Skip to content

Commit

Permalink
feat: add MONGODB-AWS as a supported auth mechanism
Browse files Browse the repository at this point in the history
  • Loading branch information
mbroadst committed Feb 26, 2020
1 parent b98a00a commit 7f3cfba
Show file tree
Hide file tree
Showing 13 changed files with 840 additions and 19 deletions.
197 changes: 194 additions & 3 deletions .evergreen/config.yml
Original file line number Diff line number Diff line change
Expand Up @@ -66,17 +66,20 @@ functions:
# If this was a patch build, doing a fresh clone would not actually test the patch
cp -R ${PROJECT_DIRECTORY}/ $DRIVERS_TOOLS
else
git clone git://github.com/mongodb-labs/drivers-evergreen-tools.git $DRIVERS_TOOLS
# git clone git://github.com/mongodb-labs/drivers-evergreen-tools.git $DRIVERS_TOOLS
git clone git://github.com/bazile-clyde/drivers-evergreen-tools.git $DRIVERS_TOOLS
fi
echo "{ \"releases\": { \"default\": \"$MONGODB_BINARIES\" }}" >
$MONGO_ORCHESTRATION_HOME/orchestration.config
bootstrap mongo-orchestration:
- command: shell.exec
params:
script: |
script: >
${PREPARE_SHELL}
MONGODB_VERSION=${VERSION} TOPOLOGY=${TOPOLOGY} bash ${DRIVERS_TOOLS}/.evergreen/run-orchestration.sh
MONGODB_VERSION=${VERSION} TOPOLOGY=${TOPOLOGY} ORCHESTRATION_FILE=${ORCHESTRATION_FILE} bash
${DRIVERS_TOOLS}/.evergreen/run-orchestration.sh
- command: expansions.update
params:
file: mo-expansion.yml
Expand Down Expand Up @@ -154,6 +157,172 @@ functions:
NODE_LTS_NAME='${NODE_LTS_NAME}' ATLAS_REPL='${atlas_repl}' ATLAS_SHRD='${atlas_shrd}'
ATLAS_FREE='${atlas_free}' ATLAS_TLS11='${atlas_tls11}' ATLAS_TLS12='${atlas_tls12}' bash
${PROJECT_DIRECTORY}/.evergreen/run-atlas-tests.sh
add aws auth variables to file:
- command: shell.exec
type: test
params:
working_dir: src
silent: true
script: |
cat <<EOF > ${DRIVERS_TOOLS}/.evergreen/auth_aws/aws_e2e_setup.json
{
"iam_auth_ecs_account" : "${iam_auth_ecs_account}",
"iam_auth_ecs_secret_access_key" : "${iam_auth_ecs_secret_access_key}",
"iam_auth_ecs_account_arn": "arn:aws:iam::557821124784:user/authtest_fargate_user",
"iam_auth_ecs_cluster": "${iam_auth_ecs_cluster}",
"iam_auth_ecs_task_definition": "${iam_auth_ecs_task_definition}",
"iam_auth_ecs_subnet_a": "${iam_auth_ecs_subnet_a}",
"iam_auth_ecs_subnet_b": "${iam_auth_ecs_subnet_b}",
"iam_auth_ecs_security_group": "${iam_auth_ecs_security_group}",
"iam_auth_assume_aws_account" : "${iam_auth_assume_aws_account}",
"iam_auth_assume_aws_secret_access_key" : "${iam_auth_assume_aws_secret_access_key}",
"iam_auth_assume_role_name" : "${iam_auth_assume_role_name}",
"iam_auth_ec2_instance_account" : "${iam_auth_ec2_instance_account}",
"iam_auth_ec2_instance_secret_access_key" : "${iam_auth_ec2_instance_secret_access_key}",
"iam_auth_ec2_instance_profile" : "${iam_auth_ec2_instance_profile}"
}
EOF
run aws auth test with regular aws credentials:
- command: shell.exec
type: test
params:
working_dir: src
script: |
${PREPARE_SHELL}
cd ${DRIVERS_TOOLS}/.evergreen/auth_aws
${MONGODB_BINARIES}/mongo aws_e2e_regular_aws.js
- command: shell.exec
type: test
params:
working_dir: src
silent: true
script: |
cat <<'EOF' > "${PROJECT_DIRECTORY}/prepare_mongodb_aws.sh"
alias urlencode='python -c "import sys, urllib as ul; print ul.quote_plus(sys.argv[1])"'
USER=$(urlencode ${iam_auth_ecs_account})
PASS=$(urlencode ${iam_auth_ecs_secret_access_key})
export MONGODB_URI="mongodb://$USER:$PASS@localhost:27017/aws?authMechanism=MONGODB-AWS"
EOF
- command: shell.exec
type: test
params:
working_dir: src
script: |
${PREPARE_SHELL}
${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-test.sh
run aws auth test with assume role credentials:
- command: shell.exec
type: test
params:
working_dir: src
script: |
${PREPARE_SHELL}
cd ${DRIVERS_TOOLS}/.evergreen/auth_aws
${MONGODB_BINARIES}/mongo aws_e2e_assume_role.js
- command: shell.exec
type: test
params:
working_dir: src
silent: true
script: |
cat <<'EOF' > "${PROJECT_DIRECTORY}/prepare_mongodb_aws.sh"
alias urlencode='python -c "import sys, urllib as ul; print ul.quote_plus(sys.argv[1])"'
