Skip to content

Commit 8237f0f

Browse files
pazonemergify[bot]
pazone
authored and
mergify[bot]
committed
[CI] BK Vault plugin for EC access (#8377)
* [CI] BK Vault plugin for ES access * Typo * Typo * Quick Windows test * Quick test Windows * Revert last two commits * Applied proposed changes * Fixed indentation * revert buildkite_analytics_token deletion * Remaned the anchor * Added the issue to comments * Updated FIPS pipeline (cherry picked from commit e2505e4) # Conflicts: # .buildkite/bk.integration-fips.pipeline.yml
1 parent 10b12af commit 8237f0f

File tree

5 files changed

+225
-25
lines changed

5 files changed

+225
-25
lines changed

‎.buildkite/bk.integration-fips.pipeline.yml‎

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
# yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
2+
3+
env:
4+
ASDF_MAGE_VERSION: 1.14.0
5+
MS_GOTOOLCHAIN_TELEMETRY_ENABLED: "0"
6+
7+
IMAGE_UBUNTU_2404_X86_64: "platform-ingest-elastic-agent-ubuntu-2404-1751072471"
8+
IMAGE_UBUNTU_X86_64_FIPS: "platform-ingest-elastic-agent-ubuntu-2204-fips-1751072471"
9+
IMAGE_UBUNTU_ARM64_FIPS: "platform-ingest-elastic-agent-ubuntu-2204-fips-aarch64-1751072471"
10+
# Remove AGENT_VERSION pinning once 9.2.0 DRA and stack are released
11+
AGENT_VERSION: "9.1.0-SNAPSHOT"
12+
13+
# This section is used to define the plugins that will be used in the pipeline.
14+
# See https://buildkite.com/docs/pipelines/integrations/plugins/using#using-yaml-anchors-with-plugins
15+
common:
16+
- vault_ec_key_prod: &vault_ec_key_prod
17+
elastic/vault-secrets#v0.1.0:
18+
path: "kv/ci-shared/platform-ingest/platform-ingest-ec-prod"
19+
field: "apiKey"
20+
env_var: "EC_API_KEY"
21+
22+
steps:
23+
- label: Build and push custom elastic-agent image
24+
depends_on:
25+
- 'packaging-containers-x86-64-fips' # Reuse artifacts produced in .buildkite/integration.pipeline.yml
26+
key: integration-fips-cloud-image
27+
env:
28+
FIPS: "true"
29+
CUSTOM_IMAGE_TAG: "git-${BUILDKITE_COMMIT:0:12}"
30+
CI_ELASTIC_AGENT_DOCKER_IMAGE: "docker.elastic.co/beats-ci/elastic-agent-cloud-fips"
31+
TF_VAR_integration_server_docker_image: "docker.elastic.co/beats-ci/elastic-agent-cloud-fips:git-${BUILDKITE_COMMIT:0:12}"
32+
command: |
33+
buildkite-agent artifact download build/distributions/elastic-agent-cloud-fips-*-linux-amd64.docker.tar.gz . --step 'packaging-containers-x86-64-fips'
34+
mage cloud:load
35+
mage cloud:push
36+
agents:
37+
provider: "gcp"
38+
machineType: "n1-standard-8"
39+
image: "${IMAGE_UBUNTU_2404_X86_64}"
40+
plugins:
41+
- elastic/vault-docker-login#v0.5.2:
42+
secret_path: 'kv/ci-shared/platform-ingest/elastic_docker_registry'
43+
44+
- label: Start ESS stack for FIPS integration tests
45+
key: integration-fips-ess
46+
depends_on:
47+
- integration-fips-cloud-image
48+
env:
49+
ASDF_TERRAFORM_VERSION: 1.9.2
50+
TF_VAR_integration_server_docker_image: "docker.elastic.co/beats-ci/elastic-agent-cloud-fips:git-${BUILDKITE_COMMIT:0:12}"
51+
command: |
52+
source .buildkite/scripts/steps/ess_start.sh
53+
artifact_paths:
54+
- test_infra/ess/*.tfstate
55+
- test_infra/ess/*.lock.hcl
56+
agents:
57+
image: "docker.elastic.co/ci-agent-images/platform-ingest/buildkite-agent-beats-ci-with-hooks:0.5"
58+
useCustomGlobalHooks: true
59+
plugins:
60+
- *vault_ec_key_prod
61+
62+
- group: "fips:Stateful:Ubuntu"
63+
key: integration-tests-ubuntu-fips
64+
depends_on:
65+
- integration-fips-ess
66+
steps:
67+
- label: "fips:x86_64:sudo-{{matrix.sudo}}:{{matrix.groups}}"
68+
depends_on:
69+
- packaging-ubuntu-x86-64-fips # Reuse artifacts produced in .buildkite/integration.pipeline.yml
70+
env:
71+
FIPS: "true"
72+
TF_VAR_integration_server_docker_image: "docker.elastic.co/beats-ci/elastic-agent-cloud-fips:git-${BUILDKITE_COMMIT:0:12}"
73+
TEST_PACKAGE: "github.com/elastic/elastic-agent/testing/integration/ess"
74+
command: |
75+
buildkite-agent artifact download build/distributions/** . --step 'packaging-ubuntu-x86-64-fips'
76+
.buildkite/scripts/steps/integration_tests_tf.sh {{matrix.groups}} {{matrix.sudo}}
77+
artifact_paths:
78+
- build/**
79+
- build/diagnostics/**
80+
retry:
81+
automatic:
82+
limit: 1
83+
agents:
84+
provider: "aws"
85+
image: "${IMAGE_UBUNTU_X86_64_FIPS}"
86+
instanceType: "m5.2xlarge"
87+
plugins:
88+
- *vault_ec_key_prod
89+
matrix:
90+
setup:
91+
sudo:
92+
- "false"
93+
- "true"
94+
groups:
95+
- fleet # currently there is only a single test in the fleet group, add more tests once they have been defined
96+
97+
- label: "fips:arm64:sudo-{{matrix.sudo}}:{{matrix.groups}}"
98+
depends_on:
99+
- packaging-ubuntu-arm64-fips
100+
env:
101+
FIPS: "true"
102+
TF_VAR_integration_server_docker_image: "docker.elastic.co/beats-ci/elastic-agent-cloud-fips:git-${BUILDKITE_COMMIT:0:12}"
103+
TEST_PACKAGE: "github.com/elastic/elastic-agent/testing/integration/ess"
104+
command: |
105+
buildkite-agent artifact download build/distributions/** . --step 'packaging-ubuntu-arm64-fips'
106+
.buildkite/scripts/steps/integration_tests_tf.sh {{matrix.groups}} {{matrix.sudo}}
107+
artifact_paths:
108+
- build/**
109+
- build/diagnostics/**
110+
retry:
111+
automatic:
112+
limit: 1
113+
agents:
114+
provider: "aws"
115+
image: "${IMAGE_UBUNTU_ARM64_FIPS}"
116+
instanceType: "m6g.2xlarge"
117+
plugins:
118+
- *vault_ec_key_prod
119+
matrix:
120+
setup:
121+
sudo:
122+
- "false"
123+
- "true"
124+
groups:
125+
- fleet
126+
127+
- label: "fips:upgrade-ech-deployment"
128+
if: build.env("BUILDKITE_PULL_REQUEST") != "false" && build.env("GITHUB_PR_LABELS") =~ /.*(Testing:run:TestUpgradeIntegrationsServer).*/
129+
env:
130+
FIPS: "true"
131+
TEST_PACKAGE: "github.com/elastic/elastic-agent/testing/integration/ess"
132+
command: |
133+
export EC_API_KEY=$(retry -t 5 -- vault kv get -field=apiKey kv/ci-shared/platform-ingest/platform-ingest-ec-prod)
134+
.buildkite/scripts/buildkite-integration-tests.sh ech-deployment false
135+
artifact_paths:
136+
- build/**
137+
- build/diagnostics/**
138+
retry:
139+
automatic:
140+
limit: 1
141+
agents:
142+
provider: "aws"
143+
image: "${IMAGE_UBUNTU_X86_64_FIPS}"
144+
instanceType: "m5.2xlarge"
145+
146+
- label: ESS FIPS stack cleanup
147+
depends_on:
148+
- integration-tests-ubuntu-fips
149+
allow_dependency_failure: true
150+
command: |
151+
buildkite-agent artifact download "test_infra/ess/**" . --step "integration-fips-ess"
152+
ls -lah test_infra/ess
153+
.buildkite/scripts/steps/ess_down.sh
154+
agents:
155+
image: "docker.elastic.co/ci-agent-images/platform-ingest/buildkite-agent-beats-ci-with-hooks:0.5"
156+
useCustomGlobalHooks: true
157+
plugins:
158+
- *vault_ec_key_prod
159+
160+
- label: Aggregate test reports
161+
depends_on:
162+
- integration-tests-ubuntu-fips
163+
allow_dependency_failure: true
164+
command: |
165+
buildkite-agent artifact download "build/*.xml" .
166+
agents:
167+
image: "docker.elastic.co/ci-agent-images/platform-ingest/buildkite-agent-beats-ci-with-hooks:0.5"
168+
useCustomGlobalHooks: true
169+
soft_fail:
170+
- exit_status: "*"
171+
plugins:
172+
- elastic/vault-secrets#v0.1.0:
173+
path: "kv/ci-shared/platform-ingest/buildkite_analytics_token"
174+
field: "token"
175+
env_var: "BUILDKITE_ANALYTICS_TOKEN"
176+
- test-collector#v1.11.0:
177+
files: "build/*.xml"
178+
format: "junit"
179+
branches: "main"
180+
debug: true

‎.buildkite/bk.integration.pipeline.yml‎

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,11 @@ common:
3939
KIBANA_HOST: ea-serverless-it-kibana-hostname
4040
KIBANA_USERNAME: ea-serverless-it-kibana-username
4141
KIBANA_PASSWORD: ea-serverless-it-kibana-password
42+
- vault_ec_key_prod: &vault_ec_key_prod
43+
elastic/vault-secrets#v0.1.0:
44+
path: "kv/ci-shared/platform-ingest/platform-ingest-ec-prod"
45+
field: "apiKey"
46+
env_var: "EC_API_KEY"
4247

4348
steps:
4449
- label: Start ESS stack for integration tests
@@ -58,6 +63,8 @@ steps:
5863
agents:
5964
image: "docker.elastic.co/ci-agent-images/platform-ingest/buildkite-agent-beats-ci-with-hooks:0.5"
6065
useCustomGlobalHooks: true
66+
plugins:
67+
- *vault_ec_key_prod
6168

6269
- group: "Extended runtime leak tests"
6370
key: extended-integration-tests
@@ -85,6 +92,9 @@ steps:
8592
retry:
8693
automatic:
8794
limit: 1
95+
plugins:
96+
- *vault_ec_key_prod
97+
8898
- label: "Windows:2025:amd64:sudo"
8999
depends_on:
90100
- packaging-windows
@@ -103,6 +113,9 @@ steps:
103113
provider: "gcp"
104114
machineType: "n2-standard-8"
105115
image: "${IMAGE_WIN_2025}"
116+
plugins:
117+
- *vault_ec_key_prod
118+
106119
- label: "Ubuntu:2404:amd64:sudo"
107120
depends_on: packaging-ubuntu-x86-64
108121
env:
@@ -120,6 +133,8 @@ steps:
120133
provider: "gcp"
121134
machineType: "n2-standard-8"
122135
image: "${IMAGE_UBUNTU_2404_X86_64}"
136+
plugins:
137+
- *vault_ec_key_prod
123138

124139
- group: "Stateful: Windows"
125140
key: integration-tests-win
@@ -147,6 +162,8 @@ steps:
147162
retry:
148163
automatic:
149164
limit: 1
165+
plugins:
166+
- *vault_ec_key_prod
150167
matrix:
151168
- default
152169
- fleet
@@ -174,6 +191,8 @@ steps:
174191
retry:
175192
automatic:
176193
limit: 1
194+
plugins:
195+
- *vault_ec_key_prod
177196
matrix:
178197
- default
179198

@@ -195,6 +214,8 @@ steps:
195214
retry:
196215
automatic:
197216
limit: 1
217+
plugins:
218+
- *vault_ec_key_prod
198219
matrix:
199220
- default
200221
- fleet
@@ -223,6 +244,8 @@ steps:
223244
provider: "gcp"
224245
machineType: "n2-standard-8"
225246
image: "${IMAGE_WIN_2025}"
247+
plugins:
248+
- *vault_ec_key_prod
226249
matrix:
227250
- default
228251

@@ -251,6 +274,8 @@ steps:
251274
provider: "gcp"
252275
machineType: "n2-standard-8"
253276
image: "${IMAGE_UBUNTU_2404_X86_64}"
277+
plugins:
278+
- *vault_ec_key_prod
254279
matrix:
255280
- default
256281

