Skip to content

Commit 5415161

Browse files
cuiy0006cuiy0006
authored
ci: add 3PI(workforce) to SA impersonation integration tests for universe domain (#14878)
* ci: add 3PI(workforce) to SA impersonation integration tests for universe domain * format * disable SC2046
1 parent 2b93e61 commit 5415161

File tree

4 files changed

+93
-8
lines changed

4 files changed

+93
-8
lines changed

‎ci/cloudbuild/builds/lib/universe_domain.sh‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,24 @@ if [[ -n "${UD_SERVICE_ACCOUNT}" ]]; then
3232
io::log "Created SA key file ${UD_SA_KEY_FILE}"
3333
fi
3434

35+
# Only create the EA key file if the secret is available.
36+
if [[ -n "${UD_EXTERNAL_ACCOUNT_CRED}" ]]; then
37+
ORIG_UMASK=$(umask)
38+
umask 077
39+
UD_EA_KEY_FILE=$(mktemp)
40+
external_account_cred_template="${UD_EXTERNAL_ACCOUNT_CRED}"
41+
42+
response=$(eval "${UD_FETCH_OIDC_TOKEN}")
43+
id_token=$(echo "${response}" | jq -r '.id_token')
44+
id_token_file=$(mktemp)
45+
echo "${id_token}" >"${id_token_file}"
46+
47+
# shellcheck disable=SC2059
48+
printf "${external_account_cred_template}" "${id_token_file}" >"${UD_EA_KEY_FILE}"
49+
umask "${ORIG_UMASK}"
50+
io::log "Created EA key file ${UD_EA_KEY_FILE}"
51+
fi
52+
3553
# Only create the IdToken SA key file if the secret is available.
3654
if [[ -n "${UD_IDTOKEN_SA_IMPERSONATION_CRED}" ]]; then
3755
ORIG_UMASK=$(umask)
@@ -52,6 +70,7 @@ function ud::bazel_test() {
5270
io::log "Executing bazel test $1 with obscured arguments:"
5371
bazel test "${args[@]}" --sandbox_add_mount_pair=/tmp \
5472
--test_env=UD_SA_KEY_FILE="${UD_SA_KEY_FILE}" \
73+
--test_env=UD_EA_KEY_FILE="${UD_EA_KEY_FILE}" \
5574
--test_env=UD_REGION="${UD_REGION}" \
5675
--test_env=UD_ZONE="${UD_ZONE}" \
5776
--test_env=UD_IMPERSONATED_SERVICE_ACCOUNT_NAME="${UD_IMPERSONATED_SERVICE_ACCOUNT_NAME}" \

‎ci/cloudbuild/cloudbuild.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,10 @@ availableSecrets:
8080
env: 'UD_IMPERSONATED_SERVICE_ACCOUNT_NAME'
8181
- versionName: 'projects/${PROJECT_ID}/secrets/UD_IDTOKEN_SA_IMPERSONATION_CRED/versions/latest'
8282
env: 'UD_IDTOKEN_SA_IMPERSONATION_CRED'
83+
- versionName: 'projects/${PROJECT_ID}/secrets/UD_EXTERNAL_ACCOUNT_CRED/versions/latest'
84+
env: 'UD_EXTERNAL_ACCOUNT_CRED'
85+
- versionName: 'projects/${PROJECT_ID}/secrets/UD_FETCH_OIDC_TOKEN/versions/latest'
86+
env: 'UD_FETCH_OIDC_TOKEN'
8387

8488
logsBucket: 'gs://${_LOGS_BUCKET}/logs/google-cloud-cpp/${_TRIGGER_SOURCE}/${COMMIT_SHA}/${_DISTRO}-${_BUILD_NAME}-${_SHARD}'
8589

@@ -117,7 +121,7 @@ steps:
117121
- name: '${_POOL_REGION}-docker.pkg.dev/${PROJECT_ID}/gcb/${_IMAGE}:${BUILD_ID}'
118122
entrypoint: 'ci/cloudbuild/build.sh'
119123
args: [ '--local', '--build', '${_BUILD_NAME}' ]
120-
secretEnv: ['CODECOV_TOKEN', 'UD', 'UD_PROJECT', 'UD_REGION', 'UD_ZONE', 'UD_SERVICE_ACCOUNT', 'UD_SERVICE_ACCOUNT_NAME', 'UD_IMPERSONATED_SERVICE_ACCOUNT_NAME', 'UD_IDTOKEN_SA_IMPERSONATION_CRED']
124+
secretEnv: ['CODECOV_TOKEN', 'UD', 'UD_PROJECT', 'UD_REGION', 'UD_ZONE', 'UD_SERVICE_ACCOUNT', 'UD_SERVICE_ACCOUNT_NAME', 'UD_IMPERSONATED_SERVICE_ACCOUNT_NAME', 'UD_IDTOKEN_SA_IMPERSONATION_CRED', 'UD_FETCH_OIDC_TOKEN', 'UD_EXTERNAL_ACCOUNT_CRED']
121125
env: [
122126
'BAZEL_REMOTE_CACHE=https://storage.googleapis.com/${_CACHE_BUCKET}/bazel-cache/${_DISTRO}-${_BUILD_NAME}',
123127
'LIBRARIES=${_LIBRARIES}',

‎ci/cloudbuild/dockerfiles/fedora-latest-bazel.Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ ARG ARCH=amd64
1818

1919
# Install the minimal packages needed to install Bazel, and then compile our
2020
# code.
21-
RUN dnf install -y clang diffutils findutils gcc-c++ git lcov libcxx-devel \
21+
RUN dnf install -y clang diffutils findutils gcc-c++ git jq lcov libcxx-devel \
2222
libcxxabi-devel libasan libubsan libtsan llvm patch python python3 \
2323
python-pip tar unzip w3m wget which zip zlib-devel
2424

‎google/cloud/universe_domain/integration_tests/impersonation_tests.cc‎

Lines changed: 68 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -71,15 +71,34 @@ class ServiceAccountImpersonationTest : public DomainUniverseImpersonationTest {
7171
auto is = std::ifstream(key_file);
7272
is.exceptions(std::ios::badbit);
7373
credential_ = std::string(std::istreambuf_iterator<char>(is.rdbuf()), {});
74+
}
75+
76+
std::string impersonated_sa_;
77+
std::string credential_;
78+
};
79+
80+
class ExternalAccountImpersonationTest
81+
: public DomainUniverseImpersonationTest {
82+
protected:
83+
void SetUp() override {
84+
DomainUniverseImpersonationTest::SetUp();
85+
86+
impersonated_sa_ =
87+
gc::internal::GetEnv("UD_IMPERSONATED_SERVICE_ACCOUNT_NAME")
88+
.value_or("");
89+
ASSERT_FALSE(impersonated_sa_.empty());
7490

75-
id_token_key_file_ =
76-
gc::internal::GetEnv("UD_IDTOKEN_SA_KEY_FILE").value_or("");
77-
ASSERT_FALSE(id_token_key_file_.empty());
91+
std::string const key_file =
92+
gc::internal::GetEnv("UD_EA_KEY_FILE").value_or("");
93+
ASSERT_FALSE(key_file.empty());
94+
95+
auto is = std::ifstream(key_file);
96+
is.exceptions(std::ios::badbit);
97+
credential_ = std::string(std::istreambuf_iterator<char>(is.rdbuf()), {});
7898
}
7999

80100
std::string impersonated_sa_;
81101
std::string credential_;
82-
std::string id_token_key_file_;
83102
};
84103

85104
TEST_F(ServiceAccountImpersonationTest, SAToSAImpersonationRest) {
@@ -122,10 +141,53 @@ TEST_F(ServiceAccountImpersonationTest, SAToSAImpersonationGrpc) {
122141
}
123142
}
124143

125-
TEST_F(ServiceAccountImpersonationTest, IdTokenSAToSAImpersonationRest) {
144+
TEST_F(ExternalAccountImpersonationTest, EAToSAImpersonationRest) {
145+
namespace disks = ::google::cloud::compute_disks_v1;
146+
147+
gc::Options options;
148+
options.set<google::cloud::UnifiedCredentialsOption>(
149+
google::cloud::MakeImpersonateServiceAccountCredentials(
150+
google::cloud::MakeExternalAccountCredentials(credential_),
151+
impersonated_sa_));
152+
153+
auto ud_options = gc::AddUniverseDomainOption(gc::ExperimentalTag{}, options);
154+
ASSERT_STATUS_OK(ud_options);
155+
156+
auto client = disks::DisksClient(disks::MakeDisksConnectionRest(*ud_options));
157+
158+
for (auto disk : client.ListDisks(project_id_, zone_id_)) {
159+
EXPECT_STATUS_OK(disk);
160+
}
161+
}
162+
163+
TEST_F(ExternalAccountImpersonationTest, EAToSAImpersonationGrpc) {
164+
namespace kms = ::google::cloud::kms_v1;
165+
166+
auto const location = gc::Location(project_id_, region_id_);
167+
gc::Options options;
168+
options.set<google::cloud::UnifiedCredentialsOption>(
169+
google::cloud::MakeImpersonateServiceAccountCredentials(
170+
google::cloud::MakeExternalAccountCredentials(credential_),
171+
impersonated_sa_));
172+
173+
auto ud_options = gc::AddUniverseDomainOption(gc::ExperimentalTag{}, options);
174+
ASSERT_STATUS_OK(ud_options);
175+
176+
auto client = kms::KeyManagementServiceClient(
177+
kms::MakeKeyManagementServiceConnection(*ud_options));
178+
179+
for (auto kr : client.ListKeyRings(location.FullName())) {
180+
EXPECT_STATUS_OK(kr);
181+
}
182+
}
183+
184+
TEST_F(DomainUniverseImpersonationTest, IdTokenSAToSAImpersonationRest) {
126185
namespace disks = ::google::cloud::compute_disks_v1;
186+
auto id_token_key_file =
187+
gc::internal::GetEnv("UD_IDTOKEN_SA_KEY_FILE").value_or("");
188+
ASSERT_FALSE(id_token_key_file.empty());
127189
// Use ADC credential
128-
ScopedEnvironment env("GOOGLE_APPLICATION_CREDENTIALS", id_token_key_file_);
190+
ScopedEnvironment env("GOOGLE_APPLICATION_CREDENTIALS", id_token_key_file);
129191

130192
auto ud_options = gc::AddUniverseDomainOption(gc::ExperimentalTag{});
131193
ASSERT_STATUS_OK(ud_options);

0 commit comments

Comments
 (0)