Skip to content

Commit a5f1606

Browse files
outcomes-winter-rakhulsprakashoutcomes-winter-rakhulsprakash
committed
feat: Update Database User
add oidcAuthType
1 parent 164b3b5 commit a5f1606

11 files changed

Lines changed: 268 additions & 3 deletions

File tree

‎.github/workflows/contract-testing.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ jobs:
1717
auditing: ${{ steps.filter.outputs.auditing }}
1818
cloud-backup-restore-jobs: ${{ steps.filter.outputs.cloud-backup-restore-jobs }}
1919
cluster-outage-simulation: ${{ steps.filter.outputs.cluster-outage-simulation }}
20+
database-user: ${{ steps.filter.outputs.database-user }}
2021
federated-database-instance: ${{ steps.filter.outputs.federated-database-instance }}
2122
federated-query-limit: ${{ steps.filter.outputs.federated-query-limit }}
2223
flex-cluster: ${{ steps.filter.outputs.flex-cluster }}
@@ -51,6 +52,8 @@ jobs:
5152
- 'cfn-resources/cloud-backup-restore-jobs/**'
5253
cluster-outage-simulation:
5354
- 'cfn-resources/cluster-outage-simulation/**'
55+
database-user:
56+
- 'cfn-resources/database-user/**'
5457
federated-database-instance:
5558
- 'cfn-resources/federated-database-instance/**'
5659
federated-query-limit:
@@ -323,6 +326,46 @@ jobs:
323326
324327
cat inputs/inputs_1_create.json
325328
329+
make run-contract-testing
330+
make delete-test-resources
331+
database-user:
332+
needs: change-detection
333+
if: ${{ needs.change-detection.outputs.database-user == 'true' }}
334+
runs-on: ubuntu-latest
335+
steps:
336+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
337+
- uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5
338+
with:
339+
go-version-file: 'cfn-resources/go.mod'
340+
- name: setup Atlas CLI
341+
uses: mongodb/atlas-github-action@e3c9e0204659bafbb3b65e1eb1ee745cca0e9f3b
342+
- uses: aws-actions/setup-sam@c2a20b1822cc4a6bc594ff7f1dbb658758e383c3
343+
with:
344+
use-installer: true
345+
- uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708
346+
with:
347+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_TEST_ENV }}
348+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_TEST_ENV }}
349+
aws-region: eu-west-1
350+
- uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548
351+
with:
352+
python-version: '3.9'
353+
cache: 'pip' # caching pip dependencies
354+
- run: pip install cloudformation-cli cloudformation-cli-go-plugin
355+
- name: Run the Contract test
356+
shell: bash
357+
env:
358+
MONGODB_ATLAS_PUBLIC_API_KEY: ${{ secrets.CLOUD_DEV_PUBLIC_KEY }}
359+
MONGODB_ATLAS_PRIVATE_API_KEY: ${{ secrets.CLOUD_DEV_PRIVATE_KEY }}
360+
MONGODB_ATLAS_ORG_ID: ${{ secrets.CLOUD_DEV_ORG_ID }}
361+
MONGODB_ATLAS_OPS_MANAGER_URL: ${{ vars.MONGODB_ATLAS_BASE_URL }}
362+
MONGODB_ATLAS_PROFILE: cfn-cloud-dev-github-action
363+
run: |
364+
pushd cfn-resources/database-user
365+
make create-test-resources
366+
367+
cat inputs/*
368+
326369
make run-contract-testing
327370
make delete-test-resources
328371
federated-database-instance:

‎cfn-resources/database-user/Makefile‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,25 @@ build:
1313

1414
debug:
1515
cfn generate
16-
env GOOS=$(goos) CGO_ENABLED=$(cgo) GOARCH=$(goarch) go build -ldflags="$(ldXflagsD)" -tags="$(tags)" -o bin/bootstrap cmd/main.go
16+
env GOOS=$(goos) CGO_ENABLED=$(cgo) GOARCH=$(goarch) go build -ldflags="$(ldXflagsD)" -tags="$(tags)" -o bin/debug cmd/main.go
1717

1818
clean:
1919
rm -rf bin
20+
21+
submit: clean build # submit to private registry must use release build not debug build
22+
@echo "==> Submitting to private registry for testing"
23+
cfn submit --set-default --region us-east-1
24+
25+
create-test-resources:
26+
@echo "==> Creating test files and resources for contract testing"
27+
./test/contract-testing/cfn-test-create.sh
28+
29+
delete-test-resources:
30+
@echo "==> Delete test resources used for contract testing"
31+
./test/contract-testing/cfn-test-delete.sh
32+
33+
run-contract-testing:
34+
@echo "==> Run contract testing"
35+
make build
36+
sam local start-lambda &
37+
cfn test --function-name TestEntrypoint --verbose

