Skip to content

Commit fb786f8

Browse files
RobinDuhanRobinDuhan
committed
INST-19278 - Added helm test cases using bash
1 parent 29b4a2b commit fb786f8

File tree

6 files changed

+936
-0
lines changed

6 files changed

+936
-0
lines changed

‎.github/workflows/helm.test.yml‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
name: Helm E2E Tests
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
download_url:
7+
description: 'Binary download URL (architecture suffix appended automatically)'
8+
required: true
9+
default: 'https://releases.jfrog.io/artifactory/run/jfrog-credentials-provider/0.1.0-beta.6/jfrog-credential-provider-linux'
10+
type: string
11+
provider:
12+
description: 'Cloud provider to test'
13+
required: true
14+
default: 'all'
15+
type: choice
16+
options:
17+
- all
18+
- aws
19+
- azure
20+
- gcp
21+
push:
22+
branches:
23+
- feature/INST-19278
24+
25+
permissions:
26+
id-token: write
27+
contents: read
28+
29+
jobs:
30+
test-aws:
31+
name: AWS E2E Tests
32+
# if: inputs.provider == 'all' || inputs.provider == 'aws'
33+
runs-on: self-hosted
34+
steps:
35+
- uses: actions/checkout@v4
36+
37+
- name: Configure aws credentials
38+
uses: aws-actions/configure-aws-credentials@v4.1.0
39+
with:
40+
role-to-assume: arn:aws:iam::095132750011:role/github-actions-kubelet-ci-role
41+
role-session-name: kubelettestcisession
42+
aws-region: ap-northeast-3
43+
44+
- name: Install tools
45+
run: |
46+
command -v helm >/dev/null || { curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash; }
47+
command -v yq >/dev/null || { sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 && sudo chmod +x /usr/local/bin/yq; }
48+
49+
- name: Run AWS E2E tests
50+
env:
51+
AWS_NODE_ROLE_ARN: ${{ secrets.AWS_NODE_ROLE_ARN }}
52+
AWS_SUBNET_IDS: ${{ secrets.AWS_SUBNET_IDS }}
53+
run: |
54+
source build/test/env
55+
export DOWNLOAD_URL="${{ inputs.download_url }}"
56+
bash build/test/aws.sh
57+
58+
test-azure:
59+
name: Azure E2E Tests
60+
# if: inputs.provider == 'all' || inputs.provider == 'azure'
61+
runs-on: self-hosted
62+
steps:
63+
- uses: actions/checkout@v4
64+
65+
- name: Login to Azure
66+
uses: azure/login@v2
67+
with:
68+
client-id: ${{ secrets.AZURE_APP_CLIENT_ID }}
69+
tenant-id: ${{ secrets.AZURE_APP_TENANT_ID }}
70+
subscription-id: ${{ secrets.AZURE_APP_SUBSCRIPTION_ID }}
71+
72+
- name: Install tools
73+
run: |
74+
command -v helm >/dev/null || { curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash; }
75+
command -v yq >/dev/null || { sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 && sudo chmod +x /usr/local/bin/yq; }
76+
77+
- name: Run Azure E2E tests
78+
env:
79+
AZURE_APP_CLIENT_ID: ${{ secrets.AZURE_HELM_TEST_APP_CLIENT_ID }}
80+
AZURE_TENANT_ID: ${{ secrets.AZURE_APP_TENANT_ID }}
81+
# user assigned identity that has access to the app registration
82+
AZURE_NODEPOOL_CLIENT_ID: ${{ secrets.AZURE_HELM_TEST_NODEPOOL_CLIENT_ID }}
83+
run: |
84+
source build/test/env
85+
export DOWNLOAD_URL="${{ inputs.download_url }}"
86+
export JFROG_OIDC_PROVIDER_NAME="${AZURE_JFROG_OIDC_PROVIDER_NAME}"
87+
bash build/test/azure.sh
88+
89+
test-gcp:
90+
name: GCP E2E Tests
91+
if: inputs.provider == 'all' || inputs.provider == 'gcp'
92+
runs-on: self-hosted
93+
steps:
94+
- uses: actions/checkout@v4
95+
96+
- name: Authenticate to GCP
97+
uses: google-github-actions/auth@v2
98+
with:
99+
workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
100+
service_account: ${{ secrets.GCP_SERVICE_ACCOUNT_EMAIL }}
101+
102+
- name: Set up gcloud CLI
103+
uses: google-github-actions/setup-gcloud@v2
104+
105+
- name: Install tools
106+
run: |
107+
command -v helm >/dev/null || { curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash; }
108+
command -v yq >/dev/null || { sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 && sudo chmod +x /usr/local/bin/yq; }
109+
110+
- name: Run GCP E2E tests
111+
env:
112+
GCP_SERVICE_ACCOUNT_EMAIL: ${{ secrets.GCP_SERVICE_ACCOUNT_EMAIL }}
113+
run: |
114+
source build/test/env
115+
export DOWNLOAD_URL="${{ inputs.download_url }}"
116+
export JFROG_OIDC_PROVIDER_NAME="${GCP_JFROG_OIDC_PROVIDER_NAME}"
117+
bash build/test/gcp.sh
118+

‎build/test/aws.sh‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
#!/bin/bash
2+
# aws.sh - E2E tests for AWS (assume_role + cognito_oidc)
3+
# Expects the following env vars to be set by the caller (GitHub Actions workflow):
4+
# EKS_CLUSTER_NAME, AWS_REGION, AWS_SUBNET_IDS, AWS_NODE_ROLE_ARN
5+
# ARTIFACTORY_URL, MATCH_IMAGES, TEST_IMAGE, HELM_CHART_VERSION
6+
# AWS_ROLE_NAME (for assume_role)
7+
# AWS_COGNITO_SECRET_NAME, AWS_COGNITO_USER_POOL_NAME,
8+
# AWS_COGNITO_RESOURCE_SERVER_NAME, AWS_COGNITO_USER_POOL_RESOURCE_SCOPE,
9+
# JFROG_OIDC_PROVIDER_NAME (for cognito_oidc)
10+
# DOWNLOAD_URL for custom binary url
11+
12+
set -euo pipefail
13+
14+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
15+
source "${SCRIPT_DIR}/helper.sh"
16+
17+
RUN_ID="${GITHUB_RUN_ID:-$(date +%s)}"
18+
19+
# ---------------------------------------------------------------------------
20+
# assume_role test
21+
# ---------------------------------------------------------------------------
22+
test_aws_assume_role() {
23+
local ng_name="jfrog-ar-${RUN_ID}"
24+
local release_name="jfrog-cp-assume-role"
25+
local namespace="jfrog-assume-role"
26+
local node_label_value="aws-assume-role"
27+
local values_file="/tmp/values-aws-assume-role.yaml"
28+
29+
log_step "TEST: AWS assume_role"
30+
31+
cleanup_assume_role() {
32+
log_step "Cleanup: AWS assume_role"
33+
cleanup_helm_test "${release_name}" "${namespace}" || true
34+
delete_node_group_aws "${EKS_CLUSTER_NAME}" "${ng_name}" || true
35+
}
36+
trap cleanup_assume_role EXIT
37+
38+
create_node_group_aws \
39+
"${EKS_CLUSTER_NAME}" \
40+
"${ng_name}" \
41+
"jfrog-test=${node_label_value},credentialsProviderEnabled=true" \
42+
"t4g.medium" \
43+
"${AWS_SUBNET_IDS}" \
44+
"AL2023_ARM_64_STANDARD" \
45+
"${AWS_NODE_ROLE_ARN}"
46+
47+
generate_values "${REPO_ROOT}/examples/aws-values.yaml" "${values_file}" \
48+
".providerConfig[0].artifactoryUrl = \"${ARTIFACTORY_URL}\"" \
49+
".providerConfig[0].matchImages[0] = \"${MATCH_IMAGES}\"" \
50+
".providerConfig[0].aws.aws_role_name = \"${AWS_ROLE_NAME}\"" \
51+
".downloadUrl = \"${DOWNLOAD_URL}\""
52+
53+
run_helm_test \
54+
"${release_name}" \
55+
"${namespace}" \
56+
"${values_file}" \
57+
"${TEST_IMAGE}" \
58+
"jfrog-test" \
59+
"${node_label_value}" \
60+
"false" \
61+
62+
log_info "TEST PASSED: AWS assume_role"
63+
64+
cleanup_assume_role
65+
trap - EXIT
66+
}
67+
68+
# ---------------------------------------------------------------------------
69+
# cognito_oidc test
70+
# ---------------------------------------------------------------------------
71+
test_aws_projected_sa() {
72+
local ng_name="jfrog-co-${RUN_ID}"
73+
local release_name="jfrog-cp-projected-sa"
74+
local namespace="jfrog-projected-sa"
75+
local node_label_value="aws-projecte-token"
76+
local values_file="/tmp/values-aws-projected-sa.yaml"
77+
78+
log_step "TEST: AWS projected_sa"
79+
80+
cleanup_projected_sa() {
81+
log_step "Cleanup: AWS projected_sa"
82+
cleanup_helm_test "${release_name}" "${namespace}" || true
83+
delete_node_group_aws "${EKS_CLUSTER_NAME}" "${ng_name}" || true
84+
}
85+
trap cleanup_cognito EXIT
86+
87+
create_node_group_aws \
88+
"${EKS_CLUSTER_NAME}" \
89+
"${ng_name}" \
90+
"jfrog-test=${node_label_value},credentialsProviderEnabled=true" \
91+
"t4g.small" \
92+
"${AWS_SUBNET_IDS}" \
93+
"${AWS_NODE_ROLE_ARN}"
94+
95+
generate_values "${REPO_ROOT}/examples/aws-projected-sa-values.yaml" "${values_file}" \
96+
".providerConfig[0].artifactoryUrl = \"${ARTIFACTORY_URL}\"" \
97+
".providerConfig[0].matchImages[0] = \"${MATCH_IMAGES}\"" \
98+
".providerConfig[0].aws.enabled = true" \
99+
".providerConfig[0].aws.aws_auth_method = \"assume_role\"" \
100+
".providerConfig[0].aws.aws_role_name = \"${AWS_ROLE_NAME}\"" \
101+
".providerConfig[0].tokenAttributes.enabled = true" \
102+
".downloadUrl = \"${DOWNLOAD_URL}\""
103+
104+
run_helm_test \
105+
"${release_name}" \
106+
"${namespace}" \
107+
"${values_file}" \
108+
"${TEST_IMAGE}" \
109+
"jfrog-test" \
110+
"${node_label_value}" \
111+
"true" \
112+
113+
log_info "TEST PASSED: AWS cognito_oidc"
114+
115+
cleanup_cognito
116+
trap - EXIT
117+
}
118+
119+
# ---------------------------------------------------------------------------
120+
# Main
121+
# ---------------------------------------------------------------------------
122+
main() {
123+
log_step "Starting AWS E2E tests (run: ${RUN_ID})"
124+
125+
connect_cluster_aws "${EKS_CLUSTER_NAME}" "${AWS_REGION}"
126+
127+
test_aws_assume_role
128+
# test_aws_cognito_oidc
129+
130+
log_step "All AWS E2E tests PASSED"
131+
}
132+
133+
main "$@"

