Skip to content

Commit 8b80a77

Browse files
bhapasbhapas
committed
DO NOT MERGE Test aws integration on localstack API
1 parent cc58daf commit 8b80a77

10 files changed

Lines changed: 338 additions & 54 deletions

File tree

‎.buildkite/pipeline.trigger.integration.tests.sh‎

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -18,37 +18,37 @@ STACK_COMMAND_TESTS=(
1818
test-stack-command-8x
1919
)
2020

21-
for test in ${STACK_COMMAND_TESTS[@]}; do
22-
echo " - label: \":go: Running integration test: ${test}\""
23-
echo " command: ./.buildkite/scripts/integration_tests.sh -t ${test}"
24-
echo " agents:"
25-
echo " provider: \"gcp\""
26-
echo " artifact_paths:"
27-
echo " - build/elastic-stack-dump/stack/*/logs/*.log"
28-
echo " - build/elastic-stack-dump/stack/*/logs/fleet-server-internal/**/*"
29-
echo " - build/elastic-stack-status/*/*"
30-
done
21+
# for test in ${STACK_COMMAND_TESTS[@]}; do
22+
# echo " - label: \":go: Running integration test: ${test}\""
23+
# echo " command: ./.buildkite/scripts/integration_tests.sh -t ${test}"
24+
# echo " agents:"
25+
# echo " provider: \"gcp\""
26+
# echo " artifact_paths:"
27+
# echo " - build/elastic-stack-dump/stack/*/logs/*.log"
28+
# echo " - build/elastic-stack-dump/stack/*/logs/fleet-server-internal/**/*"
29+
# echo " - build/elastic-stack-status/*/*"
30+
# done
3131

3232
CHECK_PACKAGES_TESTS=(
3333
test-check-packages-other
3434
test-check-packages-with-kind
3535
test-check-packages-with-custom-agent
3636
test-check-packages-benchmarks
3737
)
38-
for test in ${CHECK_PACKAGES_TESTS[@]}; do
39-
echo " - label: \":go: Running integration test: ${test}\""
40-
echo " command: ./.buildkite/scripts/integration_tests.sh -t ${test}"
41-
echo " agents:"
42-
echo " provider: \"gcp\""
43-
echo " artifact_paths:"
44-
echo " - build/test-results/*.xml"
45-
echo " - build/elastic-stack-dump/stack/check-*/logs/*.log"
46-
echo " - build/elastic-stack-dump/stack/check-*/logs/fleet-server-internal/**/*"
47-
echo " - build/elastic-stack-status/*/*"
48-
if [[ $test =~ with-kind$ ]]; then
49-
echo " - build/kubectl-dump.txt"
50-
fi
51-
done
38+
# for test in ${CHECK_PACKAGES_TESTS[@]}; do
39+
# echo " - label: \":go: Running integration test: ${test}\""
40+
# echo " command: ./.buildkite/scripts/integration_tests.sh -t ${test}"
41+
# echo " agents:"
42+
# echo " provider: \"gcp\""
43+
# echo " artifact_paths:"
44+
# echo " - build/test-results/*.xml"
45+
# echo " - build/elastic-stack-dump/stack/check-*/logs/*.log"
46+
# echo " - build/elastic-stack-dump/stack/check-*/logs/fleet-server-internal/**/*"
47+
# echo " - build/elastic-stack-status/*/*"
48+
# if [[ $test =~ with-kind$ ]]; then
49+
# echo " - build/kubectl-dump.txt"
50+
# fi
51+
# done
5252

5353
pushd test/packages/parallel > /dev/null
5454
for package in $(find . -maxdepth 1 -mindepth 1 -type d) ; do

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ test-check-packages-benchmarks:
8181
PACKAGE_TEST_TYPE=benchmarks ./scripts/test-check-packages.sh
8282

8383
test-check-packages-parallel:
84-
PACKAGE_TEST_TYPE=parallel ./scripts/test-check-packages.sh
84+
PACKAGE_TEST_TYPE=parallel PACKAGE_UNDER_TEST=aws ./scripts/test-check-packages.sh
8585

8686
test-check-packages-with-custom-agent:
8787
PACKAGE_TEST_TYPE=with-custom-agent ./scripts/test-check-packages.sh

‎internal/testrunner/runners/system/servicedeployer/_static/localstack_deployer.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
version: "3.8"
2+
services:
3+
localstack:
4+
container_name: "${LOCALSTACK_DOCKER_NAME-localstack_main}"
5+
image: localstack/localstack
6+
hostname: localstack
7+
ports:
8+
- "4566:4566" # LocalStack Gateway
9+
environment:
10+
- SERVICES=sqs,sns
11+
- DEBUG=1
12+
- DOCKER_HOST=unix:///var/run/docker.sock
13+
- HOST_TMP_FOLDER=${TMPDIR}
14+
- HOSTNAME_EXTERNAL=localstack
15+
- S3_HOSTNAME=localstack
16+
volumes:
17+
- "${LOCALSTACK_VOLUME_DIR:-./volume}:/var/lib/localstack"
18+
- "/var/run/docker.sock:/var/run/docker.sock"

‎internal/testrunner/runners/system/servicedeployer/_static/terraform_deployer_run.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ trap cleanup EXIT INT TERM
2121
terraform init
2222
terraform plan
2323
terraform apply -auto-approve && touch /tmp/tf-applied
24+
terraform output -json > ./infrastructure.json
2425

2526
echo "Terraform definitions applied."
2627

‎internal/testrunner/runners/system/servicedeployer/terraform.go‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,14 @@ import (
2424
const (
2525
terraformDeployerDir = "terraform"
2626
terraformDeployerYml = "terraform-deployer.yml"
27+
localstackDeployerYml = "localstack-deployer.yml"
2728
terraformDeployerDockerfile = "Dockerfile"
2829
terraformDeployerRun = "run.sh"
2930
)
3031

32+
//go:embed _static/localstack_deployer.yml
33+
var localstackDeployerYmlContent string
34+
3135
//go:embed _static/terraform_deployer.yml
3236
var terraformDeployerYmlContent string
3337

@@ -59,12 +63,21 @@ func (tsd TerraformServiceDeployer) SetUp(inCtxt ServiceContext) (DeployedServic
5963
}
6064

6165
ymlPaths := []string{filepath.Join(configDir, terraformDeployerYml)}
66+
67+
localstackYmlPath := filepath.Join(configDir, localstackDeployerYml)
68+
_, err = os.Stat(localstackYmlPath)
69+
if err == nil {
70+
ymlPaths = append(ymlPaths, localstackYmlPath)
71+
}
72+
6273
envYmlPath := filepath.Join(tsd.definitionsDir, envYmlFile)
6374
_, err = os.Stat(envYmlPath)
6475
if err == nil {
6576
ymlPaths = append(ymlPaths, envYmlPath)
6677
}
6778

79+
logger.Debug("Print the yml Paths %s", ymlPaths)
80+
6881
tfEnvironment := tsd.buildTerraformExecutorEnvironment(inCtxt)
6982

7083
service := dockerComposeDeployedService{
@@ -130,6 +143,11 @@ func (tsd TerraformServiceDeployer) installDockerfile() (string, error) {
130143
tfDir := filepath.Join(locationManager.DeployerDir(), terraformDeployerDir)
131144

132145
resources := []resource.Resource{
146+
&resource.File{
147+
Path: localstackDeployerYml,
148+
Content: resource.FileContentLiteral(localstackDeployerYmlContent),
149+
CreateParent: true,
150+
},
133151
&resource.File{
134152
Path: terraformDeployerYml,
135153
Content: resource.FileContentLiteral(terraformDeployerYmlContent),

‎test/packages/parallel/aws/data_stream/ec2_metrics/_dev/deploy/tf/cloudwatch.tf‎

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
resource "aws_cloudwatch_metric_stream" "main" {
2+
name = "my-metric-stream"
3+
role_arn = aws_iam_role.metric_stream_to_firehose.arn
4+
firehose_arn = aws_kinesis_firehose_delivery_stream.s3_stream.arn
5+
output_format = "json"
6+
7+
include_filter {
8+
namespace = "AWS/EC2"
9+
metric_names = ["CPUUtilization", "NetworkOut"]
10+
}
11+
12+
include_filter {
13+
namespace = "AWS/EBS"
14+
metric_names = []
15+
}
16+
}
17+
18+
# https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-metric-streams-trustpolicy.html
19+
data "aws_iam_policy_document" "streams_assume_role" {
20+
statement {
21+
effect = "Allow"
22+
23+
principals {
24+
type = "Service"
25+
identifiers = ["streams.metrics.cloudwatch.amazonaws.com"]
26+
}
27+
28+
actions = [
29+
"sts:AssumeRole",
30+
"iam:passRole",
31+
"cloudwatch:PutMetricStream"
32+
]
33+
}
34+
}
35+
36+
resource "aws_iam_role" "metric_stream_to_firehose" {
37+
name = "metric_stream_to_firehose_role"
38+
assume_role_policy = data.aws_iam_policy_document.streams_assume_role.json
39+
}
40+
41+
# https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-metric-streams-trustpolicy.html
42+
data "aws_iam_policy_document" "metric_stream_to_firehose" {
43+
statement {
44+
effect = "Allow"
45+
46+
actions = [
47+
"firehose:PutRecord",
48+
"firehose:PutRecordBatch",
49+
]
50+
51+
resources = [aws_kinesis_firehose_delivery_stream.s3_stream.arn]
52+
}
53+
}
54+
resource "aws_iam_role_policy" "metric_stream_to_firehose" {
55+
name = "default"
56+
role = aws_iam_role.metric_stream_to_firehose.id
57+
policy = data.aws_iam_policy_document.metric_stream_to_firehose.json
58+
}
59+
60+
resource "aws_s3_bucket" "bucket" {
61+
bucket = "metric-stream-test-bucket"
62+
}
63+
64+
resource "aws_s3_bucket_acl" "bucket_acl" {
65+
bucket = aws_s3_bucket.bucket.id
66+
acl = "private"
67+
}
68+
69+
data "aws_iam_policy_document" "firehose_assume_role" {
70+
statement {
71+
effect = "Allow"
72+
73+
principals {
74+
type = "Service"
75+
identifiers = ["firehose.amazonaws.com"]
76+
}
77+
78+
actions = [
79+
"sts:AssumeRole",
80+
"iam:passRole",
81+
"cloudwatch:PutMetricStream"
82+
]
83+
}
84+
}
85+
86+
resource "aws_iam_role" "firehose_to_s3" {
87+
assume_role_policy = data.aws_iam_policy_document.firehose_assume_role.json
88+
}
89+
90+
data "aws_iam_policy_document" "firehose_to_s3" {
91+
statement {
92+
effect = "Allow"
93+
94+
actions = [
95+
"s3:AbortMultipartUpload",
96+
"s3:GetBucketLocation",
97+
"s3:GetObject",
98+
"s3:ListBucket",
99+
"s3:ListBucketMultipartUploads",
100+
"s3:PutObject",
101+
]
102+
103+
resources = [
104+
aws_s3_bucket.bucket.arn,
105+
"${aws_s3_bucket.bucket.arn}/*",
106+
]
107+
}
108+
}
109+
110+
resource "aws_iam_role_policy" "firehose_to_s3" {
111+
name = "default"
112+
role = aws_iam_role.firehose_to_s3.id
113+
policy = data.aws_iam_policy_document.firehose_to_s3.json
114+
}
115+
116+
resource "aws_kinesis_firehose_delivery_stream" "s3_stream" {
117+
name = "metric-stream-test-stream"
118+
destination = "s3"
119+
120+
s3_configuration {
121+
role_arn = aws_iam_role.firehose_to_s3.arn
122+
bucket_arn = aws_s3_bucket.bucket.arn
123+
}
124+
}
125+
126+
resource "aws_iam_user" "ecs_deployer" {
127+
name = "ecs_deployer"
128+
path = "*"
129+
}
130+
131+
# The most important part is the iam:PassRole. With that, this user can give roles to ECS tasks.
132+
# In theory the user can give the task Admin rights. To make sure that does not happen we restrict
133+
# the user and allow him only to hand out roles in /ecs/ path. You still need to be careful not
134+
# to have any roles in there with full admin rights, but no ECS task should have these rights!
135+
resource "aws_iam_user_policy" "ecs_deployer_policy" {
136+
name = "ecs_deployer_policy"
137+
user = aws_iam_user.ecs_deployer.name
138+
policy = jsonencode(
139+
{
140+
"Version" : "2012-10-17",
141+
"Statement" : [
142+
{
143+
"Effect" : "Allow",
144+
"Action" : [
145+
"ecs:RegisterTaskDefinition",
146+
"ecs:DescribeTaskDefinitions",
147+
"ecs:ListTaskDefinitions",
148+
"ecs:CreateService",
149+
"ecs:UpdateService",
150+
"ecs:DescribeServices",
151+
"ecs:ListServices"
152+
],
153+
"Resource" : "*"
154+
},
155+
{
156+
"Effect" : "Allow",
157+
"Action" : [
158+
"cloudwatch:PutMetricStream"
159+
],
160+
"Resource" : "*"
161+
},
162+
{
163+
"Effect" : "Allow",
164+
"Action" : ["iam:PassRole"],
165+
"Resource" : "*"
166+
}
167+
]
168+
})
169+
}
170+
171+
resource "aws_iam_access_key" "ecs_deployer" {
172+
user = aws_iam_user.ecs_deployer.name
173+
}

‎test/packages/parallel/aws/data_stream/ec2_metrics/_dev/deploy/tf/env.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,4 @@ version: '2.3'
22
services:
33
terraform:
44
environment:
5-
- AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
6-
- AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
7-
- AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN}
8-
- AWS_PROFILE=${AWS_PROFILE}
95
- AWS_REGION=${AWS_REGION:-us-east-1}

0 commit comments

Comments
 (0)