Skip to content

Commit 610231f

Browse files
lantolilantoli
authored
chore: Bring SA dev branch non-production changes to master (#3733)
1 parent 4d7aa00 commit 610231f

File tree

12 files changed

+252
-74
lines changed

12 files changed

+252
-74
lines changed

‎.github/workflows/acceptance-tests-runner.yml‎

Lines changed: 70 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,11 @@ on:
2929
description: 'If run only minimum tests for advanced_cluster, e.g. in PRs'
3030
type: boolean
3131
required: false
32-
default: false
33-
32+
default: false
33+
use_sa:
34+
description: "Run tests using Service Account instead of API Keys"
35+
type: boolean
36+
required: false
3437
mongodb_atlas_org_id:
3538
type: string
3639
required: true
@@ -156,6 +159,10 @@ on:
156159
required: true
157160
mongodb_atlas_rp_public_key:
158161
required: true
162+
mongodb_atlas_client_id:
163+
required: true
164+
mongodb_atlas_client_secret:
165+
required: true
159166
azure_directory_id:
160167
required: true
161168
azure_resource_group_name:
@@ -195,16 +202,17 @@ env:
195202
MONGODB_ATLAS_BASE_URL: ${{ inputs.mongodb_atlas_base_url }}
196203
MONGODB_REALM_BASE_URL: ${{ inputs.mongodb_realm_base_url }}
197204
MONGODB_ATLAS_ORG_ID: ${{ inputs.mongodb_atlas_org_id }}
198-
MONGODB_ATLAS_PUBLIC_KEY: ${{ secrets.mongodb_atlas_public_key }}
199-
MONGODB_ATLAS_PRIVATE_KEY: ${{ secrets.mongodb_atlas_private_key }}
205+
MONGODB_ATLAS_PUBLIC_KEY: ${{ inputs.use_sa == false && secrets.mongodb_atlas_public_key || '' }}
206+
MONGODB_ATLAS_PRIVATE_KEY: ${{ inputs.use_sa == false && secrets.mongodb_atlas_private_key || '' }}
207+
MONGODB_ATLAS_CLIENT_ID: ${{ inputs.use_sa && secrets.mongodb_atlas_client_id || '' }}
208+
MONGODB_ATLAS_CLIENT_SECRET: ${{ inputs.use_sa && secrets.mongodb_atlas_client_secret || '' }}
200209
MONGODB_ATLAS_PUBLIC_KEY_READ_ONLY: ${{ secrets.mongodb_atlas_public_key_read_only }}
201210
MONGODB_ATLAS_PRIVATE_KEY_READ_ONLY: ${{ secrets.mongodb_atlas_private_key_read_only }}
202211
MONGODB_ATLAS_GOV_PUBLIC_KEY: ${{ secrets.mongodb_atlas_gov_public_key }}
203212
MONGODB_ATLAS_GOV_PRIVATE_KEY: ${{ secrets.mongodb_atlas_gov_private_key }}
204213
MONGODB_ATLAS_GOV_BASE_URL: ${{ inputs.mongodb_atlas_gov_base_url }}
205214
MONGODB_ATLAS_GOV_ORG_ID: ${{ inputs.mongodb_atlas_gov_org_id }}
206215

