ci-chat-bot
ci-chat-bot copied to clipboard
OCPCRT-436: Add request/revoke commands for temporary GCP project access
Add new request and revoke text commands that allow members of the Hybrid Platforms organization to obtain temporary access to GCP projects for testing complex or long-lived clusters beyond what the existing automated commands support.
Commands:
-
request <resource> "<justification>"- Request 7-day access with business justification -
revoke <resource>- Remove access early before expiration
Key features:
- Authorization via Cyborg API to verify Hybrid Platforms organization membership
- Automated IAM binding creation with 7-day default expiration
- Background monitoring and cleanup of expired access grants
- Initial support for "gcp-access" resource with extensible design for additional GCP projects or resource types
Implementation includes:
- New GCP access manager with IAM policy management (pkg/manager/gcp_access.go)
- Request/revoke command parsers and action handlers
- Comprehensive test coverage (627 lines of manager tests, 941 lines of Slack action tests)
- Documentation in docs/claude/OCPCRT-436/ for implementation details and testing procedures
This PR also has a modernization recommendations from the gopls modernizer implemented.