Administrator Automation Scripts for vSphere Per-Component Credentials#10
Open
rvanderp3 wants to merge 6 commits into
Open
Administrator Automation Scripts for vSphere Per-Component Credentials#10rvanderp3 wants to merge 6 commits into
rvanderp3 wants to merge 6 commits into
Conversation
This commit implements Story #3: Install Config Schema Extension for vSphere Multi-Account Credentials. It extends the install-config.yaml schema to support per-component credentials while maintaining backward compatibility with legacy single-account mode. Changes: - Add ComponentCredentials struct with fields for installer, machineAPI, csiDriver, cloudController, and diagnostics components - Add AccountCredentials struct supporting multi-vCenter topologies - Add platform field for optional ComponentCredentials - Create test stubs for schema validation (6 test scenarios) - Create test stubs for install-config integration tests Test Plan: - Unit tests in pkg/types/vsphere/validation_test.go - Default/fallback tests in pkg/types/vsphere/defaults_test.go - Integration tests in pkg/asset/installconfig/vsphere/validation_test.go All tests are currently stub implementations marked with t.Skip() and will be fully implemented in subsequent iterations. Related: openshift-splat-team/splat-team#3 Parent: openshift-splat-team/splat-team#2 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
…g-schema-extension Install Config Schema Extension for Per-Component Credentials
Add vSphere privilege validation logic using component-specific privilege lists. Validates that each OpenShift component account (installer, machine-api, csi-driver, cloud-controller, diagnostics) has required vCenter permissions before installation proceeds. Implementation: - PrivilegeValidator struct with ValidateComponentPrivileges method - ValidationResult struct with Valid, MissingPrivileges, Scope fields - GetRequiredPrivileges() function with comprehensive privilege lists - Installer: ~45 privileges for infrastructure deployment - Machine API: ~35 privileges for VM lifecycle - CSI Driver: ~12 privileges for storage provisioning - Cloud Controller: ~10 read-only privileges for node discovery - Diagnostics: ~5 read-only privileges for troubleshooting Test coverage: - 9 test scenarios covering all acceptance criteria - Missing privilege detection (machine-api, csi-driver) - Successful validation for all components - Component-specific privilege sets - Error handling Foundation for Story #4: Privilege Validation Parent Epic: #2 - vSphere Multi-Account Credentials Depends on: Story #3 (schema extension) Related: openshift-splat-team/splat-team#4 Related: openshift-splat-team/splat-team#2 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
…idation Privilege Validation for Per-Component Credentials
…tials - Add comprehensive per-component-credentials.md documentation - Add create-component-roles.sh (govc-based, Linux/macOS) - Add create-component-roles.ps1 (PowerCLI-based, Windows) - Add generate-credentials-file.sh (YAML template generator) - Add scripts/README.md with quick start guide Scripts support: - Multi-vCenter deployments - Complete privilege lists per component (~45/35/12/9/5 privileges) - Secure credentials file generation with 0600 permissions - Role creation/update with validation Implements Story #10: Administrator Automation Scripts Parent Epic #2: vSphere Multi-Account Credentials Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Rename YAML_TEMPLATE to CREDENTIALS_TEMPLATE in generate-credentials-file.sh - Remove TODO enhancement proposal link from per-component-credentials.md - Keep privilegevalidator.go reference (file exists and is valid) Addresses reviewer feedback: format terminology consistency and placeholder cleanup. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds administrator automation scripts for vSphere per-component credentials, implementing Story #10 of Epic #2 (vSphere Multi-Account Credentials).
Changes
Documentation
Automation Scripts
create-component-roles.sh (Linux/macOS, govc-based):
create-component-roles.ps1 (Windows, PowerCLI-based):
generate-credentials-file.sh:
scripts/README.md:
Component Privilege Counts
Acceptance Criteria
✅ Given an administrator runs
create-component-roles.shwith vCenter connection detailsThen vCenter roles are created for each component with correct privilege sets on all specified vCenters
✅ Given an administrator runs
generate-credentials-file.shThen a template YAML credentials file is created at
~/.vsphere/credentialswith 0600 permissions and placeholders for all component credentials✅ Given an administrator on Windows runs
create-component-roles.ps1Then vCenter roles are created with correct privileges (same outcome as govc script)
Testing
Scripts tested manually:
Related Issues
Documentation Links
Dependencies
None (standalone documentation and scripts)
🦸 Generated with superman (cw_writer hat)