().STS().OidcConfig()).
-					Return(providers, nil)
+					GetOpenIDConnectProviderByOidcEndpointUrl("https://test.example.com").
+					Return(providers[0].Arn, nil)
 
 				mockAWS.EXPECT().
 					EnsureRole(gomock.Any(), gomock.Any(), gomock.Any(), "", "", gomock.Any(), gomock.Any(), false).
@@ -170,7 +171,8 @@ var _ = Describe("Create IAM Service Account", func() {
 							RoleARN("arn:aws:iam::123456789012:role/test-role").
 							OidcConfig(cmv1.NewOidcConfig().
 								ID("test-oidc-id").
-								IssuerUrl("https://test.example.com"))))
+								IssuerUrl("https://test.example.com")).
+							OIDCEndpointURL("https://test.example.com")))
 				})
 
 				t.SetCluster(cluster.ID(), cluster)
@@ -193,8 +195,8 @@ var _ = Describe("Create IAM Service Account", func() {
 				}
 
 				mockAWS.EXPECT().
-					ListOidcProviders(cluster.ID(), cluster.AWS().STS().OidcConfig()).
-					Return(providers, nil)
+					GetOpenIDConnectProviderByOidcEndpointUrl("https://test.example.com").
+					Return(providers[0].Arn, nil)
 
 				mockAWS.EXPECT().
 					EnsureRole(gomock.Any(), gomock.Any(), gomock.Any(), "", "", gomock.Any(), gomock.Any(), false).
@@ -224,7 +226,8 @@ var _ = Describe("Create IAM Service Account", func() {
 							RoleARN("arn:aws-us-gov:iam::123456789012:role/test-role").
 							OidcConfig(cmv1.NewOidcConfig().
 								ID("test-oidc-id").
-								IssuerUrl("https://test.gov.example.com"))))
+								IssuerUrl("https://test.gov.example.com")).
+							OIDCEndpointURL("https://test.gov.example.com")))
 				})
 
 				t.SetCluster(cluster.ID(), cluster)
@@ -247,8 +250,8 @@ var _ = Describe("Create IAM Service Account", func() {
 				}
 
 				mockAWS.EXPECT().
-					ListOidcProviders(cluster.ID(), cluster.AWS().STS().OidcConfig()).
-					Return(providers, nil)
+					GetOpenIDConnectProviderByOidcEndpointUrl("https://test.gov.example.com").
+					Return(providers[0].Arn, nil)
 
 				mockAWS.EXPECT().
 					EnsureRole(gomock.Any(), gomock.Any(), gomock.Any(), "", "", gomock.Any(), gomock.Any(), false).
@@ -280,7 +283,8 @@ var _ = Describe("Create IAM Service Account", func() {
 					STS(cmv1.NewSTS().
 						OidcConfig(cmv1.NewOidcConfig().
 							ID("test-oidc-id").
-							IssuerUrl("https://test.example.com"))))
+							IssuerUrl("https://test.example.com")).
+						OIDCEndpointURL("https://test.example.com")))
 			})
 
 			providers := []aws.OidcProviderOutput{
@@ -290,8 +294,8 @@ var _ = Describe("Create IAM Service Account", func() {
 			}
 
 			mockAWS.EXPECT().
-				ListOidcProviders(cluster.ID(), cluster.AWS().STS().OidcConfig()).
-				Return(providers, nil)
+				GetOpenIDConnectProviderByOidcEndpointUrl("https://test.example.com").
+				Return(providers[0].Arn, nil)
 
 			arn, err := getOIDCProviderARN(t.RosaRuntime, cluster)
 			Expect(err).ToNot(HaveOccurred())
@@ -306,16 +310,18 @@ var _ = Describe("Create IAM Service Account", func() {
 					STS(cmv1.NewSTS().
 						OidcConfig(cmv1.NewOidcConfig().
 							ID("test-oidc-id").
-							IssuerUrl("https://test.example.com"))))
+							IssuerUrl("https://test.example.com")).
+						OIDCEndpointURL("https://test123.example.com")))
 			})
 
 			mockAWS.EXPECT().
-				ListOidcProviders(cluster.ID(), cluster.AWS().STS().OidcConfig()).
-				Return([]aws.OidcProviderOutput{}, nil)
+				GetOpenIDConnectProviderByOidcEndpointUrl("https://test123.example.com").
+				Return("", nil)
 
 			_, err := getOIDCProviderARN(t.RosaRuntime, cluster)
 			Expect(err).To(HaveOccurred())
-			Expect(err.Error()).To(ContainSubstring("no OIDC provider found"))
+			Expect(err.Error()).To(ContainSubstring("no OIDC provider found for cluster with ID " +
+				"'test-cluster-id'"))
 		})
 	})
 })