Skip to content

Commit 3fe9fa5

Browse files
jefchienjefchien
authored
Fix regional test failures by using separate keys (#1949)
1 parent 71bdd66 commit 3fe9fa5

13 files changed

+82
-72
lines changed

‎.github/workflows/clean-aws-resources.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
- name: Configure AWS Credentials
2222
uses: aws-actions/configure-aws-credentials@v4
2323
with:
24-
role-to-assume: ${{ secrets.TERRAFORM_AWS_ASSUME_ROLE }}
24+
role-to-assume: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE }}
2525
aws-region: us-west-2
2626

2727
- name: Clean old ami
@@ -40,7 +40,7 @@ jobs:
4040
- name: Configure AWS Credentials
4141
uses: aws-actions/configure-aws-credentials@v4
4242
with:
43-
role-to-assume: ${{ secrets.TERRAFORM_AWS_ASSUME_ROLE }}
43+
role-to-assume: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE }}
4444
aws-region: us-west-2
4545

4646
- name: Clean old file system
@@ -59,7 +59,7 @@ jobs:
5959
- name: Configure AWS Credentials
6060
uses: aws-actions/configure-aws-credentials@v4
6161
with:
62-
role-to-assume: ${{ secrets.TERRAFORM_AWS_ASSUME_ROLE }}
62+
role-to-assume: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE }}
6363
aws-region: us-west-2
6464

6565
- name: Clean old dedicated host
@@ -171,7 +171,7 @@ jobs:
171171
- name: Configure AWS Credentials
172172
uses: aws-actions/configure-aws-credentials@v4
173173
with:
174-
role-to-assume: ${{ secrets.TERRAFORM_AWS_ASSUME_ROLE }}
174+
role-to-assume: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE }}
175175
aws-region: us-west-2
176176

177177
- name: Clean old ecs resources
@@ -190,7 +190,7 @@ jobs:
190190
- name: Configure AWS Credentials
191191
uses: aws-actions/configure-aws-credentials@v4
192192
with:
193-
role-to-assume: ${{ secrets.TERRAFORM_AWS_ASSUME_ROLE }}
193+
role-to-assume: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE }}
194194
aws-region: us-west-2
195195

196196
- name: Clean old eks cluster
@@ -208,7 +208,7 @@ jobs:
208208
- name: Configure AWS Credentials
209209
uses: aws-actions/configure-aws-credentials@v4
210210
with:
211-
role-to-assume: ${{ secrets.TERRAFORM_AWS_ASSUME_ROLE }}
211+
role-to-assume: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE }}
212212
aws-region: us-west-2
213213

214214
- name: Clean old unused ebs volumes
@@ -227,7 +227,7 @@ jobs:
227227
- name: Configure AWS Credentials
228228
uses: aws-actions/configure-aws-credentials@v4
229229
with:
230-
role-to-assume: ${{ secrets.TERRAFORM_AWS_ASSUME_ROLE }}
230+
role-to-assume: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE }}
231231
aws-region: us-west-2
232232

233233
- name: Clean old asg
@@ -246,7 +246,7 @@ jobs:
246246
- name: Configure AWS Credentials
247247
uses: aws-actions/configure-aws-credentials@v4
248248
with:
249-
role-to-assume: ${{ secrets.TERRAFORM_AWS_ASSUME_ROLE }}
249+
role-to-assume: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE }}
250250
aws-region: us-west-2
251251

252252
- name: Clean old launch configuration
@@ -264,7 +264,7 @@ jobs:
264264
- name: Configure AWS Credentials
265265
uses: aws-actions/configure-aws-credentials@v4
266266
with:
267-
role-to-assume: ${{ secrets.TERRAFORM_AWS_ASSUME_ROLE }}
267+
role-to-assume: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE }}
268268
aws-region: us-west-2
269269

270270
- name: Clean old IAM roles
@@ -282,7 +282,7 @@ jobs:
282282
- name: Configure AWS Credentials
283283
uses: aws-actions/configure-aws-credentials@v4
284284
with:
285-
role-to-assume: ${{ secrets.TERRAFORM_AWS_ASSUME_ROLE }}
285+
role-to-assume: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE }}
286286
aws-region: us-west-2
287287

288288
- name: Clean old Log Groups
@@ -300,7 +300,7 @@ jobs:
300300
- name: Configure AWS Credentials
301301
uses: aws-actions/configure-aws-credentials@v4
302302
with:
303-
role-to-assume: ${{ secrets.TERRAFORM_AWS_ASSUME_ROLE }}
303+
role-to-assume: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE }}
304304
aws-region: us-west-2
305305

306306
- name: Clean Old Security Groups

‎.github/workflows/deploy-canary.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33