USER=$(jq -r '.AccessKeyId' ${DRIVERS_TOOLS}/.evergreen/auth_aws/creds.json)
USER=$(urlencode $USER)
PASS=$(jq -r '.SecretAccessKey' ${DRIVERS_TOOLS}/.evergreen/auth_aws/creds.json)
PASS=$(urlencode $PASS)
SESSION_TOKEN=$(jq -r '.SessionToken' ${DRIVERS_TOOLS}/.evergreen/auth_aws/creds.json)
SESSION_TOKEN=$(urlencode $SESSION_TOKEN)
export MONGODB_URI="mongodb://$USER:$PASS@localhost:27017/aws?authMechanism=MONGODB-AWS&authMechanismProperties=AWS_SESSION_TOKEN:$SESSION_TOKEN"
EOF
- command: shell.exec
type: test
params:
working_dir: src
script: |
${PREPARE_SHELL}
${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-test.sh
run aws auth test with aws EC2 credentials:
- command: shell.exec
type: test
params:
working_dir: src
script: |
${PREPARE_SHELL}
cd ${DRIVERS_TOOLS}/.evergreen/auth_aws
${MONGODB_BINARIES}/mongo aws_e2e_ec2.js
- command: shell.exec
type: test
params:
working_dir: src
script: |
${PREPARE_SHELL}
${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-test.sh
run aws auth test with aws credentials as environment variables:
- command: shell.exec
type: test
params:
working_dir: src
silent: true
script: |
cat <<EOF > "${PROJECT_DIRECTORY}/prepare_mongodb_aws.sh"
export AWS_ACCESS_KEY_ID=${iam_auth_ecs_account}
export AWS_SECRET_ACCESS_KEY=${iam_auth_ecs_secret_access_key}
export MONGODB_URI="mongodb://localhost:27017/aws?authMechanism=MONGODB-AWS"
EOF
- command: shell.exec
type: test
params:
working_dir: src
script: |
${PREPARE_SHELL}
${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-test.sh
run aws auth test with aws credentials and session token as environment variables:
- command: shell.exec
type: test
params:
working_dir: src
silent: true
script: |
cat <<'EOF' > "${PROJECT_DIRECTORY}/prepare_mongodb_aws.sh"
export AWS_ACCESS_KEY_ID=$(jq -r '.AccessKeyId' ${DRIVERS_TOOLS}/.evergreen/auth_aws/creds.json)
export AWS_SECRET_ACCESS_KEY=$(jq -r '.SecretAccessKey' ${DRIVERS_TOOLS}/.evergreen/auth_aws/creds.json)
export AWS_SESSION_TOKEN=$(jq -r '.SessionToken' ${DRIVERS_TOOLS}/.evergreen/auth_aws/creds.json)
export MONGODB_URI="mongodb://localhost:27017/aws?authMechanism=MONGODB-AWS"
EOF
- command: shell.exec
type: test
params:
working_dir: src
script: |
${PREPARE_SHELL}
${PROJECT_DIRECTORY}/.evergreen/run-mongodb-aws-test.sh
run aws ECS auth test:
- command: shell.exec
type: test
params:
working_dir: src
script: |
${PREPARE_SHELL}
AUTH_AWS_DIR=${DRIVERS_TOOLS}/.evergreen/auth_aws
ECS_SRC_DIR=$AUTH_AWS_DIR/src
# fix issue with `TestData` in SERVER-46340
sed -i '1s+^+TestData = {};\n+' $AUTH_AWS_DIR/lib/ecs_hosted_test.js
# pack up project directory to ssh it to the container
mkdir -p $ECS_SRC_DIR/.evergreen
cp $PROJECT_DIRECTORY/.evergreen/run-mongodb-aws-ecs-test.sh $ECS_SRC_DIR/.evergreen
tar -czf $ECS_SRC_DIR/src.tgz -C $PROJECT_DIRECTORY .
cd $AUTH_AWS_DIR
cat <<EOF > setup.js
const mongo_binaries = "$MONGODB_BINARIES";
const project_dir = "$ECS_SRC_DIR";
EOF
cat setup.js
mongo --nodb setup.js aws_e2e_ecs.js
pre:
- func: fetch source
- func: prepare resources
Expand Down Expand Up @@ -746,6 +915,21 @@ tasks:
- func: run atlas tests
vars:
VERSION: latest
- name: aws-auth-test
commands:
- func: install dependencies
- func: bootstrap mongo-orchestration
vars:
AUTH: auth
ORCHESTRATION_FILE: auth-aws.json
TOPOLOGY: server
- func: add aws auth variables to file
- func: run aws auth test with regular aws credentials
- func: run aws auth test with assume role credentials
- func: run aws auth test with aws EC2 credentials
- func: run aws auth test with aws credentials as environment variables
- func: run aws auth test with aws credentials and session token as environment variables
- func: run aws ECS auth test
buildvariants:
- name: debian71-test-boron
display_name: Debian 7.1 Node Boron
Expand Down Expand Up @@ -1191,3 +1375,10 @@ buildvariants:
expansions:
NODE_LTS_NAME: argon
tasks: *ref_5
- name: ubuntu1804-test-mongodb-aws
display_name: MONGODB-AWS Auth test
run_on: ubuntu1804-test
expansions:
NODE_LTS_NAME: carbon
tasks:
- aws-auth-test
Loading

0 comments on commit 7f3cfba

Please sign in to comment.