Skip to content

Adding aliases and policies blocks#270

Merged
davidquirozibm merged 5 commits into
mainfrom
policy-alias-bloating
Jul 23, 2026
Merged

Adding aliases and policies blocks#270
davidquirozibm merged 5 commits into
mainfrom
policy-alias-bloating

Conversation

@davidquirozibm

@davidquirozibm davidquirozibm commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds two new HCL allocation blocks to the identity benchmark which are aliases and policies. They follow the same pattern as the existing groups block. Both use preset modes (balanced / empty / full) or manual count + size for fine-grained control.

What Changed

  • alias_count is now a total alias budget rather than a per-entity cap. parseAliases() resolves it into (aliasFill, aliasCap); enableUserpassMounts provisions one auth mount per alias slot to satisfy Vault's one-alias-per-accessor constraint. Cleanup tears down all slot mounts.
  • policy_count creates placeholder ACL policies via createPolicies(). parsePolicies() resolves distribution into (polFill, polSize) and token_policies are attached to both entities and groups using selectPolicyNames(). Cleanup deletes all created policies.
  • Both blocks support the same presets as groups: balanced (even spread), empty (suppress), full (every object gets the full budget), and manual count+size.

Validation

  • go build ./benchmarktests/... passes cleanly.
  • made sample hcls that test new changes, all run with out failure.

Notes

The policies block applies the same distribution independently to both entities and groups, a single block controls both.

@davidquirozibm
davidquirozibm marked this pull request as ready for review July 23, 2026 18:37
@davidquirozibm
davidquirozibm requested a review from a team as a code owner July 23, 2026 18:37

@scellef scellef left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@davidquirozibm
davidquirozibm merged commit 635f29f into main Jul 23, 2026
53 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants