Skip to content

Commit 82c931c

Browse files
durrandurran
authored
feat(NODE-6069): OIDC k8s machine workflow (mongodb#4270)
1 parent e5582ed commit 82c931c

File tree

12 files changed

+389
-5
lines changed

12 files changed

+389
-5
lines changed

‎.evergreen/config.in.yml‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1265,6 +1265,60 @@ tasks:
12651265
args:
12661266
- src/.evergreen/run-azure-kms-tests.sh
12671267

1268+
- name: "oidc-auth-test-k8s-latest-eks"
1269+
commands:
1270+
- func: "install dependencies"
1271+
- command: subprocess.exec
1272+
type: test
1273+
params:
1274+
working_dir: src
1275+
binary: bash
1276+
env:
1277+
DRIVERS_TOOLS: ${DRIVERS_TOOLS}
1278+
PROJECT_DIRECTORY: ${PROJECT_DIRECTORY}
1279+
ENVIRONMENT: k8s
1280+
K8S_VARIANT: eks
1281+
SCRIPT: run-oidc-prose-tests.sh
1282+
include_expansions_in_env: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]
1283+
args:
1284+
- .evergreen/run-oidc-tests-k8s.sh
1285+
1286+
- name: "oidc-auth-test-k8s-latest-gke"
1287+
commands:
1288+
- func: "install dependencies"
1289+
- command: subprocess.exec
1290+
type: test
1291+
params:
1292+
working_dir: src
1293+
binary: bash
1294+
env:
1295+
DRIVERS_TOOLS: ${DRIVERS_TOOLS}
1296+
PROJECT_DIRECTORY: ${PROJECT_DIRECTORY}
1297+
ENVIRONMENT: k8s
1298+
K8S_VARIANT: gke
1299+
SCRIPT: run-oidc-prose-tests.sh
1300+
include_expansions_in_env: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]
1301+
args:
1302+
- .evergreen/run-oidc-tests-k8s.sh
1303+
1304+
- name: "oidc-auth-test-k8s-latest-aks"
1305+
commands:
1306+
- func: "install dependencies"
1307+
- command: subprocess.exec
1308+
type: test
1309+
params:
1310+
working_dir: src
1311+
binary: bash
1312+
env:
1313+
DRIVERS_TOOLS: ${DRIVERS_TOOLS}
1314+
PROJECT_DIRECTORY: ${PROJECT_DIRECTORY}
1315+
ENVIRONMENT: k8s
1316+
K8S_VARIANT: aks
1317+
SCRIPT: run-oidc-prose-tests.sh
1318+
include_expansions_in_env: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]
1319+
args:
1320+
- .evergreen/run-oidc-tests-k8s.sh
1321+
12681322
- name: "oidc-auth-test-azure-latest"
12691323
commands:
12701324
- func: "install dependencies"
@@ -1475,6 +1529,72 @@ task_groups:
14751529
tasks:
14761530
- test-azurekms-task
14771531

1532+
- name: testk8soidc_task_group_eks
1533+
setup_group:
1534+
- func: fetch source
1535+
- command: ec2.assume_role
1536+
params:
1537+
role_arn: ${OIDC_AWS_ROLE_ARN}
1538+
- command: subprocess.exec
1539+
params:
1540+
binary: bash
1541+
args:
1542+
- ${DRIVERS_TOOLS}/.evergreen/auth_oidc/k8s/setup.sh
1543+
teardown_task:
1544+
- command: subprocess.exec
1545+
params:
1546+
binary: bash
1547+
args:
1548+
- ${DRIVERS_TOOLS}/.evergreen/auth_oidc/k8s/teardown.sh
1549+
setup_group_can_fail_task: true
1550+
setup_group_timeout_secs: 1800
1551+
tasks:
1552+
- oidc-auth-test-k8s-latest-eks
1553+
1554+
- name: testk8soidc_task_group_gke
1555+
setup_group:
1556+
- func: fetch source
1557+
- command: ec2.assume_role
1558+
params:
1559+
role_arn: ${OIDC_AWS_ROLE_ARN}
1560+
- command: subprocess.exec
1561+
params:
1562+
binary: bash
1563+
args:
1564+
- ${DRIVERS_TOOLS}/.evergreen/auth_oidc/k8s/setup.sh
1565+
teardown_task:
1566+
- command: subprocess.exec
1567+
params:
1568+
binary: bash
1569+
args:
1570+
- ${DRIVERS_TOOLS}/.evergreen/auth_oidc/k8s/teardown.sh
1571+
setup_group_can_fail_task: true
1572+
setup_group_timeout_secs: 1800
1573+
tasks:
1574+
- oidc-auth-test-k8s-latest-gke
1575+
1576+
- name: testk8soidc_task_group_aks
1577+
setup_group:
1578+
- func: fetch source
1579+
- command: ec2.assume_role
1580+
params:
1581+
role_arn: ${OIDC_AWS_ROLE_ARN}
1582+
- command: subprocess.exec
1583+
params:
1584+
binary: bash
1585+
args:
1586+
- ${DRIVERS_TOOLS}/.evergreen/auth_oidc/k8s/setup.sh
1587+
teardown_task:
1588+
- command: subprocess.exec
1589+
params:
1590+
binary: bash
1591+
args:
1592+
- ${DRIVERS_TOOLS}/.evergreen/auth_oidc/k8s/teardown.sh
1593+
setup_group_can_fail_task: true
1594+
setup_group_timeout_secs: 1800
1595+
tasks:
1596+
- oidc-auth-test-k8s-latest-aks
1597+
14781598
- name: testtestoidc_task_group
14791599
setup_group:
14801600
- func: fetch source

‎.evergreen/config.yml‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1217,6 +1217,66 @@ tasks:
12171217
EXPECTED_AZUREKMS_OUTCOME: failure
12181218
args:
12191219
- src/.evergreen/run-azure-kms-tests.sh
1220+
- name: oidc-auth-test-k8s-latest-eks
1221+
commands:
1222+
- func: install dependencies
1223+
- command: subprocess.exec
1224+
type: test
1225+
params:
1226+
working_dir: src
1227+
binary: bash
1228+
env:
1229+
DRIVERS_TOOLS: ${DRIVERS_TOOLS}
1230+
PROJECT_DIRECTORY: ${PROJECT_DIRECTORY}
1231+
ENVIRONMENT: k8s
1232+
K8S_VARIANT: eks
1233+
SCRIPT: run-oidc-prose-tests.sh
1234+
include_expansions_in_env:
1235+
- AWS_ACCESS_KEY_ID
1236+
- AWS_SECRET_ACCESS_KEY
1237+
- AWS_SESSION_TOKEN
1238+
args:
1239+
- .evergreen/run-oidc-tests-k8s.sh
1240+
- name: oidc-auth-test-k8s-latest-gke
1241+
commands:
1242+
- func: install dependencies
1243+
- command: subprocess.exec
1244+
type: test
1245+
params:
1246+
working_dir: src
1247+
binary: bash
1248+
env:
1249+
DRIVERS_TOOLS: ${DRIVERS_TOOLS}
1250+
PROJECT_DIRECTORY: ${PROJECT_DIRECTORY}
1251+
ENVIRONMENT: k8s
1252+
K8S_VARIANT: gke
1253+
SCRIPT: run-oidc-prose-tests.sh
1254+
include_expansions_in_env:
1255+
- AWS_ACCESS_KEY_ID
1256+
- AWS_SECRET_ACCESS_KEY
1257+
- AWS_SESSION_TOKEN
1258+
args:
1259+
- .evergreen/run-oidc-tests-k8s.sh
1260+
- name: oidc-auth-test-k8s-latest-aks
1261+
commands:
1262+
- func: install dependencies
1263+
- command: subprocess.exec
1264+
type: test
1265+
params:
1266+
working_dir: src
1267+
binary: bash
1268+
env:
1269+
DRIVERS_TOOLS: ${DRIVERS_TOOLS}
1270+
PROJECT_DIRECTORY: ${PROJECT_DIRECTORY}
1271+
ENVIRONMENT: k8s
1272+
K8S_VARIANT: aks
1273+
SCRIPT: run-oidc-prose-tests.sh
1274+
include_expansions_in_env:
1275+
- AWS_ACCESS_KEY_ID
1276+
- AWS_SECRET_ACCESS_KEY
1277+
- AWS_SESSION_TOKEN
1278+
args:
1279+
- .evergreen/run-oidc-tests-k8s.sh
12201280
- name: oidc-auth-test-azure-latest
12211281
commands:
12221282
- func: install dependencies
@@ -4410,6 +4470,69 @@ task_groups:
44104470
- ${DRIVERS_TOOLS}/.evergreen/csfle/azurekms/teardown.sh
44114471
tasks:
44124472
- test-azurekms-task
4473+
- name: testk8soidc_task_group_eks
4474+
setup_group:
4475+
- func: fetch source
4476+
- command: ec2.assume_role
4477+
params:
4478+
role_arn: ${OIDC_AWS_ROLE_ARN}
4479+
- command: subprocess.exec
4480+
params:
4481+
binary: bash
4482+
args:
4483+
- ${DRIVERS_TOOLS}/.evergreen/auth_oidc/k8s/setup.sh
4484+
teardown_task:
4485+
- command: subprocess.exec
4486+
params:
4487+
binary: bash
4488+
args:
4489+
- ${DRIVERS_TOOLS}/.evergreen/auth_oidc/k8s/teardown.sh
4490+
setup_group_can_fail_task: true
4491+
setup_group_timeout_secs: 1800
4492+
tasks:
4493+
- oidc-auth-test-k8s-latest-eks
4494+
- name: testk8soidc_task_group_gke
4495+
setup_group:
4496+
- func: fetch source
4497+
- command: ec2.assume_role
4498+
params:
4499+
role_arn: ${OIDC_AWS_ROLE_ARN}
4500+
- command: subprocess.exec
4501+
params:
4502+
binary: bash
4503+
args:
4504+
- ${DRIVERS_TOOLS}/.evergreen/auth_oidc/k8s/setup.sh
4505+
teardown_task:
4506+
- command: subprocess.exec
4507+
params:
4508+
binary: bash
4509+
args:
4510+
- ${DRIVERS_TOOLS}/.evergreen/auth_oidc/k8s/teardown.sh
4511+
setup_group_can_fail_task: true
4512+
setup_group_timeout_secs: 1800
4513+
tasks:
4514+
- oidc-auth-test-k8s-latest-gke
4515+
- name: testk8soidc_task_group_aks
4516+
setup_group:
4517+
- func: fetch source
4518+
- command: ec2.assume_role
4519+
params:
4520+
role_arn: ${OIDC_AWS_ROLE_ARN}
4521+
- command: subprocess.exec
4522+
params:
4523+
binary: bash
4524+
args:
4525+
- ${DRIVERS_TOOLS}/.evergreen/auth_oidc/k8s/setup.sh
4526+
teardown_task:
4527+
- command: subprocess.exec
4528+
params:
4529+
binary: bash
4530+
args:
4531+
- ${DRIVERS_TOOLS}/.evergreen/auth_oidc/k8s/teardown.sh
4532+
setup_group_can_fail_task: true
4533+
setup_group_timeout_secs: 1800
4534+
tasks:
4535+
- oidc-auth-test-k8s-latest-aks
44134536
- name: testtestoidc_task_group
44144537
setup_group:
44154538
- func: fetch source
@@ -5093,6 +5216,9 @@ buildvariants:
50935216
- testtestoidc_task_group
50945217
- testazureoidc_task_group
50955218
- testgcpoidc_task_group
5219+
- testk8soidc_task_group_eks
5220+
- testk8soidc_task_group_gke
5221+
- testk8soidc_task_group_aks
50965222
- name: rhel8-test-atlas
50975223
display_name: Atlas Cluster Tests
50985224
run_on: rhel80-large

‎.evergreen/generate_evergreen_tasks.js‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -721,7 +721,10 @@ BUILD_VARIANTS.push({
721721
tasks: [
722722
'testtestoidc_task_group',
723723
'testazureoidc_task_group',
724-
'testgcpoidc_task_group'
724+
'testgcpoidc_task_group',
725+
'testk8soidc_task_group_eks',
726+
'testk8soidc_task_group_gke',
727+
'testk8soidc_task_group_aks'
725728
]
726729
});
727730

‎.evergreen/run-oidc-prose-tests.sh‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,16 @@ if [ "$ENVIRONMENT" = "azure" ]; then
1919
npm run check:oidc-azure
2020
elif [ "$ENVIRONMENT" = "gcp" ]; then
2121
npm run check:oidc-gcp
22-
else
22+
elif [ "$ENVIRONMENT" = "test" ]; then
2323
if [ -z "${OIDC_TOKEN_FILE}" ]; then
2424
echo "Must specify OIDC_TOKEN_FILE"
2525
exit 1
2626
fi
2727
npm run check:oidc-test
28+
else
29+
if [ -z "${K8S_VARIANT}" ]; then
30+
echo "Must specify K8S_VARIANT"
31+
exit 1
32+
fi
33+
npm run check:oidc-k8s
2834
fi

‎.evergreen/run-oidc-tests-k8s.sh‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/bin/bash
2+
set -o xtrace # Write all commands first to stderr
3+
set -o errexit # Exit the script with error if any of the commands fail
4+
5+
export K8S_DRIVERS_TAR_FILE=/tmp/node-mongodb-native.tgz
6+
cd ..
7+
tar -czf $K8S_DRIVERS_TAR_FILE src drivers-tools
8+
cd -
9+
bash $DRIVERS_TOOLS/.evergreen/auth_oidc/k8s/setup-pod.sh
10+
bash $DRIVERS_TOOLS/.evergreen/auth_oidc/k8s/run-self-test.sh
11+
export K8S_TEST_CMD="cd src && DRIVERS_TOOLS=${DRIVERS_TOOLS} ENVIRONMENT=k8s ./.evergreen/${SCRIPT}"
12+
source $DRIVERS_TOOLS/.evergreen/auth_oidc/k8s/secrets-export.sh
13+
bash $DRIVERS_TOOLS/.evergreen/auth_oidc/k8s/run-driver-test.sh
14+
bash $DRIVERS_TOOLS/.evergreen/auth_oidc/k8s/teardown-pod.sh

‎package.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,7 @@
151151
"check:oidc-test": "mocha --config test/mocha_mongodb.json test/integration/auth/mongodb_oidc.prose.test.ts",
152152
"check:oidc-azure": "mocha --config test/mocha_mongodb.json test/integration/auth/mongodb_oidc_azure.prose.05.test.ts",
153153
"check:oidc-gcp": "mocha --config test/mocha_mongodb.json test/integration/auth/mongodb_oidc_gcp.prose.06.test.ts",
154+
"check:oidc-k8s": "mocha --config test/mocha_mongodb.json test/integration/auth/mongodb_oidc_k8s.prose.07.test.ts",
154155
"check:ocsp": "mocha --config test/manual/mocharc.json test/manual/ocsp_support.test.js",
155156
"check:kerberos": "nyc mocha --config test/manual/mocharc.json test/manual/kerberos.test.ts",
156157
"check:tls": "mocha --config test/manual/mocharc.json test/manual/tls_support.test.ts",

‎src/cmap/auth/mongo_credentials.ts‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,8 @@ function getDefaultAuthMechanism(hello: Document | null): AuthMechanism {
3131
const ALLOWED_ENVIRONMENT_NAMES: AuthMechanismProperties['ENVIRONMENT'][] = [
3232
'test',
3333
'azure',
34-
'gcp'
34+
'gcp',
35+
'k8s'
3536
];
3637
const ALLOWED_HOSTS_ERROR = 'Auth mechanism property ALLOWED_HOSTS must be an array of strings.';
3738

@@ -62,7 +63,7 @@ export interface AuthMechanismProperties extends Document {
6263
/** A user provided OIDC human interacted callback function. */
6364
OIDC_HUMAN_CALLBACK?: OIDCCallbackFunction;
6465
/** The OIDC environment. Note that 'test' is for internal use only. */
65-
ENVIRONMENT?: 'test' | 'azure' | 'gcp';
66+
ENVIRONMENT?: 'test' | 'azure' | 'gcp' | 'k8s';
6667
/** Allowed hosts that OIDC auth can connect to. */
6768
ALLOWED_HOSTS?: string[];
6869
/** The resource token for OIDC auth in Azure and GCP. */

‎src/cmap/auth/mongodb_oidc.ts‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import { type AuthContext, AuthProvider } from './auth_provider';
66
import type { MongoCredentials } from './mongo_credentials';
77
import { AzureMachineWorkflow } from './mongodb_oidc/azure_machine_workflow';
88
import { GCPMachineWorkflow } from './mongodb_oidc/gcp_machine_workflow';
9+
import { K8SMachineWorkflow } from './mongodb_oidc/k8s_machine_workflow';
910
import { TokenCache } from './mongodb_oidc/token_cache';
1011
import { TokenMachineWorkflow } from './mongodb_oidc/token_machine_workflow';
1112

@@ -88,7 +89,7 @@ export type OIDCCallbackFunction = (params: OIDCCallbackParams) => Promise<OIDCR
8889
/** The current version of OIDC implementation. */
8990
export const OIDC_VERSION = 1;
9091

91-
type EnvironmentName = 'test' | 'azure' | 'gcp' | undefined;
92+
type EnvironmentName = 'test' | 'azure' | 'gcp' | 'k8s' | undefined;
9293

9394
/** @internal */
9495
export interface Workflow {
@@ -118,6 +119,7 @@ export const OIDC_WORKFLOWS: Map<EnvironmentName, () => Workflow> = new Map();
118119
OIDC_WORKFLOWS.set('test', () => new TokenMachineWorkflow(new TokenCache()));
119120
OIDC_WORKFLOWS.set('azure', () => new AzureMachineWorkflow(new TokenCache()));
120121
OIDC_WORKFLOWS.set('gcp', () => new GCPMachineWorkflow(new TokenCache()));
122+
OIDC_WORKFLOWS.set('k8s', () => new K8SMachineWorkflow(new TokenCache()));
121123

122124
/**
123125
* OIDC auth provider.

0 commit comments

Comments
 (0)