Sandbox: dedicated IRSA role + enable registry changeset sync - #1060
Merged
Conversation
added 3 commits
August 4, 2026 18:05
Carve the sandbox Registry app out of the shared ce-registry-eks application IRSA role (which spans staging/sandbox/prod) into a dedicated ce-registry-eks-sandbox-application-irsa-role. - Trust: only system:serviceaccount:credreg-sandbox:main-app-service-account. - Policy: scoped to the buckets the sandbox app actually uses (cer-envelope-downloads, cer-envelope-graphs-sandb) — verified against the app's S3 code paths (downloads, changeset, OCN) and the sandbox DB (OCN export disabled for all sandbox communities). No production buckets. - Repoint k8s-manifests-sandbox/app-service-account.yaml to the new role. This removes the sandbox workload's ability to read/write production S3 (cer-envelope-graphs-prod, cer-db-dumps-prod, etc.). The shared role's trust still lists the sandbox SA; removing it is a follow-up once the pod is verified running on the dedicated role.
Now that the sandbox app runs on its dedicated ce-registry-eks-sandbox-application-irsa-role, drop credreg-sandbox:main-app-service-account from the shared application role's trust so the sandbox SA can no longer assume it (verified: AssumeRole now returns AccessDenied). Staging and prod remain on the shared role.
Promote the changeset sync feature to the sandbox environment: - Provision the cer-registry-changesets-sandbox S3 bucket and grant it on the dedicated sandbox IRSA policy (application_policy_sandbox). S3 access uses the pod's IRSA role; no static AWS credentials. - Add REGISTRY_CHANGESET_SYNC_* env vars plus AWS_REGION to the sandbox ConfigMap (consumed by app and worker). Publisher endpoint host pending client confirmation. - Bump the app and worker images from the floating registry:sandbox tag (2026.05.18.0152, predates the feature) to the immutable 2026.07.30.0154 (commit 32ffd06, the build validated in test).
chuang-CE
previously approved these changes
Aug 5, 2026
The github-oidc-widget role runs `terraform plan` in CI and must refresh the managed S3 buckets, which requires s3:GetBucket* reads (CORS, versioning, encryption, ownership, etc.). It only had this for cer-db-dumps-prod, so plan failed on the new cer-registry-changesets-sandbox bucket with AccessDenied on s3:GetBucketCORS. Add a changeset-buckets-read policy scoped to cer-registry-changesets-* (covers sandbox now, prod/staging later).
chuang-CE
approved these changes
Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes the registry changeset sync feature to sandbox (
credreg-sandboxonce-registry-eks), and first isolates sandbox onto a dedicated least-privilege IRSA role.1. Dedicated sandbox IRSA role (isolation)
Previously the sandbox app shared
ce-registry-eks-application-irsa-rolewith staging + prod, which granted it RW to production S3 (cer-envelope-graphs-prod,cer-db-dumps-prod).ce-registry-eks-sandbox-application-irsa-roletrusting onlycredreg-sandbox:main-app-service-account, scoped to the buckets the sandbox app actually uses (verified against the app's S3 code paths + the sandbox DB — OCN export disabled for all sandbox communities).credreg-sandboxfrom the shared role's trust.k8s-manifests-sandbox/app-service-account.yaml.2. Changeset sync
cer-registry-changesets-sandboxbucket, granted on the dedicated sandbox policy.app-configmap.yaml:REGISTRY_CHANGESET_SYNC_*+AWS_REGION(endpoint = sandbox publisher). S3 auth via pod IRSA, no static credentials.registry:sandbox(2026.05.18.0152, predates the feature) to immutable2026.07.30.0154(commit32ffd06, the build validated in test).Deployed & verified (live)
RemoveArgoFields,AddPayloadToEnvelopeResourceSyncEvents).2026.07.30.0154, 1/1 ready. IRSA write to changeset bucket OK. Publisher endpoint reachable (405) with egress107.21.182.55allowlisted (confirmed by publisher team).Follow-up
201) pending a sandbox publish.