44
name: Deploy Canary
55
env:
6-
TERRAFORM_AWS_ASSUME_ROLE: ${{ secrets.TERRAFORM_AWS_ASSUME_ROLE }}
7-
S3_INTEGRATION_BUCKET: ${{ secrets.S3_INTEGRATION_BUCKET }}
6+
TERRAFORM_AWS_ASSUME_ROLE: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE }}
7+
S3_INTEGRATION_BUCKET: ${{ vars.S3_INTEGRATION_BUCKET }}
88
KEY_NAME: ${{ secrets.KEY_NAME }}
99
PRIVATE_KEY: ${{ secrets.AWS_PRIVATE_KEY }}
1010
CWA_GITHUB_TEST_REPO_NAME: "aws/amazon-cloudwatch-agent-test"
@@ -31,8 +31,8 @@ jobs:
3131
steps:
3232
- uses: actions/checkout@v3
3333
with:
34-
repository: ${{env.CWA_GITHUB_TEST_REPO_NAME}}
35-
ref: ${{env.CWA_GITHUB_TEST_REPO_BRANCH}}
34+
repository: ${{ env.CWA_GITHUB_TEST_REPO_NAME }}
35+
ref: ${{ env.CWA_GITHUB_TEST_REPO_BRANCH }}
3636

3737
- name: Configure AWS Credentials
3838
uses: aws-actions/configure-aws-credentials@v4
@@ -47,14 +47,14 @@ jobs:
4747

4848
- name: Terminate Last Canary
4949
run: |
50-
if aws s3api wait object-exists --bucket ${S3_INTEGRATION_BUCKET} --key canary/al2/terraform.tfstate ;
50+
if aws s3api wait object-exists --bucket ${{ env.S3_INTEGRATION_BUCKET }} --key canary/al2/terraform.tfstate ;
5151
then
5252
cd terraform/ec2/linux
53-
aws s3 cp s3://${S3_INTEGRATION_BUCKET}/canary/al2/terraform.tfstate .
53+
aws s3 cp s3://${{ env.S3_INTEGRATION_BUCKET }}/canary/al2/terraform.tfstate .
5454
terraform --version
5555
terraform init
5656
terraform destroy -auto-approve
57-
aws s3api delete-object --bucket ${S3_INTEGRATION_BUCKET} --key canary/al2/terraform.tfstate
57+
aws s3api delete-object --bucket ${{ env.S3_INTEGRATION_BUCKET }} --key canary/al2/terraform.tfstate
5858
fi
5959
6060
- name: Verify Terraform version
@@ -71,18 +71,18 @@ jobs:
7171
cd terraform/ec2/linux
7272
terraform init
7373
if terraform apply --auto-approve \
74-
-var="github_test_repo=${{env.CWA_GITHUB_TEST_REPO_URL}}" \
75-
-var="github_test_repo_branch=${{env.CWA_GITHUB_TEST_REPO_BRANCH}}" \
74+
-var="github_test_repo=${{ env.CWA_GITHUB_TEST_REPO_URL }}" \
75+
-var="github_test_repo_branch=${{ env.CWA_GITHUB_TEST_REPO_BRANCH }}" \
7676
-var="user=ec2-user" \
7777
-var="ami=cloudwatch-agent-integration-test-al2*" \
7878
-var="arc=amd64" \
7979
-var="binary_name=amazon-cloudwatch-agent.rpm" \
80-
-var="s3_bucket=${S3_INTEGRATION_BUCKET}" \
81-
-var="ssh_key_name=${KEY_NAME}" \
82-
-var="ssh_key_value=${PRIVATE_KEY}" \
80+
-var="s3_bucket=${{ env.S3_INTEGRATION_BUCKET }}" \
81+
-var="ssh_key_name=${{ env.KEY_NAME }}" \
82+
-var="ssh_key_value=${{ env.PRIVATE_KEY }}" \
8383
-var="test_name=canary" \
8484
-var="is_canary=true" \
85-
-var="test_dir=./test/canary" ; then aws s3 cp terraform.tfstate s3://${S3_INTEGRATION_BUCKET}/canary/al2/terraform.tfstate
85+
-var="test_dir=./test/canary" ; then aws s3 cp terraform.tfstate s3://${{ env.S3_INTEGRATION_BUCKET }}/canary/al2/terraform.tfstate
8686
else
8787
terraform destroy -auto-approve && exit 1
8888
fi

‎.github/workflows/e2e-test.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,6 @@ env:
99
CWA_GITHUB_TEST_REPO_NAME: "aws/amazon-cloudwatch-agent-test"
1010
CWA_GITHUB_TEST_REPO_URL: "https://github.com/aws/amazon-cloudwatch-agent-test.git"
1111
CWA_GITHUB_TEST_REPO_BRANCH: "main"
12-
TERRAFORM_AWS_ASSUME_ROLE_ITAR: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE_ITAR }}
13-
TERRAFORM_AWS_ASSUME_ROLE_CN: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE_CN }}
1412
OPERATOR_GITHUB_REPO_NAME: "aws/amazon-cloudwatch-agent-operator"
1513

1614
on:

‎.github/workflows/ec2-integration-test.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,11 @@ on:
4242
type: boolean
4343
s3_integration_bucket:
4444
type: string
45+
secrets:
46+
AWS_PRIVATE_KEY:
47+
required: false
48+
KEY_NAME:
49+
required: false
4550

4651
jobs:
4752
EC2IntegrationTest:

‎.github/workflows/release-candidate-test.yml‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,7 @@
33

44
name: Test Release Candidate
55
env:
6-
TERRAFORM_AWS_ASSUME_ROLE: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE }}
7-
TERRAFORM_AWS_ASSUME_ROLE_DURATION: 14400 # 4 hours
8-
S3_INTEGRATION_BUCKET: ${{ vars.S3_INTEGRATION_BUCKET }}
9-
S3_RELEASE_BUCKET: amazon-cloud-watch-agent
10-
S3_RELEASE_REPO: cloudwatch-agent
116
CWA_GITHUB_TEST_REPO_BRANCH: "main"
12-
TERRAFORM_AWS_ASSUME_ROLE_ITAR: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE_ITAR }}
13-
S3_INTEGRATION_BUCKET_ITAR: ${{ vars.S3_INTEGRATION_BUCKET_ITAR }}
14-
TERRAFORM_AWS_ASSUME_ROLE_CN: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE_CN }}
15-
S3_INTEGRATION_BUCKET_CN: ${{ vars.S3_INTEGRATION_BUCKET_CN }}
167

178
on:
189
workflow_dispatch:

‎.github/workflows/soak-test.yml‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@
33

44
name: Soak Test
55
env:
6-
TERRAFORM_AWS_ASSUME_ROLE: ${{ secrets.TERRAFORM_AWS_ASSUME_ROLE }}
7-
S3_INTEGRATION_BUCKET: ${{ secrets.S3_INTEGRATION_BUCKET }}
86
KEY_NAME: ${{ secrets.KEY_NAME }}
97
PRIVATE_KEY: ${{ secrets.AWS_PRIVATE_KEY }}
108
CWA_GITHUB_TEST_REPO_NAME: "aws/amazon-cloudwatch-agent-test"
@@ -70,13 +68,13 @@ jobs:
7068
steps:
7169
- uses: actions/checkout@v3
7270
with:
73-
repository: ${{env.CWA_GITHUB_TEST_REPO_NAME}}
74-
ref: ${{env.CWA_GITHUB_TEST_REPO_BRANCH}}
71+
repository: ${{ env.CWA_GITHUB_TEST_REPO_NAME }}
72+
ref: ${{ env.CWA_GITHUB_TEST_REPO_BRANCH }}
7573

7674
- name: Configure AWS Credentials
7775
uses: aws-actions/configure-aws-credentials@v4
7876
with:
79-
role-to-assume: ${{ env.TERRAFORM_AWS_ASSUME_ROLE }}
77+
role-to-assume: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE }}
8078
aws-region: us-west-2
8179

8280
- name: Install Terraform
@@ -98,16 +96,16 @@ jobs:
9896
cd terraform/ec2/linux
9997
terraform init
10098
terraform apply --auto-approve \
101-
-var="github_test_repo=${{env.CWA_GITHUB_TEST_REPO_URL}}" \
99+
-var="github_test_repo=${{ env.CWA_GITHUB_TEST_REPO_URL }}" \
102100
-var="github_test_repo_branch=${{env.CWA_GITHUB_TEST_REPO_BRANCH}}" \
103-
-var="cwa_github_sha=${GITHUB_SHA}" \
101+
-var="cwa_github_sha=${{ github.sha }}" \
104102
-var="user=ec2-user" \
105103
-var="ami=cloudwatch-agent-integration-test-al2*" \
106104
-var="arc=amd64" \
107105
-var="binary_name=amazon-cloudwatch-agent.rpm" \
108-
-var="s3_bucket=${S3_INTEGRATION_BUCKET}" \
109-
-var="ssh_key_name=${KEY_NAME}" \
110-
-var="ssh_key_value=${PRIVATE_KEY}" \
106+
-var="s3_bucket=${{ vars.S3_INTEGRATION_BUCKET }}" \
107+
-var="ssh_key_name=${{ env.KEY_NAME }}" \
108+
-var="ssh_key_value=${{ env.PRIVATE_KEY }}" \
111109
-var="test_name=SoakTest" \
112110
-var="test_dir=./test/soak -run TestSoakHigh"
113111