‎cfn-resources/database-user/cmd/resource/model.go‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎cfn-resources/database-user/cmd/resource/resource.go‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,7 @@ func Read(req handler.Request, prevModel *Model, currentModel *Model) (handler.P
110110
currentModel.LdapAuthType = databaseUser.LdapAuthType
111111
currentModel.AWSIAMType = databaseUser.AwsIAMType
112112
currentModel.X509Type = databaseUser.X509Type
113+
currentModel.OIDCAuthType = databaseUser.OidcAuthType
113114
currentModel.Username = &databaseUser.Username
114115
var roles []RoleDefinition
115116

@@ -252,7 +253,9 @@ func List(req handler.Request, prevModel *Model, currentModel *Model) (handler.P
252253
DatabaseName: &databaseUser.DatabaseName,
253254
Description: databaseUser.Description,
254255
LdapAuthType: databaseUser.LdapAuthType,
256+
AWSIAMType: databaseUser.AwsIAMType,
255257
X509Type: databaseUser.X509Type,
258+
OIDCAuthType: databaseUser.OidcAuthType,
256259
Username: &databaseUser.Username,
257260
ProjectId: currentModel.ProjectId,
258261
}
@@ -341,10 +344,13 @@ func setModel(currentModel *Model) (*admin.CloudDatabaseUser, error) {
341344
if currentModel.X509Type == nil {
342345
currentModel.X509Type = &none
343346
}
347+
if currentModel.OIDCAuthType == nil {
348+
currentModel.OIDCAuthType = &none
349+
}
344350

345351
if currentModel.Password == nil {
346-
if (*currentModel.LdapAuthType == none) && (*currentModel.AWSIAMType == none) && (*currentModel.X509Type == none) {
347-
err := fmt.Errorf("password cannot be empty if not LDAP or IAM or X509 is not provided")
352+
if (*currentModel.LdapAuthType == none) && (*currentModel.AWSIAMType == none) && (*currentModel.X509Type == none) && (*currentModel.OIDCAuthType == none) {
353+
err := fmt.Errorf("password cannot be empty if not LDAP or IAM or X509 or OIDC is not provided")
348354
return nil, err
349355
}
350356
currentModel.Password = aws.String("")
@@ -364,6 +370,7 @@ func setModel(currentModel *Model) (*admin.CloudDatabaseUser, error) {
364370
LdapAuthType: currentModel.LdapAuthType,
365371
AwsIAMType: currentModel.AWSIAMType,
366372
X509Type: currentModel.X509Type,
373+
OidcAuthType: currentModel.OIDCAuthType,
367374
DeleteAfterDate: util.StringPtrToTimePtr(currentModel.DeleteAfterDate),
368375
Description: currentModel.Description,
369376
}

‎cfn-resources/database-user/docs/README.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ To declare this entity in your AWS CloudFormation template, use the following sy
1919
"<a href="#labels" title="Labels">Labels</a>" : <i>[ <a href="labeldefinition.md">labelDefinition</a>, ... ]</i>,
2020
"<a href="#ldapauthtype" title="LdapAuthType">LdapAuthType</a>" : <i>String</i>,
2121
"<a href="#x509type" title="X509Type">X509Type</a>" : <i>String</i>,
22+
"<a href="#oidcauthtype" title="OIDCAuthType">OIDCAuthType</a>" : <i>String</i>,
2223
"<a href="#password" title="Password">Password</a>" : <i>String</i>,
2324
"<a href="#projectid" title="ProjectId">ProjectId</a>" : <i>String</i>,
2425
"<a href="#roles" title="Roles">Roles</a>" : <i>[ <a href="roledefinition.md">roleDefinition</a>, ... ]</i>,
@@ -42,6 +43,7 @@ Properties:
4243
- <a href="labeldefinition.md">labelDefinition</a></i>
4344
<a href="#ldapauthtype" title="LdapAuthType">LdapAuthType</a>: <i>String</i>
4445
<a href="#x509type" title="X509Type">X509Type</a>: <i>String</i>
46+
<a href="#oidcauthtype" title="OIDCAuthType">OIDCAuthType</a>: <i>String</i>
4547
<a href="#password" title="Password">Password</a>: <i>String</i>
4648
<a href="#projectid" title="ProjectId">ProjectId</a>: <i>String</i>
4749
<a href="#roles" title="Roles">Roles</a>: <i>
@@ -130,6 +132,18 @@ _Allowed Values_: <code>NONE</code> | <code>MANAGED</code> | <code>CUSTOMER</cod
130132

