CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[QT-444] Use repo isolated AWS account for enos CI tests (#2727)

Browse Source 
* [QT-444] Use repo isolated AWS account for enos CI tests
This commit is contained in:
Mike Baum authored and GitHub committed 2023-02-16 17:07:30 -05:00
1 parent af1b8d2f02
commit e1d078fa9f
6 files changed
+28 -24
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/enos-run.yml
+8 -8
View File
@@ -66,10 +66,10 @@ jobs:
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_CI }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_CI }}
aws-region: us-east-1
role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
role-to-assume: ${{ secrets.AWS_ROLE_ARN_CI }}
role-skip-session-tagging: true
role-duration-seconds: 3600
- name: Set up Enos
@@ -79,7 +79,7 @@ jobs:
- name: Set up AWS SSH private key
run: |
mkdir -p ./enos/support
echo "${{ secrets.ENOS_CI_SSH_KEY }}" > ./enos/support/private_key.pem
echo "${{ secrets.SSH_KEY_PRIVATE_CI }}" > ./enos/support/private_key.pem
chmod 600 ./enos/support/private_key.pem
- name: Set up dependency cache
id: dep-cache
@@ -126,7 +126,7 @@ jobs:
# Use the same env vars from the following step
env:
ENOS_VAR_aws_region: us-east-1
ENOS_VAR_aws_ssh_keypair_name: enos-ci-ssh-key
ENOS_VAR_aws_ssh_keypair_name: ${{ github.event.repository.name }}-ci-ssh-key
ENOS_VAR_aws_ssh_private_key_path: ./support/private_key.pem
ENOS_VAR_local_boundary_dir: ./support/
ENOS_VAR_crt_bundle_path: ./support/boundary.zip
@@ -143,7 +143,7 @@ jobs:
continue-on-error: true
env:
ENOS_VAR_aws_region: us-east-1
ENOS_VAR_aws_ssh_keypair_name: enos-ci-ssh-key
ENOS_VAR_aws_ssh_keypair_name: ${{ github.event.repository.name }}-ci-ssh-key
ENOS_VAR_aws_ssh_private_key_path: ./support/private_key.pem
ENOS_VAR_local_boundary_dir: ./support/
ENOS_VAR_crt_bundle_path: ./support/boundary.zip
@@ -171,7 +171,7 @@ jobs:
if: steps.run.outcome == 'failure'
env:
ENOS_VAR_aws_region: us-east-1
ENOS_VAR_aws_ssh_keypair_name: enos-ci-ssh-key
ENOS_VAR_aws_ssh_keypair_name: ${{ github.event.repository.name }}-ci-ssh-key
ENOS_VAR_aws_ssh_private_key_path: ./support/private_key.pem
ENOS_VAR_local_boundary_dir: ./support/
ENOS_VAR_crt_bundle_path: ./support/boundary.zip
@@ -183,7 +183,7 @@ jobs:
- name: Destroy Enos scenario
env:
ENOS_VAR_aws_region: us-east-1
ENOS_VAR_aws_ssh_keypair_name: enos-ci-ssh-key
ENOS_VAR_aws_ssh_keypair_name: ${{ github.event.repository.name }}-ci-ssh-key
ENOS_VAR_aws_ssh_private_key_path: ./support/private_key.pem
ENOS_VAR_local_boundary_dir: ./support/
ENOS_VAR_crt_bundle_path: ./support/boundary.zip
.github/workflows/enos-ci-bootstrap-oss.yml → .github/workflows/test-ci-bootstrap-oss.yml
+5 -5
View File
@@ -1,4 +1,4 @@
name: enos-ci-bootstrap-oss
name: test-ci-bootstrap-oss
on:
pull_request:
@@ -6,13 +6,13 @@ on:
- main
paths:
- enos/ci/**
- .github/workflows/enos-ci-bootstrap-oss.yml
- .github/workflows/test-ci-bootstrap-oss.yml
push:
branches:
- main
paths:
- enos/ci/**
- .github/workflows/enos-ci-bootstrap-oss.yml
- .github/workflows/test-ci-bootstrap-oss.yml
jobs:
bootstrap-ci-oss:
@@ -28,12 +28,12 @@ jobs:
- name: Set up Terraform
uses: hashicorp/setup-terraform@v2
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1
uses: aws-actions/configure-aws-credentials@v1-node16
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_CI }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_CI }}
aws-region: us-east-1
role-to-assume: arn:aws:iam::271311691044:role/github_actions-boundary_ci
role-to-assume: ${{ secrets.AWS_ROLE_ARN_CI }}
role-skip-session-tagging: true
role-duration-seconds: 3600
- name: Init Terraform
.github/workflows/test-ci-cleanup-oss.yml
+2 -6
View File
@@ -10,6 +10,7 @@ jobs:
runs-on: ${{ fromJSON(vars.RUNNER) }}
outputs:
regions: ${{steps.setup.outputs.regions}}
account_id: ${{steps.setup.outputs.account_id}}
steps:
- name: Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v1-node16
@@ -25,10 +26,6 @@ jobs:
run: |
echo "regions=$(aws ec2 describe-regions --region us-east-1 --output json --query 'Regions[].RegionName' | tr -d '\n ')" >> $GITHUB_OUTPUT
echo "account_id=$(curl -s http://169.254.169.254/latest/dynamic/instance-identity/document | awk -F'"' '/"accountId"/ { print $4 }')" >> $GITHUB_OUTPUT
- name: Get account ID
id: setup_aws
run: |
echo "account_id=$(curl -s http://169.254.169.254/latest/dynamic/instance-identity/document | awk -F'"' '/"accountId"/ { print $4 }')" >> $GITHUB_OUTPUT
aws-nuke:
if: ${{ github.event.repository.name == 'boundary' }}
@@ -58,8 +55,7 @@ jobs:
- name: Configure
run: |
cp enos/ci/aws-nuke.yml .
echo "test: ${{ needs.setup.output.account_num }}"
sed -i "s/ACCOUNT_NUM/${{ needs.setup.output.account_num }}/g" aws-nuke.yml
sed -i "s/ACCOUNT_NUM/${{ needs.setup.outputs.account_id }}/g" aws-nuke.yml
sed -i "s/TIME_LIMIT/${TIME_LIMIT}/g" aws-nuke.yml
# We don't care if cleanup succeeds or fails, because dependencies be dependenceies,
# we'll fail on actually actionable things in the quota steep afterwards.