‎build/test/azure.sh‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
#!/bin/bash
2+
# azure.sh - E2E tests for Azure (azure_oidc)
3+
# Expects the following env vars to be set by the caller (GitHub Actions workflow):
4+
# AKS_CLUSTER_NAME, AKS_RESOURCE_GROUP
5+
# ARTIFACTORY_URL, MATCH_IMAGES, TEST_IMAGE
6+
# AZURE_APP_CLIENT_ID, AZURE_TENANT_ID, AZURE_NODEPOOL_CLIENT_ID,
7+
# JFROG_OIDC_PROVIDER_NAME
8+
9+
set -euo pipefail
10+
11+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
12+
source "${SCRIPT_DIR}/helper.sh"
13+
14+
RUN_ID="${GITHUB_RUN_ID:-$(date +%s)}"
15+
16+
# ---------------------------------------------------------------------------
17+
# azure_oidc test
18+
# ---------------------------------------------------------------------------
19+
test_azure_oidc() {
20+
local ng_name="jfrogazoidc${RUN_ID}"
21+
# Azure node pool names must be <= 12 chars alphanumeric; truncate RUN_ID
22+
ng_name="jfaz${RUN_ID: -8}"
23+
local release_name="jfrog-cp-azure-oidc"
24+
local namespace="jfrog-azure-oidc"
25+
local node_label_value="azure-oidc"
26+
local values_file="/tmp/values-azure-oidc.yaml"
27+
28+
log_step "TEST: Azure OIDC"
29+
30+
cleanup_azure() {
31+
log_step "Cleanup: Azure OIDC"
32+
cleanup_helm_test "${release_name}" "${namespace}" || true
33+
delete_node_group_azure "${AKS_CLUSTER_NAME}" "${AKS_RESOURCE_GROUP}" "${ng_name}" || true
34+
}
35+
trap cleanup_azure EXIT
36+
37+
create_node_group_azure \
38+
"${AKS_CLUSTER_NAME}" \
39+
"${AKS_RESOURCE_GROUP}" \
40+
"${ng_name}" \
41+
"jfrog-test=${node_label_value},credentialsProviderEnabled=true" \
42+
"${AZURE_NODE_VM_SIZE:-Standard_D2pds_v5}" \
43+
"${AZURE_NODE_COUNT:-1}" \
44+
"${AZURE_NODEPOOL_CLIENT_ID}"
45+
46+
generate_values "${REPO_ROOT}/examples/azure-values.yaml" "${values_file}" \
47+
".providerConfig[0].artifactoryUrl = \"${ARTIFACTORY_URL}\"" \
48+
".providerConfig[0].matchImages[0] = \"${MATCH_IMAGES}\"" \
49+
".providerConfig[0].azure.azure_app_client_id = \"${AZURE_APP_CLIENT_ID}\"" \
50+
".providerConfig[0].azure.azure_tenant_id = \"${AZURE_TENANT_ID}\"" \
51+
".providerConfig[0].azure.azure_nodepool_client_id = \"${AZURE_NODEPOOL_CLIENT_ID}\"" \
52+
".providerConfig[0].azure.jfrog_oidc_provider_name = \"${JFROG_OIDC_PROVIDER_NAME}\"" \
53+
54+
run_helm_test \
55+
"${release_name}" \
56+
"${namespace}" \
57+
"${values_file}" \
58+
"${TEST_IMAGE}" \
59+
"jfrog-test" \
60+
"${node_label_value}" \
61+
"false" \
62+
63+
log_info "TEST PASSED: Azure OIDC"
64+
65+
cleanup_azure
66+
trap - EXIT
67+
}
68+
69+
# ---------------------------------------------------------------------------
70+
# Main
71+
# ---------------------------------------------------------------------------
72+
main() {
73+
log_step "Starting Azure E2E tests (run: ${RUN_ID})"
74+
75+
connect_cluster_azure "${AKS_CLUSTER_NAME}" "${AKS_RESOURCE_GROUP}"
76+
77+
test_azure_oidc
78+
79+
log_step "All Azure E2E tests PASSED"
80+
}
81+
82+
main "$@"

