Add OIDC k8s provider #1576
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -19,6 +19,46 @@ elif [ $OIDC_ENV == "azure" ]; then | |
| source ./env.sh | ||
| elif [ $OIDC_ENV == "gcp" ]; then | ||
| source ./secrets-export.sh | ||
| elif [ $OIDC_ENV == "k8s" ]; then | ||
| # Make sure K8S_VARIANT is set. | ||
| if [ -z "$K8S_VARIANT" ]; then | ||
| echo "Must specify K8S_VARIANT" | ||
| popd | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [ -z "${VARIANT}" ]; then | ||
| echo "VARIANT is not set" | ||
| exit 1 | ||
| elif [ $VARIANT == "eks" ]; then | ||
| path="${AWS_WEB_IDENTITY_TOKEN_FILE}" | ||
| elif [ $VARIANT == "aks" ]; then | ||
| path="${AZURE_FEDERATED_TOKEN_FILE}" | ||
| elif [ $VARIANT == "gke" ]; then | ||
| path="/var/run/secrets/kubernetes.io/serviceaccount/token" | ||
| else | ||
| echo "Unrecognized k8s VARIANT: $VARIANT" | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Print the file | ||
| if [ -f "$path" ]; then | ||
| file_size=$(stat -c%s "$path") | ||
| echo "VARIANT: $VARIANT" | ||
| echo "Token file path: $path" | ||
| echo "Token file size: $file_size bytes" | ||
| else | ||
| echo "Error: Token file not found at $path" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| if [ $VARIANT == "gke" ]; then | ||
| echo "Skipping gke test to avoid error code 137 when running gradle" | ||
|
There was a problem hiding this comment. Based on our previous investigation, I ran diagnostics on the failing GKE pod and found that the provisioned ephemeral storage was insufficient for Gradle to store dependencies. Diagnostics can be found here: Diagnostic logs. I increased the storage from 2GB to 4GB, and the tests seem to have executed successfully: Successful run. Based on this, I’ve opened a PR with the fix in drivers-evergreen-tools: PR #598. This should resolve the issue with pod execution. There was a problem hiding this comment. Great! Let's push the diagnostic changes up as a PR? There was a problem hiding this comment. I will block this on the other PR |
||
| exit 0 | ||
| fi | ||
|
|
||
| # fix for git permissions issue: | ||
| git config --global --add safe.directory /tmp/test | ||
| else | ||
| echo "Unrecognized OIDC_ENV $OIDC_ENV" | ||
| exit 1 | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -261,7 +261,14 @@ static class ShutdownHook extends Thread { | |
| @Override | ||
| public void run() { | ||
| if (cluster != null) { | ||
| try { | ||
| new DropDatabaseOperation(getDefaultDatabaseName(), WriteConcern.ACKNOWLEDGED).execute(getBinding()); | ||
| } catch (MongoCommandException e) { | ||
| // if we do not have permission to drop the database, assume it is cleaned up in some other way | ||
| if (!e.getMessage().contains("Command dropDatabase requires authentication")) { | ||
| throw e; | ||
| } | ||
| } | ||
| cluster.close(); | ||
|
Comment on lines
-264
to
272
There was a problem hiding this comment. As of this PR, we will sometimes lack permission to drop the database. |
||
| } | ||
| } | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -481,7 +481,7 @@ | |
| }, | ||
| { | ||
| "description": "should throw an exception if username is specified for test (MONGODB-OIDC)", | ||
| "uri": "mongodb://principalName@localhost/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:test", | ||
| "valid": false, | ||
| "credential": null | ||
| }, | ||
|
|
@@ -631,6 +631,26 @@ | |
| "uri": "mongodb://user:pass@localhost/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:gcp", | ||
| "valid": false, | ||
| "credential": null | ||
| }, | ||
| { | ||
| "description": "should recognise the mechanism with k8s provider (MONGODB-OIDC)", | ||
| "uri": "mongodb://localhost/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:k8s", | ||
| "valid": true, | ||
| "credential": { | ||
| "username": null, | ||
| "password": null, | ||
| "source": "$external", | ||
| "mechanism": "MONGODB-OIDC", | ||
| "mechanism_properties": { | ||
| "ENVIRONMENT": "k8s" | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "description": "should throw an error for a username and password with k8s provider (MONGODB-OIDC)", | ||
| "uri": "mongodb://user:pass@localhost/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:k8s", | ||
| "valid": false, | ||
| "credential": null | ||
| } | ||
| ] | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -826,6 +826,7 @@ private MongoClientSettings createSettings( | |
| String cleanedConnectionString = callback == null ? connectionString : connectionString | ||
| .replace("ENVIRONMENT:azure,", "") | ||
| .replace("ENVIRONMENT:gcp,", "") | ||
| .replace("&authMechanismProperties=ENVIRONMENT:k8s", "") | ||
| .replace("ENVIRONMENT:test,", ""); | ||
| return createSettings(cleanedConnectionString, callback, commandListener, OIDC_CALLBACK_KEY); | ||
| } | ||
|
|
@@ -1042,6 +1043,8 @@ private OidcCallbackResult callback(final OidcCallbackContext context) { | |
| c = OidcAuthenticator.getAzureCallback(credential); | ||
| } else if (oidcEnv.contains("gcp")) { | ||
| c = OidcAuthenticator.getGcpCallback(credential); | ||
| } else if (oidcEnv.contains("k8s")) { | ||
| c = OidcAuthenticator.getK8sCallback(); | ||
| } else { | ||
| c = getProseTestCallback(); | ||
| } | ||
|
|
||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I suggest we break this into separate tasks and list them in the
test-oidc-k8s-task-grouptask group. This would allow us to: