Skip to content

Commit 8ee3efc

Browse files
simonmartysimonmarty
authored
Add integration tests workflow (#539)
*Issue #, if available:* *Description of changes:* Fork run: https://github.com/simonmarty/secrets-store-csi-driver-provider-aws/actions/runs/18887954508 (will try to keep this link up to date during review) Add initial integration test workflow. The workflow triggers on `pull_request_target` similar to aws/aws-secretsmanager-agent#136 By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
1 parent e8bd5fc commit 8ee3efc

File tree

8 files changed

+264
-146
lines changed

8 files changed

+264
-146
lines changed

‎.github/workflows/integ.yml‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
name: Integration Tests
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
branches: ["main"]
7+
pull_request_target:
8+
types: [labeled]
9+
10+
concurrency:
11+
# Only run one workflow at a time to avoid hitting the network interface quota
12+
group: integration-tests
13+
cancel-in-progress: false
14+
15+
jobs:
16+
build-docker:
17+
name: Build Docker Image
18+
if: |
19+
github.event_name != 'pull_request_target' ||
20+
contains(github.event.pull_request.labels.*.name, 'safe-to-test')
21+
permissions:
22+
contents: read
23+
packages: write
24+
strategy:
25+
matrix:
26+
runner: [ubuntu-latest, ubuntu-24.04-arm]
27+
include:
28+
- os: linux
29+
- arch: amd64
30+
runner: ubuntu-latest
31+
- arch: arm64
32+
runner: ubuntu-24.04-arm
33+
runs-on: ${{ matrix.runner }}
34+
steps:
35+
- name: Checkout
36+
uses: actions/checkout@v5
37+
with:
38+
ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}
39+
40+
- name: Login to GitHub Container Registry
41+
uses: docker/login-action@v3
42+
with:
43+
registry: ghcr.io
44+
username: ${{ github.actor }}
45+
password: ${{ secrets.GITHUB_TOKEN }}
46+
47+
- name: Build the Docker image
48+
uses: docker/build-push-action@v6
49+
with:
50+
build-args: LDFLAGS=-X 'github.com/aws/secrets-store-csi-driver-provider-aws/server.Version=fakeversion' -X 'github.com/aws/secrets-store-csi-driver-provider-aws/auth.ProviderVersion=fakeversion' -extldflags '-static'
51+
context: .
52+
platforms: ${{ matrix.os }}/${{ matrix.arch }}
53+
load: true
54+
push: true
55+
tags: ghcr.io/${{ github.repository_owner }}/test-build:latest-${{ matrix.arch }}-${{ github.run_id }}
56+
57+
- name: List images
58+
run: |
59+
docker image ls -a
60+
integration-tests:
61+
name: Run Integration Tests
62+
needs: build-docker
63+
if: |
64+
github.event_name != 'pull_request_target' ||
65+
contains(github.event.pull_request.labels.*.name, 'safe-to-test')
66+
permissions:
67+
id-token: write
68+
contents: read
69+
strategy:
70+
fail-fast: false
71+
matrix:
72+
runner: [ubuntu-latest, ubuntu-24.04-arm]
73+
auth_type: [irsa, pod-identity]
74+
include:
75+
- os: linux
76+
- arch: amd64
77+
arch-short: x64
78+
runner: ubuntu-latest
79+
- arch: arm64
80+
arch-short: arm
81+
runner: ubuntu-24.04-arm
82+
runs-on: ${{ matrix.runner }}
83+
84+
steps:
85+
- name: Setup kubectl
86+
uses: azure/setup-kubectl@v4
87+
88+
- name: Setup Helm
89+
uses: azure/setup-helm@v4
90+
91+
- name: Setup eksctl
92+
run: |
93+
ARCH=${{ matrix.arch }}
94+
PLATFORM=$(uname -s)_$ARCH
95+
96+
curl -sLO "https://github.com/eksctl-io/eksctl/releases/latest/download/eksctl_$PLATFORM.tar.gz"
97+
98+
curl -sL "https://github.com/eksctl-io/eksctl/releases/latest/download/eksctl_checksums.txt" | grep $PLATFORM | sha256sum --check
99+
100+
tar -xzf eksctl_$PLATFORM.tar.gz -C /tmp && rm eksctl_$PLATFORM.tar.gz
101+
102+
sudo install -m 0755 /tmp/eksctl /usr/local/bin && rm /tmp/eksctl
103+
104+
- run: eksctl version
105+
106+
- name: Setup Python
107+
uses: actions/setup-python@v6
108+
with:
109+
python-version: "3"
110+
111+
- name: Install Python dependencies
112+
run: pip install boto3
113+
114+
- name: Setup Bats and bats libs
115+
id: setup-bats
116+
uses: bats-core/[email protected]
117+
118+
- name: Checkout
119+
uses: actions/checkout@v5
120+
with:
121+
ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || github.sha }}
122+
123+
- name: Configure AWS credentials
124+
uses: aws-actions/configure-aws-credentials@v5
125+
with:
126+
role-to-assume: ${{ secrets.ROLE_ARN }}
127+
role-session-name: csi-driver-ci-${{ github.run_id }}-${{ matrix.arch }}
128+
aws-region: us-west-2
129+
130+
- name: Run integ tests
131+
run: cd tests && ./run-tests.sh ${{ matrix.arch-short }}-${{ matrix.auth_type }}
132+
env:
133+
POD_IDENTITY_ROLE_ARN: ${{ secrets.POD_IDENTITY_ROLE_ARN }}
134+
PRIVREPO: ghcr.io/${{ github.repository_owner }}/test-build:latest-${{ matrix.arch }}-${{ github.run_id }}
135+
136+
- name: Run cleanup
137+
if: always()
138+
run: cd tests && ./run-tests.sh clean ${{ matrix.arch-short }}-${{ matrix.auth_type }}

