Skip to content

Commit d2fce80

Browse files
ig15ig15
authored
Fix e2e workflow authn issue and add local proxy params for integration testing (#514)
* Fix e2e workflow's aws authentication issue * Add --destination-client-type param to localproxy command in integ test * Add ssl certs store param in local proxy command in integ test
1 parent ad9c745 commit d2fce80

File tree

4 files changed

+22
-48
lines changed

4 files changed

+22
-48
lines changed

‎.github/workflows/e2e-ci.yml

Lines changed: 8 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -359,20 +359,15 @@ jobs:
359359
tags: |
360360
public.ecr.aws/${{ env.ECR_TEST_RUNNER_REPO }}:x86_64-ubuntu-${{ needs.versioning.outputs.version }}
361361
public.ecr.aws/${{ env.ECR_TEST_RUNNER_REPO }}:x86_64-ubuntu-latest
362-
platforms: linux/amd64
363-
- name: Assume Role for Integration Test
364-
uses: aws-actions/configure-aws-credentials@v2
365-
with:
366-
role-to-assume: arn:aws:iam::${{ secrets.DC_AWS_ACCOUNT_ID }}:role/integration-test-role
367-
aws-region: us-east-1
362+
platforms: linux/amd64
368363
- name: Run Integration Tests container with OIDC role credentials
369364
env:
370365
IOT_ENDPOINT: ${{ secrets.IOT_ENDPOINT }}
371366
CERTIFICATE: ${{ secrets.CLAIM_CERTIFICATE }}
372367
DEVICE_KEY_SECRET: ${{ secrets.FP_DEVICE_KEY_SECRET }}
373368
AMAZON_ROOT_CA: ${{ secrets.AMAZON_ROOT_CA }}
374369
run: |
375-
docker run -e AWS_ACCESS_KEY_ID="(echo $AWS_ACCESS_KEY_ID)" -e AWS_SECRET_ACCESS_KEY="(echo $AWS_SECRET_ACCESS_KEY)" -e AWS_SESSION_TOKEN="$(echo $AWS_SESSION_TOKEN)" -e IOT_ENDPOINT="$(echo $IOT_ENDPOINT)" -e CERTIFICATE="$(echo $CERTIFICATE)" -e DEVICE_KEY_SECRET="$(echo $DEVICE_KEY_SECRET)" -e AMAZON_ROOT_CA="$(echo $AMAZON_ROOT_CA)" -e THING_NAME=fleetprovisioning ${{ steps.build-test-runner.outputs.imageid }} --clean-up
370+
docker run -e AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID" -e AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY" -e AWS_SESSION_TOKEN="$AWS_SESSION_TOKEN" -e IOT_ENDPOINT="$IOT_ENDPOINT" -e CERTIFICATE="$CERTIFICATE" -e DEVICE_KEY_SECRET="$DEVICE_KEY_SECRET" -e AMAZON_ROOT_CA="$AMAZON_ROOT_CA" -e THING_NAME=fleetprovisioning ${{ steps.build-test-runner.outputs.imageid }} --clean-up
376371
e2e-tests-ubuntu-aarch64:
377372
runs-on: ubuntu-latest
378373
if: ${{ false }} # Disabled for now. aarch64 local proxy build takes too long
@@ -413,19 +408,14 @@ jobs:
413408
public.ecr.aws/${{ env.ECR_TEST_RUNNER_REPO }}:aarch64-ubuntu-${{ needs.versioning.outputs.version }}
414409
public.ecr.aws/${{ env.ECR_TEST_RUNNER_REPO }}:aarch64-ubuntu-latest
415410
platforms: linux/arm64
416-
- name: Assume Role for Integration Test
417-
uses: aws-actions/configure-aws-credentials@v2
418-
with:
419-
role-to-assume: arn:aws:iam::${{ secrets.DC_AWS_ACCOUNT_ID }}:role/integration-test-role
420-
aws-region: us-east-1
421411
- name: Run Integration Tests container with OIDC role credentials
422412
env:
423413
IOT_ENDPOINT: ${{ secrets.IOT_ENDPOINT }}
424414
CERTIFICATE: ${{ secrets.CLAIM_CERTIFICATE }}
425415
DEVICE_KEY_SECRET: ${{ secrets.FP_DEVICE_KEY_SECRET }}
426416
AMAZON_ROOT_CA: ${{ secrets.AMAZON_ROOT_CA }}
427417
run: |
428-
