feat: add SSM as a gitprovider #1768

Camila-B · 2025-07-01T17:54:37Z

This change adds SSM as a git provider to the E2E tests. It adds tests to validate that a repo can be created, pushed to, synced to by Config Sync, and deleted
It also adds the https://www.googleapis.com/auth/userinfo.email scope to the askpass credential provider as tokens used by SSM require it
Depends on the SSM TF setup introduced in ci: Add TF configs for SSM #1790

google-oss-prow · 2025-07-01T17:54:39Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

gemini-code-assist

Summary of Changes

Hello @Camila-B, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly expands our end-to-end testing capabilities by integrating Secure Source Manager (SSM) as a new Git provider. It introduces the necessary infrastructure to interact with SSM repositories, including a dedicated client and authentication mechanisms, and adds a foundational test case to ensure Config Sync can successfully synchronize configurations from SSM using Workload Identity.

Highlights

Secure Source Manager (SSM) Integration: Added Secure Source Manager (SSM) as a new supported Git provider for end-to-end (E2E) tests, enabling Config Sync to pull configurations from SSM repositories.
New E2E Test for SSM: Introduced a dedicated E2E test case (TestWorkloadIdentity_GitSourceSSM) to validate Config Sync's ability to sync from an SSM repository using Workload Identity, covering repository creation, pushing, syncing, and deletion.
E2E Test Infrastructure Enhancements: Extended the E2E test framework to include a new --ssm-instance flag, a RequireSecureSourceManagerRepository test option, and validation for required environment variables when SSM is used.
Code Refactoring: Centralized the repository name sanitization logic into a new util package, improving code reusability and maintainability across different Git provider implementations.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request adds support for Google Cloud Secure Source Manager (SSM) as a Git provider for the E2E tests. The changes include adding a new test case for SSM, updating flags, and creating a new client for interacting with SSM. The refactoring of sanitizeRepoName into a shared utility is a good improvement.

I've identified a few critical issues, such as the use of an interactive gcloud command that will fail in CI and a missing required flag in a cleanup command. There are also several medium-severity issues related to hardcoded values, copy-paste errors in comments, and misleading naming that should be addressed to improve code quality and maintainability. Overall, this is a good start for adding SSM support, and addressing the feedback will make it robust.

gemini-code-assist · 2025-07-01T17:57:00Z

e2e/nomostest/gitproviders/secure_source_manager.go

+}
+
+func (c *SSMClient) login() error {
+	_, err := c.shell.ExecWithDebug("gcloud", "init")


The gcloud init command is interactive and is intended for first-time setup of a gcloud configuration. It will hang in a non-interactive environment like a CI/CD pipeline, causing tests to fail or time out.

If the goal is to ensure authentication, the test environment should already be authenticated (e.g., via Workload Identity or a service account key). If authentication is already handled, this login function may not be necessary. If it is, a non-interactive command like gcloud auth activate-service-account should be used. Given this is a pre-existing pattern from the CSR client, it should be fixed in both places.

e2e/nomostest/gitproviders/secure_source_manager.go

e2e/nomostest/ntopts/new.go

e2e/testcases/workload_identity_test.go

Camila-B · 2025-07-07T21:32:23Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces support for Secure Source Manager (SSM) as a Git provider for the E2E tests. The changes include adding new flags for SSM configuration, implementing an SSM client, and adding an initial test case for workload identity with SSM. The refactoring of sanitizeRepoName into a shared utility is a nice improvement for code reuse.

gemini-code-assist · 2025-07-07T21:33:38Z

e2e/nomostest/gitproviders/secure_source_manager.go

+}
+
+func (c *SSMClient) login() error {
+	_, err := c.shell.ExecWithDebug("gcloud", "init")


gcloud init is an interactive command and may cause tests to hang in a non-interactive CI environment. Consider a non-interactive approach, or rely on the gcloud.sh credential helper to manage authentication implicitly. Since CSRClient uses the same login implementation, this could be a good opportunity to refactor both.

e2e/flags.go

e2e/nomostest/gitproviders/secure_source_manager.go

e2e/nomostest/gitproviders/util/reponame.go

Camila-B · 2025-07-09T21:29:16Z

/gemini review

gemini-code-assist

Code Review

This pull request introduces support for Secure Source Manager (SSM) as a Git provider in the E2E test suite. The changes are well-structured. I've identified a few issues related to the use of an interactive command in an automated script, granting excessive permissions to the service account, and a suggestion to improve maintainability by avoiding a hardcoded value.

