diff --git a/pipelines/integration-test/ansible-upgrade.yaml b/pipelines/integration-test/ansible-upgrade.yaml index b5a5698d..f86d94cb 100644 --- a/pipelines/integration-test/ansible-upgrade.yaml +++ b/pipelines/integration-test/ansible-upgrade.yaml @@ -57,31 +57,23 @@ spec: - name: prepare-molecule-tests runAfter: - clone-source-code + taskRef: + resolver: git + params: + - name: url + value: https://github.com/securesign/pipelines.git + - name: revision + value: eli/dupeCode + - name: pathInRepo + value: tasks/integration-test/prepare-molecule-tests.yaml + params: + - name: container-image + value: $(tasks.parse-metadata.results.container-image) + - name: ansible-path + value: "ansible" workspaces: - name: work workspace: work - taskSpec: - workspaces: - - name: work - steps: - - name: extract-release-image-content - image: "gcr.io/go-containerregistry/crane" - args: - - export - - $(tasks.parse-metadata.results.container-image) - - $(workspaces.work.path)/image.tar - - name: prepare-tests - image: "quay.io/redhat-appstudio/konflux-test:stable" - script: | - #!/bin/sh - set -ex - - # extract the release image content - tar xf $(workspaces.work.path)/image.tar -C $(workspaces.work.path) - - # replace the tas_single_node name with the redhat.artifact_signer.tas_single_node name - find $(workspaces.work.path)/ansible/molecule -type f -name "converge.yml" \ - -exec sed -i 's@name: tas_single_node@name: redhat.artifact_signer.tas_single_node@g' {} + - name: run-upgrade-test runAfter: - prepare-molecule-tests @@ -188,51 +180,15 @@ spec: memory: 4Gi finally: - name: aws-cleanup + taskRef: + resolver: git + params: + - name: url + value: https://github.com/securesign/pipelines.git + - name: revision + value: eli/dupeCode + - name: pathInRepo + value: tasks/integration-test/aws-cleanup-ec2-instances.yaml params: - name: run-id value: "$(context.pipelineRun.name)" - taskSpec: - params: - - name: run-id - volumes: - - name: aws-creds - secret: - secretName: aws-ci-test - steps: - - name: terminate-instances - volumeMounts: - - name: aws-creds - mountPath: /creds - image: amazon/aws-cli:latest - env: - - name: AWS_DEFAULT_REGION - value: "eu-north-1" - script: | - #!/bin/bash - set -eu - - set +x - export AWS_SECRET_ACCESS_KEY=$(cat /creds/AWS_ACCESS_KEY) - export AWS_ACCESS_KEY_ID=$(cat /creds/AWS_ACCESS_KEY_ID) - set -x - - # Check for credentials before proceeding (crucial step) - if [ -z "${AWS_ACCESS_KEY_ID}" ]; then - echo "ERROR: AWS_ACCESS_KEY_ID environment variable is missing." >&2 - exit 1 - fi - - INSTANCE_LIST=$( - aws ec2 describe-instances \ - --filters "Name=tag:Name,Values=CI-$(params.run-id)*" "Name=instance-state-name,Values=running,pending" \ - --query 'Reservations[].Instances[].InstanceId' \ - --output text - ) - echo "Instance IDs received for termination: ${INSTANCE_LIST} in ${AWS_DEFAULT_REGION}..." - - aws ec2 terminate-instances \ - --instance-ids ${INSTANCE_LIST} \ - --region ${AWS_DEFAULT_REGION} \ - --output text - - echo "Termination request sent for instance ${INSTANCE_LIST}." diff --git a/pipelines/integration-test/ansible.yaml b/pipelines/integration-test/ansible.yaml index 36261e18..8480e628 100644 --- a/pipelines/integration-test/ansible.yaml +++ b/pipelines/integration-test/ansible.yaml @@ -78,31 +78,23 @@ spec: - name: output workspace: work - name: prepare-molecule-tests + taskRef: + resolver: git + params: + - name: url + value: https://github.com/securesign/pipelines.git + - name: revision + value: eli/dupeCode + - name: pathInRepo + value: tasks/integration-test/prepare-molecule-tests.yaml + params: + - name: container-image + value: $(tasks.parse-metadata.results.container-image) + - name: ansible-path + value: "artifact-signer-ansible" workspaces: - name: work workspace: work - taskSpec: - workspaces: - - name: work - steps: - - name: extract-release-image-content - image: "gcr.io/go-containerregistry/crane" - args: - - export - - $(tasks.parse-metadata.results.container-image) - - $(workspaces.work.path)/image.tar - - name: prepare-env - image: "quay.io/redhat-appstudio/konflux-test:stable" - script: | - #!/bin/sh - set -ex - - # extract the release image content - tar xf $(workspaces.work.path)/image.tar -C $(workspaces.work.path) - - # replace the tas_single_node name with the redhat.artifact_signer.tas_single_node name - find $(workspaces.work.path)/artifact-signer-ansible/molecule -type f -name "converge.yml" \ - -exec sed -i 's@name: tas_single_node@name: redhat.artifact_signer.tas_single_node@g' {} + - name: run-molecule-tests runAfter: - prepare-molecule-tests @@ -145,51 +137,15 @@ spec: value: tasks/integration-test/ansible/run-sigstore-e2e-tests.yaml finally: - name: aws-cleanup + taskRef: + resolver: git + params: + - name: url + value: https://github.com/securesign/pipelines.git + - name: revision + value: eli/dupeCode + - name: pathInRepo + value: tasks/integration-test/aws-cleanup-ec2-instances.yaml params: - name: run-id value: "$(context.pipelineRun.name)" - taskSpec: - params: - - name: run-id - volumes: - - name: aws-creds - secret: - secretName: aws-ci-test - steps: - - name: terminate-instances - volumeMounts: - - name: aws-creds - mountPath: /creds - image: amazon/aws-cli:latest - env: - - name: AWS_DEFAULT_REGION - value: "eu-north-1" - script: | - #!