From f6323f65734975a1b9747ea7e9fa87eeaf219d1f Mon Sep 17 00:00:00 2001 From: Noah Stapp Date: Thu, 3 Aug 2023 13:29:12 -0700 Subject: [PATCH 01/17] DRIVERS-2585 Use AWS Secrets Manager for AWS-Related Test Secrets --- .evergreen/config.yml | 23 ++++++++++++++++ .evergreen/run-mongodb-oidc-test.sh | 12 ++++----- tox.ini | 42 ++++++++++++++++++++++++++--- 3 files changed, 68 insertions(+), 9 deletions(-) diff --git a/.evergreen/config.yml b/.evergreen/config.yml index 5447439ca8..fdbbdfed80 100644 --- a/.evergreen/config.yml +++ b/.evergreen/config.yml @@ -792,6 +792,29 @@ functions: python oidc_write_orchestration.py python oidc_get_tokens.py + "bootstrap aws-secrets": + - command: ec2.assume_role + params: + role_arn: ${aws_test_secrets_role} + - command: shell.exec + type: test + params: + shell: bash + script: | + ${PREPARE_SHELL} + if [ "${skip_EC2_auth_test}" = "true" ]; then + echo "This platform does not support aws secrets, skipping..." + exit 0 + fi + + cd ${DRIVERS_TOOLS}/.evergreen/auth_aws + python setup_secrets.py + + - command: expansions.update + params: + file: secrets-expansion.yml + + "run oidc auth test with aws credentials": - command: shell.exec type: test diff --git a/.evergreen/run-mongodb-oidc-test.sh b/.evergreen/run-mongodb-oidc-test.sh index 46bb779578..48055b32bd 100755 --- a/.evergreen/run-mongodb-oidc-test.sh +++ b/.evergreen/run-mongodb-oidc-test.sh @@ -15,7 +15,7 @@ set -o errexit # Exit the script with error if any of the commands fail echo "Running MONGODB-OIDC authentication tests" # ensure no secrets are printed in log files -set +x +#set +x # load the script shopt -s expand_aliases # needed for `urlencode` alias @@ -49,11 +49,11 @@ fi set -x # Workaround macOS python 3.9 incompatibility with system virtualenv. -if [ "$(uname -s)" = "Darwin" ]; then - VIRTUALENV="/Library/Frameworks/Python.framework/Versions/3.9/bin/python3 -m virtualenv" -else +#if [ "$(uname -s)" = "Darwin" ]; then +# VIRTUALENV="/Library/Frameworks/Python.framework/Versions/3.9/bin/python3 -m virtualenv" +#else VIRTUALENV=$(command -v virtualenv) -fi +#fi authtest () { if [ "Windows_NT" = "$OS" ]; then @@ -71,7 +71,7 @@ authtest () { fi python -m pip install -U pip setuptools python -m pip install '.[aws]' - python test/auth_aws/test_auth_oidc.py -v + pytest -v test/auth_aws/test_auth_oidc.py deactivate rm -rf venvoidc } diff --git a/tox.ini b/tox.ini index c268fd1f4c..03fb59e434 100644 --- a/tox.ini +++ b/tox.ini @@ -144,12 +144,17 @@ commands = sphinx-build -E -b linkcheck doc ./doc/_build/linkcheck [testenv:test-atlas] -description = run atlas connection tests deps = - {[testenv:test]deps} + PyYAML + boto3 + pytest>=7 passenv = * +allowlist_externals = + bash commands = - python -m pytest -v {posargs} ./test/atlas/test_connection.py + bash -c 'git -C drivers-evergreen-tools pull origin DRIVERS-2585 || git clone -b DRIVERS-2585 https://github.com/NoahStapp/drivers-evergreen-tools.git' + python ./drivers-evergreen-tools/.evergreen/auth_aws/setup_secrets.py drivers/test + bash -c 'source ./secrets-export.sh; python -m pytest -v {posargs} ./test/atlas/test_connection.py' [testenv:test-mockupdb] description = run mockupdb tests @@ -159,3 +164,34 @@ deps = passenv = * commands = python -m pytest -v {posargs} ./test/mockupdb + +[testenv:test-aws-secrets] +deps = + PyYAML + boto3 + pyjwkest + pyop~=3.4.0 + azure-identity + azure-keyvault-secrets + pytest +passenv = * +setenv = + OIDC_TOKEN_DIR=/tmp/tokens + PYTHON_BINARY=python + MONGODB_URI=mongodb+srv://oidc-rapid.oztdp.mongodb-dev.net + MONGODB_URI_SINGLE="mongodb+srv://oidc-rapid.oztdp.mongodb-dev.net/?authMechanism=MONGODB-OIDC" + MONGODB_URI_MULTIPLE="mongodb+srv://oidc-rapid.oztdp.mongodb-dev.net:27018/?authMechanism=MONGODB-OIDC&directConnection=true" +allowlist_externals = + bash + source + echo +commands = +; git clone -b DRIVERS-2585 https://github.com/NoahStapp/drivers-evergreen-tools.git + python ./drivers-evergreen-tools/.evergreen/auth_aws/setup_secrets.py drivers/test + bash ./secrets-export.sh + + bash ./drivers-evergreen-tools/.evergreen/auth_oidc/activate-authoidcvenv.sh + python ./drivers-evergreen-tools/.evergreen/auth_oidc/oidc_write_orchestration.py + python ./drivers-evergreen-tools/.evergreen/auth_oidc/oidc_get_tokens.py + + bash .evergreen/run-mongodb-oidc-test.sh From c3069fea8318ee119593e84645fe59756bc122fd Mon Sep 17 00:00:00 2001 From: Noah Stapp Date: Thu, 3 Aug 2023 14:04:16 -0700 Subject: [PATCH 02/17] Test on EG with atlas-tests Test again Use correct DET Use tox properly Correct utils.sh path debug prepare shell Use correct working dir --- .evergreen/config.yml | 39 ++++++--------------------------------- tox.ini | 14 ++++++++++---- 2 files changed, 16 insertions(+), 37 deletions(-) diff --git a/.evergreen/config.yml b/.evergreen/config.yml index fdbbdfed80..181fd1ba6e 100644 --- a/.evergreen/config.yml +++ b/.evergreen/config.yml @@ -98,7 +98,7 @@ functions: # If this was a patch build, doing a fresh clone would not actually test the patch cp -R ${PROJECT_DIRECTORY}/ $DRIVERS_TOOLS else - git clone https://github.com/mongodb-labs/drivers-evergreen-tools.git $DRIVERS_TOOLS + git clone -b DRIVERS-2585 https://github.com/NoahStapp/drivers-evergreen-tools.git $DRIVERS_TOOLS fi echo "{ \"releases\": { \"default\": \"$MONGODB_BINARIES\" }}" > $MONGO_ORCHESTRATION_HOME/orchestration.config @@ -534,40 +534,18 @@ functions: PYTHON_BINARY=${PYTHON_BINARY} PROJECT_DIRECTORY=${PROJECT_DIRECTORY} bash ${PROJECT_DIRECTORY}/.evergreen/run-enterprise-auth-tests.sh "run atlas tests": - - command: shell.exec - type: test - params: - silent: true - working_dir: "src" - script: | - cat < prepare_atlas_connectivity.sh - export ATLAS_FREE='${atlas_free}' - export ATLAS_REPL='${atlas_repl}' - export ATLAS_SHRD='${atlas_shrd}' - export ATLAS_TLS11='${atlas_tls11}' - export ATLAS_TLS12='${atlas_tls12}' - export ATLAS_SERVERLESS='${atlas_serverless}' - export ATLAS_SRV_FREE='${atlas_srv_free}' - export ATLAS_SRV_REPL='${atlas_srv_repl}' - export ATLAS_SRV_SHRD='${atlas_srv_shrd}' - export ATLAS_SRV_TLS11='${atlas_srv_tls11}' - export ATLAS_SRV_TLS12='${atlas_srv_tls12}' - export ATLAS_SRV_SERVERLESS='${atlas_srv_serverless}' - EOT - command: shell.exec type: test params: working_dir: "src" script: | + ${PREPARE_SHELL} # Disable xtrace for security reasons (just in case it was accidentally set). set +x - . ./prepare_atlas_connectivity.sh - rm -f ./prepare_atlas_connectivity.sh - set -o errexit set -o xtrace - ${PYTHON_BINARY} -m tox -m test-atlas + bash ${PROJECT_DIRECTORY}/.evergreen/tox.sh ${PYTHON_BINARY} -m test-atlas "add aws auth variables to file": - command: shell.exec @@ -799,22 +777,16 @@ functions: - command: shell.exec type: test params: + working_dir: "src" shell: bash script: | ${PREPARE_SHELL} - if [ "${skip_EC2_auth_test}" = "true" ]; then - echo "This platform does not support aws secrets, skipping..." - exit 0 - fi - - cd ${DRIVERS_TOOLS}/.evergreen/auth_aws - python setup_secrets.py + bash ${PROJECT_DIRECTORY}/.evergreen/tox.sh ${PYTHON_BINARY} -m aws-secrets - command: expansions.update params: file: secrets-expansion.yml - "run oidc auth test with aws credentials": - command: shell.exec type: test @@ -1739,6 +1711,7 @@ tasks: - name: "atlas-connect" tags: ["atlas-connect"] commands: + - func: "bootstrap aws-secrets" - func: "run atlas tests" - name: atlas-data-lake-tests diff --git a/tox.ini b/tox.ini index 03fb59e434..2999a9a9f9 100644 --- a/tox.ini +++ b/tox.ini @@ -145,15 +145,11 @@ commands = [testenv:test-atlas] deps = - PyYAML - boto3 pytest>=7 passenv = * allowlist_externals = bash commands = - bash -c 'git -C drivers-evergreen-tools pull origin DRIVERS-2585 || git clone -b DRIVERS-2585 https://github.com/NoahStapp/drivers-evergreen-tools.git' - python ./drivers-evergreen-tools/.evergreen/auth_aws/setup_secrets.py drivers/test bash -c 'source ./secrets-export.sh; python -m pytest -v {posargs} ./test/atlas/test_connection.py' [testenv:test-mockupdb] @@ -165,6 +161,16 @@ passenv = * commands = python -m pytest -v {posargs} ./test/mockupdb +[testenv:aws-secrets] +deps = + PyYAML + boto3 +passenv = * +allowlist_externals = + bash +commands = + python {env:DRIVERS_TOOLS}/.evergreen/auth_aws/setup_secrets.py drivers/test + [testenv:test-aws-secrets] deps = PyYAML From e2286cc8ea76283769ae38b92dc54bf0437abb8e Mon Sep 17 00:00:00 2001 From: Noah Stapp Date: Thu, 3 Aug 2023 14:56:42 -0700 Subject: [PATCH 03/17] Add aws-secrets label --- tox.ini | 1 + 1 file changed, 1 insertion(+) diff --git a/tox.ini b/tox.ini index 2999a9a9f9..1a8bef81a2 100644 --- a/tox.ini +++ b/tox.ini @@ -40,6 +40,7 @@ labels = # Use labels and -m instead of -e so that tox -m