feat: add ActivityPolicy for MachineAccount resources#563
Conversation
|
Tried working out how to add these policies for MachineAccounts, if its in the right direction I can continue with some others but thought this would be as good as any place to start. @scotwells |
scotwells
left a comment
scotwells
left a comment
There was a problem hiding this comment.
Looks directionally accurate. Have you tried this against the policy preview endpoint to confirm it gives you the timeline you expect?
|
Moved again in 3de08dc — now at |
ActivityPolicy CRDs are not installed in milo's own cluster — these policies need to be deployed separately via a Flux Kustomization once the activity service is present, similar to how the dns-operator deploys its activity policies.
|
@kevwilliams any reason you removed it from the service's kustomization? |
|
Re-added in 19185ad. Removed it because a CI run failed with |
|
@kevwilliams oh, they probably aren't installed in the test cluster. We should probably re-evaluate what that test is doing because it's odd it's including the services configuration. |
|
Yea so I removed it because the test-environment-validation CI job failed with: It looks like the test environment spins up a fresh cluster and applies config/services/ directly. Since the activity service (which provides the ActivityPolicy CRD) isn't installed in that cluster, it couldn't apply the policy and the deploy step failed. |
|
@kevwilliams can you disable that test for now? It's been broken for awhile and need to be fixed. |
ActivityPolicy CRDs are not available in the milo test cluster — they require the activity service to be deployed first.
Notes created outside a project context never get a ConsumerRef on their ResourceClaim, so quota enforcement always fails. Tracked in #565.
|
Got this to pass, also created #565 to deal with an issue separately, skipped that test for now. |
2 participants
Summary
config/milo/activity/policies/machineaccount-policy.yamlwith anActivityPolicyforiam.miloapis.com/MachineAccountdeactivate/activate) match onspec.stateto produce meaningful summaries for activation state changesconfig/milo/activity/convention established in the dns-operator repoTest plan
kubectl apply -k config/milo/activity/(or wire into the Flux Kustomization)Ready=Trueviadatumctl get activitypoliciesspec.statetoInactiveand confirm "deactivated" activity appearsspec.stateback toActiveand confirm "reactivated" activity appears