chihsuan commented on code in PR #11042:
URL: https://github.com/apache/ozone/pull/11042#discussion_r3813626971
##########
hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.resource:
##########
@@ -27,6 +27,8 @@ ${RANGER_ENDPOINT_URL} ${EMPTY}
${STS_ENDPOINT_URL} http://s3g:9880/sts
${S3G_ENDPOINT_URL} http://s3g:9878
${ROLE_SESSION_NAME} sts-session-name
+${EXPIRED_STS_TOKEN_PROFILE} expired_sts_token
+${EXPIRED_STS_TOKEN_MIN_ELAPSED_SECONDS} 902
Review Comment:
Is it possible to derive this wait from `.Credentials.Expiration` instead of
hard-coding 902 seconds?
##########
hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.resource:
##########
@@ -115,6 +117,51 @@ Assume Role And Get Temporary Credentials
Should Be True ${time_diff} >= ${minimum_expected}
Expected expiration to be at least ${minimum_expected}s in the future, but was
${time_diff}s
Should Be True ${time_diff} <= ${maximum_expected}
Expected expiration to be at most ${maximum_expected}s in the future, but was
${time_diff}s
+Assume Role And Store Expired STS Token Credentials
+ # Issue a 900s STS credential and store it in EXPIRED_STS_TOKEN_* globals
only (it should never be used/modified until the "Expired STS temporary
credentials return ExpiredToken on S3 APIs" test).
+ [Arguments] ${perm_access_key_id} ${perm_secret_key}
${role_arn} ${duration_seconds}=900
+ Configure AWS Profile permanent ${perm_access_key_id}
${perm_secret_key}
+ ${suffix} = Generate Random String 8 [LOWER]
+ ${role_session_name} = Set Variable
expired-sts-token-${suffix}
+
+ ${cmd} = Set Variable aws sts
assume-role --endpoint-url ${STS_ENDPOINT_URL} --role-arn ${role_arn}
--role-session-name ${role_session_name} --duration-seconds ${duration_seconds}
--output json --profile permanent
+
+ ${json} = Execute ${cmd}
+ Should Contain ${json} Credentials
+
+ ${issued_epoch} = Get Current Date
result_format=epoch time_zone=UTC
+
+ ${expiredStsAccessKeyId} = Execute printf '%s'
'${json}' | jq -r '.Credentials.AccessKeyId'
+ ${expiredStsSecretKey} = Execute printf '%s'
'${json}' | jq -r '.Credentials.SecretAccessKey'
+ ${expiredStsSessionToken} = Execute printf '%s'
'${json}' | jq -r '.Credentials.SessionToken'
+ Should Start With ${expiredStsAccessKeyId} ASIA
+ Set Global Variable ${EXPIRED_STS_TOKEN_ACCESS_KEY_ID}
${expiredStsAccessKeyId}
Review Comment:
Could we declare these expired-token variables as `${EMPTY}` in `***
Variables ***` and guard their use with Skip If or Should Not Be Empty?
They are currently created only by an earlier test case. If that test fails,
or if the expiration test is selected directly with `--test`, Robot fails with
`Variable ... not found` instead of reporting that the credential prerequisite
is unavailable.
##########
hadoop-ozone/dist/src/main/compose/ozonesecure-ha/ranger-testlib.sh:
##########
@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# shellcheck source=/dev/null
+source "$COMPOSE_DIR/../testlib.sh"
Review Comment:
Since `testlib.sh` enables `set -e` before this optional `.env` read,
unresolved Maven placeholders may stop the script silently. Would adding `||
true` help preserve the previous best-effort behavior?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
