diff --git a/.github/workflows/_integration-tests.yaml b/.github/workflows/_integration-tests.yaml index a81df748..8f138685 100644 --- a/.github/workflows/_integration-tests.yaml +++ b/.github/workflows/_integration-tests.yaml @@ -72,21 +72,19 @@ jobs: . ./set-tf-envs.sh terraform -chdir=../tf init terraform -chdir=../tf apply -auto-approve - echo "SUBACC_ID=$(cat ../tf/subaccount_id.txt)" >> $GITHUB_ENV + echo "SUBACC_ID=$(terraform -chdir=../tf output -raw subaccount_id)" >> $GITHUB_ENV env: BTP_ENV: ${{ secrets.BTP_INTEGRATION_TEST }} - TF_VAR_BTP_SUBACCOUNT: docker-registry-test-${{ github.run_id }}-${{ github.run_attempt }} + TF_VAR_BTP_NEW_SUBACCOUNT_NAME: docker-registry-test-${{ github.run_id }}-${{ github.run_attempt }} - name: Generate access run: | sudo ln -sf bash /bin/sh . ./set-tf-envs.sh mkdir -p tmp - make headless-kubeconfig CLUSTERROLE=cluster-admin make service-account-kubeconfig env: BTP_ENV: ${{ secrets.BTP_INTEGRATION_TEST }} - TF_VAR_BTP_SUBACCOUNT: btp-test-${{ github.run_id }}-${{ github.run_attempt }} - name: Add bindings run: | @@ -97,7 +95,6 @@ jobs: KUBECONFIG=tmp/sa-kubeconfig.yaml OPERATOR_MANIFEST=../../../dockerregistry-operator.yaml make enable_docker_registry env: BTP_ENV: ${{ secrets.BTP_INTEGRATION_TEST }} - TF_VAR_BTP_SUBACCOUNT: btp-test-${{ github.run_id }}-${{ github.run_attempt }} IMG: ${{ inputs.image }} - name: Test if docker registry is working diff --git a/tests/btp/README.md b/tests/btp/README.md index 1b206e77..c26ffe58 100644 --- a/tests/btp/README.md +++ b/tests/btp/README.md @@ -11,12 +11,8 @@ Export the following environment variables: TF_VAR_BTP_BOT_USER= TF_VAR_BTP_BOT_PASSWORD= TF_VAR_BTP_GLOBAL_ACCOUNT= -TF_VAR_BTP_BACKEND_URL=https://cpcli.cf.sap.hana.ondemand.com TF_VAR_BTP_CUSTOM_IAS_TENANT= -TF_VAR_BTP_CUSTOM_IAS_DOMAIN=accounts400.ondemand.com -TF_VAR_BTP_KYMA_PLAN=gcp -TF_VAR_BTP_SA_REGION=us31 -TF_VAR_BTP_KYMA_REGION=us-central1 + TF_VAR_BTP_PROVIDER_SUBACCOUNT_ID= ``` diff --git a/tests/btp/hack/Makefile b/tests/btp/hack/Makefile index fcb99a87..36dc7ff6 100644 --- a/tests/btp/hack/Makefile +++ b/tests/btp/hack/Makefile @@ -1,27 +1,7 @@ -.PHONY: headless-kubeconfig -headless-kubeconfig: - pwd - ls -la - ( \ - set -e -o pipefail ;\ - curl -s -o tmp/kubeconfig.yaml $$(cat ../tf/kubeconfig_url.txt) ;\ - ISSUER=$$(cat ../tf/binding_credentials.json | jq -r '. | { clientid, url: (.url+ "/oauth2/token") }' ) ;\ - TOKEN=$$(curl -X POST $$(jq -r '. | .url' <<< $$ISSUER) \ - -H 'Content-Type: application/x-www-form-urlencoded' \ - -d 'grant_type=password' \ - -d 'username='"$$TF_VAR_BTP_BOT_USER" \ - -d 'password='"$$TF_VAR_BTP_BOT_PASSWORD" \ - -d 'client_id='$$(jq -r '. | .clientid' <<< $$ISSUER) \ - -d 'scope=groups, email' \ - | jq -r '.id_token' ) ;\ - echo "i got $$(jq -r '. | .clientid' <<< $$ISSUER)" ;\ - ../bin/kyma alpha oidc --kubeconfig=tmp/kubeconfig.yaml --output=tmp/headless-kubeconfig.yaml --token=$$TOKEN ;\ - ) - .PHONY: service-account-kubeconfig service-account-kubeconfig: @echo "Generating expiring service-account based kubeconfig..." - ../bin/kyma alpha access --clusterrole ${CLUSTERROLE} --kubeconfig tmp/headless-kubeconfig.yaml --name ci-workflow-sa --time 1h --output tmp/sa-kubeconfig.yaml + ../bin/kyma alpha access --clusterrole ${CLUSTERROLE} --kubeconfig ../tf/kubeconfig.yaml --name ci-workflow-sa --time 1h --output tmp/sa-kubeconfig.yaml @echo "Service-account based kubeconfig generated" .PHONY: docker_push_simple_app diff --git a/tests/btp/tf/kyma.tf b/tests/btp/tf/kyma.tf deleted file mode 100644 index c25b28d7..00000000 --- a/tests/btp/tf/kyma.tf +++ /dev/null @@ -1,58 +0,0 @@ - - -resource "btp_subaccount_entitlement" "kyma" { - subaccount_id = btp_subaccount.subaccount.id - service_name = "kymaruntime" - plan_name = var.BTP_KYMA_PLAN - amount = 1 -} - -resource "btp_subaccount_environment_instance" "kyma" { - subaccount_id = btp_subaccount.subaccount.id - name = "${var.BTP_SUBACCOUNT}-kyma" - environment_type = "kyma" - service_name = btp_subaccount_entitlement.kyma.service_name - plan_name = btp_subaccount_entitlement.kyma.plan_name - parameters = jsonencode({ - modules = { - list = [ - { - name = "api-gateway" - channel = "fast" - }, - { - name = "istio" - channel = "fast" - }, - { - name = "btp-operator" - channel = "fast" - } - ] - } - oidc = { - groupsClaim = "groups" - signingAlgs = ["RS256"] - usernameClaim = "sub" - usernamePrefix = "-" - clientID = jsondecode(btp_subaccount_service_binding.identity_application_binding.credentials).clientid - issuerURL = "https://${var.BTP_CUSTOM_IAS_TENANT}.${var.BTP_CUSTOM_IAS_DOMAIN}" - } - name = "${var.BTP_SUBACCOUNT}-kyma" - region = var.BTP_KYMA_REGION - administrators = [ - var.BTP_BOT_USER - ] - }) - timeouts = { - create = "40m" - update = "30m" - delete = "60m" - } -} - - -resource "local_file" "kubeconfig_url" { - content = jsondecode(btp_subaccount_environment_instance.kyma.labels).KubeconfigURL - filename = "kubeconfig_url.txt" -} diff --git a/tests/btp/tf/main.tf b/tests/btp/tf/main.tf new file mode 100644 index 00000000..7bb9e523 --- /dev/null +++ b/tests/btp/tf/main.tf @@ -0,0 +1,51 @@ +terraform { + required_providers { + btp = { + source = "SAP/btp" + version = "1.6.0" + } + jq = { + source = "massdriver-cloud/jq" + } + http = { + source = "hashicorp/http" + version = "3.4.4" + } + } +} + +provider "jq" {} +provider "http" {} + +provider "btp" { + globalaccount = var.BTP_GLOBAL_ACCOUNT + cli_server_url = var.BTP_BACKEND_URL + idp = var.BTP_CUSTOM_IAS_TENANT + username = var.BTP_BOT_USER + password = var.BTP_BOT_PASSWORD +} + +module "kyma" { + source = "github.com/kyma-project/terraform-module" + BTP_NEW_SUBACCOUNT_NAME = var.BTP_NEW_SUBACCOUNT_NAME + BTP_CUSTOM_IAS_TENANT = var.BTP_CUSTOM_IAS_TENANT + BTP_BOT_USER = var.BTP_BOT_USER + BTP_BOT_PASSWORD = var.BTP_BOT_PASSWORD + BTP_PROVIDER_SUBACCOUNT_ID = var.BTP_PROVIDER_SUBACCOUNT_ID +} + +resource "local_file" "provider_sm" { + content = <