gemini-code-assist · 2025-07-09T21:30:55Z

e2e/nomostest/gitproviders/secure_source_manager.go

+	_, err := c.shell.ExecWithDebug("gcloud", "init")
+	if err != nil {
+		return fmt.Errorf("authorizing gcloud: %w", err)
+	}


The gcloud init command is designed for interactive use and is not suitable for automated scripts, as it may hang waiting for user input. The test environment should be pre-authenticated.

gemini-code-assist · 2025-07-09T21:30:55Z

e2e/nomostest/gitproviders/secure_source_manager.go

+	_, err = c.shell.ExecWithDebug("gcloud", "beta", "source-manager", "repos",
+		"add-iam-policy-binding", fullName, "--region", c.region,
+		"--member", fmt.Sprintf("serviceAccount:%s", SSMServiceAccountEmail()),
+		"--role", "roles/securesourcemanager.repoWriter",


The service account used by Config Sync is being granted the roles/securesourcemanager.repoWriter role. This grants write access, but Config Sync only needs read access. Consider using roles/securesourcemanager.repoReader to adhere to the principle of least privilege.

Suggested change

"--role", "roles/securesourcemanager.repoWriter",

"--role", "roles/securesourcemanager.repoReader",

e2e/nomostest/gitproviders/secure_source_manager.go

e2e/nomostest/gitproviders/cloud_source_repository.go

e2e/nomostest/gitproviders/secure_source_manager.go

e2e/testcases/workload_identity_test.go

sdowell

Please also tidy up the proposed commit history

e2e/flags.go

e2e/nomostest/gitproviders/secure_source_manager.go

pkg/auth/credential_provider.go

e2e/nomostest/nt.go

sdowell · 2025-07-25T17:27:42Z

e2e/testcases/workload_identity_test.go

+			name:        "Authenticate to Git repo on SSM with GKE WI",
+			fleetWITest: false,
+			rootSrcCfg:  sourceConfig{pkg: "hydration/kustomize-components", dir: "kustomize-components", commitFn: nomostest.RootRepoSha1Fn},
+			nsSrcCfg:    sourceConfig{pkg: "hydration/namespace-repo", dir: "namespace-repo", commitFn: nomostest.NsRepoSha1Fn},


nit: consider adding the following snippet to updateRSyncWithGitSourceConfig:

meta := rsyncValidateMeta{rsID: id, syncDir: sc.dir} switch id.Kind { case configsync.RootSyncKind: meta.sha1Func = nomostest.DefaultRootSha1Fn case configsync.RepoSyncKind: meta.sha1Func = nomostest.DefaultRepoSha1Fn default: nt.T.Fatalf("unrecognized RSync kind: %s", id.Kind) } return meta

Then the commitFn doesn't need to be declared here for CSR and SSM

e2e/nomostest/gitproviders/secure_source_manager.go

Camila-B · 2025-07-25T23:24:37Z

/retest

e2e/nomostest/testing/env.go

* Adds SSM gitprovider * Adds tests to test basic flow of fetching from a SSM repo

sdowell

/lgtm

google-oss-prow · 2025-07-26T00:00:22Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sdowell

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [sdowell]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Camila-B · 2025-07-26T05:12:58Z

/retest

Camila-B · 2025-07-26T22:39:03Z

/retest

google-oss-prow bot added the do-not-merge/work-in-progress label Jul 1, 2025

google-oss-prow bot requested review from mikebz and tiffanny29631 July 1, 2025 17:54

Camila-B removed request for mikebz and tiffanny29631 July 1, 2025 17:54

google-oss-prow bot added the size/L label Jul 1, 2025

gemini-code-assist bot reviewed Jul 1, 2025

View reviewed changes

Camila-B force-pushed the feat/ssm-validation branch 5 times, most recently from af42c00 to 1e285d4 Compare July 7, 2025 20:00

gemini-code-assist bot reviewed Jul 7, 2025

View reviewed changes

Camila-B force-pushed the feat/ssm-validation branch from 1e285d4 to 31bcf69 Compare July 9, 2025 21:22

gemini-code-assist bot reviewed Jul 9, 2025

View reviewed changes

sdowell reviewed Jul 10, 2025

View reviewed changes

e2e/nomostest/gitproviders/cloud_source_repository.go Show resolved Hide resolved

sdowell reviewed Jul 10, 2025

View reviewed changes

e2e/nomostest/gitproviders/secure_source_manager.go Outdated Show resolved Hide resolved

sdowell reviewed Jul 10, 2025

View reviewed changes

e2e/testcases/workload_identity_test.go Outdated Show resolved Hide resolved

tiffanny29631 reviewed Jul 10, 2025

View reviewed changes

e2e/testcases/workload_identity_test.go Outdated Show resolved Hide resolved

Camila-B force-pushed the feat/ssm-validation branch from 0d92a7b to 81bf694 Compare July 14, 2025 17:43

sdowell mentioned this pull request Jul 15, 2025

ci: Add TF configs for SSM #1790

Merged

Camila-B force-pushed the feat/ssm-validation branch from e21d4da to 48c34af Compare July 22, 2025 20:09

Camila-B changed the title ~~[WIP] test: add SSM as gitprovider~~ feat: add SSM as a gitprovider Jul 25, 2025

Camila-B marked this pull request as ready for review July 25, 2025 16:49

google-oss-prow bot removed the do-not-merge/work-in-progress label Jul 25, 2025

google-oss-prow bot requested a review from mikebz July 25, 2025 16:49

google-oss-prow bot requested a review from sdowell July 25, 2025 16:49

sdowell reviewed Jul 25, 2025

View reviewed changes

Camila-B force-pushed the feat/ssm-validation branch from f0b9814 to c533978 Compare July 25, 2025 17:04

sdowell reviewed Jul 25, 2025

View reviewed changes

e2e/nomostest/nt.go Outdated Show resolved Hide resolved

sdowell reviewed Jul 25, 2025

View reviewed changes

tiffanny29631 reviewed Jul 25, 2025

View reviewed changes

e2e/nomostest/gitproviders/secure_source_manager.go Outdated Show resolved Hide resolved

sdowell reviewed Jul 25, 2025

View reviewed changes

e2e/nomostest/gitproviders/secure_source_manager.go Outdated Show resolved Hide resolved

Camila-B force-pushed the feat/ssm-validation branch from c533978 to 9c6c972 Compare July 25, 2025 17:48

fix: Add GitSourceScope to support SSM

1e2369d

Camila-B force-pushed the feat/ssm-validation branch 2 times, most recently from e749eb6 to 5a6db0c Compare July 25, 2025 18:34

sdowell reviewed Jul 25, 2025

View reviewed changes

e2e/nomostest/gitproviders/secure_source_manager.go Outdated Show resolved Hide resolved

Camila-B force-pushed the feat/ssm-validation branch 2 times, most recently from bb8b13b to d2c58b8 Compare July 25, 2025 22:29

sdowell reviewed Jul 25, 2025

View reviewed changes

e2e/nomostest/testing/env.go Outdated Show resolved Hide resolved

Camila-B force-pushed the feat/ssm-validation branch from c17af0e to 2bc1629 Compare July 25, 2025 23:35

test: Add SSM gitprovider to E2E tests

0f8d447

* Adds SSM gitprovider * Adds tests to test basic flow of fetching from a SSM repo

Camila-B force-pushed the feat/ssm-validation branch from 2bc1629 to 0f8d447 Compare July 25, 2025 23:56

sdowell approved these changes Jul 26, 2025

View reviewed changes

google-oss-prow bot assigned sdowell Jul 26, 2025

google-oss-prow bot added the lgtm label Jul 26, 2025

google-oss-prow bot added the approved label Jul 26, 2025

google-oss-prow bot merged commit d728b5e into GoogleContainerTools:main Jul 26, 2025
6 checks passed

	"--role", "roles/securesourcemanager.repoWriter",
	"--role", "roles/securesourcemanager.repoReader",

feat: add SSM as a gitprovider #1768

feat: add SSM as a gitprovider #1768

Uh oh!

Conversation

Camila-B commented Jul 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

google-oss-prow bot commented Jul 1, 2025

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Jul 1, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Camila-B commented Jul 7, 2025

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Jul 7, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Camila-B commented Jul 9, 2025

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Jul 9, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jul 9, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sdowell left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sdowell Jul 25, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Camila-B commented Jul 25, 2025

Uh oh!

Uh oh!

sdowell left a comment

Camila-B commented Jul 1, 2025 •

edited

Loading