-
Notifications
You must be signed in to change notification settings - Fork 11
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
JPERF-831 Migrate CI from CircleCI to Github Actions. Change the pipeline config to use IAM role and OIDC token for assuming an identity on AWS. #89
Merged
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ewefie
commented
Jan 25, 2023
ewefie
commented
Jan 25, 2023
mgrzaslewicz
previously approved these changes
Jan 25, 2023
src/test/kotlin/com/atlassian/performance/tools/hardware/IntegrationTestRuntime.kt
Show resolved
Hide resolved
pczuj
previously approved these changes
Jan 25, 2023
dagguh
suggested changes
Jan 26, 2023
dagguh
reviewed
Jan 26, 2023
ewefie
force-pushed
the
issue/JPERF-831-migrate-to-iam-roles-v3
branch
from
January 27, 2023 09:22
02b6128
to
785453e
Compare
I'm running |
ewefie
force-pushed
the
issue/JPERF-831-migrate-to-iam-roles-v3
branch
from
January 30, 2023 07:10
785453e
to
4904eef
Compare
…line config to use IAM role and OIDC token for assuming an identity on AWS. This change allows getting rid of the access key and secret. While applying changes I ran into a problem where some ubuntu images were not available on a particular AWS region. To fix that I had to bump both aws-resources and aws-infrastructure and some other required dependencies.
ewefie
force-pushed
the
issue/JPERF-831-migrate-to-iam-roles-v3
branch
from
January 30, 2023 09:59
4904eef
to
21dec1c
Compare
pczuj
approved these changes
Jan 30, 2023
dagguh
approved these changes
Jan 30, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The reason for those changes was initially the need for migration from long-term credentials to IAM role during authentication on AWS.
Additionally, we decided to migrate the CI from CircleCI to Github Actions in one go.
After just rewriting the pipeline it turned out that not everything works as expected, I observed many failures, and as a result, the scope and time spent on the migration increased significantly.
The team decided to split the task into smaller parts, and this is the first part that consists on:
curl
command used for downloading Oracle JDK infrastructure#128)virtual-users
lib to avoid failure related to https://ecosystem.atlassian.net/browse/JPERF-748CopiedDocker.kt
to avoid the error:Note:
CopiedDocker.kt
was, as the name suggests, a copy ofDocker.kt
located ininfrastructure
lib. The foremention error was already addressed ininfrastructure
, but not here.In this PR I followed the previous approach and just copied the implementation from
infrastructure
, but IMO keeping those two classes doesn’t make sense in a long term. I’d personally opt for getting rid of bothCopiedDocker.kt
andCopiedDockerImage.kt
and using original classes frominfrastructure
. I’m aware though that this would require changes in API (currently they are only for internal use) - we can discuss it.For now, tests fail and in most cases, the reason is insufficient AWS resources. It’s manifested either by error with the message: “We currently do not have sufficient xxxxx capacity in the Availability Zone you requested (eu-west-1a). Our system will be working on provisioning additional capacity.” or “ResourceStatus: CREATE_FAILED,ResourceStatusReason: Request limit exceeded.” But in general, we can see that the new auth method works, we are allowed to provision instances, and some of them are created successfully.
The most recent error I encountered is this one:
I found that it is caused by errors in "log in" action, but I didn't investigate it further yet.
I don’t know if there are any other issues obscured by the errors above - it is possible. I tried to run those tests in the night, I also reduced for some time the list of instances provisioned during the execution, but all I found I mentioned above or already addressed. Maybe after running those tests regularly (there’s a cron schedule for that) for a longer time some other issues appear.
cc/ @Nubzor