[d2burkhalter]

Allows the testrunner to make authenticated requests and test for expected behavior for global/queue authenticated actions. In testSpec adds auth_context field to define what context will be used for a test and expected_error_code field for the RPC error code expected when an authenticated call fails. Added ability for CI to switch the configs of armada services between tests to allow for basic and then authenticated tests to run.

From the testing I found that when submitting jobs without permissions the error code is PermissionDenied but for cancel, preempt and reprioritize the error code is Unknown so I'm not sure if that is the intended behavior.

Submit 1 job(s) to url localhost:50051 jobSet submit_without_permission-RSpEcDrwfPaUPkmNLoqhwD in 10.044416ms: FAIL (rpc error: code = PermissionDenied desc = faa074b5-9d5f-4208-871f-47b5eea25549 lacks permission submit required for action submit for queue rbac-queue-no-submit-zR7vYMhb8QiaHEeqM2DJaQ; user faa074b5-9d5f-4208-871f-47b5eea25549 cannot perform action submit on queue rbac-queue-no-submit-zR7vYMhb8QiaHEeqM2DJaQ as they are neither explicitly permissioned on the queue or a member of submit_any_jobs group)

ReprioritizeJobs 1 job(s) in job set reprioritize_without_permission-ctB6dNxdUf9VecCYnwHUJn: FAIL (rpc error: code = Unknown desc = [x-request-id: "29jWFH37CRSLckhLMiN4GQ"] faa074b5-9d5f-4208-871f-47b5eea25549 lacks permission reprioritize required for action /api.Submit/ReprioritizeJobs; user faa074b5-9d5f-4208-871f-47b5eea25549 cannot perform action reprioritize on queue rbac-queue-submit-no-reprioritize-xBTHTFwNnmeKuN3qTVFPEk as they are neither explicitly permissioned on the queue or a member of reprioritize_any_jobs group)

[datadog-armadaproject]

⚠️ Warnings

⚠️ Your PR has warnings. Please review the issues below.

🚦 1 Pipeline job failed

Python Airflow Operator | airflow-integration-tests

View in Datadog · View in GitHub Actions

Network is unreachable while waiting for container to start during docker compose execution.

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: af346c7 | Docs | View more details | Give us feedback!}

[d2burkhalter]

@greptileai

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The changes appear safe to merge; both numbered findings are fixed.

Summary

Adds named authentication contexts and expected error phases to the end-to-end tests, plus RBAC cases for global and queue permissions.

• Each test can use a different identity and check an expected error.
• RBAC cases check which identities can submit jobs and act on them.
• CI and the local stack run the RBAC suite with authenticated services.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Run ordinary test suites] --> B[Switch services to authenticated configs]
  B --> C[Run RBAC suite]
  C --> D[Resolve each test's named context]
  D --> E[Create queues and submit jobs]
  E --> F[Run the action under test]
  F --> G[Check the expected phase and gRPC code]
  G --> H[Cancel remaining jobs and delete test queues]

Loading

_{Reviews (13) · Last reviewed commit: "fix: greptile comments" · Reviewed by Greptile}

[d2burkhalter]

@greptileai

[d2burkhalter]

@greptileai

[dejanzele]

is there an easier way for this?

[d2burkhalter]

I don't think so since the keycloak image doesn't have curl or an equivalent in it