Skip to content

Commit 835c5e1

Browse files
prestonvasquezprestonvasquez
authored
GODRIVER-3560 Assume ec2 role explicitly in CI (#2080)
1 parent 6966434 commit 835c5e1

File tree

3 files changed

+35
-124
lines changed

3 files changed

+35
-124
lines changed

‎.evergreen/config.yml

Lines changed: 26 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,11 @@ timeout:
2626
script: |
2727
ls -la
2828
functions:
29+
assume-test-secrets-ec2-role:
30+
- command: ec2.assume_role
31+
params:
32+
role_arn: ${aws_test_secrets_role}
33+
2934
fetch-source:
3035
# Executes clone and applies the submitted patch, if any
3136
- command: git.get_project
@@ -233,9 +238,13 @@ functions:
233238
display_name: "test_suite.tgz"
234239

235240
bootstrap-mongohoused:
241+
- command: ec2.assume_role
242+
params:
243+
role_arn: ${aws_test_secrets_role}
236244
- command: subprocess.exec
237245
params:
238246
binary: "bash"
247+
add_expansions_to_env: true
239248
args:
240249
- ${DRIVERS_TOOLS}/.evergreen/atlas_data_lake/pull-mongohouse-image.sh
241250
- command: subprocess.exec
@@ -580,16 +589,6 @@ functions:
580589
MONGO_GO_DRIVER_COMPRESSOR=${MONGO_GO_DRIVER_COMPRESSOR} \
581590
make evg-test-load-balancers
582591
583-
run-serverless-tests:
584-
- command: shell.exec
585-
type: test
586-
params:
587-
shell: "bash"
588-
working_dir: src/go.mongodb.org/mongo-driver
589-
script: |
590-
${PREPARE_SHELL}
591-
bash etc/run-serverless-test.sh
592-
593592
run-atlas-data-lake-test:
594593
- command: shell.exec
595594
type: test
@@ -1830,14 +1829,6 @@ tasks:
18301829
AUTH: "noauth"
18311830
SSL: "nossl"
18321831

1833-
- name: "test-serverless"
1834-
tags: ["serverless"]
1835-
commands:
1836-
- func: start-cse-servers
1837-
- func: "run-serverless-tests"
1838-
vars:
1839-
MONGO_GO_DRIVER_COMPRESSOR: "snappy"
1840-
18411832
- name: "testgcpkms-task"
18421833
commands:
18431834
- command: shell.exec
@@ -1896,10 +1887,12 @@ tasks:
18961887
18971888
- name: "testawskms-task"
18981889
commands:
1890+
- func: assume-test-secrets-ec2-role
18991891
- command: shell.exec
19001892
type: test
19011893
params:
19021894
shell: "bash"
1895+
add_expansions_to_env: true
19031896
working_dir: src/go.mongodb.org/mongo-driver
19041897
script: |
19051898
${PREPARE_SHELL}
@@ -1909,10 +1902,12 @@ tasks:
19091902
# testawskms-fail-task runs without environment variables.
19101903
# It is expected to fail to obtain credentials.
19111904
commands:
1905+
- func: assume-test-secrets-ec2-role
19121906
- command: shell.exec
19131907
type: test
19141908
params:
19151909
shell: "bash"
1910+
add_expansions_to_env: true
19161911
working_dir: src/go.mongodb.org/mongo-driver
19171912
script: |
19181913
${PREPARE_SHELL}
@@ -1925,6 +1920,7 @@ tasks:
19251920
type: test
19261921
params:
19271922
shell: "bash"
1923+
add_expansions_to_env: true
19281924
working_dir: src/go.mongodb.org/mongo-driver
19291925
script: |
19301926
${PREPARE_SHELL}
@@ -1957,10 +1953,12 @@ tasks:
19571953
# testazurekms-fail-task runs without environment variables.
19581954
# It is expected to fail to obtain credentials.
19591955
commands:
1956+
- func: assume-test-secrets-ec2-role
19601957
- command: shell.exec
19611958
type: test
19621959
params:
19631960
shell: "bash"
1961+
add_expansions_to_env: true
19641962
working_dir: src/go.mongodb.org/mongo-driver
19651963
script: |
19661964
${PREPARE_SHELL}
@@ -1985,10 +1983,6 @@ tasks:
19851983

