feat(iaas): add image share resource #1164
Draft
+532
−0
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Problems with this resource:
When you set parent_organization = true, you are telling the API to share the image with every project in your organization. projects = null (Because they are mutually exclusive, user don't set this). The API calculates which projects belongs to your organization and returns that list of projects in the response (e.g., projects: ["proj-A", "proj-B"]). To fix this we ignore the data the API returns for projects whenever parent_organization is active (mapShareFields).
The API treats image sharing as a single global configuration. Creating a new share silently overwrites any existing one. Fix: Added a Check-Then-Act validation in Create (using authorization resource utils right now, should be moved to general utils?)
The API rejects null for projects (requires []), but throws a 400 Conflict if both projects and parentOrganization keys are present in the payload, even if one is empty/null. Fix: Implemented custom payload serialization (toSetImageSharePayload) that explicitly sets unused fields to nil (omitting the key) while initializing used fields
Open Problem (unlikely case a user does that but still open):
Resource1: Sets parent_organization = false.
Resource2: runs its pre-create check, it calls the API. My duplicate check logic interprets this as "No resource exists," effectively making Resource 1 invisible to the conflict detector.
I don't have a solution for this problem. We could add this resource as beta and add a comment to the documentation which explains that each image can only have a single share resource.
Checklist
make fmtexamples/directory)make generate-docs(will be checked by CI)make test(will be checked by CI)make lint(will be checked by CI)