207-
208216
jobs:
209217

210218
get-provider-version:
@@ -231,6 +239,7 @@ jobs:
231239
outputs: # ensure resources are sorted alphabetically
232240
advanced_cluster: ${{ steps.filter.outputs.advanced_cluster == 'true' || env.mustTrigger == 'true' }}
233241
assume_role: ${{ steps.filter.outputs.assume_role == 'true' || env.mustTrigger == 'true' }}
242+
authentication: ${{ steps.filter.outputs.authentication == 'true' || env.mustTrigger == 'true' }}
234243
autogen: ${{ steps.filter.outputs.autogen == 'true' || env.mustTrigger == 'true' }}
235244
backup: ${{ steps.filter.outputs.backup == 'true' || env.mustTrigger == 'true' }}
236245
control_plane_ip_addresses: ${{ steps.filter.outputs.control_plane_ip_addresses == 'true' || env.mustTrigger == 'true' }}
@@ -264,6 +273,10 @@ jobs:
264273
advanced_cluster:
265274
- 'internal/service/advancedcluster/*.go'
266275
assume_role:
276+
- 'internal/config/*.go'
277+
- 'internal/provider/*.go'
278+
authentication:
279+
- 'internal/config/*.go'
267280
- 'internal/provider/*.go'
268281
autogen:
269282
- 'internal/common/autogen/*.go'
@@ -388,13 +401,13 @@ jobs:
388401
MONGODB_ATLAS_LAST_VERSION: ${{ needs.get-provider-version.outputs.provider_version }}
389402
HTTP_MOCKER_CAPTURE: 'true'
390403
ACCTEST_REGEX_RUN: ${{ inputs.reduced_tests && '^TestAccMockable' || env.ACCTEST_REGEX_RUN }}
391-
ACCTEST_PACKAGES: |
392-
./internal/service/advancedcluster
404+
ACCTEST_PACKAGES: ./internal/service/advancedcluster
393405
run: make testacc
394406

395407
advanced_cluster_tpf_mig_from_sdkv2:
396408
needs: [ change-detection, get-provider-version ]
397-
if: ${{ inputs.reduced_tests == false && (needs.change-detection.outputs.advanced_cluster == 'true' || inputs.test_group == 'advanced_cluster') }}
409+
# Previous advanced_cluster versions don't support SA.
410+
if: ${{ inputs.reduced_tests == false && inputs.use_sa == false && (needs.change-detection.outputs.advanced_cluster == 'true' || inputs.test_group == 'advanced_cluster') }}
398411
runs-on: ubuntu-latest
399412
permissions: {}
400413
steps:
@@ -414,13 +427,13 @@ jobs:
414427
MONGODB_ATLAS_LAST_1X_VERSION: ${{ inputs.mongodb_atlas_last_1x_version }}
415428
MONGODB_ATLAS_TEST_SDKV2_TO_TPF: 'true'
416429
ACCTEST_REGEX_RUN: '^TestV1xMig'
417-
ACCTEST_PACKAGES: |
418-
./internal/service/advancedcluster
430+
ACCTEST_PACKAGES: ./internal/service/advancedcluster
419431
run: make testacc
420432

421433
advanced_cluster_tpf_mig_from_tpf_preview:
422434
needs: [ change-detection, get-provider-version ]
423-
if: ${{ inputs.reduced_tests == false && (needs.change-detection.outputs.advanced_cluster == 'true' || inputs.test_group == 'advanced_cluster') }}
435+
# Previous advanced_cluster versions don't support SA.
436+
if: ${{ inputs.reduced_tests == false && inputs.use_sa == false && (needs.change-detection.outputs.advanced_cluster == 'true' || inputs.test_group == 'advanced_cluster') }}
424437
runs-on: ubuntu-latest
425438
permissions: {}
426439
steps:
@@ -441,8 +454,7 @@ jobs:
441454
MONGODB_ATLAS_LAST_1X_VERSION: ${{ inputs.mongodb_atlas_last_1x_version }}
442455
MONGODB_ATLAS_TEST_SDKV2_TO_TPF: 'false'
443456
ACCTEST_REGEX_RUN: '^TestV1xMig'
444-
ACCTEST_PACKAGES: |
445-
./internal/service/advancedcluster
457+
ACCTEST_PACKAGES: ./internal/service/advancedcluster
446458
run: make testacc
447459

448460
assume_role:
@@ -503,8 +515,49 @@ jobs:
503515
ACCTEST_REGEX_RUN: ^TestAccSTSAssumeRole_basic$
504516
run: make testacc
505517

506-
autogen:
518+
authentication:
507519
needs: [ change-detection, get-provider-version ]
520+
if: ${{ needs.change-detection.outputs.authentication == 'true' || inputs.test_group == 'authentication' }}
521+
runs-on: ubuntu-latest
522+
permissions: {}
523+
steps:
524+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
525+
with:
526+
ref: ${{ inputs.ref || github.ref }}
527+
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
528+
with:
529+
go-version-file: 'go.mod'
530+
- uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd
531+
with:
532+
terraform_version: ${{ inputs.terraform_version }}
533+
terraform_wrapper: false
534+
- name: Acceptance Tests (Service Account)
535+
env:
536+
MONGODB_ATLAS_PUBLIC_KEY: ""
537+
MONGODB_ATLAS_PRIVATE_KEY: ""
538+
MONGODB_ATLAS_CLIENT_ID: ${{ secrets.mongodb_atlas_client_id }}
539+
MONGODB_ATLAS_CLIENT_SECRET: ${{ secrets.mongodb_atlas_client_secret }}
540+
MONGODB_ATLAS_LAST_VERSION: ${{ needs.get-provider-version.outputs.provider_version }}
541+
ACCTEST_REGEX_RUN: '^TestUnexisting' # TODO: SA not implemented in master yet
542+
# ACCTEST_REGEX_RUN: '^TestAccServiceAccount'
543+
ACCTEST_PACKAGES: ./internal/provider
544+
run: make testacc
545+
- name: Acceptance Tests (Service Account smoke tests) # small selection of fast tests to run with SA
546+
env:
547+
MONGODB_ATLAS_PUBLIC_KEY: ""
548+
MONGODB_ATLAS_PRIVATE_KEY: ""
549+
MONGODB_ATLAS_CLIENT_ID: ${{ secrets.mongodb_atlas_client_id }}
550+
MONGODB_ATLAS_CLIENT_SECRET: ${{ secrets.mongodb_atlas_client_secret }}
551+
MONGODB_ATLAS_LAST_VERSION: ${{ needs.get-provider-version.outputs.provider_version }}
552+
ACCTEST_REGEX_RUN: '^TestUnexisting' # TODO: SA not implemented in master yet
553+
ACCTEST_PACKAGES: |
554+
./internal/service/alertconfiguration
555+
./internal/service/databaseuser
556+
./internal/service/maintenancewindow
557+
run: make testacc
558+
559+
autogen:
560+
needs: [change-detection, get-provider-version]
508561
if: ${{ needs.change-detection.outputs.autogen == 'true' || inputs.test_group == 'autogen' }}
509562
runs-on: ubuntu-latest
510563
permissions: {}
@@ -766,8 +819,9 @@ jobs:
766819
run: make testacc
767820

768821
event_trigger:
769-
needs: [ change-detection, get-provider-version ]
770-
if: ${{ needs.change-detection.outputs.event_trigger == 'true' || inputs.test_group == 'event_trigger' }}
822+
needs: [change-detection, get-provider-version]
823+
# Realm SDK doesn't support SA.
824+
if: ${{ inputs.use_sa == false && (needs.change-detection.outputs.event_trigger == 'true' || inputs.test_group == 'event_trigger') }}
771825
runs-on: ubuntu-latest
772826
permissions: {}
773827
steps:

‎.github/workflows/acceptance-tests.yml‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: 'Acceptance Tests'
2-
run-name: 'Acceptance Tests ${{ inputs.atlas_cloud_env }} ${{ inputs.test_group }}'
2+
run-name: "Acceptance Tests ${{ inputs.atlas_cloud_env }} ${{ inputs.test_group }} ${{ inputs.use_sa && 'sa' || 'pak'}}"
33