19861984
- name: "test-aws-lambda-deployed"
19871985
commands:
1988-
- command: ec2.assume_role
1989-
params:
1990-
role_arn: ${LAMBDA_AWS_ROLE_ARN}
1991-
duration_seconds: 3600
19921986
- command: shell.exec
19931987
type: test
19941988
params:
@@ -2219,73 +2213,7 @@ axes:
22192213
variables:
22202214
GO_DIST: "/opt/golang/go1.22"
22212215

2222-
- id: os-serverless
2223-
display_name: OS
2224-
values:
2225-
- id: "rhel87"
2226-
display_name: "RHEL 8.7"
2227-
run_on: rhel8.7-small
2228-
variables:
2229-
GO_DIST: "/opt/golang/go1.22"
2230-
22312216
task_groups:
2232-
- name: serverless_task_group
2233-
setup_group_can_fail_task: true
2234-
setup_group_timeout_secs: 1800 # 30 minutes
2235-
setup_group:
2236-
- func: fetch-source
2237-
- func: prepare-resources
2238-
- func: fix-absolute-paths
2239-
- func: make-files-executable
2240-
- func: start-cse-servers
2241-
- command: shell.exec
2242-
params:
2243-
shell: "bash"
2244-
script: |
2245-
${PREPARE_SHELL}
2246-
bash ${DRIVERS_TOOLS}/.evergreen/serverless/setup-secrets.sh ${VAULT_NAME}
2247-
bash ${DRIVERS_TOOLS}/.evergreen/serverless/create-instance.sh
2248-
- command: expansions.update
2249-
params:
2250-
file: serverless-expansion.yml
2251-
- command: shell.exec
2252-
params:
2253-
shell: "bash"
2254-
script: |
2255-
${PREPARE_SHELL}
2256-
2257-
# Find the crypt_shared library file in the current directory and set the CRYPT_SHARED_LIB_PATH to
2258-
# the path of that file. Only look for .so, .dll, or .dylib files to prevent matching any other
2259-
# downloaded files.
2260-
CRYPT_SHARED_LIB_PATH="$(find $(pwd) -maxdepth 1 -type f \
2261-
-name 'mongo_crypt_v1.so' -o \
2262-
-name 'mongo_crypt_v1.dll' -o \
2263-
-name 'mongo_crypt_v1.dylib')"
2264-
2265-
# If we're on Windows, convert the "cygdrive" path to Windows-style paths.
2266-
if [ "Windows_NT" = "$OS" ]; then
2267-
CRYPT_SHARED_LIB_PATH=$(cygpath -m $CRYPT_SHARED_LIB_PATH)
2268-
fi
2269-
2270-
echo "CRYPT_SHARED_LIB_PATH: $CRYPT_SHARED_LIB_PATH" >> crypt-expansion.yml
2271-
2272-
# Load the expansion file to make an evergreen variable with the current unique version
2273-
- command: expansions.update
2274-
params:
2275-
file: crypt-expansion.yml
2276-
2277-
teardown_group:
2278-
- command: shell.exec
2279-
params:
2280-
shell: "bash"
2281-
script: |
2282-
${PREPARE_SHELL}
2283-
bash ${DRIVERS_TOOLS}/.evergreen/serverless/delete-instance.sh ${VAULT_NAME}
2284-
- func: handle-test-artifacts
2285-
- func: cleanup
2286-
tasks:
2287-
- ".serverless"
2288-
22892217
- name: testgcpkms_task_group
22902218
setup_group_can_fail_task: true
22912219
setup_group_timeout_secs: 1800 # 30 minutes
@@ -2294,9 +2222,11 @@ task_groups:
22942222
- func: prepare-resources
22952223
- func: fix-absolute-paths
22962224
- func: make-files-executable
2225+
- func: assume-test-secrets-ec2-role
22972226
- command: shell.exec
22982227
params:
22992228
shell: "bash"
2229+
add_expansions_to_env: true
23002230
script: |
23012231
${PREPARE_SHELL}
23022232
$DRIVERS_TOOLS/.evergreen/csfle/gcpkms/setup.sh
@@ -2321,9 +2251,11 @@ task_groups:
23212251
- func: prepare-resources
23222252
- func: fix-absolute-paths
23232253
- func: make-files-executable
2254+
- func: assume-test-secrets-ec2-role
23242255
- command: shell.exec
23252256
params:
23262257
shell: "bash"
2258+
add_expansions_to_env: true
23272259
script: |
23282260
${PREPARE_SHELL}
23292261
export AZUREKMS_VMNAME_PREFIX="GODRIVER"
@@ -2375,9 +2307,11 @@ task_groups:
23752307
- func: prepare-resources
23762308
- func: fix-absolute-paths
23772309
- func: make-files-executable
2310+
- func: assume-test-secrets-ec2-role
23782311
- command: subprocess.exec
23792312
params:
23802313
binary: bash
2314+
add_expansions_to_env: true
23812315
env:
23822316
AZUREOIDC_VMNAME_PREFIX: "GO_DRIVER"
23832317
args:
@@ -2399,9 +2333,11 @@ task_groups:
23992333
- func: prepare-resources
24002334
- func: fix-absolute-paths
24012335
- func: make-files-executable
2336+
- func: assume-test-secrets-ec2-role
24022337
- command: subprocess.exec
24032338
params:
24042339
binary: bash
2340+
add_expansions_to_env: true
24052341
env:
24062342
AZUREOIDC_VMNAME_PREFIX: "GO_DRIVER"
24072343
args:
@@ -2421,10 +2357,12 @@ task_groups:
24212357
setup_group:
24222358
- func: fetch-source
24232359
- func: prepare-resources
2360+
- func: assume-test-secrets-ec2-role
24242361
- command: subprocess.exec
24252362
params:
24262363
working_dir: src/go.mongodb.org/mongo-driver
24272364
binary: bash
2365+
add_expansions_to_env: true
24282366
env:
24292367
LAMBDA_STACK_NAME: dbx-go-lambda
24302368
AWS_REGION: us-east-1
@@ -2706,13 +2644,6 @@ buildvariants:
27062644
tasks:
27072645
- name: ".load-balancer"
27082646