@@ -273,6 +298,8 @@ steps:
273298
provider: "gcp"
274299
machineType: "n2-standard-8"
275300
image: "${IMAGE_UBUNTU_2404_X86_64}"
301+
plugins:
302+
- *vault_ec_key_prod
276303
matrix:
277304
- default
278305
- upgrade
@@ -306,6 +333,8 @@ steps:
306333
retry:
307334
automatic:
308335
limit: 1
336+
plugins:
337+
- *vault_ec_key_prod
309338
matrix:
310339
- default
311340
- upgrade
@@ -341,6 +370,8 @@ steps:
341370
provider: "aws"
342371
image: "${IMAGE_UBUNTU_2404_ARM_64}"
343372
instanceType: "m6g.xlarge"
373+
plugins:
374+
- *vault_ec_key_prod
344375
matrix:
345376
- default
346377

@@ -369,6 +400,8 @@ steps:
369400
provider: "gcp"
370401
machineType: "n2-standard-8"
371402
image: "${IMAGE_DEBIAN_12}"
403+
plugins:
404+
- *vault_ec_key_prod
372405
matrix:
373406
- default
374407

@@ -391,6 +424,8 @@ steps:
391424
provider: "gcp"
392425
machineType: "n2-standard-8"
393426
image: "${IMAGE_DEBIAN_12}"
427+
plugins:
428+
- *vault_ec_key_prod
394429
matrix:
395430
- default
396431
- upgrade
@@ -430,6 +465,8 @@ steps:
430465
retry:
431466
automatic:
432467
limit: 1
468+
plugins:
469+
- *vault_ec_key_prod
433470
agents:
434471
provider: "gcp"
435472
machineType: "n2-standard-8"
@@ -465,6 +502,8 @@ steps:
465502
machineType: "n2-standard-4"
466503
image: "${IMAGE_UBUNTU_2404_X86_64}"
467504
diskSizeGb: 80
505+
plugins:
506+
- *vault_ec_key_prod
468507
matrix:
469508
setup:
470509
variants:
@@ -561,7 +600,8 @@ steps:
561600
agents:
562601
image: "docker.elastic.co/ci-agent-images/platform-ingest/buildkite-agent-beats-ci-with-hooks:0.5"
563602
useCustomGlobalHooks: true
564-
603+
plugins:
604+
- *vault_ec_key_prod
565605
- label: Aggregate test reports
566606
# Warning: The key has a hook in pre-command
567607
key: aggregate-reports

‎.buildkite/hooks/pre-command‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ fi
1515

1616
CI_DRA_ROLE_PATH="kv/ci-shared/release/dra-role"
1717
CI_GCP_OBS_PATH="kv/ci-shared/observability-ingest/cloud/gcp"
18+
# This key exists for backward compatibility with OGC framework
19+
# see https://github.com/elastic/elastic-agent/issues/8536
1820
CI_ESS_PATH="kv/ci-shared/platform-ingest/platform-ingest-ec-prod"
1921
CI_DRA_ROLE_PATH="kv/ci-shared/release/dra-role"
2022

‎.buildkite/scripts/steps/ess.ps1‎

Lines changed: 2 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -13,16 +13,7 @@ function ess_up {
1313
Write-Error "Error: Specify stack version: ess_up [stack_version]"
1414
return 1
1515
}
16-
17-
$Env:EC_API_KEY = Retry-Command -ScriptBlock {
18-
vault kv get -field=apiKey kv/ci-shared/platform-ingest/platform-ingest-ec-prod
19-
}
20-
21-
if (-not $Env:EC_API_KEY) {
22-
Write-Error "Error: Failed to get EC API key from vault"
23-
exit 1
24-
}
25-
16+
2617
$BuildkiteBuildCreator = if ($Env:BUILDKITE_BUILD_CREATOR) { $Env:BUILDKITE_BUILD_CREATOR } else { get_git_user_email }
2718
$BuildkiteBuildNumber = if ($Env:BUILDKITE_BUILD_NUMBER) { $Env:BUILDKITE_BUILD_NUMBER } else { "0" }
2819
$BuildkitePipelineSlug = if ($Env:BUILDKITE_PIPELINE_SLUG) { $Env:BUILDKITE_PIPELINE_SLUG } else { "elastic-agent-integration-tests" }
@@ -55,10 +46,7 @@ function ess_down {
5546
return 0
5647
}
5748
Write-Output "~~~ Tearing down the ESS Stack(created for this step)"
58-
try {
59-
$Env:EC_API_KEY = Retry-Command -ScriptBlock {
60-
vault kv get -field=apiKey kv/ci-shared/platform-ingest/platform-ingest-ec-prod
61-
}
49+
try {
6250
Push-Location -Path $TfDir
6351
& terraform init
6452
& terraform destroy -auto-approve

0 commit comments

Comments
 (0)