docker run -e AWS_ACCESS_KEY_ID="(echo $AWS_ACCESS_KEY_ID)" -e AWS_SECRET_ACCESS_KEY="(echo $AWS_SECRET_ACCESS_KEY)" -e AWS_SESSION_TOKEN="$(echo $AWS_SESSION_TOKEN)" -e IOT_ENDPOINT="$(echo $IOT_ENDPOINT)" -e CERTIFICATE="$(echo $CERTIFICATE)" -e DEVICE_KEY_SECRET="$(echo $DEVICE_KEY_SECRET)" -e AMAZON_ROOT_CA="$(echo $AMAZON_ROOT_CA)" -e THING_NAME=fleetprovisioning ${{ steps.build-test-runner.outputs.imageid }} --clean-up
418+
docker run -e AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID" -e AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY" -e AWS_SESSION_TOKEN="$AWS_SESSION_TOKEN" -e IOT_ENDPOINT="$(echo $IOT_ENDPOINT)" -e CERTIFICATE="$(echo $CERTIFICATE)" -e DEVICE_KEY_SECRET="$(echo $DEVICE_KEY_SECRET)" -e AMAZON_ROOT_CA="$(echo $AMAZON_ROOT_CA)" -e THING_NAME=fleetprovisioning ${{ steps.build-test-runner.outputs.imageid }} --clean-up
429419
e2e-tests-ubuntu-armv7:
430420
runs-on: ubuntu-latest
431421
if: ${{ false }} # Disabled for now as local proxy builds take too long. Re-enable if binary or image becomes available.
@@ -463,19 +453,14 @@ jobs:
463453
public.ecr.aws/${{ env.ECR_TEST_RUNNER_REPO }}:armv7-ubuntu-${{ needs.versioning.outputs.version }}
464454
public.ecr.aws/${{ env.ECR_TEST_RUNNER_REPO }}:armv7-ubuntu-latest
465455
platforms: linux/arm/v7
466-
- name: Assume Role for Integration Test
467-
uses: aws-actions/configure-aws-credentials@v2
468-
with:
469-
role-to-assume: arn:aws:iam::${{ secrets.DC_AWS_ACCOUNT_ID }}:role/integration-test-role
470-
aws-region: us-east-1
471456
- name: Run Integration Tests container with OIDC role credentials
472457
env:
473458
IOT_ENDPOINT: ${{ secrets.IOT_ENDPOINT }}
474459
CERTIFICATE: ${{ secrets.CLAIM_CERTIFICATE }}
475460
DEVICE_KEY_SECRET: ${{ secrets.FP_DEVICE_KEY_SECRET }}
476461
AMAZON_ROOT_CA: ${{ secrets.AMAZON_ROOT_CA }}
477462
run: |
478-
docker run -e AWS_ACCESS_KEY_ID="(echo $AWS_ACCESS_KEY_ID)" -e AWS_SECRET_ACCESS_KEY="(echo $AWS_SECRET_ACCESS_KEY)" -e AWS_SESSION_TOKEN="$(echo $AWS_SESSION_TOKEN)" -e IOT_ENDPOINT="$(echo $IOT_ENDPOINT)" -e CERTIFICATE="$(echo $CERTIFICATE)" -e DEVICE_KEY_SECRET="$(echo $DEVICE_KEY_SECRET)" -e AMAZON_ROOT_CA="$(echo $AMAZON_ROOT_CA)" -e THING_NAME=fleetprovisioning ${{ steps.build-test-runner.outputs.imageid }} --clean-up
463+
docker run -e AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID" -e AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY" -e AWS_SESSION_TOKEN="$AWS_SESSION_TOKEN" -e IOT_ENDPOINT="$(echo $IOT_ENDPOINT)" -e CERTIFICATE="$(echo $CERTIFICATE)" -e DEVICE_KEY_SECRET="$(echo $DEVICE_KEY_SECRET)" -e AMAZON_ROOT_CA="$(echo $AMAZON_ROOT_CA)" -e THING_NAME=fleetprovisioning ${{ steps.build-test-runner.outputs.imageid }} --clean-up
479464
e2e-tests-amazonlinux-x86_64:
480465
# The amazonlinux integration tests do not run the secure tunneling integration tests. TODO:// Need to configure SSH in ubi8 integration test image
481466
runs-on: ubuntu-latest
@@ -515,19 +500,14 @@ jobs:
515500
public.ecr.aws/${{ env.ECR_TEST_RUNNER_REPO }}:x86_64-amazonlinux-${{ needs.versioning.outputs.version }}
516501
public.ecr.aws/${{ env.ECR_TEST_RUNNER_REPO }}:x86_64-amazonlinux-latest
517502
platforms: linux/amd64
518-
- name: Assume Role for Integration Test
519-
uses: aws-actions/configure-aws-credentials@v2
520-
with:
521-
role-to-assume: arn:aws:iam::${{ secrets.DC_AWS_ACCOUNT_ID }}:role/integration-test-role
522-
aws-region: us-east-1
523503
- name: Run Integration Tests container with OIDC role credentials
524504
env:
525505
