Merge pull request #164 from IABTechLab/gdm-UID2-5050-e2e

Enhanced E2E pipeline to better support real env testing

Author: gmsdelmundo

.github/workflows/shared-publish-to-pypi-versioned.yaml

@@ -16,7 +16,7 @@ on:
         default: '.'
       publish_vulnerabilities:
         type: string
-        default: true
+        default: "true"
 
 env:
   REPO: ${{ github.event.repository.name }}

.github/workflows/shared-run-e2e-tests.yaml

@@ -100,7 +100,6 @@ jobs:
         with:
           scan_severity: HIGH,CRITICAL
           failure_severity: ${{ inputs.failure_severity }}
-          publish_vulnerabilities: ${{ inputs.publish_vulnerabilities }}
           image_ref: ${{ steps.meta.outputs.tags }}
           scan_type: image
           full_report: 'true'

.github/workflows/shared-validate-image.yaml

@@ -5,22 +5,19 @@ inputs:
   operator_image_version:
     description: The uid2-operator image version
     default: latest
-  admin_root:
-    description: The root path for uid2-admin folder
-    default: uid2-admin
-  operator_root:
-    description: The root path for uid2-operator folder
-    default: uid2-operator
+  target_environment:
+    description: The target environment [mock, integ, prod]
+    required: true
   bore_url_core:
     description: The bore URL for core service
     required: true
   bore_url_optout:
     description: The bore URL for optout service
     required: true
 outputs:
-  output_template_file:
-    description: The output template file
-    value: ${{ steps.enclave_artifacts.outputs.OUTPUT_TEMPLATE_FILE }}
+  template_file:
+    description: The template file
+    value: ${{ steps.enclave_artifacts.outputs.template_file }}
 
 runs:
   using: "composite"
@@ -30,32 +27,31 @@ runs:
       shell: bash
       run: |
         az --version
-    
+
     - name: Generate AKS enclave deployment artifacts
       id: enclave_artifacts
       shell: bash
       env:
-        IMAGE_VERSION: ${{ inputs.operator_image_version }}
-        OPERATOR_ROOT: ${{ inputs.operator_root }}
         BORE_URL_CORE: ${{ inputs.bore_url_core }}
         BORE_URL_OPTOUT: ${{ inputs.bore_url_optout }}
+        IMAGE_VERSION: ${{ inputs.operator_image_version }}
+        TARGET_ENVIRONMENT: ${{ inputs.target_environment }}
       run: |
         bash uid2-shared-actions/scripts/aks/prepare_aks_artifacts.sh
 
     - name: Prepare AKS enclave ID
       id: enclave_id
       shell: bash
       env:
-        OUTPUT_POLICY_DIGEST_FILE: ${{ steps.enclave_artifacts.outputs.OUTPUT_POLICY_DIGEST_FILE }}
+        POLICY_DIGEST_FILE: ${{ steps.enclave_artifacts.outputs.policy_digest_file }}
       run: |
         bash uid2-shared-actions/scripts/aks/prepare_aks_enclave_id.sh
 
     - name: Prepare AKS enclave metadata
       id: enclave_metadata
       shell: bash
       env:
-        ADMIN_ROOT: ${{ inputs.admin_root }}
-        ENCLAVE_ID: ${{ steps.enclave_id.outputs.ENCLAVE_ID }}
+        ENCLAVE_ID: ${{ steps.enclave_id.outputs.enclave_id }}
         ENCLAVE_PROTOCOL: azure-cc
       run: |
         bash uid2-shared-actions/scripts/save_enclave_id_to_admin.sh

actions/prepare_aks_metadata/action.yaml

@@ -2,28 +2,41 @@ name: Prepare AWS Metadata
 description: Prepares the AWS Nitro enclave metadata
 
 inputs:
-  admin_root:
-    description: The root path for uid2-admin folder
-    default: uid2-admin
+  identity_scope:
+    description: The identity scope [UID2, EUID]
+    required: true
+  target_environment:
+    description: The target environment [mock, integ, prod]
+    required: true
   aws_pcr0:
     description: The AWS PCR0
     required: true
 
 outputs:
   operator_key:
     description: The operator key
-    value: ${{ steps.enclave_metadata.outputs.OPERATOR_KEY }}
+    value: ${{ steps.operator_key.outputs.operator_key }}
 
 runs:
   using: "composite"
 
   steps:
     - name: Prepare AWS enclave metadata
       id: enclave_metadata
+      if: ${{ inputs.target_environment == 'mock' }}
       shell: bash
       env:
-        ADMIN_ROOT: ${{ inputs.admin_root }}
         ENCLAVE_ID: ${{ inputs.aws_pcr0 }}
         ENCLAVE_PROTOCOL: aws-nitro
       run: |
         bash uid2-shared-actions/scripts/save_enclave_id_to_admin.sh
+
+    - name: Get operator key
+      id: operator_key
+      shell: bash
+      env:
+          IDENTITY_SCOPE: ${{ inputs.identity_scope }}
+          TARGET_ENVIRONMENT: ${{ inputs.target_environment }}
+          ENCLAVE_PROTOCOL: aws-nitro
+      run: |
+        bash ./uid2-shared-actions/scripts/get_operator_key.sh

