fix: source STACKIT storage-bucket e2e credentials from environment#233
Merged
Merged
Conversation
The storage-bucket e2e harness's platform-team provider hardcoded service_account_key = var.stackit_service_account_key. Drop the variable and the explicit argument so the STACKIT provider discovers credentials from the environment instead: STACKIT_SERVICE_ACCOUNT_KEY_PATH for local development and WIF in CI. Passing an explicit null argument otherwise overrides that discovery and confuses the CI environment. The building block and backplane already authenticate via WIF; this only touches the test harness. experiments = ["iam"] stays because the inherited backplane provisions IAM resources. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
Scorecard Check
📊 meshstack-hub Module Scorecard
📋 Per-Module Category SummaryScore per category per building block.
Core Structure — ✅ all passingBasic module file structure and documentation — applies to 1 modules
Core Structure — Summary
Integration — ✅ all passingmeshstack_integration.tf conventions — applies to 1 modules
Integration — Summary
Azure Backplane — not applicableAzure UAMI-based automation principal conventions — applies to 0 modules No applicable modules. STACKIT Backplane — ✅ all passingSTACKIT WIF-based automation principal conventions — applies to 1 modules
STACKIT Backplane — Summary
Testing — ✅ all passingEnd-to-end test coverage — applies to 1 modules
Testing — Summary
|
|
This pull request is automatically being deployed by Amplify Hosting (learn more). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The
stackit/storage-buckete2e harness's platform-team provider hardcodedservice_account_key = var.stackit_service_account_key. This drops the variable and the explicit argument so the STACKIT provider discovers credentials from the environment on its own:STACKIT_SERVICE_ACCOUNT_KEY_PATH(~/.stackit/credentials.json), per the standardized convention inmeshstack-smoke-test/setup-env.sh.Passing an explicit (possibly
null)service_account_keyargument overrides that env-based discovery and confused the CI environment.Why not a "WIF fix" to the building block
The building block (
buildingblock/provider.tf) and backplane already authenticate the STACKIT API via WIF (use_oidc = true+ federated identity providers). Only the e2e test harness used a service account key — as the platform-team credential to provision the ephemeral backplane. This change touches only that harness.experiments = ["iam"]stays because the inherited backplane provisions IAM resources (stackit_authorization_project_role_assignment,stackit_service_account_federated_identity_provider).Testing
Ran locally via
task hub:e2e:run MODULE=stackit/storage-bucket(build-from-source mode). The provider authenticated purely fromSTACKIT_SERVICE_ACCOUNT_KEY_PATH, provisioned the backplane, ordered a real building block, and the test passed: 1 passed, 0 failed.🤖 Generated with Claude Code