44
# Used for running acceptance tests, either triggered manually or called by other workflows.
55
on:
@@ -29,6 +29,11 @@ on:
2929
description: 'The branch, tag or SHA where tests will run, e.g. v1.14.0, empty for default branch'
3030
type: string
3131
required: false
32+
use_sa:
33+
description: "Run tests using Service Account instead of API Keys"
34+
type: boolean
35+
required: false
36+
3237
workflow_call: # workflow runs after Test Suite or code-health
3338
inputs:
3439
terraform_version:
@@ -51,7 +56,11 @@ on:
5156
description: 'If run only minimum tests for advanced_cluster, e.g. in PRs'
5257
type: boolean
5358
required: false
54-
59+
use_sa:
60+
description: "Run tests using Service Account instead of API Keys"
61+
type: boolean
62+
required: false
63+
5564
jobs:
5665
tests:
5766
name: tests-${{ inputs.terraform_version || 'latest' }}-${{ inputs.provider_version || 'latest' }}-${{ inputs.atlas_cloud_env || 'dev' }}
@@ -65,6 +74,8 @@ jobs:
6574
mongodb_atlas_gov_private_key: ${{ inputs.atlas_cloud_env == 'qa' && secrets.MONGODB_ATLAS_GOV_PRIVATE_KEY_QA || secrets.MONGODB_ATLAS_GOV_PRIVATE_KEY_DEV }}
6675
mongodb_atlas_rp_public_key: ${{ inputs.atlas_cloud_env == 'qa' && secrets.MONGODB_ATLAS_RP_PUBLIC_KEY_QA || secrets.MONGODB_ATLAS_RP_PUBLIC_KEY_DEV }}
6776
mongodb_atlas_rp_private_key: ${{ inputs.atlas_cloud_env == 'qa' && secrets.MONGODB_ATLAS_RP_PRIVATE_KEY_QA || secrets.MONGODB_ATLAS_RP_PRIVATE_KEY_DEV }}
77+
mongodb_atlas_client_id: ${{ inputs.atlas_cloud_env == 'qa' && secrets.MONGODB_ATLAS_CLIENT_ID_QA || secrets.MONGODB_ATLAS_CLIENT_ID_DEV }}
78+
mongodb_atlas_client_secret: ${{ inputs.atlas_cloud_env == 'qa' && secrets.MONGODB_ATLAS_CLIENT_SECRET_QA || secrets.MONGODB_ATLAS_CLIENT_SECRET_DEV }}
6879
ca_cert: ${{ secrets.CA_CERT }}
6980
aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
7081
aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
@@ -95,14 +106,14 @@ jobs:
95106
confluent_cloud_api_secret: ${{ secrets.CONFLUENT_CLOUD_API_SECRET }}
96107
aws_customer_master_key_id: ${{ secrets.AWS_CUSTOMER_MASTER_KEY_ID }}
97108

98-
99109
with:
100110
terraform_version: ${{ inputs.terraform_version || '1.13.x' }}
101111
provider_version: ${{ inputs.provider_version }}
102112
ref: ${{ inputs.ref }}
103113
test_group: ${{ inputs.test_group }}
104114
test_name: ${{ inputs.test_name }}
105115
reduced_tests: ${{ inputs.reduced_tests || false }}
116+
use_sa: ${{ inputs.use_sa || false }}
106117
aws_region_federation: ${{ vars.AWS_REGION_FEDERATION }}
107118
mongodb_atlas_org_id: ${{ inputs.atlas_cloud_env == 'qa' && vars.MONGODB_ATLAS_ORG_ID_CLOUD_QA || vars.MONGODB_ATLAS_ORG_ID_CLOUD_DEV }}
108119
mongodb_atlas_base_url: ${{ inputs.atlas_cloud_env == 'qa' && vars.MONGODB_ATLAS_BASE_URL_QA || vars.MONGODB_ATLAS_BASE_URL }}