‎.github/workflows/pr_sync.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Remove safe-to-test label when new commits are pushed
2+
3+
on:
4+
pull_request_target:
5+
types: [synchronize]
6+
7+
jobs:
8+
remove-label:
9+
runs-on: ubuntu-latest
10+
permissions:
11+
issues: write
12+
pull-requests: write
13+
contents: read
14+
if: |
15+
contains(github.event.pull_request.labels.*.name, 'safe-to-test')
16+
17+
steps:
18+
- name: Remove label
19+
run: |
20+
echo "Removing label '$LABEL_NAME' from PR #$PR_NUMBER on repo $REPO"
21+
gh_status=$(gh api "repos/$REPO/issues/$PR_NUMBER/labels/$LABEL_NAME" -X DELETE | jq 'if type == "object" then .status else empty end' --raw-output)
22+
case $gh_status in
23+
"") echo "Label removed" ;;
24+
404) echo "Label not found — ignoring" ;;
25+
*) echo "unexpected HTTP $gh_status" && exit 1 ;;
26+
esac
27+
env:
28+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
29+
LABEL_NAME: safe-to-test
30+
REPO: ${{ github.event.pull_request.base.repo.full_name }}
31+
PR_NUMBER: ${{ github.event.pull_request.number }}

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
$(eval AWS_REGION=$(shell echo $${REGION:-us-east-1}))
2-
$(eval REGISTRY_NAME=$(shell echo $${PRIVREPO:-public.ecr.aws/aws-secrets-manager/secrets-store-csi-driver-provider-aws}))
2+
$(eval REGISTRY_NAME=$(shell echo $${PRIVREPO:-public.ecr.aws/aws-secrets-manager/secrets-store-csi-driver-provider-aws:latest}))
33
$(eval REPOBASE=$(shell echo $(REGISTRY_NAME) | cut -f1 -d/))
44

55
ifeq ($(REPOBASE), public.ecr.aws)

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -286,7 +286,7 @@ cd secrets-store-csi-driver-provider-aws
286286
Next, set your region and repository name in bash shell variables to be used later:
287287
```bash
288288
export REGION=<REGION>
289-
export PRIVREPO=<ACCOUNT>.dkr.ecr.$REGION.amazonaws.com/secrets-store-csi-driver-provider-aws
289+
export PRIVREPO=<ACCOUNT>.dkr.ecr.$REGION.amazonaws.com/secrets-store-csi-driver-provider-aws:latest
290290
```
291291
Where **&lt;REGION&gt;** is the AWS region in which your Kubernetes cluster is running, and **&lt;ACCOUNT&gt;** is your AWS account Id. Next create your ECR repository if you have not already done so:
292292
```bash

‎deployment/private-installer.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ spec:
5858
hostNetwork: false
5959
containers:
6060
- name: provider-aws-installer
61-
image: ${PRIVREPO}:latest
61+
image: ${PRIVREPO}
6262
imagePullPolicy: Always
6363
args:
6464
- --provider-volume=/var/run/secrets-store-csi-providers

‎tests/README.md‎

Lines changed: 4 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -8,23 +8,7 @@
88
6. Create the following two IAM roles:
99

1010
```bash
11-
export POD_IDENTITY_X64_ROLE_ARN=$(aws --region "$REGION" --query Role.Arn --output text iam create-role --role-name x64-pod-identity-role --assume-role-policy-document '{
12-
"Version": "2012-10-17",
13-
"Statement": [
14-
{
15-
"Effect": "Allow",
16-
"Principal": {
17-
"Service": "pods.eks.amazonaws.com"
18-
},
19-
"Action": [
20-
"sts:AssumeRole",
21-
"sts:TagSession"
22-
]
23-
}
24-
]
25-
}')
26-
27-
export POD_IDENTITY_ARM_ROLE_ARN=$(aws --region "$REGION" --query Role.Arn --output text iam create-role --role-name arm-pod-identity-role --assume-role-policy-document '{
11+
export POD_IDENTITY_ROLE_ARN=$(aws --region "$REGION" --query Role.Arn --output text iam create-role --role-name pod-identity-role --assume-role-policy-document '{
2812
"Version": "2012-10-17",
2913
"Statement": [
3014
{
@@ -41,14 +25,14 @@ export POD_IDENTITY_ARM_ROLE_ARN=$(aws --region "$REGION" --query Role.Arn --out
4125
}')
4226
```
4327

44-
7. Attach the following policies to each role, replacing `${ARCH}` with `x64` and `arm` respectively:
28+
7. Attach the following policies to the role:
4529

4630
```bash
4731
aws iam attach-role-policy \
48-
--role-name ${ARCH}-pod-identity-role \
32+
--role-name pod-identity-role \
4933
--policy-arn arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess
5034
aws iam attach-role-policy \
51-
--role-name ${ARCH}-pod-identity-role \
35+
--role-name pod-identity-role \
5236
--policy-arn arn:aws:iam::aws:policy/SecretsManagerReadWrite
5337
```
5438

0 commit comments

Comments
 (0)