Skip to content

Commit 9ce0bcc

Browse files
durranaddaleax
durran
and
addaleax
authored
test(NODE-5038): setup OIDC CI environment (mongodb#3560)
Co-authored-by: Anna Henningsen <anna.henningsen@mongodb.com>
1 parent 71d0d79 commit 9ce0bcc

File tree

8 files changed

+199
-2
lines changed

8 files changed

+199
-2
lines changed

‎.evergreen/config.in.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,63 @@ functions:
9494
- .evergreen/run-kms-servers.sh
9595
env:
9696
DRIVERS_TOOLS: ${DRIVERS_TOOLS}
97+
98+
"bootstrap oidc":
99+
- command: ec2.assume_role
100+
params:
101+
role_arn: ${OIDC_AWS_ROLE_ARN}
102+
- command: shell.exec
103+
type: test
104+
params:
105+
working_dir: "src"
106+
shell: bash
107+
script: |
108+
${PREPARE_SHELL}
109+
110+
# TODO(NODE-5035): Remove when merged - need to replace with branch just for OIDC.
111+
rm -rf "${DRIVERS_TOOLS}"
112+
git clone --branch DRIVERS-2415 https://github.com/blink1073/drivers-evergreen-tools.git "${DRIVERS_TOOLS}"
113+
114+
cd "${DRIVERS_TOOLS}"/.evergreen/auth_oidc
115+
116+
# This is a bit confusing but the ec2.assume_role command before
117+
# this task will overwrite these variables to a different value
118+
# than we have set in our evergreen project config. As these are
119+
# now specific to the OIDC ARN, we re-export for the python
120+
# scripts.
121+
export AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
122+
export AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
123+
export AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}
124+
export AWS_TOKEN_DIR=/tmp/tokens
125+
126+
. ./activate_venv.sh
127+
python oidc_write_orchestration.py
128+
python oidc_get_tokens.py
129+
130+
"setup oidc roles":
131+
- command: subprocess.exec
132+
params:
133+
working_dir: src
134+
binary: bash
135+
args:
136+
- .evergreen/setup-oidc-roles.sh
137+
env:
138+
DRIVERS_TOOLS: ${DRIVERS_TOOLS}
139+
140+
"run oidc tests aws":
141+
- command: shell.exec
142+
type: test
143+
params:
144+
working_dir: "src"
145+
timeout_secs: 300
146+
shell: bash
147+
script: |
148+
${PREPARE_SHELL}
149+
150+
AWS_WEB_IDENTITY_TOKEN_FILE="/tmp/tokens/test1" \
151+
PROJECT_DIRECTORY="${PROJECT_DIRECTORY}" \
152+
bash ${PROJECT_DIRECTORY}/.evergreen/run-oidc-tests.sh
153+
97154
"run tests":
98155
- command: shell.exec
99156
type: test

‎.evergreen/config.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,59 @@ functions:
6868
- .evergreen/run-kms-servers.sh
6969
env:
7070
DRIVERS_TOOLS: ${DRIVERS_TOOLS}
71+
bootstrap oidc:
72+
- command: ec2.assume_role
73+
params:
74+
role_arn: ${OIDC_AWS_ROLE_ARN}
75+
- command: shell.exec
76+
type: test
77+
params:
78+
working_dir: src
79+
shell: bash
80+
script: |
81+
${PREPARE_SHELL}
82+
83+
# TODO(NODE-5035): Remove when merged - need to replace with branch just for OIDC.
84+
rm -rf "${DRIVERS_TOOLS}"
85+
git clone --branch DRIVERS-2415 https://github.com/blink1073/drivers-evergreen-tools.git "${DRIVERS_TOOLS}"
86+
87+
cd "${DRIVERS_TOOLS}"/.evergreen/auth_oidc
88+
89+
# This is a bit confusing but the ec2.assume_role command before
90+
# this task will overwrite these variables to a different value
91+
# than we have set in our evergreen project config. As these are
92+
# now specific to the OIDC ARN, we re-export for the python
93+
# scripts.
94+
export AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
95+
export AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
96+
export AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}
97+
export AWS_TOKEN_DIR=/tmp/tokens
98+
99+
. ./activate_venv.sh
100+
python oidc_write_orchestration.py
101+
python oidc_get_tokens.py
102+
setup oidc roles:
103+
- command: subprocess.exec
104+
params:
105+
working_dir: src
106+
binary: bash
107+
args:
108+
- .evergreen/setup-oidc-roles.sh
109+
env:
110+
DRIVERS_TOOLS: ${DRIVERS_TOOLS}
111+
run oidc tests aws:
112+
- command: shell.exec
113+
type: test
114+
params:
115+
working_dir: src
116+
timeout_secs: 300
117+
shell: bash
118+
script: |
119+
${PREPARE_SHELL}
120+
121+
AWS_WEB_IDENTITY_TOKEN_FILE="/tmp/tokens/test1" \
122+
PROJECT_DIRECTORY="${PROJECT_DIRECTORY}" \
123+
bash ${PROJECT_DIRECTORY}/.evergreen/run-oidc-tests.sh
71124
run tests:
72125
- command: shell.exec
73126
type: test
@@ -1380,6 +1433,22 @@ tasks:
13801433
commands:
13811434
- func: install dependencies
13821435
- func: run ldap tests
1436+
- name: test-auth-oidc
1437+
tags:
1438+
- latest
1439+
- replica_set
1440+
- oidc
1441+
commands:
1442+
- func: install dependencies
1443+
- func: bootstrap oidc
1444+
- func: bootstrap mongo-orchestration
1445+
vars:
1446+
VERSION: latest
1447+
TOPOLOGY: replica_set
1448+
AUTH: auth
1449+
ORCHESTRATION_FILE: auth-oidc.json
1450+
- func: setup oidc roles
1451+
- func: run oidc tests aws
13831452
- name: test-socks5
13841453
tags: []
13851454
commands:
@@ -3005,6 +3074,7 @@ buildvariants:
30053074
- test-latest-load-balanced
30063075
- test-auth-kerberos
30073076
- test-auth-ldap
3077+
- test-auth-oidc
30083078
- test-socks5
30093079
- test-socks5-csfle
30103080
- test-socks5-tls
@@ -3054,6 +3124,7 @@ buildvariants:
30543124
- test-latest-load-balanced
30553125
- test-auth-kerberos
30563126
- test-auth-ldap
3127+
- test-auth-oidc
30573128
- test-socks5
30583129
- test-socks5-csfle
30593130
- test-socks5-tls
@@ -3101,6 +3172,7 @@ buildvariants:
31013172
- test-latest-load-balanced
31023173
- test-auth-kerberos
31033174
- test-auth-ldap
3175+
- test-auth-oidc
31043176
- test-socks5
31053177
- test-socks5-csfle
31063178
- test-socks5-tls
@@ -3147,6 +3219,7 @@ buildvariants:
31473219
- test-6.0-load-balanced
31483220
- test-latest-load-balanced
31493221
- test-auth-ldap
3222+
- test-auth-oidc
31503223
- test-socks5-csfle
31513224
- test-socks5-tls
31523225
- test-tls-support-latest

‎.evergreen/generate_evergreen_tasks.js‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,8 @@ const OPERATING_SYSTEMS = [
3333
...osConfig
3434
}));
3535

36-
// TODO: NODE-3060: enable skipped tests on windows
37-
const WINDOWS_SKIP_TAGS = new Set(['atlas-connect', 'auth', 'load_balancer', 'socks5-csfle']);
36+
// TODO: NODE-3060: enable skipped tests on windows except oidc (not supported)
37+
const WINDOWS_SKIP_TAGS = new Set(['atlas-connect', 'auth', 'load_balancer', 'socks5-csfle', 'oidc']);
3838

3939
const TASKS = [];
4040
const SINGLETON_TASKS = [];
@@ -183,6 +183,25 @@ TASKS.push(
183183
tags: ['auth', 'ldap'],
184184
commands: [{ func: 'install dependencies' }, { func: 'run ldap tests' }]
185185
},
186+
{
187+
name: 'test-auth-oidc',
188+
tags: ['latest', 'replica_set', 'oidc'],
189+
commands: [
190+
{ func: 'install dependencies' },
191+
{ func: 'bootstrap oidc' },
192+
{
193+
func: 'bootstrap mongo-orchestration',
194+
vars: {
195+
VERSION: 'latest',
196+
TOPOLOGY: 'replica_set',
197+
AUTH: 'auth',
198+
ORCHESTRATION_FILE: 'auth-oidc.json'
199+
}
200+
},
201+
{ func: 'setup oidc roles' },
202+
{ func: 'run oidc tests aws' }
203+
]
204+
},
186205
{
187206
name: 'test-socks5',
188207
tags: [],

‎.evergreen/run-oidc-tests.sh‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/bin/bash
2+
set -o errexit # Exit the script with error if any of the commands fail
3+
set -o xtrace # Write all commands first to stderr
4+
5+
source "${PROJECT_DIRECTORY}/.evergreen/init-nvm.sh"
6+
7+
MONGODB_URI=${MONGODB_URI:-"mongodb://127.0.0.1:27017"}
8+
MONGODB_URI_SINGLE="${MONGODB_URI}/?authMechanism=MONGODB-OIDC&authMechanismProperties=DEVICE_NAME:aws"
9+
10+
echo $MONGODB_URI_SINGLE
11+
12+
export MONGODB_URI="$MONGODB_URI_SINGLE"
13+
14+
npm run check:oidc

‎.evergreen/setup-oidc-roles.sh‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/bin/bash
2+
set -o errexit # Exit the script with error if any of the commands fail
3+
set -o xtrace # Write all commands first to stderr
4+
5+
cd ${DRIVERS_TOOLS}/.evergreen/auth_oidc
6+
. ./activate_venv.sh
7+
8+
${DRIVERS_TOOLS}/mongodb/bin/mongosh setup_oidc.js

‎package.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,7 @@
128128
"check:atlas": "mocha --config test/manual/mocharc.json test/manual/atlas_connectivity.test.js",
129129
"check:adl": "mocha --config test/mocha_mongodb.json test/manual/atlas-data-lake-testing",
130130
"check:aws": "mocha --config test/mocha_mongodb.json test/integration/auth/mongodb_aws.test.ts",
131+
"check:oidc": "mocha --config test/mocha_mongodb.json test/integration/auth/mongodb_oidc.test.ts",
131132
"check:ocsp": "mocha --config test/manual/mocharc.json test/manual/ocsp_support.test.js",
132133
"check:kerberos": "mocha --config test/manual/mocharc.json test/manual/kerberos.test.js",
133134
"check:tls": "mocha --config test/manual/mocharc.json test/manual/tls_support.test.js",

‎test/integration/auth/mongodb_oidc.test.ts‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
import { expect } from 'chai';
2+
3+
describe('MONGODB-OIDC', function () {
4+
beforeEach(function () {
5+
const MONGODB_URI = process.env.MONGODB_URI;
6+
if (!MONGODB_URI || !MONGODB_URI.includes('MONGODB-OIDC')) {
7+
this.currentTest.skipReason = 'requires MONGODB_URI to contain MONGODB-OIDC auth mechanism';
8+
this.skip();
9+
}
10+
});
11+
12+
context('when running in the environment', function () {
13+
it('contains AWS_WEB_IDENTITY_TOKEN_FILE', function () {
14+
expect(process.env).to.have.property('AWS_WEB_IDENTITY_TOKEN_FILE');
15+
});
16+
});
17+
});

‎test/tools/runner/hooks/configuration.js‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,14 @@ const skipBrokenAuthTestBeforeEachHook = function ({ skippedTests } = { skippedT
100100
};
101101

102102
const testConfigBeforeHook = async function () {
103+
// TODO(NODE-5035): Implement OIDC support. Creating the MongoClient will fail
104+
// with "MongoInvalidArgumentError: AuthMechanism 'MONGODB-OIDC' not supported"
105+
// as is expected until that ticket goes in. Then this condition gets removed.
106+
if (MONGODB_URI && MONGODB_URI.includes('MONGODB-OIDC')) {
107+
this.configuration = new TestConfiguration(MONGODB_URI, {});
108+
return;
109+
}
110+
103111
const client = new MongoClient(loadBalanced ? SINGLE_MONGOS_LB_URI : MONGODB_URI, {
104112
...getEnvironmentalOptions(),
105113
// TODO(NODE-4884): once happy eyeballs support is added, we no longer need to set

0 commit comments

Comments
 (0)