Skip to content

Commit a07fed2

Browse files
cuiy0006cuiy0006
committed
ci: add impersonation integration tests for universe domain
1 parent 95ae5a2 commit a07fed2

File tree

7 files changed

+142
-6
lines changed

7 files changed

+142
-6
lines changed

‎ci/cloudbuild/builds/lib/universe_domain.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,5 +43,7 @@ function ud::bazel_test() {
4343
bazel test "${args[@]}" --sandbox_add_mount_pair=/tmp \
4444
--test_env=UD_SA_KEY_FILE="${UD_SA_KEY_FILE}" \
4545
--test_env=UD_REGION="${UD_REGION}" \
46+
--test_env=UD_ZONE="${UD_ZONE}" \
47+
--test_env=UD_IMPERSONATED_SERVICE_ACCOUNT_NAME="${UD_IMPERSONATED_SERVICE_ACCOUNT_NAME}" \
4648
--test_env=UD_PROJECT="${UD_PROJECT}" -- "$@"
4749
}

ci/cloudbuild/builds/universe-domain-demo.sh renamed to ci/cloudbuild/builds/universe-domain.sh

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ if [[ -n "${UD_SA_KEY_FILE}" ]]; then
2929
ud::bazel_run //google/cloud/universe_domain/demo:kms_demo \
3030
"${UD_PROJECT}" "${UD_REGION}" "${UD_SA_KEY_FILE}"
3131
ud::bazel_test //google/cloud/storage/tests:universe_domain_integration_test
32+
ud::bazel_test //google/cloud/universe_domain/integration_tests:impersonation_tests
3233
else
3334
source module ci/etc/integration-tests-config.sh
3435
bazel run -- //google/cloud/universe_domain/demo:kms_demo \

‎ci/cloudbuild/cloudbuild.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,11 +70,14 @@ availableSecrets:
7070
env: 'UD_PROJECT'
7171
- versionName: 'projects/${PROJECT_ID}/secrets/UD_REGION/versions/latest'
7272
env: 'UD_REGION'
73+
- versionName: 'projects/${PROJECT_ID}/secrets/UD_ZONE/versions/latest'
74+
env: 'UD_ZONE'
7375
- versionName: 'projects/${PROJECT_ID}/secrets/UD_SERVICE_ACCOUNT/versions/latest'
7476
env: 'UD_SERVICE_ACCOUNT'
7577
- versionName: 'projects/${PROJECT_ID}/secrets/UD_SERVICE_ACCOUNT_NAME/versions/latest'
7678
env: 'UD_SERVICE_ACCOUNT_NAME'
77-
79+
- versionName: 'projects/${PROJECT_ID}/secrets/UD_IMPERSONATED_SERVICE_ACCOUNT_NAME/versions/latest'
80+
env: 'UD_IMPERSONATED_SERVICE_ACCOUNT_NAME'
7881

7982
logsBucket: 'gs://${_LOGS_BUCKET}/logs/google-cloud-cpp/${_TRIGGER_SOURCE}/${COMMIT_SHA}/${_DISTRO}-${_BUILD_NAME}-${_SHARD}'
8083

@@ -112,7 +115,7 @@ steps:
112115
- name: '${_POOL_REGION}-docker.pkg.dev/${PROJECT_ID}/gcb/${_IMAGE}:${BUILD_ID}'
113116
entrypoint: 'ci/cloudbuild/build.sh'
114117
args: [ '--local', '--build', '${_BUILD_NAME}' ]
115-
secretEnv: ['CODECOV_TOKEN', 'UD', 'UD_PROJECT', 'UD_REGION', 'UD_SERVICE_ACCOUNT', 'UD_SERVICE_ACCOUNT_NAME']
118+
secretEnv: ['CODECOV_TOKEN', 'UD', 'UD_PROJECT', 'UD_REGION', 'UD_ZONE', 'UD_SERVICE_ACCOUNT', 'UD_SERVICE_ACCOUNT_NAME', 'UD_IMPERSONATED_SERVICE_ACCOUNT_NAME']
116119
env: [
117120
'BAZEL_REMOTE_CACHE=https://storage.googleapis.com/${_CACHE_BUCKET}/bazel-cache/${_DISTRO}-${_BUILD_NAME}',
118121
'LIBRARIES=${_LIBRARIES}',

ci/cloudbuild/triggers/universe-domain-demo-ci.yaml renamed to ci/cloudbuild/triggers/universe-domain-ci.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,9 @@ github:
1818
owner: googleapis
1919
push:
2020
branch: ^main$
21-
name: universe-domain-demo-ci
21+
name: universe-domain-ci
2222
substitutions:
23-
_BUILD_NAME: universe-domain-demo
23+
_BUILD_NAME: universe-domain
2424
_DISTRO: fedora-latest-bazel
2525
_TRIGGER_TYPE: ci
2626
includeBuildLogs: INCLUDE_BUILD_LOGS_WITH_STATUS

ci/cloudbuild/triggers/universe-domain-demo-pr.yaml renamed to ci/cloudbuild/triggers/universe-domain-pr.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,9 @@ github:
1919
pullRequest:
2020
branch: ^main$
2121
commentControl: COMMENTS_ENABLED_FOR_EXTERNAL_CONTRIBUTORS_ONLY
22-
name: universe-domain-demo-pr
22+
name: universe-domain-pr
2323
substitutions:
24-
_BUILD_NAME: universe-domain-demo
24+
_BUILD_NAME: universe-domain
2525
_DISTRO: fedora-latest-bazel
2626
_TRIGGER_TYPE: pr
2727
includeBuildLogs: INCLUDE_BUILD_LOGS_WITH_STATUS

‎google/cloud/universe_domain/integration_tests/BUILD.bazel‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# Copyright 2018 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# https://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
package(default_visibility = ["//visibility:private"])
16+
17+
licenses(["notice"]) # Apache 2.0
18+
19+
cc_test(
20+
name = "impersonation_tests",
21+
timeout = "long",
22+
srcs = ["impersonation_tests.cc"],
23+
tags = [
24+
"integration-test",
25+
],
26+
deps = [
27+
"//:common",
28+
"//:experimental-universe_domain",
29+
"//google/cloud/testing_util:google_cloud_cpp_testing_private",
30+
"@com_google_googletest//:gtest_main",
31+
"@google_cloud_cpp//:compute",
32+
"@google_cloud_cpp//:kms",
33+
],
34+
)

‎google/cloud/universe_domain/integration_tests/impersonation_tests.cc‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
#include "google/cloud/compute/disks/v1/disks_client.h"
2+
#include "google/cloud/compute/disks/v1/disks_options.h"
3+
#include "google/cloud/kms/v1/key_management_client.h"
4+
#include "google/cloud/kms/v1/key_management_options.h"
5+
#include "google/cloud/internal/getenv.h"
6+
#include "google/cloud/internal/rest_options.h"
7+
#include "google/cloud/location.h"
8+
#include "google/cloud/testing_util/integration_test.h"
9+
#include "google/cloud/universe_domain.h"
10+
#include "google/cloud/universe_domain_options.h"
11+
#include <gmock/gmock.h>
12+
#include <fstream>
13+
14+
namespace google {
15+
namespace cloud {
16+
namespace universe_domain {
17+
GOOGLE_CLOUD_CPP_INLINE_NAMESPACE_BEGIN
18+
namespace {
19+
20+
namespace gc = ::google::cloud;
21+
22+
class DomainUniverseImpersonationTest
23+
: public ::google::cloud::testing_util::IntegrationTest {
24+
protected:
25+
void SetUp() override {
26+
project_id_ = gc::internal::GetEnv("UD_PROJECT").value_or("");
27+
ASSERT_FALSE(project_id_.empty());
28+
zone_id_ = gc::internal::GetEnv("UD_ZONE").value_or("");
29+
ASSERT_FALSE(zone_id_.empty());
30+
region_id_ = gc::internal::GetEnv("UD_REGION").value_or("");
31+
ASSERT_FALSE(region_id_.empty());
32+
impersonated_sa_ =
33+
gc::internal::GetEnv("UD_IMPERSONATED_SERVICE_ACCOUNT_NAME")
34+
.value_or("");
35+
ASSERT_FALSE(impersonated_sa_.empty());
36+
std::string const sa_key_file =
37+
gc::internal::GetEnv("UD_SA_KEY_FILE").value_or("");
38+
ASSERT_FALSE(sa_key_file.empty());
39+
40+
auto is = std::ifstream(sa_key_file);
41+
is.exceptions(std::ios::badbit);
42+
credential_ = std::string(std::istreambuf_iterator<char>(is.rdbuf()), {});
43+
}
44+
45+
std::string project_id_;
46+
std::string zone_id_;
47+
std::string region_id_;
48+
std::string impersonated_sa_;
49+
std::string credential_;
50+
};
51+
52+
TEST_F(DomainUniverseImpersonationTest, SAToSAImpersonationRest) {
53+
namespace disks = ::google::cloud::compute_disks_v1;
54+
55+
gc::Options options;
56+
options.set<google::cloud::UnifiedCredentialsOption>(
57+
google::cloud::MakeImpersonateServiceAccountCredentials(
58+
google::cloud::MakeServiceAccountCredentials(credential_),
59+
impersonated_sa_));
60+
61+
auto ud_options = gc::AddUniverseDomainOption(gc::ExperimentalTag{}, options);
62+
if (!ud_options.ok()) throw std::move(ud_options).status();
63+
64+
auto client = disks::DisksClient(disks::MakeDisksConnectionRest(*ud_options));
65+
66+
for (auto disk : client.ListDisks(project_id_, zone_id_)) {
67+
if (!disk) throw std::move(disk).status();
68+
}
69+
}
70+
71+
TEST_F(DomainUniverseImpersonationTest, SAToSAImpersonationGrpc) {
72+
namespace kms = ::google::cloud::kms_v1;
73+
74+
auto const location = gc::Location(project_id_, region_id_);
75+
gc::Options options;
76+
options.set<google::cloud::UnifiedCredentialsOption>(
77+
google::cloud::MakeImpersonateServiceAccountCredentials(
78+
google::cloud::MakeServiceAccountCredentials(credential_),
79+
impersonated_sa_));
80+
81+
auto ud_options = gc::AddUniverseDomainOption(gc::ExperimentalTag{}, options);
82+
if (!ud_options.ok()) throw std::move(ud_options).status();
83+
84+
auto client = kms::KeyManagementServiceClient(
85+
kms::MakeKeyManagementServiceConnection(*ud_options));
86+
87+
for (auto kr : client.ListKeyRings(location.FullName())) {
88+
if (!kr) throw std::move(kr).status();
89+
}
90+
}
91+
92+
} // namespace
93+
GOOGLE_CLOUD_CPP_INLINE_NAMESPACE_END
94+
} // namespace universe_domain
95+
} // namespace cloud
96+
} // namespace google

0 commit comments

Comments
 (0)