‎.github/workflows/test-suite.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,10 @@ on:
1717
description: 'Send the Slack notification if any of the tests fail.'
1818
type: boolean
1919
default: false
20+
use_sa:
21+
description: "Run tests using Service Account instead of API Keys"
22+
type: boolean
23+
required: false
2024
workflow_call:
2125
inputs:
2226
terraform_matrix:
@@ -34,9 +38,9 @@ on:
3438
description: 'Send the Slack notification if any of the tests fail.'
3539
type: boolean
3640
default: true
37-
3841
schedule:
3942
- cron: "0 0 2-31 * *" # workflow runs every day at midnight UTC except on the first day of the month
43+
4044
concurrency:
4145
group: '${{ github.workflow }}'
4246
cancel-in-progress: false
@@ -70,13 +74,14 @@ jobs:
7074
matrix:
7175
terraform_version: ${{ fromJSON(needs.variables.outputs.terraform_matrix) }}
7276
provider_version: ${{ fromJSON(needs.variables.outputs.provider_matrix) }}
73-
name: ${{ matrix.terraform_version || 'latest' }}-${{ matrix.provider_version || 'latest' }}
77+
name: ${{ matrix.terraform_version || 'latest' }}-${{ matrix.provider_version || 'latest' }}-${{ inputs.use_sa && 'sa' || 'pak' }}
7478
secrets: inherit
7579
uses: ./.github/workflows/acceptance-tests.yml
7680
with:
7781
terraform_version: ${{ matrix.terraform_version }}
7882
provider_version: ${{ matrix.provider_version }}
7983
atlas_cloud_env: ${{ inputs.atlas_cloud_env || needs.variables.outputs.is_sun == 'true' && 'qa' || '' }} # Run against QA on Sundays
84+
use_sa: ${{ inputs.use_sa || false }}
8085
clean-after:
8186
needs: tests
8287
if: ${{ !cancelled() }}

‎internal/provider/provider_authentication_test.go‎

Lines changed: 53 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,15 @@ import (
1010
)
1111

1212
func TestAccSTSAssumeRole_basic(t *testing.T) {
13+
acc.SkipInPAK(t, "skipping as this test is for AWS credentials only")
14+
acc.SkipInSA(t, "skipping as this test is for AWS credentials only")
1315
var (
1416
resourceName = "mongodbatlas_project.test"
1517
orgID = os.Getenv("MONGODB_ATLAS_ORG_ID")
1618
projectName = acc.RandomProjectName()
1719
)
1820
resource.ParallelTest(t, resource.TestCase{
19-
PreCheck: func() { acc.PreCheckSTSAssumeRole(t); acc.PreCheckRegularCredsAreEmpty(t) },
21+
PreCheck: func() { acc.PreCheckSTSAssumeRole(t) },
2022
ProtoV6ProviderFactories: acc.TestAccProviderV6Factories,
2123
CheckDestroy: acc.CheckDestroyProject,
2224
Steps: []resource.TestStep{
@@ -40,6 +42,48 @@ func TestAccSTSAssumeRole_basic(t *testing.T) {
4042
})
4143
}
4244

45+
func TestAccServiceAccount_basic(t *testing.T) {
46+
acc.SkipInPAK(t, "skipping as this test is for SA only")
47+
var (
48+
resourceName = "data.mongodbatlas_organization.test"
49+
orgID = os.Getenv("MONGODB_ATLAS_ORG_ID")
50+
)
51+
resource.ParallelTest(t, resource.TestCase{
52+
PreCheck: func() { acc.PreCheckBasic(t) },
53+
ProtoV6ProviderFactories: acc.TestAccProviderV6Factories,
54+
Steps: []resource.TestStep{
55+
{
56+
Config: configDataSourceOrg(orgID),
57+
Check: resource.ComposeAggregateTestCheckFunc(
58+
resource.TestCheckResourceAttrSet(resourceName, "org_id"),
59+
),
60+
},
61+
},
62+
})
63+
}
64+
65+
func TestAccAccessToken_basic(t *testing.T) {
66+
acc.SkipTestForCI(t) // access token has a validity period of 1 hour, so it cannot be used in CI reliably
67+
acc.SkipInPAK(t, "skipping as this test is for Token credentials only")
68+
acc.SkipInSA(t, "skipping as this test is for Token credentials only")
69+
var (
70+
resourceName = "data.mongodbatlas_organization.test"
71+
orgID = os.Getenv("MONGODB_ATLAS_ORG_ID")
72+
)
73+
resource.ParallelTest(t, resource.TestCase{
74+
PreCheck: func() { acc.PreCheckAccessToken(t) },
75+
ProtoV6ProviderFactories: acc.TestAccProviderV6Factories,
76+
Steps: []resource.TestStep{
77+
{
78+
Config: configDataSourceOrg(orgID),
79+
Check: resource.ComposeAggregateTestCheckFunc(
80+
resource.TestCheckResourceAttrSet(resourceName, "org_id"),
81+
),
82+
},
83+
},
84+
})
85+
}
86+
4387
func configProject(orgID, projectName string) string {
4488
return fmt.Sprintf(`
4589
resource "mongodbatlas_project" "test" {
@@ -48,3 +92,11 @@ func configProject(orgID, projectName string) string {
4892
}
4993
`, orgID, projectName)
5094
}
95+
96+
func configDataSourceOrg(orgID string) string {
97+
return fmt.Sprintf(`
98+
data "mongodbatlas_organization" "test" {
99+
org_id = %[1]q
100+
}
101+
`, orgID)
102+
}

‎internal/service/organization/resource_organization_test.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -481,10 +481,10 @@ func checkAggr(orgOwnerID, name, description string, settings *admin.Organizatio
481481
"name": name,
482482
"org_owner_id": orgOwnerID,
483483
"description": description,
484-
"api_access_list_required": strconv.FormatBool(*settings.ApiAccessListRequired),
485-
"multi_factor_auth_required": strconv.FormatBool(*settings.MultiFactorAuthRequired),
486-
"restrict_employee_access": strconv.FormatBool(*settings.RestrictEmployeeAccess),
487-
"gen_ai_features_enabled": strconv.FormatBool(*settings.GenAIFeaturesEnabled),
484+
"api_access_list_required": strconv.FormatBool(settings.GetApiAccessListRequired()),
485+
"multi_factor_auth_required": strconv.FormatBool(settings.GetMultiFactorAuthRequired()),
486+
"restrict_employee_access": strconv.FormatBool(settings.GetRestrictEmployeeAccess()),
487+
"gen_ai_features_enabled": strconv.FormatBool(settings.GetGenAIFeaturesEnabled()),
488488
"security_contact": settings.GetSecurityContact(),
489489
}
490490
checks := []resource.TestCheckFunc{

‎internal/service/project/resource_project_migration_test.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,7 @@ func TestMigProject_withLimits(t *testing.T) {
153153

154154
// based on bug report: https://github.com/mongodb/terraform-provider-mongodbatlas/issues/2263
155155
func TestMigGovProject_regionUsageRestrictionsDefault(t *testing.T) {
156+
acc.SkipInSA(t, "SA not supported in Gov tests yet")
156157
var (
157158
orgID = os.Getenv("MONGODB_ATLAS_GOV_ORG_ID")
158159
projectName = acc.RandomProjectName()

‎internal/service/project/resource_project_test.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -638,6 +638,7 @@ func TestAccProject_basic(t *testing.T) {
638638
}
639639

640640
func TestAccGovProject_withProjectOwner(t *testing.T) {
641+
acc.SkipInSA(t, "SA not supported in Gov tests yet")
641642
var (
642643
orgID = os.Getenv("MONGODB_ATLAS_GOV_ORG_ID")
643644
projectOwnerID = os.Getenv("MONGODB_ATLAS_GOV_PROJECT_OWNER_ID")

‎internal/testutil/acc/factory.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,12 @@ func ConnV2UsingGov() *admin.APIClient {
5252
}
5353

5454
func init() {
55+
if InUnitTest() { // Dummy credentials for unit tests
56+
os.Setenv("MONGODB_ATLAS_PUBLIC_KEY", "dummy")
57+
os.Setenv("MONGODB_ATLAS_PRIVATE_KEY", "dummy")
58+
os.Unsetenv("MONGODB_ATLAS_CLIENT_ID")
59+
os.Unsetenv("MONGODB_ATLAS_CLIENT_SECRET")
60+
}
5561
TestAccProviderV6Factories = map[string]func() (tfprotov6.ProviderServer, error){
5662
ProviderNameMongoDBAtlas: func() (tfprotov6.ProviderServer, error) {
5763
return provider.MuxProviderFactory()(), nil

0 commit comments

Comments
 (0)