IOT_ENDPOINT: ${{ secrets.IOT_ENDPOINT }}
526506
CERTIFICATE: ${{ secrets.CLAIM_CERTIFICATE }}
527507
DEVICE_KEY_SECRET: ${{ secrets.FP_DEVICE_KEY_SECRET }}
528508
AMAZON_ROOT_CA: ${{ secrets.AMAZON_ROOT_CA }}
529509
run: |
530-
docker run -e AWS_ACCESS_KEY_ID="(echo $AWS_ACCESS_KEY_ID)" -e AWS_SECRET_ACCESS_KEY="(echo $AWS_SECRET_ACCESS_KEY)" -e AWS_SESSION_TOKEN="$(echo $AWS_SESSION_TOKEN)" -e IOT_ENDPOINT="$(echo $IOT_ENDPOINT)" -e CERTIFICATE="$(echo $CERTIFICATE)" -e DEVICE_KEY_SECRET="$(echo $DEVICE_KEY_SECRET)" -e AMAZON_ROOT_CA="$(echo $AMAZON_ROOT_CA)" -e THING_NAME=fleetprovisioning ${{ steps.build-test-runner.outputs.imageid }} --clean-up
510+
docker run -e AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID" -e AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY" -e AWS_SESSION_TOKEN="$AWS_SESSION_TOKEN" -e IOT_ENDPOINT="$(echo $IOT_ENDPOINT)" -e CERTIFICATE="$(echo $CERTIFICATE)" -e DEVICE_KEY_SECRET="$(echo $DEVICE_KEY_SECRET)" -e AMAZON_ROOT_CA="$(echo $AMAZON_ROOT_CA)" -e THING_NAME=fleetprovisioning ${{ steps.build-test-runner.outputs.imageid }} --clean-up
531511
e2e-tests-amazonlinux-aarch64:
532512
# The amazonlinux integration tests do not run the secure tunneling integration tests. TODO:// Need to configure SSH in ubi8 integration test image
533513
runs-on: ubuntu-latest
@@ -567,19 +547,14 @@ jobs:
567547
public.ecr.aws/${{ env.ECR_TEST_RUNNER_REPO }}:aarch64-amazonlinux-${{ needs.versioning.outputs.version }}
568548
public.ecr.aws/${{ env.ECR_TEST_RUNNER_REPO }}:aarch64-amazonlinux-latest
569549
platforms: linux/arm64
570-
- name: Assume Role for Integration Test
571-
uses: aws-actions/configure-aws-credentials@v2
572-
with:
573-
role-to-assume: arn:aws:iam::${{ secrets.DC_AWS_ACCOUNT_ID }}:role/integration-test-role
574-
aws-region: us-east-1
575550
- name: Run Integration Tests container with OIDC role credentials
576551
env:
577552
IOT_ENDPOINT: ${{ secrets.IOT_ENDPOINT }}
578553
CERTIFICATE: ${{ secrets.CLAIM_CERTIFICATE }}
579554
DEVICE_KEY_SECRET: ${{ secrets.FP_DEVICE_KEY_SECRET }}
580555
AMAZON_ROOT_CA: ${{ secrets.AMAZON_ROOT_CA }}
581556
run: |
582-
docker run -e AWS_ACCESS_KEY_ID="(echo $AWS_ACCESS_KEY_ID)" -e AWS_SECRET_ACCESS_KEY="(echo $AWS_SECRET_ACCESS_KEY)" -e AWS_SESSION_TOKEN="$(echo $AWS_SESSION_TOKEN)" -e IOT_ENDPOINT="$(echo $IOT_ENDPOINT)" -e CERTIFICATE="$(echo $CERTIFICATE)" -e DEVICE_KEY_SECRET="$(echo $DEVICE_KEY_SECRET)" -e AMAZON_ROOT_CA="$(echo $AMAZON_ROOT_CA)" -e THING_NAME=fleetprovisioning ${{ steps.build-test-runner.outputs.imageid }} --clean-up
557+
docker run -e AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID" -e AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY" -e AWS_SESSION_TOKEN="$AWS_SESSION_TOKEN" -e IOT_ENDPOINT="$(echo $IOT_ENDPOINT)" -e CERTIFICATE="$(echo $CERTIFICATE)" -e DEVICE_KEY_SECRET="$(echo $DEVICE_KEY_SECRET)" -e AMAZON_ROOT_CA="$(echo $AMAZON_ROOT_CA)" -e THING_NAME=fleetprovisioning ${{ steps.build-test-runner.outputs.imageid }} --clean-up
583558
e2e-tests-ubi8-x86_64:
584559
# The ubi8 integration tests do not run the secure tunneling integration tests. TODO:// Need to configure SSH in ubi8 integration test image
585560
runs-on: ubuntu-latest
@@ -621,19 +596,14 @@ jobs:
621596
public.ecr.aws/${{ env.ECR_TEST_RUNNER_REPO }}:x86_64-ubi8-${{ needs.versioning.outputs.version }}
622597
public.ecr.aws/${{ env.ECR_TEST_RUNNER_REPO }}:x86_64-ubi8-latest
623598
platforms: linux/amd64
624-
- name: Assume Role for Integration Test
625-
uses: aws-actions/configure-aws-credentials@v2
626-
with:
627-
role-to-assume: arn:aws:iam::${{ secrets.DC_AWS_ACCOUNT_ID }}:role/integration-test-role
628-
aws-region: us-east-1
629599
- name: Run Integration Tests container with OIDC role credentials
630600
env:
631601
IOT_ENDPOINT: ${{ secrets.IOT_ENDPOINT }}
632602
CERTIFICATE: ${{ secrets.CLAIM_CERTIFICATE }}
633603
DEVICE_KEY_SECRET: ${{ secrets.FP_DEVICE_KEY_SECRET }}
634604
AMAZON_ROOT_CA: ${{ secrets.AMAZON_ROOT_CA }}
635605
run: |
636-
docker run -e AWS_ACCESS_KEY_ID="(echo $AWS_ACCESS_KEY_ID)" -e AWS_SECRET_ACCESS_KEY="(echo $AWS_SECRET_ACCESS_KEY)" -e AWS_SESSION_TOKEN="$(echo $AWS_SESSION_TOKEN)" -e IOT_ENDPOINT="$(echo $IOT_ENDPOINT)" -e CERTIFICATE="$(echo $CERTIFICATE)" -e DEVICE_KEY_SECRET="$(echo $DEVICE_KEY_SECRET)" -e AMAZON_ROOT_CA="$(echo $AMAZON_ROOT_CA)" -e THING_NAME=fleetprovisioning ${{ steps.build-test-runner.outputs.imageid }} --clean-up
606+
docker run -e AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID" -e AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY" -e AWS_SESSION_TOKEN="$AWS_SESSION_TOKEN" -e IOT_ENDPOINT="$(echo $IOT_ENDPOINT)" -e CERTIFICATE="$(echo $CERTIFICATE)" -e DEVICE_KEY_SECRET="$(echo $DEVICE_KEY_SECRET)" -e AMAZON_ROOT_CA="$(echo $AMAZON_ROOT_CA)" -e THING_NAME=fleetprovisioning ${{ steps.build-test-runner.outputs.imageid }} --clean-up
637607
e2e-tests-ubi8-aarch64:
638608
# The ubi8 integration tests do not run the secure tunneling integration tests. TODO:// Need to configure SSH in ubi8 integration test image
639609
runs-on: ubuntu-latest
@@ -677,16 +647,11 @@ jobs:
677647
public.ecr.aws/${{ env.ECR_TEST_RUNNER_REPO }}:aarch64-ubi8-${{ needs.versioning.outputs.version }}
678648
public.ecr.aws/${{ env.ECR_TEST_RUNNER_REPO }}:aarch64-ubi8-latest
679649
platforms: linux/arm64
680-
- name: Assume Role for Integration Test
681-
uses: aws-actions/configure-aws-credentials@v2
682-
with:
683-
role-to-assume: arn:aws:iam::${{ secrets.DC_AWS_ACCOUNT_ID }}:role/integration-test-role
684-
aws-region: us-east-1
685650
- name: Run Integration Tests container with OIDC role credentials
686651
env:
687652
IOT_ENDPOINT: ${{ secrets.IOT_ENDPOINT }}
688653
CERTIFICATE: ${{ secrets.CLAIM_CERTIFICATE }}
689654
DEVICE_KEY_SECRET: ${{ secrets.FP_DEVICE_KEY_SECRET }}
690655
AMAZON_ROOT_CA: ${{ secrets.AMAZON_ROOT_CA }}
691656
run: |
692-
docker run -e AWS_ACCESS_KEY_ID="(echo $AWS_ACCESS_KEY_ID)" -e AWS_SECRET_ACCESS_KEY="(echo $AWS_SECRET_ACCESS_KEY)" -e AWS_SESSION_TOKEN="$(echo $AWS_SESSION_TOKEN)" -e IOT_ENDPOINT="$(echo $IOT_ENDPOINT)" -e CERTIFICATE="$(echo $CERTIFICATE)" -e DEVICE_KEY_SECRET="$(echo $DEVICE_KEY_SECRET)" -e AMAZON_ROOT_CA="$(echo $AMAZON_ROOT_CA)" -e THING_NAME=fleetprovisioning ${{ steps.build-test-runner.outputs.imageid }} --clean-up
657+
docker run -e AWS_ACCESS_KEY_ID="$AWS_ACCESS_KEY_ID" -e AWS_SECRET_ACCESS_KEY="$AWS_SECRET_ACCESS_KEY" -e AWS_SESSION_TOKEN="$AWS_SESSION_TOKEN" -e IOT_ENDPOINT="$(echo $IOT_ENDPOINT)" -e CERTIFICATE="$(echo $CERTIFICATE)" -e DEVICE_KEY_SECRET="$(echo $DEVICE_KEY_SECRET)" -e AMAZON_ROOT_CA="$(echo $AMAZON_ROOT_CA)" -e THING_NAME=fleetprovisioning ${{ steps.build-test-runner.outputs.imageid }} --clean-up