/bin/bash - set -eu - - set +x - export AWS_SECRET_ACCESS_KEY=$(cat /creds/AWS_ACCESS_KEY) - export AWS_ACCESS_KEY_ID=$(cat /creds/AWS_ACCESS_KEY_ID) - set -x - - # Check for credentials before proceeding (crucial step) - if [ -z "${AWS_ACCESS_KEY_ID}" ]; then - echo "ERROR: AWS_ACCESS_KEY_ID environment variable is missing." >&2 - exit 1 - fi - - INSTANCE_LIST=$( - aws ec2 describe-instances \ - --filters "Name=tag:Name,Values=CI-$(params.run-id)*" "Name=instance-state-name,Values=running,pending" \ - --query 'Reservations[].Instances[].InstanceId' \ - --output text - ) - echo "Instance IDs received for termination: ${INSTANCE_LIST} in ${AWS_DEFAULT_REGION}..." - - aws ec2 terminate-instances \ - --instance-ids ${INSTANCE_LIST} \ - --region ${AWS_DEFAULT_REGION} \ - --output text - - echo "Termination request sent for instance ${INSTANCE_LIST}." diff --git a/tasks/integration-test/aws-cleanup-ec2-instances.yaml b/tasks/integration-test/aws-cleanup-ec2-instances.yaml new file mode 100644 index 00000000..a497fe87 --- /dev/null +++ b/tasks/integration-test/aws-cleanup-ec2-instances.yaml @@ -0,0 +1,62 @@ +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: aws-cleanup-ec2-instances +spec: + description: | + Terminates AWS EC2 instances created during integration tests based on run ID tag. + Uses aws-ci-test secret credentials to clean up ephemeral test infrastructure. + params: + - name: run-id + type: string + description: Pipeline run ID used to tag and identify EC2 instances to terminate + - name: aws-region + type: string + default: "eu-north-1" + description: AWS region where EC2 instances are running + volumes: + - name: aws-creds + secret: + secretName: aws-ci-test + steps: + - name: terminate-instances + volumeMounts: + - name: aws-creds + mountPath: /creds + image: amazon/aws-cli:latest + env: + - name: AWS_DEFAULT_REGION + value: "$(params.aws-region)" + script: | + #!/bin/bash + set -eu + + echo "==========================================" + echo "๐Ÿงน Running REFACTORED aws-cleanup-ec2-instances task from eli/dupeCode branch" + echo "==========================================" + + set +x + export AWS_SECRET_ACCESS_KEY=$(cat /creds/AWS_ACCESS_KEY) + export AWS_ACCESS_KEY_ID=$(cat /creds/AWS_ACCESS_KEY_ID) + set -x + + # Check for credentials before proceeding (crucial step) + if [ -z "${AWS_ACCESS_KEY_ID}" ]; then + echo "ERROR: AWS_ACCESS_KEY_ID environment variable is missing." >&2 + exit 1 + fi + + INSTANCE_LIST=$( + aws ec2 describe-instances \ + --filters "Name=tag:Name,Values=CI-$(params.run-id)*" "Name=instance-state-name,Values=running,pending" \ + --query 'Reservations[].Instances[].InstanceId' \ + --output text + ) + echo "Instance IDs received for termination: ${INSTANCE_LIST} in ${AWS_DEFAULT_REGION}..." + + aws ec2 terminate-instances \ + --instance-ids ${INSTANCE_LIST} \ + --region ${AWS_DEFAULT_REGION} \ + --output text + + echo "Termination request sent for instance ${INSTANCE_LIST}." diff --git a/tasks/integration-test/prepare-molecule-tests.yaml b/tasks/integration-test/prepare-molecule-tests.yaml new file mode 100644 index 00000000..b56b9fa7 --- /dev/null +++ b/tasks/integration-test/prepare-molecule-tests.yaml @@ -0,0 +1,45 @@ +apiVersion: tekton.dev/v1 +kind: Task +metadata: + name: prepare-molecule-tests +spec: + description: | + Extracts a container image and prepares the Ansible molecule test environment + by replacing role names in converge.yml files. + params: + - name: container-image + type: string + description: The container image URL to extract (e.g., from Snapshot) + - name: ansible-path + type: string + description: Path to the Ansible directory relative to workspace (e.g., "ansible" or "artifact-signer-ansible") + default: "ansible" + workspaces: + - name: work + description: Workspace where the image will be extracted and processed + steps: + - name: extract-release-image-content + image: "gcr.io/go-containerregistry/crane" + args: + - export + - $(params.container-image) + - $(workspaces.work.path)/image.tar + - name: prepare-env + image: "quay.io/redhat-appstudio/konflux-test:stable" + script: | + #!/bin/sh + set -ex + + echo "==========================================" + echo "๐Ÿš€ Running REFACTORED prepare-molecule-tests task from eli/dupeCode branch" + echo "==========================================" + + # Extract the release image content + tar xf $(workspaces.work.path)/image.tar -C $(workspaces.work.path) + + # Replace the tas_single_node name with the redhat.artifact_signer.tas_single_node name + # This finds all converge.yml files in the molecule directory and updates the role name + find $(workspaces.work.path)/$(params.ansible-path)/molecule -type f -name "converge.yml" \ + -exec sed -i 's@name: tas_single_node@name: redhat.artifact_signer.tas_single_node@g' {} + + + echo "Successfully prepared molecule tests in $(params.ansible-path)"