‎build/test/env‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# build/test/env - Non-sensitive test configuration
2+
# Source this file before running test scripts.
3+
#
4+
# Required GitHub Actions secrets (not stored here):
5+
# AWS_ROLE_TO_ASSUME - IAM role ARN for GitHub Actions OIDC auth to AWS
6+
# AWS_NODE_ROLE_ARN - IAM role ARN for EKS node groups
7+
# AWS_SUBNET_IDS - Space-separated subnet IDs for EKS node groups
8+
# AZURE_APP_CLIENT_ID - Azure AD app registration client ID
9+
# AZURE_TENANT_ID - Azure AD tenant ID
10+
# AZURE_SUBSCRIPTION_ID - Azure subscription ID
11+
# AZURE_NODEPOOL_CLIENT_ID - Managed identity client ID for AKS node pool
12+
# GCP_WORKLOAD_IDENTITY_PROVIDER - Workload Identity Federation provider for GitHub Actions OIDC auth to GCP
13+
# GCP_SERVICE_ACCOUNT_EMAIL - GCP service account email for node pools and GH Actions auth
14+
15+
# ---------------------------------------------------------------------------
16+
# Shared
17+
# ---------------------------------------------------------------------------
18+
export ARTIFACTORY_URL="partnership.jfrog.io"
19+
export MATCH_IMAGES="partnership*.jfrog.io"
20+
export TEST_IMAGE="partnership-docker-remote-test.jfrog.io/busybox:latest"
21+
22+
# ---------------------------------------------------------------------------
23+
# AWS
24+
# ---------------------------------------------------------------------------
25+
export EKS_CLUSTER_NAME="aws-operator-jfrog"
26+
export AWS_REGION="ap-northeast-3"
27+
export AWS_ROLE_NAME="OperatorSelfManagedWorkerNodeRole"
28+
29+
# ---------------------------------------------------------------------------
30+
# Azure
31+
# ---------------------------------------------------------------------------
32+
export AKS_CLUSTER_NAME="robind-test-v1"
33+
export AKS_RESOURCE_GROUP="infra-robin-test"
34+
export AZURE_JFROG_OIDC_PROVIDER_NAME="azure-aks-oidc-provider"
35+
export AZURE_APP_AUDIENCE="api://AzureADTokenExchange"
36+
export AZURE_IDENTITY_NAME="kep-identity"
37+
38+
# ---------------------------------------------------------------------------
39+
# GCP
40+
# ---------------------------------------------------------------------------
41+
export GKE_CLUSTER_NAME="jfrog-inst-credentials-cluster"
42+
export GCP_PROJECT="jfrog-dev"
43+
export GCP_ZONE="asia-south1-a"
44+
export GCP_MACHINE_TYPE="e2-medium"
45+
export GCP_OIDC_AUDIENCE="jfrog-dev"
46+
export GCP_JFROG_OIDC_PROVIDER_NAME="gcp-gke-oidc-provider"

0 commit comments

Comments
 (0)