2709-
- matrix_name: "serverless"
2710-
tags: ["pullrequest"]
2711-
matrix_spec: { os-serverless: "*" }
2712-
display_name: "Serverless ${os-serverless}"
2713-
tasks:
2714-
- "serverless_task_group"
2715-
27162647
- matrix_name: "kms-kmip-test"
27172648
matrix_spec: { version: ["7.0"], os-ssl-40: ["rhel87-64"] }
27182649
display_name: "KMS KMIP ${os-ssl-40}"

‎Makefile

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -170,30 +170,6 @@ evg-test-search-index:
170170
evg-test-ocsp:
171171
go test -v ./mongo -run TestOCSP $(OCSP_TLS_SHOULD_SUCCEED) >> test.suite
172172

173-
.PHONY: evg-test-serverless
174-
evg-test-serverless:
175-
# Serverless should be tested with all unified tests as well as tests in the following components: CRUD, load balancer,
176-
# retryable reads, retryable writes, sessions, transactions and cursor behavior.
177-
go test $(BUILD_TAGS) ./mongo/integration -run TestCrudSpec -v -timeout $(TEST_TIMEOUT)s >> test.suite
178-
go test $(BUILD_TAGS) ./mongo/integration -run TestWriteErrorsWithLabels -v -timeout $(TEST_TIMEOUT)s >> test.suite
179-
go test $(BUILD_TAGS) ./mongo/integration -run TestWriteErrorsDetails -v -timeout $(TEST_TIMEOUT)s >> test.suite
180-
go test $(BUILD_TAGS) ./mongo/integration -run TestHintErrors -v -timeout $(TEST_TIMEOUT)s >> test.suite
181-
go test $(BUILD_TAGS) ./mongo/integration -run TestWriteConcernError -v -timeout $(TEST_TIMEOUT)s >> test.suite
182-
go test $(BUILD_TAGS) ./mongo/integration -run TestErrorsCodeNamePropagated -v -timeout $(TEST_TIMEOUT)s >> test.suite
183-
go test $(BUILD_TAGS) ./mongo/integration -run TestLoadBalancerSupport -v -timeout $(TEST_TIMEOUT)s >> test.suite
184-
go test $(BUILD_TAGS) ./mongo/integration -run TestUnifiedSpecs/retryable-reads -v -timeout $(TEST_TIMEOUT)s >> test.suite
185-
go test $(BUILD_TAGS) ./mongo/integration -run TestRetryableReadsProse -v -timeout $(TEST_TIMEOUT)s >> test.suite
186-
go test $(BUILD_TAGS) ./mongo/integration -run TestRetryableWritesSpec -v -timeout $(TEST_TIMEOUT)s >> test.suite
187-
go test $(BUILD_TAGS) ./mongo/integration -run TestRetryableWritesProse -v -timeout $(TEST_TIMEOUT)s >> test.suite
188-
go test $(BUILD_TAGS) ./mongo/integration -run TestUnifiedSpecs/sessions -v -timeout $(TEST_TIMEOUT)s >> test.suite
189-
go test $(BUILD_TAGS) ./mongo/integration -run TestSessionsProse -v -timeout $(TEST_TIMEOUT)s >> test.suite