‎.github/workflows/start-localstack.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,11 @@ on:
3131
outputs:
3232
local_stack_host_name:
3333
value: ${{ jobs.StartLocalStack.outputs.local_stack_host_name }}
34+
secrets:
35+
AWS_PRIVATE_KEY:
36+
required: false
37+
KEY_NAME:
38+
required: false
3439

3540

3641
jobs:

‎.github/workflows/stop-localstack.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,11 @@ on:
2525
type: string
2626
s3_integration_bucket:
2727
type: string
28+
secrets:
29+
AWS_PRIVATE_KEY:
30+
required: false
31+
KEY_NAME:
32+
required: false
2833

2934

3035
jobs:

‎.github/workflows/test-artifacts.yml‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
name: Test Artifacts
55
env:
6-
PRIVATE_KEY: ${{ secrets.AWS_PRIVATE_KEY }}
6+
PRIVATE_KEY: ${{ secrets.AWS_PRIVATE_KEY }}
77
TERRAFORM_AWS_ASSUME_ROLE: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE }}
88
TERRAFORM_AWS_ASSUME_ROLE_DURATION: 14400 # 4 hours
99
S3_INTEGRATION_BUCKET: ${{ vars.S3_INTEGRATION_BUCKET }}
@@ -250,7 +250,9 @@ jobs:
250250
name: 'StartLocalStackITAR'
251251
needs: [OutputEnvVariables]
252252
uses: ./.github/workflows/start-localstack.yml
253-
secrets: inherit
253+
secrets:
254+
AWS_PRIVATE_KEY: ${{ secrets.AWS_PRIVATE_KEY_ITAR }}
255+
KEY_NAME: ${{ secrets.KEY_NAME }}
254256
permissions:
255257
id-token: write
256258
contents: read
@@ -267,7 +269,9 @@ jobs:
267269
name: 'StartLocalStackCN'
268270
needs: [ OutputEnvVariables, UploadDependenciesCN ]
269271
uses: ./.github/workflows/start-localstack.yml
270-
secrets: inherit
272+
secrets:
273+
AWS_PRIVATE_KEY: ${{ secrets.AWS_PRIVATE_KEY_CN }}
274+
KEY_NAME: ${{ secrets.KEY_NAME }}
271275
permissions:
272276
id-token: write
273277
contents: read
@@ -450,7 +454,9 @@ jobs:
450454
region: us-gov-east-1
451455
terraform_assume_role: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE_ITAR }}
452456
s3_integration_bucket: ${{ vars.S3_INTEGRATION_BUCKET_ITAR }}
453-
secrets: inherit
457+
secrets:
458+
AWS_PRIVATE_KEY: ${{ secrets.AWS_PRIVATE_KEY_ITAR }}
459+
KEY_NAME: ${{ secrets.KEY_NAME }}
454460

455461
EC2LinuxIntegrationTestCN:
456462
needs: [ StartLocalStackCN, GenerateTestMatrix, OutputEnvVariables ]
@@ -468,7 +474,9 @@ jobs:
468474
region: cn-north-1
469475
terraform_assume_role: ${{ vars.TERRAFORM_AWS_ASSUME_ROLE_CN }}
470476
s3_integration_bucket: ${{ vars.S3_INTEGRATION_BUCKET_CN }}
471-
secrets: inherit
477+
secrets:
478+
AWS_PRIVATE_KEY: ${{ secrets.AWS_PRIVATE_KEY_CN }}
479+
KEY_NAME: ${{ secrets.KEY_NAME }}
472480

473481
EC2SELinuxIntegrationTest:
474482
needs: [ StartLocalStack, GenerateTestMatrix, OutputEnvVariables ]
@@ -669,7 +677,9 @@ jobs:
669677
if: ${{ always() && needs.StartLocalStackITAR.result == 'success' }}
670678
needs: [ StartLocalStackITAR, EC2LinuxIntegrationTestITAR, OutputEnvVariables ]
671679
uses: ./.github/workflows/stop-localstack.yml
672-
secrets: inherit
680+
secrets:
681+
AWS_PRIVATE_KEY: ${{ secrets.AWS_PRIVATE_KEY_ITAR }}
682+
KEY_NAME: ${{ secrets.KEY_NAME }}
673683
permissions:
674684
id-token: write
675685
contents: read
@@ -686,7 +696,9 @@ jobs:
686696
if: ${{ always() && needs.StartLocalStackCN.result == 'success' }}
687697
needs: [ StartLocalStackCN, EC2LinuxIntegrationTestCN, OutputEnvVariables]
688698
uses: ./.github/workflows/stop-localstack.yml
689-
secrets: inherit
699+
secrets:
700+
AWS_PRIVATE_KEY: ${{ secrets.AWS_PRIVATE_KEY_CN }}
701+
KEY_NAME: ${{ secrets.KEY_NAME }}
690702
permissions:
691703
id-token: write
692704
contents: read

0 commit comments

Comments
 (0)