CLOUDP-314916: OIDC e2e test single cluster

[anandsyncs]

Summary

Test File Summary

• replica_set_oidc_m2m_user.py

  • Tests OIDC machine-to-machine (M2M) user authentication for a replica set.
  • Verifies user creation, role updates, access restrictions, and negative authentication scenarios.

• replica_set_oidc_m2m_group.py

  • Tests OIDC group-based (Workload Identity Federation) authentication in a replica set.
  • Covers creation, OIDC provider/role updates, and removal of OIDC configs and roles.

• replica_set_oidc_workforce.py

  • Tests OIDC workforce (human identity) authentication in a replica set.
  • Validates user creation and correct automation config for multiple OIDC providers.

• sharded_cluster_oidc_m2m_group.py

  • Tests OIDC group-based authentication in a sharded cluster.
  • Verifies creation, connectivity, provider/role updates, and automation config state.

• sharded_cluster_oidc_m2m_user.py

  • Tests OIDC machine-to-machine user authentication in a sharded cluster, including user creation, role assignment, and
    access restrictions.
  • Verifies correct OIDC provider configuration, user propagation, and negative authentication scenarios.

Additional PR Changes

• OIDC Callback Integration:
  Introduced a custom OIDC callback handler utilizing AWS Cognito for token acquisition, allowing automated OIDC authentication in E2E tests.

• Automation Config Tester Improvements:
  Enhanced assertion helpers to validate OIDC-specific state in the Ops Manager automation config, including provider counts, configuration details, and user propagation.

• New OIDC Fixture Files:
  Added YAML resource definitions for OIDC-enabled replica sets, sharded clusters, and MongoDB users, supporting a wide range of authentication and authorization test cases.

• Core Controller and Logic Adjustments:
  Minor changes in Go controller code to ensure robust handling of OIDC provider configs and roles, and to support expanded test coverage.

AWS Setup:

The project uses AWS Cognito in the mongodb-mms-testing AWS account to facilitate OIDC authentication testing. This setup includes:

• User Pool: A user pool in Cognito manages the identities.
• Users: We use the user credentials to do authentication.
• App Client: An app client is configured for machine-to-machine (M2M) authentication.
• Groups: Cognito groups are used to manage users from the user pool for GroupMembership access.

Environment variables and secrets required for these tests (like client IDs, URLs, and user IDs, as seen in the Python code) are stored in Evergreen and fetched from there during test execution.

Link to the session where I explained the AWS setup for OIDC

Proof of Work

Added tests are passing.

Checklist

• Have you linked a jira ticket and/or is the ticket in the title?
• Have you checked whether your jira ticket required DOCSP changes?
• Have you checked for release_note changes?

Reminder (Please remove this when merging)

• Please try to Approve or Reject Changes the PR, keep PRs in review as short as possible
• Our Short Guide for PRs: Link
• Remember the following Communication Standards - use comment prefixes for clarity:
  • blocking: Must be addressed before approval.
  • follow-up: Can be addressed in a later PR or ticket.
  • q: Clarifying question.
  • nit: Non-blocking suggestions.
  • note: Side-note, non-actionable. Example: Praise
  • --> no prefix is considered a question

[anandsyncs]

evergreen patch

[anandsyncs]

evergreen patch

[mircea-cosbuc]

LGTM

[anandsyncs]

evergreen patch

[Copilot]

Pull Request Overview

This PR adds comprehensive end-to-end tests and supporting code to validate OIDC authentication flows (M2M user, group, and workforce) against single-cluster MongoDB deployments (replica sets and sharded clusters).

• Introduces new Python E2E test scripts for OIDC M2M user, M2M group, and workforce identity scenarios.
• Implements a custom OIDC callback handler and extends kubetester helpers to assert OIDC state in the automation config.
• Adds YAML fixtures for OIDC-enabled clusters and updates CI (Evergreen) tasks and environment variable expansions.

Reviewed Changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
docker/mongodb-kubernetes-tests/tests/authentication/sharded_cluster_oidc_m2m_user.py	E2E tests for M2M user OIDC on a sharded cluster
docker/mongodb-kubernetes-tests/tests/authentication/sharded_cluster_oidc_m2m_group.py	E2E tests for M2M group OIDC on a sharded cluster
docker/mongodb-kubernetes-tests/tests/authentication/replica_set_oidc_workforce.py	E2E tests for workforce (human) OIDC on a replica set
docker/mongodb-kubernetes-tests/tests/authentication/replica_set_oidc_m2m_user.py	E2E tests for M2M user OIDC on a replica set
docker/mongodb-kubernetes-tests/tests/authentication/replica_set_oidc_m2m_group.py	E2E tests for M2M group OIDC on a replica set
docker/mongodb-kubernetes-tests/tests/authentication/fixtures/oidc/sharded-cluster-replica-set.yaml	Fixture for sharded-cluster with OIDC M2M user & group
docker/mongodb-kubernetes-tests/tests/authentication/fixtures/oidc/sharded-cluster-m2m-user.yaml	Fixture for sharded-cluster OIDC M2M user
docker/mongodb-kubernetes-tests/tests/authentication/fixtures/oidc/replica-set.yaml	Fixture for replica set with OIDC group-based M2M
docker/mongodb-kubernetes-tests/tests/authentication/fixtures/oidc/replica-set-workforce.yaml	Fixture for replica set with workforce OIDC
docker/mongodb-kubernetes-tests/tests/authentication/fixtures/oidc/replica-set-m2m-user.yaml	Fixture for replica set OIDC M2M user
docker/mongodb-kubernetes-tests/tests/authentication/fixtures/oidc/oidc-user.yaml	Fixture for MongoDBUser resource used in OIDC tests
docker/mongodb-kubernetes-tests/kubetester/oidc.py	Helper functions to fetch AWS Cognito environment variables
docker/mongodb-kubernetes-tests/kubetester/mongotester.py	Adds MyOIDCCallback and assert_oidc_authentication(_fails)
docker/mongodb-kubernetes-tests/kubetester/mongodb.py	Adds CRUD helpers: get/set/append OIDC configs and roles
docker/mongodb-kubernetes-tests/kubetester/automation_config_tester.py	Adds assertions for OIDC provider count and configuration
controllers/operator/authentication/authentication.go	Minor formatting adjustment around agent authentication logic
controllers/om/deployment.go	Enhances GetRoles to handle dynamic JSON unmarshalling
.evergreen.yml	Registers new OIDC e2e test task groups
.evergreen-tasks.yml	Defines individual CI tasks for each OIDC e2e scenario
.evergreen-functions.yml	Exposes Cognito-related environment variables to Evergreen tasks

Comments suppressed due to low confidence (3)

docker/mongodb-kubernetes-tests/tests/authentication/sharded_cluster_oidc_m2m_group.py:32

• [nitpick] This class name duplicates TestCreateOIDCShardedCluster in sharded_cluster_oidc_m2m_user.py. Rename it (e.g., TestCreateOIDCShardedClusterGroup) to avoid test name collisions.

class TestCreateOIDCShardedCluster(KubernetesTester):

docker/mongodb-kubernetes-tests/tests/authentication/replica_set_oidc_workforce.py:44

• [nitpick] The class name is generic and matches other replica set tests. Consider renaming to TestCreateOIDCReplicaSetWorkforce to clearly reflect the workforce flow.

class TestCreateOIDCReplicaset(KubernetesTester):

docker/mongodb-kubernetes-tests/kubetester/mongotester.py:320

• The module uses time.sleep(5) but does not import the time module, leading to a NameError. Add import time at the top of the file.

time.sleep(5)