actions/prepare_aws_metadata/action.yaml

@@ -5,16 +5,16 @@ inputs:
   operator_image_version:
     description: The uid2-operator image version
     default: latest
-  admin_root:
-    description: The root path for uid2-admin folder
-    default: uid2-admin
+  target_environment:
+    description: The target environment [mock, integ, prod]
+    required: true
 outputs:
-  output_template_file:
-    description: The output template file
-    value: ${{ steps.enclave_artifacts.outputs.OUTPUT_TEMPLATE_FILE }}
-  output_parameters_file:
-    description: The output parameters file
-    value: ${{ steps.enclave_artifacts.outputs.OUTPUT_PARAMETERS_FILE }}
+  template_file:
+    description: The template file
+    value: ${{ steps.enclave_artifacts.outputs.template_file }}
+  parameters_file:
+    description: The parameters file
+    value: ${{ steps.enclave_artifacts.outputs.parameters_file }}
 
 runs:
   using: "composite"
@@ -37,16 +37,16 @@ runs:
       id: enclave_id
       shell: bash
       env:
-        OUTPUT_POLICY_DIGEST_FILE: ${{ steps.enclave_artifacts.outputs.OUTPUT_POLICY_DIGEST_FILE }}
+        POLICY_DIGEST_FILE: ${{ steps.enclave_artifacts.outputs.policy_digest_file }}
       run: |
         bash uid2-shared-actions/scripts/azure/prepare_azure_enclave_id.sh
 
     - name: Prepare Azure enclave metadata
       id: enclave_metadata
+      if: ${{ inputs.target_environment == 'mock' }}
       shell: bash
       env:
-        ADMIN_ROOT: ${{ inputs.admin_root }}
-        ENCLAVE_ID: ${{ steps.enclave_id.outputs.ENCLAVE_ID }}
+        ENCLAVE_ID: ${{ steps.enclave_id.outputs.enclave_id }}
         ENCLAVE_PROTOCOL: azure-cc
       run: |
         bash uid2-shared-actions/scripts/save_enclave_id_to_admin.sh

actions/prepare_azure_metadata/action.yaml

@@ -5,9 +5,9 @@ inputs:
   operator_image_version:
     description: The uid2-operator image version
     default: latest
-  admin_root:
-    description: The root path for uid2-admin folder
-    default: uid2-admin
+  target_environment:
+    description: The target environment [mock, integ, prod]
+    required: true
   gcp_service_account:
     description: The GCP service account
     required: true
@@ -21,10 +21,10 @@ inputs:
 outputs:
   image_hash:
     description: The operator image hash
-    value: ${{ steps.image_digest.outputs.IMAGE_HASH }}
+    value: ${{ steps.image_digest.outputs.image_hash }}
   operator_key:
     description: The operator key
-    value: ${{ steps.enclave_metadata.outputs.OPERATOR_KEY }}
+    value: ${{ steps.operator_key.outputs.operator_key }}
 
 runs:
   using: "composite"
@@ -73,10 +73,20 @@ runs:
 
     - name: Prepare GCP enclave metadata
       id: enclave_metadata
+      if: ${{ inputs.target_environment == 'mock' }}
       shell: bash
       env:
-        ADMIN_ROOT: ${{ inputs.admin_root }}
-        ENCLAVE_ID: ${{ steps.enclave_id.outputs.ENCLAVE_ID }}
+        ENCLAVE_ID: ${{ steps.enclave_id.outputs.enclave_id }}
         ENCLAVE_PROTOCOL: gcp-oidc
       run: |
         bash uid2-shared-actions/scripts/save_enclave_id_to_admin.sh
+
+    - name: Get operator key
+      id: operator_key
+      shell: bash
+      env:
+          IDENTITY_SCOPE: UID2
+          TARGET_ENVIRONMENT: ${{ inputs.target_environment }}
+          ENCLAVE_PROTOCOL: gcp-oidc
+      run: |
+        bash ./uid2-shared-actions/scripts/get_operator_key.sh

actions/prepare_eks_metadata/action.yaml

@@ -4,39 +4,30 @@ description: Pull uid2-e2e Docker image and run E2E test suite
 inputs:
   e2e_network:
     description: The network to use for the E2E test
-    type: string
     default: e2e_default
   e2e_image_version:
     description: The version of E2E image
-    required: false
     default: latest
   uid2_e2e_identity_scope:
     description: Environment variable to run the E2E test
-    required: false
     default: UID2
   uid2_e2e_pipeline_operator_type:
     description: Environment variable to run the E2E test
-    required: false
     default: PUBLIC
   uid2_e2e_pipeline_operator_url:
     description: Environment variable to run the E2E test
-    required: false
     default: http://publicoperator:8080
   uid2_e2e_pipeline_operator_cloud_provider:
     description: Environment variable to run the E2E test
-    required: false
     default: PUBLIC
   uid2_e2e_phone_support:
     description: Environment variable to run the E2E test
-    required: false
     default: 'true'
   uid2_e2e_pipeline_core_url:
-    description: 'Environment variable for the Core service'
-    required: false
+    description: Environment variable for Core service
     default: 'http://core:8088'
   uid2_e2e_pipeline_optout_url:
-    description: 'Environment variable for the OptOut service'
-    required: false
+    description: Environment variable for OptOut service
     default: 'http://optout:8081'
 
 runs:

actions/prepare_gcp_metadata/action.yaml

@@ -2,8 +2,8 @@ name: Start AKS Private Operator
 description: Spins up an AKS private operator
 
 inputs:
-  output_template_file:
-    description: The output template file
+  template_file:
+    description: The template file
     required: true
   azure_credentials:
     description: The Azure credentials
@@ -28,6 +28,6 @@ runs:
       id: start_aks
       shell: bash
       env:
-        OUTPUT_TEMPLATE_FILE: ${{ inputs.output_template_file }}
+        TEMPLATE_FILE: ${{ inputs.template_file }}
       run: |
         bash uid2-shared-actions/scripts/aks/start_aks_enclave.sh