131133
_Update requires_: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)
132134

135+
#### OIDCAuthType
136+
137+
Human-readable label that indicates whether the new database user or group authenticates with OIDC federated authentication. To create a federated authentication user, specify the value of USER in this field. To create a federated authentication group, specify the value of IDP_GROUP in this field. Default value is `NONE`.
138+
139+
_Required_: No
140+
141+
_Type_: String
142+
143+
_Allowed Values_: <code>NONE</code> | <code>USER</code> | <code>IDP_GROUP</code>
144+
145+
_Update requires_: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)
146+
133147
#### Password
134148

135149
The user’s password. This field is not included in the entity returned from the server.

‎cfn-resources/database-user/mongodb-atlas-databaseuser.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,11 @@
120120
],
121121
"type": "string"
122122
},
123+
"OIDCAuthType": {
124+
"description": "Human-readable label that indicates whether the new database user or group authenticates with OIDC federated authentication. To create a federated authentication user, specify the value of USER in this field. To create a federated authentication group, specify the value of IDP_GROUP in this field. Default value is `NONE`.",
125+
"enum": ["NONE", "USER", "IDP_GROUP"],
126+
"type": "string"
127+
},
123128
"Password": {
124129
"description": "The user’s password. This field is not included in the entity returned from the server.",
125130
"type": "string"

‎cfn-resources/database-user/test/contract-testing/cfn-test-create.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/usr/bin/env bash
2+
3+
# This tool generates the resources and json files in the inputs/ for `cfn test`.
4+
set -o errexit
5+
set -o nounset
6+
set -o pipefail
7+
8+
projectName="cfn-test-bot-$(date +%s)-$RANDOM"
9+
10+
# create project
11+
projectId=$(atlas projects create "${projectName}" --output=json | jq -r '.id')
12+
13+
echo "projectId: $projectId"
14+
echo "projectName: $projectName"
15+
16+
./test/cfn-test-create-inputs.sh "$projectName"

‎cfn-resources/database-user/test/contract-testing/cfn-test-delete.sh‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/usr/bin/env bash
2+
3+
# This tool deletes the mongodb resources used for `cfn test` as inputs.
4+
set -o errexit
5+
set -o nounset
6+
set -o pipefail
7+
8+
projectId=$(jq -r '.ProjectId' ./inputs/inputs_1_create.json)
9+
10+
# delete project
11+
if atlas projects delete "$projectId" --force; then
12+
echo "$projectId project deletion OK"
13+
else
14+
(echo "Failed cleaning project: $projectId" && exit 1)
15+
fi

‎cfn-resources/database-user/test/inputs_3_create.template.json‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
{
2+
"Username": "DataUser3",
3+
"Password": "MongoDB12345%",
4+
"ProjectId": "${MONGODB_ATLAS_PROJECT_ID}",
5+
"Profile": "${MONGODB_ATLAS_PROFILE}",
6+
"DatabaseName": "admin",
7+
"Description": "User with Labels to test OIDCAuthType field",
8+
"OIDCAuthType": "NONE",
9+
"Roles": [
10+
{
11+
"RoleName": "readWrite",
12+
"DatabaseName": "testdb",
13+
"CollectionName": "col1"
14+
}
15+
],
16+
"Scopes": [
17+
{
18+
"Type": "CLUSTER",
19+
"Name": "testdb"
20+
}
21+
],
22+
"Labels": [
23+
{
24+
"Key": "testType",
25+
"Value": "oidc-field-validation"
26+
}
27+
]
28+
}

‎cfn-resources/database-user/test/inputs_3_update.template.json‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{
2+
"Username": "DataUser3",
3+
"Password": "MongoDB12345%",
4+
"ProjectId": "${MONGODB_ATLAS_PROJECT_ID}",
5+
"Profile": "${MONGODB_ATLAS_PROFILE}",
6+
"DatabaseName": "admin",
7+
"Description": "Updated user with modified Labels",
8+
"OIDCAuthType": "NONE",
9+
"Roles": [
10+
{
11+
"RoleName": "readWriteAnyDatabase",
12+
"DatabaseName": "admin"
13+
}
14+
],
15+
"Scopes": [
16+
{
17+
"Type": "CLUSTER",
18+
"Name": "testdb2"
19+
}
20+
],
21+
"Labels": [
22+
{
23+
"Key": "testType",
24+
"Value": "oidc-field-validation"
25+
},
26+
{
27+
"Key": "updated",
28+
"Value": "true"
29+
}
30+
]
31+
}

0 commit comments

Comments
 (0)