190-
go test $(BUILD_TAGS) ./mongo/integration -run TestUnifiedSpecs/transactions/legacy -v -timeout $(TEST_TIMEOUT)s >> test.suite
191-
go test $(BUILD_TAGS) ./mongo/integration -run TestConvenientTransactions -v -timeout $(TEST_TIMEOUT)s >> test.suite
192-
go test $(BUILD_TAGS) ./mongo/integration -run TestCursor -v -timeout $(TEST_TIMEOUT)s >> test.suite
193-
go test $(BUILD_TAGS) ./mongo/integration/unified -run TestUnifiedSpec -v -timeout $(TEST_TIMEOUT)s >> test.suite
194-
go test -exec "env PKG_CONFIG_PATH=$(PKG_CONFIG_PATH) LD_LIBRARY_PATH=$(LD_LIBRARY_PATH) DYLD_LIBRARY_PATH=$(MACOS_LIBRARY_PATH)" $(BUILD_TAGS) -v -timeout $(TEST_TIMEOUT)s ./mongo/integration -run TestClientSideEncryptionSpec >> test.suite
195-
go test -exec "env PKG_CONFIG_PATH=$(PKG_CONFIG_PATH) LD_LIBRARY_PATH=$(LD_LIBRARY_PATH) DYLD_LIBRARY_PATH=$(MACOS_LIBRARY_PATH)" $(BUILD_TAGS) -v -timeout $(TEST_TIMEOUT)s ./mongo/integration -run TestClientSideEncryptionProse >> test.suite
196-
197173
.PHONY: evg-test-versioned-api
198174
evg-test-versioned-api:
199175
# Versioned API related tests are in the mongo, integration and unified packages.

‎etc/run-awskms-test.sh

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,17 +4,21 @@
44

55
echo "Building build-kms-test ... begin"
66
BUILD_TAGS="-tags=cse" \
7-
PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
8-
make build-kms-test
7+
PKG_CONFIG_PATH=$PKG_CONFIG_PATH \
8+
make build-kms-test
99
echo "Building build-kms-test ... end"
1010

1111
. ${DRIVERS_TOOLS}/.evergreen/secrets_handling/setup-secrets.sh drivers/atlas_connect
1212
export MONGODB_URI="$ATLAS_FREE"
1313

1414
if [ -z "${EXPECT_ERROR:-}" ]; then
15-
. ${DRIVERS_TOOLS}/.evergreen/csfle/setup-secrets.sh
16-
export AWS_SECRET_ACCESS_KEY=$FLE_AWS_SECRET_ACCESS_KEY
17-
export AWS_ACCESS_KEY_ID=$FLE_AWS_ACCESS_KEY_ID
15+
. ${DRIVERS_TOOLS}/.evergreen/csfle/setup-secrets.sh
16+
export AWS_SECRET_ACCESS_KEY=$FLE_AWS_SECRET_ACCESS_KEY
17+
export AWS_ACCESS_KEY_ID=$FLE_AWS_ACCESS_KEY_ID
1818
fi
1919

20+
# AWS_SESSION_TOKEN is required to get credentials from the drivers/csfle vault
21+
# but interferes with the testkms binary causing UnrecognizedClientException.
22+
unset AWS_SESSION_TOKEN
23+
2024
LD_LIBRARY_PATH=./install/libmongocrypt/lib64 PROVIDER='aws' ./testkms

0 commit comments

Comments
 (0)