[mzottolaqovery]

Summary

Issue:

Screenshots / Recordings

For organizations with feature flag:

• toggle off (disabled by default):

• toggle on:

Testing

• Changes tested locally in the relevant Console's pages and Storybooks
• yarn test or yarn test -u (if you need to regenerate snapshots)
• yarn format
• yarn lint

PR Checklist

• I followed naming, styling, and TypeScript rules (see .cursor/rules)
• I performed a self-review (diff inspected, dead code removed)
• I titled the PR using Conventional Commits with a scope when possible (e.g. feat(service): add new Terraform service) - required for semantic-release
• I only kept necessary comments, written in English (watch for useless AI comments)
• I involved a designer to validate UI changes if I am not a designer
• I covered new business logic with tests (unit)
• I confirmed CI is green (Codecov red can be accepted)
• I reviewed and executed locally any AI-assisted code

---

Summary by cubic

Adds a restrictive-permissions mode to the AWS managed cluster creation flow so clusters run on restricted credentials by default and request extended credentials only when wider access is needed.

• Gated behind the wide-credentials PostHog feature flag for managed AWS clusters.
• The toggle defaults to off, and using_restrictive_permissions is registered on the form in both creation and edit flows.
• With the toggle on, extended credentials are limited to AWS roles, and a restricted credentials selector plus a Slack webhook URL appear; with it off, all credential types are selectable.
• The Slack webhook URL is validated against hooks.slack.com in both the creation flow and the edit-cluster credentials settings.
• The summary step sends restricted credentials as cloud_provider_credentials, extended credentials as wide_permission_credentials, plus a wide_permissions payload block.
• EKS Anywhere clusters keep the existing credential flow when the flag is enabled.

^{Written for commit cb8a33f. Summary will update on new commits.}

[RemiBonnet]

Qovery can create a Preview Environment for this PR.
To trigger its creation, please post a comment with one of the following command.

Command	Blueprint environment
/qovery preview cc1de7de-94e5-40f8-8e45-bc8986d9dfec	storybook
/qovery preview 964984c5-fba6-4371-88d3-a5daf99642ab	test-prod
/qovery preview 28c47145-c8e7-4b9d-8d9e-c65c95b48425	staging
/qovery preview {all|UUID1,UUID2,...}	To preview multiple environments

---

This comment has been generated from Qovery AI 🤖.
Below, a word from its wisdom :

Programs must be written for people to read, and only incidentally for machines to execute

[nx-cloud]

View your CI Pipeline Execution ↗ for commit cb8a33f

Command	Status	Duration	Result
nx run console:build --parallel=3 --configurati...	✅ Succeeded	58s	View ↗
nx affected --target=test --parallel=3 --config...	✅ Succeeded	4m 25s	View ↗
nx affected --target=lint --parallel=3	✅ Succeeded	2m 56s	View ↗
nx-cloud record -- yarn nx format:check	✅ Succeeded	1s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-10-28 18:10:55 UTC

[cubic-dev-ai]

1 issue found and verified against the latest diff

Confidence score: 3/5

• step-summary.tsx can submit an AWS credential type that the wide-permission flow does not allow. Use the wide-permission credential selector or validate the credential type before submission.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="libs/domains/clusters/feature/src/lib/cluster-creation-flow/step-summary/step-summary.tsx">

<violation number="1" location="libs/domains/clusters/feature/src/lib/cluster-creation-flow/step-summary/step-summary.tsx:137">
P2: This submits any selected AWS credential as `wide_permission_credentials`, although the existing wide-permission control permits only AWS role/STS credentials. Use the wide-permission credential selector or validate the selected credential type before building this request.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[codecov]

Codecov Report

❌ Patch coverage is 87.03704% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 54.49%. Comparing base (1a5d56a) to head (cb8a33f).
⚠️ Report is 1 commits behind head on staging.

Files with missing lines	Patch %	Lines
...luster-creation-flow/step-general/step-general.tsx	79.16%	3 Missing and 2 partials ⚠️
...s/cluster-wide-permission-credentials-settings.tsx	85.71%	0 Missing and 1 partial ⚠️
.../cluster-credentials-settings/slack-webhook-url.ts	80.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           staging    #3156      +/-   ##
===========================================
+ Coverage    54.42%   54.49%   +0.07%     
===========================================
  Files         1424     1428       +4     
  Lines        31999    32033      +34     
  Branches      9537     9555      +18     
===========================================
+ Hits         17415    17457      +42     
+ Misses       11844    11838       -6     
+ Partials      2740     2738       -2     

Flag	Coverage Δ
unittests	54.49% <87.03%> (+0.07%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cubic-dev-ai]

All reported issues were addressed across 8 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 4 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[rmnbrd]

ClusterCreationRestrictivePermissionsSettings duplicates most of the existing ClusterRestrictivePermissionsSettings: the restrictive permissions toggle and description, restricted credentials selector, and Slack webhook field.

Could we share these controls between creation and editing? The field names, ordering, and credential creation behavior differ, so those differences should remain explicit, but sharing the common controls would keep validation and copy consistent.

[rmnbrd]

Let's reuse the already existing components.

[cubic-dev-ai]

All reported issues were addressed across 4 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>