Skip to content

Commit 835c5e1

Browse files
prestonvasquezprestonvasquez
authored
GODRIVER-3560 Assume ec2 role explicitly in CI (#2080)
1 parent 6966434 commit 835c5e1

File tree

3 files changed

+35
-124
lines changed

3 files changed

+35
-124
lines changed

‎.evergreen/config.yml

Lines changed: 26 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,11 @@ timeout:
2626
script: |
2727
ls -la
2828
functions:
29+
assume-test-secrets-ec2-role:
30+
- command: ec2.assume_role
31+
params:
32+
role_arn: ${aws_test_secrets_role}
33+
2934
fetch-source:
3035
# Executes clone and applies the submitted patch, if any
3136
- command: git.get_project
@@ -233,9 +238,13 @@ functions:
233238
display_name: "test_suite.tgz"
234239

235240
bootstrap-mongohoused:
241+
- command: ec2.assume_role
242+
params:
243+
role_arn: ${aws_test_secrets_role}
236244
- command: subprocess.exec
237245
params:
238246
binary: "bash"
247+
add_expansions_to_env: true
239248
args:
240249
- ${DRIVERS_TOOLS}/.evergreen/atlas_data_lake/pull-mongohouse-image.sh
241250
- command: subprocess.exec
@@ -580,16 +589,6 @@ functions:
580589
MONGO_GO_DRIVER_COMPRESSOR=${MONGO_GO_DRIVER_COMPRESSOR} \
581590
make evg-test-load-balancers
582591
583-
run-serverless-tests:
584-
- command: shell.exec
585-
type: test
586-
params:
587-
shell: "bash"
588-
working_dir: src/go.mongodb.org/mongo-driver
589-
script: |
590-
${PREPARE_SHELL}
591-
bash etc/run-serverless-test.sh
592-
593592
run-atlas-data-lake-test:
594593
- command: shell.exec
595594
type: test
@@ -1830,14 +1829,6 @@ tasks:
18301829
AUTH: "noauth"
18311830
SSL: "nossl"
18321831

1833-
- name: "test-serverless"
1834-
tags: ["serverless"]
1835-
commands:
1836-
- func: start-cse-servers
1837-
- func: "run-serverless-tests"
1838-
vars:
1839-
MONGO_GO_DRIVER_COMPRESSOR: "snappy"
1840-
18411832
- name: "testgcpkms-task"
18421833
commands:
18431834
- command: shell.exec
@@ -1896,10 +1887,12 @@ tasks:
18961887
18971888
- name: "testawskms-task"
18981889
commands:
1890+
- func: assume-test-secrets-ec2-role
18991891
- command: shell.exec
19001892
type: test
19011893
params:
19021894
shell: "bash"
1895+
add_expansions_to_env: true
19031896
working_dir: src/go.mongodb.org/mongo-driver
19041897
script: |
19051898
${PREPARE_SHELL}
@@ -1909,10 +1902,12 @@ tasks:
19091902
# testawskms-fail-task runs without environment variables.
19101903
# It is expected to fail to obtain credentials.
19111904
commands:
1905+
- func: assume-test-secrets-ec2-role
19121906
- command: shell.exec
19131907
type: test
19141908
params:
19151909
shell: "bash"
1910+
add_expansions_to_env: true
19161911
working_dir: src/go.mongodb.org/mongo-driver
19171912
script: |
19181913
${PREPARE_SHELL}
@@ -1925,6 +1920,7 @@ tasks:
19251920
type: test
19261921
params:
19271922
shell: "bash"
1923+
add_expansions_to_env: true
19281924
working_dir: src/go.mongodb.org/mongo-driver
19291925
script: |
19301926
${PREPARE_SHELL}
@@ -1957,10 +1953,12 @@ tasks:
19571953
# testazurekms-fail-task runs without environment variables.
19581954
# It is expected to fail to obtain credentials.
19591955
commands:
1956+
- func: assume-test-secrets-ec2-role
19601957
- command: shell.exec
19611958
type: test
19621959
params:
19631960
shell: "bash"
1961+
add_expansions_to_env: true
19641962
working_dir: src/go.mongodb.org/mongo-driver
19651963
script: |
19661964
${PREPARE_SHELL}
@@ -1985,10 +1983,6 @@ tasks:
19851983

19861984
- name: "test-aws-lambda-deployed"
19871985
commands:
1988-
- command: ec2.assume_role
1989-
params:
1990-
role_arn: ${LAMBDA_AWS_ROLE_ARN}
1991-
duration_seconds: 3600
19921986
- command: shell.exec
19931987
type: test
19941988
params:
@@ -2219,73 +2213,7 @@ axes:
22192213
variables:
22202214
GO_DIST: "/opt/golang/go1.22"
22212215

2222-
- id: os-serverless
2223-
display_name: OS
2224-
values:
2225-
- id: "rhel87"
2226-
display_name: "RHEL 8.7"
2227-
run_on: rhel8.7-small
2228-
variables:
2229-
GO_DIST: "/opt/golang/go1.22"
2230-
22312216
task_groups:
2232-
- name: serverless_task_group
2233-
setup_group_can_fail_task: true
2234-
setup_group_timeout_secs: 1800 # 30 minutes
2235-
setup_group:
2236-
- func: fetch-source
2237-
- func: prepare-resources
2238-
- func: fix-absolute-paths
2239-
- func: make-files-executable
2240-
- func: start-cse-servers
2241-
- command: shell.exec
2242-
params:
2243-
shell: "bash"
2244-
script: |
2245-
${PREPARE_SHELL}
2246-
bash ${DRIVERS_TOOLS}/.evergreen/serverless/setup-secrets.sh ${VAULT_NAME}
2247-
bash ${DRIVERS_TOOLS}/.evergreen/serverless/create-instance.sh
2248-
- command: expansions.update
2249-
params:
2250-
file: serverless-expansion.yml
2251-
- command: shell.exec
2252-
params:
2253-
shell: "bash"
2254-
script: |
2255-
${PREPARE_SHELL}
2256-
2257-
# Find the crypt_shared library file in the current directory and set the CRYPT_SHARED_LIB_PATH to
2258-
# the path of that file. Only look for .so, .dll, or .dylib files to prevent matching any other
2259-
# downloaded files.
2260-
CRYPT_SHARED_LIB_PATH="$(find $(pwd) -maxdepth 1 -type f \
2261-
-name 'mongo_crypt_v1.so' -o \
2262-
-name 'mongo_crypt_v1.dll' -o \
2263-
-name 'mongo_crypt_v1.dylib')"
2264-
2265-
# If we're on Windows, convert the "cygdrive" path to Windows-style paths.
2266-
if [ "Windows_NT" = "$OS" ]; then
2267-
CRYPT_SHARED_LIB_PATH=$(cygpath -m $CRYPT_SHARED_LIB_PATH)
2268-
fi
2269-
2270-
echo "CRYPT_SHARED_LIB_PATH: $CRYPT_SHARED_LIB_PATH" >> crypt-expansion.yml
2271-
2272-
# Load the expansion file to make an evergreen variable with the current unique version
2273-
- command: expansions.update
2274-
params:
2275-
file: crypt-expansion.yml
2276-
2277-
teardown_group:
2278-
- command: shell.exec
2279-
params:
2280-
shell: "bash"
2281-
script: |
2282-
${PREPARE_SHELL}
2283-
bash ${DRIVERS_TOOLS}/.evergreen/serverless/delete-instance.sh ${VAULT_NAME}
2284-
- func: handle-test-artifacts
2285-
- func: cleanup
2286-
tasks:
2287-
- ".serverless"
2288-
22892217
- name: testgcpkms_task_group
22902218
setup_group_can_fail_task: true
22912219
setup_group_timeout_secs: 1800 # 30 minutes
@@ -2294,9 +2222,11 @@ task_groups:
22942222
- func: prepare-resources
22952223
- func: fix-absolute-paths
22962224
- func: make-files-executable
2225+
- func: assume-test-secrets-ec2-role
22972226
- command: shell.exec
22982227
params:
22992228
shell: "bash"
2229+
add_expansions_to_env: true
23002230
script: |
23012231
${PREPARE_SHELL}
23022232
$DRIVERS_TOOLS/.evergreen/csfle/gcpkms/setup.sh
@@ -2321,9 +2251,11 @@ task_groups:
23212251
- func: prepare-resources
23222252
- func: fix-absolute-paths
23232253
- func: make-files-executable
2254+
- func: assume-test-secrets-ec2-role
23242255
- command: shell.exec
23252256
params:
23262257
shell: "bash"
2258+
add_expansions_to_env: true
23272259
script: |
23282260
${PREPARE_SHELL}
23292261
export AZUREKMS_VMNAME_PREFIX="GODRIVER"
@@ -2375,9 +2307,11 @@ task_groups:
23752307
- func: prepare-resources
23762308
- func: fix-absolute-paths
23772309
- func: make-files-executable
2310+
- func: assume-test-secrets-ec2-role
23782311
- command: subprocess.exec
23792312
params:
23802313
binary: bash
2314+
add_expansions_to_env: true
23812315
env:
23822316
AZUREOIDC_VMNAME_PREFIX: "GO_DRIVER"
23832317
args:
@@ -2399,9 +2333,11 @@ task_groups:
23992333
- func: prepare-resources
24002334
- func: fix-absolute-paths
24012335
- func: make-files-executable
2336+
- func: assume-test-secrets-ec2-role
24022337
- command: subprocess.exec
24032338
params:
24042339
binary: bash
2340+
add_expansions_to_env: true
24052341
env:
24062342
AZUREOIDC_VMNAME_PREFIX: "GO_DRIVER"
24072343
args:
@@ -2421,10 +2357,12 @@ task_groups:
24212357
setup_group:
24222358
- func: fetch-source
24232359
- func: prepare-resources
2360+
- func: assume-test-secrets-ec2-role
24242361
- command: subprocess.exec
24252362
params:
24262363
working_dir: src/go.mongodb.org/mongo-driver
24272364
binary: bash
2365+
add_expansions_to_env: true
24282366
env:
24292367
LAMBDA_STACK_NAME: dbx-go-lambda
24302368
AWS_REGION: us-east-1
@@ -2706,13 +2644,6 @@ buildvariants:
27062644
tasks:
27072645
- name: ".load-balancer"
27082646

2709-
- matrix_name: "serverless"
2710-
tags: ["pullrequest"]
2711-
matrix_spec: { os-serverless: "*" }
2712-
display_name: "Serverless ${os-serverless}"
2713-
tasks:
2714-
- "serverless_task_group"
2715-
27162647
- matrix_name: "kms-kmip-test"
27172648
matrix_spec: { version: ["7.0"], os-ssl-40: ["rhel87-64"] }
27182649
display_name: "KMS KMIP ${os-ssl-40}"

‎Makefile

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -170,30 +170,6 @@ evg-test-search-index:
170170
evg-test-ocsp:
171171
go test -v ./mongo -run TestOCSP $(OCSP_TLS_SHOULD_SUCCEED) >> test.suite
172172

173-
.PHONY: evg-test-serverless
174-
evg-test-serverless:
175-
# Serverless should be tested with all unified tests as well as tests in the following components: CRUD, load balancer,
176-
# retryable reads, retryable writes, sessions, transactions and cursor behavior.
177-
go test $(BUILD_TAGS) ./mongo/integration -run TestCrudSpec -v -timeout $(TEST_TIMEOUT)s >> test.suite
178-
go test $(BUILD_TAGS) ./mongo/integration -run TestWriteErrorsWithLabels -v -timeout $(TEST_TIMEOUT)s >> test.suite
179-
go test $(BUILD_TAGS) ./mongo/integration -run TestWriteErrorsDetails -v -timeout $(TEST_TIMEOUT)s >> test.suite
180-
go test $(BUILD_TAGS) ./mongo/integration -run TestHintErrors -v -timeout $(TEST_TIMEOUT)s >> test.suite
181-
go test $(BUILD_TAGS) ./mongo/integration -run TestWriteConcernError -v -timeout $(TEST_TIMEOUT)s >> test.suite
182-
go test $(BUILD_TAGS) ./mongo/integration -run TestErrorsCodeNamePropagated -v -timeout $(TEST_TIMEOUT)s >> test.suite
183-
go test $(BUILD_TAGS) ./mongo/integration -run TestLoadBalancerSupport -v -timeout $(TEST_TIMEOUT)s >> test.suite
184-
go test $(BUILD_TAGS) ./mongo/integration -run TestUnifiedSpecs/retryable-reads -v -timeout $(TEST_TIMEOUT)s >> test.suite
185-
go test $(BUILD_TAGS) ./mongo/integration -run TestRetryableReadsProse -v -timeout $(TEST_TIMEOUT)s >> test.suite
186-
go test $(BUILD_TAGS) ./mongo/integration -run TestRetryableWritesSpec -v -timeout $(TEST_TIMEOUT)s >> test.suite
187-
go test $(BUILD_TAGS) ./mongo/integration -run TestRetryableWritesProse -v -timeout $(TEST_TIMEOUT)s >> test.suite
188-
go test $(BUILD_TAGS) ./mongo/integration -run TestUnifiedSpecs/sessions -v -timeout $(TEST_TIMEOUT)s >> test.suite
189-
go test $(BUILD_TAGS) ./mongo/integration -run TestSessionsProse -v -timeout $(TEST_TIMEOUT)s >> test.suite
190-
go test $(BUILD_TAGS) ./mongo/integration -run TestUnifiedSpecs/transactions/legacy -v -timeout $(TEST_TIMEOUT)s >> test.suite
191-
go test $(BUILD_TAGS) ./mongo/integration -run TestConvenientTransactions -v -timeout $(TEST_TIMEOUT)s >> test.suite
192-
go test $(BUILD_TAGS) ./mongo/integration -run TestCursor -v -timeout $(TEST_TIMEOUT)s >> test.suite
193-
go test $(BUILD_TAGS) ./mongo/integration/unified -run TestUnifiedSpec -v -timeout $(TEST_TIMEOUT)s >> test.suite
194-
go test -exec "env PKG_CONFIG_PATH=$(PKG_CONFIG_PATH) LD_LIBRARY_PATH=$(LD_LIBRARY_PATH) DYLD_LIBRARY_PATH=$(MACOS_LIBRARY_PATH)" $(BUILD_TAGS) -v -timeout $(TEST_TIMEOUT)s ./mongo/integration -run TestClientSideEncryptionSpec >> test.suite
195-
go test -exec "env PKG_CONFIG_PATH=$(PKG_CONFIG_PATH) LD_LIBRARY_PATH=$(LD_LIBRARY_PATH) DYLD_LIBRARY_PATH=$(MACOS_LIBRARY_PATH)" $(BUILD_TAGS) -v -timeout $(TEST_TIMEOUT)s ./mongo/integration -run TestClientSideEncryptionProse >> test.suite
196-
197173
.PHONY: evg-test-versioned-api
198174
evg-test-versioned-api:
199175
# Versioned API related tests are in the mongo, integration and unified packages.

‎etc/run-awskms-test.sh

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,17 +4,21 @@
44

55
echo "Building build-kms-test ... begin"
66
BUILD_TAGS="-tags=cse" \
7-
PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
8-
make build-kms-test
7+
PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
8+
make build-kms-test
99
echo "Building build-kms-test ... end"
1010

1111
. ${DRIVERS_TOOLS}/.evergreen/secrets_handling/setup-secrets.sh drivers/atlas_connect
1212
export MONGODB_URI="$ATLAS_FREE"
1313

1414
if [ -z "${EXPECT_ERROR:-}" ]; then
15-
. ${DRIVERS_TOOLS}/.evergreen/csfle/setup-secrets.sh
16-
export AWS_SECRET_ACCESS_KEY=$FLE_AWS_SECRET_ACCESS_KEY
17-
export AWS_ACCESS_KEY_ID=$FLE_AWS_ACCESS_KEY_ID
15+
. ${DRIVERS_TOOLS}/.evergreen/csfle/setup-secrets.sh
16+
export AWS_SECRET_ACCESS_KEY=$FLE_AWS_SECRET_ACCESS_KEY
17+
export AWS_ACCESS_KEY_ID=$FLE_AWS_ACCESS_KEY_ID
1818
fi
1919

20+
# AWS_SESSION_TOKEN is required to get credentials from the drivers/csfle vault
21+
# but interferes with the testkms binary causing UnrecognizedClientException.
22+
unset AWS_SESSION_TOKEN
23+
2024
LD_LIBRARY_PATH=./install/libmongocrypt/lib64 PROVIDER='aws' ./testkms

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy