Uploaded image for project: 'Managed Service - API'
  1. Managed Service - API
  2. MGDAPI-3806

e2e test container should use own role for aws functional tests

XMLWordPrintable

    • Icon: Task Task
    • Resolution: Done
    • Icon: Undefined Undefined
    • None
    • None
    • None
    • Sprint 23, MGDAPI - Sprint 24

      WHAT
      Changes to E2E aws functional test was made to use STS authentication and RHOAM role for permissions (MGDAPI-2656).

      However it was noticed that F04 is failing using the RHOAM role:

          F04 - Verify AWS s3 blob storage resources exist [It]
          /home/kevinfan/go/src/github.com/integr8ly/integreatly-operator/test/functional/integreatly_test.go:107
      
          test s3 blob storage failed with the following errors : [Error getting bucket encryption, bucket :kfccssts2m5p82redhatrhoamoperatorth-j7gz, AccessDenied: Access Denied
              status code: 403, request id: 4QHNZGAP0BXDE58B, host id: 9pzIHYtM6/G3OP7j189w7i7pApcu5ffKK4Y6zwAAZRfSWJU0RqDwBNg6Zz7NtTB7N9vFOm1g80c= Error getting bucket public access block, bucket :kfccssts2m5p82redhatrhoamoperatorth-j7gz, AccessDenied: Access Denied
              status code: 403, request id: 4QHHASA4SHY7WZ94, host id: U+eHGaogaX0kOcnzdTXDY1nfjnbcNn0PTBojw8KD4ek1HPDh40lM1nC3QN29cl880htBRZEgsiU= Error getting bucket tags, bucket :kfccssts2m5p82redhatrhoamoperatorth-j7gz, AccessDenied: Access Denied
              status code: 403, request id: 4QHN7YZV43SQYD0Y, host id: +cy/yWwdxelKKj7TTGFouwEGYP4ofQ0iPwn2CVR4Sz/dcYkvWjnC54Ao2ohCAO81GSNUXxFfa7o= Failed to find appropriate resource names for buckets for managed api install]
      

      This looks to be due to the functional test is using permissions that is not provided by the RHOAM role.

      So instead of using the RHOAM role is the functional test, it would be better for the functional test to use it's own role with read only permissions to certain aws resources.

      HOW

      • Update delorean prerequisite script to create a role for use by the test container with read only permissions to certain aws resources
      • This Role ARN should be passed to the functional test via environment variable
        • When creating the pipeline, these environment variables should be set for the test container image
      • Update functional test get ROLE ARN from environmentn variables instead of using RHOAM role

      TESTS
      <List of related tests>

      DONE

      • Delorean prerequiste updated to create role for test container use
      • Functional test updated to get ROLE arn from environment variable for STS clusters
      • Functional tests passing using the test role

              chfan@redhat.com Kevin Chi Keen Fan (Inactive)
              chfan@redhat.com Kevin Chi Keen Fan (Inactive)
              Tsvetoslav Dimov Tsvetoslav Dimov (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: