ci-chat-bot icon indicating copy to clipboard operation
ci-chat-bot copied to clipboard

OCPCRT-436: Add request/revoke commands for temporary GCP project access

Open AlexNPavel opened this issue 2 weeks ago • 6 comments

Add new request and revoke text commands that allow members of the Hybrid Platforms organization to obtain temporary access to GCP projects for testing complex or long-lived clusters beyond what the existing automated commands support.

Commands:

  • request <resource> "<justification>" - Request 7-day access with business justification
  • revoke <resource> - Remove access early before expiration

Key features:

  • Authorization via Cyborg API to verify Hybrid Platforms organization membership
  • Automated IAM binding creation with 7-day default expiration
  • Background monitoring and cleanup of expired access grants
  • Initial support for "gcp-access" resource with extensible design for additional GCP projects or resource types

Implementation includes:

  • New GCP access manager with IAM policy management (pkg/manager/gcp_access.go)
  • Request/revoke command parsers and action handlers
  • Comprehensive test coverage (627 lines of manager tests, 941 lines of Slack action tests)
  • Documentation in docs/claude/OCPCRT-436/ for implementation details and testing procedures

This PR also has a modernization recommendations from the gopls modernizer implemented.

AlexNPavel avatar Jan 17 '26 00:01 AlexNPavel