name: Cdbg deploy description: Deploy the Constellation Bootstrapper to the cluster via the debugd. inputs: test: description: "The e2e test payload." required: true azureClusterCreateCredentials: description: "Azure credentials authorized to create a Constellation cluster." required: true azureIAMCreateCredentials: description: "Azure credentials authorized to create an IAM configuration." required: true cloudProvider: description: "The cloud provider to use." required: true attestationVariant: description: "Attestation variant of the cluster." required: false kubernetesVersion: description: "Kubernetes version to create the cluster from." required: true refStream: description: "The refStream of the image the test runs on." required: true clusterCreation: description: "How the infrastructure for the e2e test was created. One of [cli, terraform]." default: "cli" runs: using: "composite" steps: - name: Login to Azure (IAM service principal) if: inputs.cloudProvider == 'azure' uses: ./.github/actions/login_azure with: azure_credentials: ${{ inputs.azureIAMCreateCredentials }} - name: Add Azure Keyvault access role if: inputs.cloudProvider == 'azure' shell: bash run: | UAMI=$(yq eval ".provider.azure.userAssignedIdentity" constellation-conf.yaml) PRINCIPAL_ID=$(az identity show --ids "$UAMI" | yq ".principalId") if [ -z "$PRINCIPAL_ID" ]; then echo "::error::PRINCIPAL_ID for \"$UAMI\" not found" echo "::group::Available identities" az identity list | yq ".[].id" echo "::endgroup::" exit 1 fi az role assignment create --role "Key Vault Secrets User" \ --assignee "$PRINCIPAL_ID" \ --scope /subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/e2e-test-creds/providers/Microsoft.KeyVault/vaults/opensearch-creds - name: Login to Azure (Cluster service principal) if: inputs.cloudProvider == 'azure' uses: ./.github/actions/login_azure with: azure_credentials: ${{ inputs.azureClusterCreateCredentials }} - name: Login to AWS (IAM service principal) if: inputs.cloudProvider == 'aws' uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2 with: role-to-assume: arn:aws:iam::795746500882:role/GithubActionsE2EIAM aws-region: eu-central-1 # extend token expiry to 6 hours to ensure constellation can terminate role-duration-seconds: 21600 - name: Add AWS Secrets Manager access role if: inputs.cloudProvider == 'aws' shell: bash run: | INSTANCE_PROFILE=$(yq eval ".provider.aws.iamProfileControlPlane" constellation-conf.yaml) ROLE_NAME=$(aws iam get-instance-profile --instance-profile-name "$INSTANCE_PROFILE" | yq ".InstanceProfile.Roles[0].RoleName") aws iam attach-role-policy \ --role-name "$ROLE_NAME" \ --policy-arn arn:aws:iam::795746500882:policy/GitHubActionsOSCredAccess - name: Login to AWS (Cluster service principal) if: inputs.cloudProvider == 'aws' uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2 with: role-to-assume: arn:aws:iam::795746500882:role/GithubActionsE2ECluster aws-region: eu-central-1 # extend token expiry to 6 hours to ensure constellation can terminate role-duration-seconds: 21600 - name: Cdbg deploy shell: bash run: | echo "::group::cdbg deploy" on_error() { echo "::error::cdbg deploy failed" } trap on_error ERR chmod +x $GITHUB_WORKSPACE/build/cdbg cdbg deploy \ --bootstrapper "${{ github.workspace }}/build/bootstrapper" \ --upgrade-agent "${{ github.workspace }}/build/upgrade-agent" \ --info logcollect=true \ --info logcollect.github.actor="${{ github.triggering_actor }}" \ --info logcollect.github.workflow="${{ github.workflow }}" \ --info logcollect.github.run-id="${{ github.run_id }}" \ --info logcollect.github.run-attempt="${{ github.run_attempt }}" \ --info logcollect.github.ref-name="${{ github.ref_name }}" \ --info logcollect.github.sha="${{ github.sha }}" \ --info logcollect.github.runner-os="${{ runner.os }}" \ --info logcollect.github.e2e-test-payload="${{ inputs.test }}" \ --info logcollect.github.is-debug-cluster=false \ --info logcollect.github.ref-stream="${{ inputs.refStream }}" \ --info logcollect.github.kubernetes-version="${{ inputs.kubernetesVersion }}" \ --info logcollect.github.cluster-creation="${{ inputs.clusterCreation }}" \ --info logcollect.github.attestation-variant="${{ inputs.attestationVariant }}" \ --info logcollect.deployment-type="debugd" \ --verbosity=-1 \ --force echo "::endgroup::"