feat(fga): add openfga backup to bootstrap - #595
Conversation
Allows to configure openfga backups in the config.yaml. Thread regarding config schema for that: https://codesphere-cloud.slack.com/archives/C01Q12KG2Q4/p1784641065573559 Follow up PR adds it to the bootstrap command to test it with each Test PC Installation: - #595 Signed-off-by: Jona Neef <Jona.Neef.97@gmail.com>
2f3ccae to
16c2f7d
Compare
NautiluX
left a comment
NautiluX
left a comment
There was a problem hiding this comment.
literally requesting changes I guess :D
Signed-off-by: Jona Neef <Jona.Neef.97@gmail.com>
Signed-off-by: NJona <25478046+NJona@users.noreply.github.com>
634ca0a to
9df21d3
Compare
ups, something went wrong with rebase 🤦♂️ Fixed now. |
NautiluX
left a comment
NautiluX
left a comment
There was a problem hiding this comment.
one comment, else looks good :)
| saEmail, _, err := b.GCPClient.CreateServiceAccount(b.Env.ProjectID, openfgaBackupSAName, openfgaBackupSAName) | ||
| if err != nil { | ||
| return fmt.Errorf("failed to ensure openfga backup service account: %w", err) | ||
| } | ||
| if err := b.GCPClient.AssignIAMRole(b.Env.ProjectID, openfgaBackupSAName, b.Env.ProjectID, []string{"roles/storage.objectAdmin"}); err != nil { | ||
| return fmt.Errorf("failed to assign storage role to openfga backup service account: %w", err) | ||
| } |
There was a problem hiding this comment.
I think we have a different function creating service accounts. Not saying it's better to have them all in 1 function, but to have it consistently, I think this should move into the same function, or reuse an existing service account if there is no strict requirement to use another one.
There was a problem hiding this comment.
Moved the openfga-backup SA creation into EnsureServiceAccounts and its storage.objectAdmin binding into EnsureIAMRoles (using the shared retry helper), so all SAs/roles are provisioned in one place. Kept it as a dedicated SA rather than reusing cloud-controller to avoid granting storage admin to the compute SA. EnsureOpenfgaBackupBucket now just handles the bucket + HMAC key and derives the SA email deterministically.
Move the openfga-backup service account creation into EnsureServiceAccounts and its storage.objectAdmin role assignment into EnsureIAMRoles (via the shared retry helper), so all service accounts and roles are provisioned consistently in one place. EnsureOpenfgaBackupBucket now only ensures the bucket and HMAC key, reconstructing the SA email deterministically. Also fix a latent WriteVault/WriteUnencryptedVault mismatch in the backup config test. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: Jona Neef <Jona.Neef.97@gmail.com>
91586a0 to
1a9126f
Compare
2 participants
Stacked PR, only merge after #594.
Adds openfga backup to the bootstrap, so the backup configuration is tested with each PC Installation. Creates a new bucket in gcp in the same project and configures that as backup storage for openfga. On cleanup the bucket is deleted together with the whole project deletion.