diff --git a/ee/app/models/integrations/google_cloud_platform/workload_identity_federation.rb b/ee/app/models/integrations/google_cloud_platform/workload_identity_federation.rb index e9305bc98dab9d664c0f7aae84075d62ccba0d9b..e89443a23c6218c07814a9f8a2ea96865124247a 100644 --- a/ee/app/models/integrations/google_cloud_platform/workload_identity_federation.rb +++ b/ee/app/models/integrations/google_cloud_platform/workload_identity_federation.rb @@ -72,9 +72,14 @@ def testable? def identity_provider_resource_name return unless parent.google_cloud_workload_identity_federation_enabled? && activated? - "//iam.googleapis.com/projects/#{workload_identity_federation_project_number}/" \ - "locations/global/workloadIdentityPools/#{workload_identity_pool_id}/" \ - "providers/#{workload_identity_pool_provider_id}" + "//#{identity_pool_resource_name}/providers/#{workload_identity_pool_provider_id}" + end + + def identity_pool_resource_name + return unless parent.google_cloud_workload_identity_federation_enabled? && activated? + + "iam.googleapis.com/projects/#{workload_identity_federation_project_number}/" \ + "locations/global/workloadIdentityPools/#{workload_identity_pool_id}" end end end diff --git a/ee/spec/models/integrations/google_cloud_platform/workload_identity_federation_spec.rb b/ee/spec/models/integrations/google_cloud_platform/workload_identity_federation_spec.rb index 0decb0c9aa5ad262e5648f69bfa72be532fb4ea2..789644ddbdbddb77a1c70b21ce2100b40521e8bc 100644 --- a/ee/spec/models/integrations/google_cloud_platform/workload_identity_federation_spec.rb +++ b/ee/spec/models/integrations/google_cloud_platform/workload_identity_federation_spec.rb @@ -126,4 +126,52 @@ end end end + + describe '#identity_pool_resource_name' do + using RSpec::Parameterized::TableSyntax + + let_it_be(:group) { create(:group) } + let_it_be(:project_integration) { create(:google_cloud_platform_workload_identity_federation_integration) } + let_it_be(:group_integration) do + create(:google_cloud_platform_workload_identity_federation_integration, project: nil, group: group) + end + + let(:resource_name) do + "iam.googleapis.com/projects/#{integration.workload_identity_federation_project_number}/" \ + "locations/global/workloadIdentityPools/#{integration.workload_identity_pool_id}" + end + + subject { integration.identity_pool_resource_name } + + where(:integration, :active, :expected_resource_name) do + ref(:project_integration) | true | ref(:resource_name) + ref(:project_integration) | false | nil + ref(:group_integration) | true | ref(:resource_name) + ref(:group_integration) | false | nil + end + + with_them do + before do + integration.update!(active: active) unless active + end + + it { is_expected.to be_nil } + + context 'when feature is available' do + before do + stub_saas_features(google_cloud_support: true) + end + + it { is_expected.to eq(expected_resource_name) } + end + + context 'when google_cloud_workload_identity_federation FF is disabled' do + before do + stub_feature_flags(google_cloud_workload_identity_federation: false) + end + + it { is_expected.to be_nil } + end + end + end end