Skip to content

Commit a1f1d9a

Browse files
pazonemergify[bot]
pazone
authored and
mergify[bot]
committed
[CI] BK Vault plugin for EC access (#8377)
* [CI] BK Vault plugin for ES access * Typo * Typo * Quick Windows test * Quick test Windows * Revert last two commits * Applied proposed changes * Fixed indentation * revert buildkite_analytics_token deletion * Remaned the anchor * Added the issue to comments * Updated FIPS pipeline (cherry picked from commit e2505e4) # Conflicts: # .buildkite/bk.integration-fips.pipeline.yml
1 parent 7277c27 commit a1f1d9a

File tree

5 files changed

+225
-25
lines changed

5 files changed

+225
-25
lines changed

‎.buildkite/bk.integration-fips.pipeline.yml‎

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
# yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
2+
3+
env:
4+
ASDF_MAGE_VERSION: 1.14.0
5+
MS_GOTOOLCHAIN_TELEMETRY_ENABLED: "0"
6+
7+
IMAGE_UBUNTU_2404_X86_64: "platform-ingest-elastic-agent-ubuntu-2404-1751072471"
8+
IMAGE_UBUNTU_X86_64_FIPS: "platform-ingest-elastic-agent-ubuntu-2204-fips-1751072471"
9+
IMAGE_UBUNTU_ARM64_FIPS: "platform-ingest-elastic-agent-ubuntu-2204-fips-aarch64-1751072471"
10+
# Remove AGENT_VERSION pinning once 9.2.0 DRA and stack are released
11+
AGENT_VERSION: "9.1.0-SNAPSHOT"
12+
13+
# This section is used to define the plugins that will be used in the pipeline.
14+
# See https://buildkite.com/docs/pipelines/integrations/plugins/using#using-yaml-anchors-with-plugins
15+
common:
16+
- vault_ec_key_prod: &vault_ec_key_prod
17+
elastic/vault-secrets#v0.1.0:
18+
path: "kv/ci-shared/platform-ingest/platform-ingest-ec-prod"
19+
field: "apiKey"
20+
env_var: "EC_API_KEY"
21+
22+
steps:
23+
- label: Build and push custom elastic-agent image
24+
depends_on:
25+
- 'packaging-containers-x86-64-fips' # Reuse artifacts produced in .buildkite/integration.pipeline.yml
26+
key: integration-fips-cloud-image
27+
env:
28+
FIPS: "true"
29+
CUSTOM_IMAGE_TAG: "git-${BUILDKITE_COMMIT:0:12}"
30+
CI_ELASTIC_AGENT_DOCKER_IMAGE: "docker.elastic.co/beats-ci/elastic-agent-cloud-fips"
31+
TF_VAR_integration_server_docker_image: "docker.elastic.co/beats-ci/elastic-agent-cloud-fips:git-${BUILDKITE_COMMIT:0:12}"
32+
command: |
33+
buildkite-agent artifact download build/distributions/elastic-agent-cloud-fips-*-linux-amd64.docker.tar.gz . --step 'packaging-containers-x86-64-fips'
34+
mage cloud:load
35+
mage cloud:push
36+
agents:
37+
provider: "gcp"
38+
machineType: "n1-standard-8"
39+
image: "${IMAGE_UBUNTU_2404_X86_64}"
40+
plugins:
41+
- elastic/vault-docker-login#v0.5.2:
42+
secret_path: 'kv/ci-shared/platform-ingest/elastic_docker_registry'
43+
44+
- label: Start ESS stack for FIPS integration tests
45+
key: integration-fips-ess
46+
depends_on:
47+
- integration-fips-cloud-image
48+
env:
49+
ASDF_TERRAFORM_VERSION: 1.9.2
50+
TF_VAR_integration_server_docker_image: "docker.elastic.co/beats-ci/elastic-agent-cloud-fips:git-${BUILDKITE_COMMIT:0:12}"
51+
command: |
52+
source .buildkite/scripts/steps/ess_start.sh
53+
artifact_paths:
54+
- test_infra/ess/*.tfstate
55+
- test_infra/ess/*.lock.hcl
56+
agents:
57+
image: "docker.elastic.co/ci-agent-images/platform-ingest/buildkite-agent-beats-ci-with-hooks:0.5"
58+
useCustomGlobalHooks: true
59+
plugins:
60+
- *vault_ec_key_prod
61+
62+
- group: "fips:Stateful:Ubuntu"
63+
key: integration-tests-ubuntu-fips
64+
depends_on:
65+
- integration-fips-ess
66+
steps:
67+
- label: "fips:x86_64:sudo-{{matrix.sudo}}:{{matrix.groups}}"
68+
depends_on:
69+
- packaging-ubuntu-x86-64-fips # Reuse artifacts produced in .buildkite/integration.pipeline.yml
70+
env:
71+
FIPS: "true"
72+
TF_VAR_integration_server_docker_image: "docker.elastic.co/beats-ci/elastic-agent-cloud-fips:git-${BUILDKITE_COMMIT:0:12}"
73+
TEST_PACKAGE: "github.com/elastic/elastic-agent/testing/integration/ess"
74+
command: |
75+
buildkite-agent artifact download build/distributions/** . --step 'packaging-ubuntu-x86-64-fips'
76+
.buildkite/scripts/steps/integration_tests_tf.sh {{matrix.groups}} {{matrix.sudo}}
77+
artifact_paths:
78+
- build/**
79+
- build/diagnostics/**
80+
retry:
81+
automatic:
82+
limit: 1
83+
agents:
84+
provider: "aws"
85+
image: "${IMAGE_UBUNTU_X86_64_FIPS}"
86+
instanceType: "m5.2xlarge"
87+
plugins:
88+
- *vault_ec_key_prod
89+
matrix:
90+
setup:
91+
sudo:
92+
- "false"
93+
- "true"
94+
groups:
95+
- fleet # currently there is only a single test in the fleet group, add more tests once they have been defined
96+
97+
- label: "fips:arm64:sudo-{{matrix.sudo}}:{{matrix.groups}}"
98+
depends_on:
99+
- packaging-ubuntu-arm64-fips
100+
env:
101+
FIPS: "true"
102+
TF_VAR_integration_server_docker_image: "docker.elastic.co/beats-ci/elastic-agent-cloud-fips:git-${BUILDKITE_COMMIT:0:12}"
103+
TEST_PACKAGE: "github.com/elastic/elastic-agent/testing/integration/ess"
104+
command: |
105+
buildkite-agent artifact download build/distributions/** . --step 'packaging-ubuntu-arm64-fips'
106+
.buildkite/scripts/steps/integration_tests_tf.sh {{matrix.groups}} {{matrix.sudo}}
107+
artifact_paths:
108+
- build/**
109+
- build/diagnostics/**
110+
retry:
111+
automatic:
112+
limit: 1
113+
agents:
114+
provider: "aws"
115+
image: "${IMAGE_UBUNTU_ARM64_FIPS}"
116+
instanceType: "m6g.2xlarge"
117+
plugins:
118+
- *vault_ec_key_prod
119+
matrix:
120+
setup:
121+
sudo:
122+
- "false"
123+
- "true"
124+
groups:
125+
- fleet
126+
127+
- label: "fips:upgrade-ech-deployment"
128+
if: build.env("BUILDKITE_PULL_REQUEST") != "false" && build.env("GITHUB_PR_LABELS") =~ /.*(Testing:run:TestUpgradeIntegrationsServer).*/
129+
env:
130+
FIPS: "true"
131+
TEST_PACKAGE: "github.com/elastic/elastic-agent/testing/integration/ess"
132+
command: |
133+
export EC_API_KEY=$(retry -t 5 -- vault kv get -field=apiKey kv/ci-shared/platform-ingest/platform-ingest-ec-prod)
134+
.buildkite/scripts/buildkite-integration-tests.sh ech-deployment false
135+
artifact_paths:
136+
- build/**
137+
- build/diagnostics/**
138+
retry:
139+
automatic:
140+
limit: 1
141+
agents:
142+
provider: "aws"
143+
image: "${IMAGE_UBUNTU_X86_64_FIPS}"
144+
instanceType: "m5.2xlarge"
145+
146+
- label: ESS FIPS stack cleanup
147+
depends_on:
148+
- integration-tests-ubuntu-fips
149+
allow_dependency_failure: true
150+
command: |
151+
buildkite-agent artifact download "test_infra/ess/**" . --step "integration-fips-ess"
152+
ls -lah test_infra/ess
153+
.buildkite/scripts/steps/ess_down.sh
154+
agents:
155+
image: "docker.elastic.co/ci-agent-images/platform-ingest/buildkite-agent-beats-ci-with-hooks:0.5"
156+
useCustomGlobalHooks: true
157+
plugins:
158+
- *vault_ec_key_prod
159+
160+
- label: Aggregate test reports
161+
depends_on:
162+
- integration-tests-ubuntu-fips
163+
allow_dependency_failure: true
164+
command: |
165+
buildkite-agent artifact download "build/*.xml" .
166+
agents:
167+
image: "docker.elastic.co/ci-agent-images/platform-ingest/buildkite-agent-beats-ci-with-hooks:0.5"
168+
useCustomGlobalHooks: true
169+
soft_fail:
170+
- exit_status: "*"
171+
plugins:
172+
- elastic/vault-secrets#v0.1.0:
173+
path: "kv/ci-shared/platform-ingest/buildkite_analytics_token"
174+
field: "token"
175+
env_var: "BUILDKITE_ANALYTICS_TOKEN"
176+
- test-collector#v1.11.0:
177+
files: "build/*.xml"
178+
format: "junit"
179+
branches: "main"
180+
debug: true

‎.buildkite/bk.integration.pipeline.yml‎

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,11 @@ common:
4040
KIBANA_HOST: ea-serverless-it-kibana-hostname
4141
KIBANA_USERNAME: ea-serverless-it-kibana-username
4242
KIBANA_PASSWORD: ea-serverless-it-kibana-password
43+
- vault_ec_key_prod: &vault_ec_key_prod
44+
elastic/vault-secrets#v0.1.0:
45+
path: "kv/ci-shared/platform-ingest/platform-ingest-ec-prod"
46+
field: "apiKey"
47+
env_var: "EC_API_KEY"
4348

4449
steps:
4550
- label: Start ESS stack for integration tests
@@ -59,6 +64,8 @@ steps:
5964
agents:
6065
image: "docker.elastic.co/ci-agent-images/platform-ingest/buildkite-agent-beats-ci-with-hooks:0.5"
6166
useCustomGlobalHooks: true
67+
plugins:
68+
- *vault_ec_key_prod
6269

6370
- group: "Extended runtime leak tests"
6471
key: extended-integration-tests
@@ -86,6 +93,9 @@ steps:
8693
retry:
8794
automatic:
8895
limit: 1
96+
plugins:
97+
- *vault_ec_key_prod
98+
8999
- label: "Windows:2025:amd64:sudo"
90100
depends_on:
91101
- packaging-windows
@@ -104,6 +114,9 @@ steps:
104114
provider: "gcp"
105115
machineType: "n2-standard-8"
106116
image: "${IMAGE_WIN_2025}"
117+
plugins:
118+
- *vault_ec_key_prod
119+
107120
- label: "Ubuntu:2404:amd64:sudo"
108121
depends_on: packaging-ubuntu-x86-64
109122
env:
@@ -121,6 +134,8 @@ steps:
121134
provider: "gcp"
122135
machineType: "n2-standard-8"
123136
image: "${IMAGE_UBUNTU_2404_X86_64}"
137+
plugins:
138+
- *vault_ec_key_prod
124139

125140
- group: "Stateful: Windows"
126141
key: integration-tests-win
@@ -148,6 +163,8 @@ steps:
148163
retry:
149164
automatic:
150165
limit: 1
166+
plugins:
167+
- *vault_ec_key_prod
151168
matrix:
152169
- default
153170
- fleet
@@ -175,6 +192,8 @@ steps:
175192
retry:
176193
automatic:
177194
limit: 1
195+
plugins:
196+
- *vault_ec_key_prod
178197
matrix:
179198
- default
180199

@@ -196,6 +215,8 @@ steps:
196215
retry:
197216
automatic:
198217
limit: 1
218+
plugins:
219+
- *vault_ec_key_prod
199220
matrix:
200221
- default
201222
- fleet
@@ -224,6 +245,8 @@ steps:
224245
provider: "gcp"
225246
machineType: "n2-standard-8"
226247
image: "${IMAGE_WIN_2025}"
248+
plugins:
249+
- *vault_ec_key_prod
227250
matrix:
228251
- default
229252

@@ -252,6 +275,8 @@ steps:
252275
provider: "gcp"
253276
machineType: "n2-standard-8"
254277
image: "${IMAGE_UBUNTU_2404_X86_64}"
278+
plugins:
279+
- *vault_ec_key_prod
255280
matrix:
256281
- default
257282

@@ -274,6 +299,8 @@ steps:
274299
provider: "gcp"
275300
machineType: "n2-standard-8"
276301
image: "${IMAGE_UBUNTU_2404_X86_64}"
302+
plugins:
303+
- *vault_ec_key_prod
277304
matrix:
278305
- default
279306
- upgrade
@@ -307,6 +334,8 @@ steps:
307334
retry:
308335
automatic:
309336
limit: 1
337+
plugins:
338+
- *vault_ec_key_prod
310339
matrix:
311340
- default
312341
- upgrade
@@ -342,6 +371,8 @@ steps:
342371
provider: "aws"
343372
image: "${IMAGE_UBUNTU_2404_ARM_64}"
344373
instanceType: "m6g.xlarge"
374+
plugins:
375+
- *vault_ec_key_prod
345376
matrix:
346377
- default
347378

@@ -370,6 +401,8 @@ steps:
370401
provider: "gcp"
371402
machineType: "n2-standard-8"
372403
image: "${IMAGE_DEBIAN_12}"
404+
plugins:
405+
- *vault_ec_key_prod
373406
matrix:
374407
- default
375408

@@ -392,6 +425,8 @@ steps:
392425
provider: "gcp"
393426
machineType: "n2-standard-8"
394427
image: "${IMAGE_DEBIAN_12}"
428+
plugins:
429+
- *vault_ec_key_prod
395430
matrix:
396431
- default
397432
- upgrade
@@ -431,6 +466,8 @@ steps:
431466
retry:
432467
automatic:
433468
limit: 1
469+
plugins:
470+
- *vault_ec_key_prod
434471
agents:
435472
provider: "gcp"
436473
machineType: "n2-standard-8"
@@ -466,6 +503,8 @@ steps:
466503
machineType: "n2-standard-4"
467504
image: "${IMAGE_UBUNTU_2404_X86_64}"
468505
diskSizeGb: 80
506+
plugins:
507+
- *vault_ec_key_prod
469508
matrix:
470509
setup:
471510
variants:
@@ -562,7 +601,8 @@ steps:
562601
agents:
563602
image: "docker.elastic.co/ci-agent-images/platform-ingest/buildkite-agent-beats-ci-with-hooks:0.5"
564603
useCustomGlobalHooks: true
565-
604+
plugins:
605+
- *vault_ec_key_prod
566606
- label: Aggregate test reports
567607
# Warning: The key has a hook in pre-command
568608
key: aggregate-reports

‎.buildkite/hooks/pre-command‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ fi
1515

1616
CI_DRA_ROLE_PATH="kv/ci-shared/release/dra-role"
1717
CI_GCP_OBS_PATH="kv/ci-shared/observability-ingest/cloud/gcp"
18+
# This key exists for backward compatibility with OGC framework
19+
# see https://github.com/elastic/elastic-agent/issues/8536
1820
CI_ESS_PATH="kv/ci-shared/platform-ingest/platform-ingest-ec-prod"
1921
CI_DRA_ROLE_PATH="kv/ci-shared/release/dra-role"
2022

‎.buildkite/scripts/steps/ess.ps1‎

Lines changed: 2 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -13,16 +13,7 @@ function ess_up {
1313
Write-Error "Error: Specify stack version: ess_up [stack_version]"
1414
return 1
1515
}
16-
17-
$Env:EC_API_KEY = Retry-Command -ScriptBlock {
18-
vault kv get -field=apiKey kv/ci-shared/platform-ingest/platform-ingest-ec-prod
19-
}
20-
21-
if (-not $Env:EC_API_KEY) {
22-
Write-Error "Error: Failed to get EC API key from vault"
23-
exit 1
24-
}
25-
16+
2617
$BuildkiteBuildCreator = if ($Env:BUILDKITE_BUILD_CREATOR) { $Env:BUILDKITE_BUILD_CREATOR } else { get_git_user_email }
2718
$BuildkiteBuildNumber = if ($Env:BUILDKITE_BUILD_NUMBER) { $Env:BUILDKITE_BUILD_NUMBER } else { "0" }
2819
$BuildkitePipelineSlug = if ($Env:BUILDKITE_PIPELINE_SLUG) { $Env:BUILDKITE_PIPELINE_SLUG } else { "elastic-agent-integration-tests" }
@@ -55,10 +46,7 @@ function ess_down {
5546
return 0
5647
}
5748
Write-Output "~~~ Tearing down the ESS Stack(created for this step)"
58-
try {
59-
$Env:EC_API_KEY = Retry-Command -ScriptBlock {
60-
vault kv get -field=apiKey kv/ci-shared/platform-ingest/platform-ingest-ec-prod
61-
}
49+
try {
6250
Push-Location -Path $TfDir
6351
& terraform init
6452
& terraform destroy -auto-approve

0 commit comments

Comments
 (0)