[GCP-3987] Add GCP issue resolver script (POC) - #244
Draft
sujaysdesai wants to merge 3 commits into
Draft
Conversation
…an existing service account Adds gcp/shared/src/gcp_shared/ensure_permissions.py with helpers for validating and binding IAM roles, and a new gcp/issue_resolver package that support engineers can run in Cloud Shell to repair a broken integration without re-running the full quickstart. - ensure_permissions.py: is_valid_service_account_email (tightened regex to block filter injection), validate_service_account_in_project, ensure_service_account_permissions, create_service_account_with_permissions - issue_resolver: standalone .pyz that accepts an email and one or more project IDs, re-applies REQUIRED_ROLES, and refreshes the Datadog delegate permission - integration_quickstart/main.py: _resolve_service_account now accepts an existing SA email as an alternative to creating a new one
…se pipeline Adds a WorkflowReporter-based UI mode to gcp_issue_resolver, mirroring integration_quickstart's WORKFLOW_ID/env-var contract, so a Datadog UI "repair permissions" action can drive it the same way it drives service account creation. The existing CLI mode is unchanged for support engineers. - main.py: branch on WORKFLOW_ID to run UI mode (workflow type gcp-permission-repair) vs. CLI mode; report progress per step - release.yaml: publish gcp/issue_resolver as a release artifact - README.md: document both invocation modes - rebuilt dist/gcp_issue_resolver.pyz, dropping a stale uncommitted fix_permissions.py module that had leaked into the previous binary
…for project selection UI mode now requires ACCOUNT_EMAIL to be set at launch (like WORKFLOW_ID), instead of pulling the service account email out of the polled workflow selections. receive_user_selections() now only waits for project_ids. - main.py: rename EMAIL -> ACCOUNT_EMAIL, validate it up front via _resolve_email_from_env() before any workflow calls; rename RepairStep.SELECTIONS -> PROJECT_SELECTION - test_main.py: update UI-mode tests for the new env var and payload shape - README.md: document ACCOUNT_EMAIL as a launch env var - rebuilt dist/gcp_issue_resolver.pyz
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Goal
Add a standalone "GCP issue resolver" script (
gcp_issue_resolver.pyz) that re-grants missing IAM permissions on an existing Datadog GCP integration service account, so a customer with a broken/incomplete permission set can fix it without redoing full onboarding.This branch mirrors an in-progress POC from dan.trujillo (
dan.trujillo/GCP-XXXX-gcp-perm-fixer), rebased onto currentmain. One real conflict was resolved:mainhad independently gained aCREATE_CUSTOM_ORG_ROLEstep (GCP-3851) that also touchedintegration_quickstart/main.py; Dan's commit replaced the old directfind_or_create_service_account(...)call with a new_resolve_service_account(...)helper that falls back to the same call when no existing account is given, so both changes were merged with nothing dropped. The.pyzartifacts were rebuilt from the merged source viabuild.sh; all affected test suites pass (integration_quickstart17,issue_resolver14,shared52).Implementation
gcp/issue_resolver/src/gcp_issue_resolver/main.py: new entrypoint. Resolves the target service account by email (viaACCOUNT_EMAIL), re-assigns delegate impersonation trust (roles/iam.serviceAccountTokenCreator), and reports progress back to Datadog per step.gcp/shared/src/gcp_shared/ensure_permissions.py: new shared helper for verifying/re-granting IAM roles on an existing service account, reused by the issue resolver.gcp/integration_quickstart/src/gcp_integration_quickstart/main.py: merged in the_resolve_service_accounthelper described above, so the same account-resolution logic now backs both the original onboarding script and the new resolver.gcp/issue_resolver/build.sh,gcp/issue_resolver/README.md,gcp/issue_resolver/pytest.ini: new package scaffolding for the resolver, mirroringintegration_quickstart's layout.gcp/integration_quickstart/dist/gcp_integration_quickstart.pyz,gcp/issue_resolver/dist/gcp_issue_resolver.pyz,gcp/log_forwarding_quickstart/dist/gcp_log_forwarding_quickstart.pyz: rebuilt binaries reflecting the merged/new source..github/workflows/release.yaml: wires the new resolver package into the release pipeline.test_main.py(issue resolver),test_ensure_permissions.py(shared), and an extendedtest_integration_configuration.py.