Move runner tests to AWS sandbox (#899)

iterative · Feb 24, 2022 · 8a37f5a · 8a37f5a · github-actions · Feb 25, 2022
1 parent 062dd46
commit 8a37f5a
Show file tree

Hide file tree

Showing 2 changed files with 26 additions and 2 deletions.
diff --git a/.github/workflows/checkbot.yml b/.github/workflows/checkbot.yml
@@ -1,4 +1,6 @@
 name: checkbot
+permissions:
+  id-token: write
 on:
   issue_comment:
     types: [created]
@@ -58,6 +60,7 @@ jobs:
           BASE_IMAGE: 'ubuntu:20.04'
   # test container all CML features, vega and actions with issues in the past
   check-container:
+    environment: internal
     needs: build-container
     runs-on: ubuntu-18.04
     container: dvcorg/cml-test
@@ -70,10 +73,12 @@ jobs:
       - uses: actions/setup-python@v2
         with:
           python-version: '3.x'
+      - uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-region: us-west-1
+          role-to-assume: arn:aws:iam::342840881361:role/SandboxUser
       - name: CML test
         env:
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
           AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
           AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
@@ -1,6 +1,21 @@
 deploy-runner:
+  only:
+    refs: [master]
   image: iterativeai/cml:0-dvc2-base1
   script:
+    - pip install awscli
+    - >
+      CREDENTIALS=($(aws sts assume-role-with-web-identity
+      --region=us-west-1
+      --role-arn=arn:aws:iam::342840881361:role/SandboxUser
+      --role-session-name=GitLab
+      --duration-seconds=3600
+      --web-identity-token="$CI_JOB_JWT_V2"
+      --query="Credentials.[AccessKeyId,SecretAccessKey,SessionToken]"
+      --output=text))
+    - export AWS_ACCESS_KEY_ID="${CREDENTIALS[0]}"
+    - export AWS_SECRET_ACCESS_KEY="${CREDENTIALS[1]}"
+    - export AWS_SESSION_TOKEN="${CREDENTIALS[2]}"
     - |
       cml runner \
           --cloud=aws \
@@ -10,6 +25,8 @@ deploy-runner:
           --labels=cml-runner-gpu
 test-runner:
   needs: [deploy-runner]
+  only:
+    refs: [master]
   tags:
     - cml-runner-gpu
   script:
@@ -22,6 +39,8 @@ test-runner:
     - nvidia-smi
 test-container:
   needs: [deploy-runner]
+  only:
+    refs: [master]
   tags:
     - cml-runner-gpu
   image: iterativeai/cml:0-dvc2-base1-gpu