‎integration-tests/source/GTestMain.cpp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ std::string THING_NAME;
2727
std::string REGION = "us-east-1";
2828
std::string PORT = "5555";
2929
std::string LOCAL_PROXY_PATH = "/localproxy";
30+
std::string PROTOCOL_VERSION = "V1";
31+
std::string sslCertsPath = "/etc/ssl/certs";
3032
bool CLEAN_UP = false;
3133
bool SKIP_FP = false;
3234
bool SKIP_ST = false;

‎integration-tests/source/IntegrationTestResourceHandler.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ IntegrationTestResourceHandler::IntegrationTestResourceHandler(const ClientConfi
5656
: iotClient(IoTClient(clientConfig)),
5757
ioTSecureTunnelingClient(IoTSecureTunnelingClient(clientConfig)),
5858
logger(std::unique_ptr<Aws::Utils::Logging::ConsoleLogSystem>(
59-
new Aws::Utils::Logging::ConsoleLogSystem(Aws::Utils::Logging::LogLevel::Info)))
59+
new Aws::Utils::Logging::ConsoleLogSystem(Aws::Utils::Logging::LogLevel::Info)))
6060
{
6161
targetArn = GetTargetArn(THING_NAME);
6262
}

‎integration-tests/source/tunneling/SecureTunnelingIntegrationTests.cpp

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,10 @@ using namespace std;
2020
extern string THING_NAME;
2121
extern string PORT;
2222
extern string REGION;
23+
extern string PROTOCOL_VERSION;
2324
extern bool SKIP_ST;
2425
extern string LOCAL_PROXY_PATH;
26+
extern string sslCertsPath;
2527
extern std::shared_ptr<IntegrationTestResourceHandler> resourceHandler;
2628

2729
const string TEST_TUNNEL_PATH = "/test-tunnel.sh";
@@ -39,20 +41,25 @@ class TestSecureTunnelingFeature : public ::testing::Test
3941
sourceToken = openTunnelResult.GetSourceAccessToken();
4042

4143
// cppcheck-suppress leakReturnValNotUsed
42-
std::unique_ptr<const char *[]> argv(new const char *[8]);
44+
std::unique_ptr<const char *[]> argv(new const char *[12]);
4345
argv[0] = LOCAL_PROXY_PATH.c_str();
4446
argv[1] = "-s";
4547
argv[2] = PORT.c_str();
4648
argv[3] = "-r";
4749
argv[4] = REGION.c_str();
48-
argv[5] = "-t";
49-
argv[6] = sourceToken.c_str();
50-
argv[7] = nullptr;
50+
argv[5] = "--destination-client-type";
51+
argv[6] = PROTOCOL_VERSION.c_str();
52+
argv[7] = "-t";
53+
argv[8] = sourceToken.c_str();
54+
argv[9] = "-c";
55+
argv[10] = sslCertsPath.c_str();
56+
argv[11] = nullptr;
5157

5258
PID = fork();
5359
if (PID == 0)
5460
{
5561
printf("Started Child Process to run Local Proxy\n");
62+
printf("Received Tunnel Source Token of Length: %zu\n", sourceToken.length());
5663
if (execvp(LOCAL_PROXY_PATH.c_str(), const_cast<char *const *>(argv.get())) == -1)
5764
{
5865
printf("Failed to initialize Local Proxy.\n");

0 commit comments

Comments
 (0)