docs: add GCP Cloud Armor update note to the provider checklist - #281
Merged
Conversation
The provider-adding checklist had an "Update note" section for Fastly (#186) but nothing for GCP (#187), even though GCP's build turned up more new information than Fastly's did — a real BaseFirewallClient deviation (async auth headers, #232), a structural fact no prior provider has (priority as the only id/order/addressing-key, no separate server-assigned id), and confirmation that #184/#185 both genuinely don't apply here. The main addition is the real-e2e-verification gap this checklist didn't previously have a category for: GCP shipped, passed a holistic epic-wide review, and was still broken on the first real command against any real policy, because neither unit tests nor the mock server's fixtures ever happened to include the mandatory default rule every real Cloud Armor policy carries. Two more bugs (a shared-code id-remapping gap, a dead --ci flag on download) surfaced the same way once real infrastructure was finally involved. Added as both a new bullet in the existing "Verification methodology" section (so it's an actionable checklist item for AWS, not just GCP history) and as the headline finding in the new GCP update note.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.kiro/steering/adding-a-provider.mdhad an "Update note" section for Fastly (#186) but none for GCP (#187), flagged as a known gap in this repo's own memory since #187's implementation session.Adds:
GoogleAuthneeds real Google infrastructure to mint a token even when API traffic is mocked). Framed as an actionable checklist item for AWS, not just GCP history.BaseFirewallClientdeviation (async auth headers), the new priority-as-only-id structural fact, the no-dedicated-IP-resource shape-ambiguity gotcha, and confirmation that Model: recursive condition trees (UnifiedRule.conditions cannot express nested boolean logic) #184/Model: multi-resource / multi-region targeting (UnifiedConfig assumes one provider = one target) #185 both genuinely don't apply to GCP.Test plan