diff --git a/Makefile b/Makefile index 2efb0f966..eb91fa6f3 100644 --- a/Makefile +++ b/Makefile @@ -80,13 +80,13 @@ gpg-test-clean: # image build order: # # app -> {app-hsm,monitor} -# monitor -> monitor-lambda-emulator,monitor-hsm-lambda-emulator -# app-hsm -> monitor-hsm-lambda-emulator (app-hsm writes chains and updated config to shared /tmp volume) +# monitor -> monitor,monitor-hsm +# app-hsm -> monitor-hsm(app-hsm writes chains and updated config to shared /tmp volume) # build: generate DOCKER_BUILDKIT=0 COMPOSE_DOCKER_CLI_BUILD=0 docker compose build --no-cache --parallel app db DOCKER_BUILDKIT=0 COMPOSE_DOCKER_CLI_BUILD=0 docker compose build --no-cache --parallel app-hsm monitor - DOCKER_BUILDKIT=0 COMPOSE_DOCKER_CLI_BUILD=0 docker compose build --no-cache --parallel monitor-lambda-emulator monitor-hsm-lambda-emulator + DOCKER_BUILDKIT=0 COMPOSE_DOCKER_CLI_BUILD=0 docker compose build --no-cache --parallel monitor monitor-hsm integration-test: ./bin/run_integration_tests.sh diff --git a/bin/run_integration_tests.sh b/bin/run_integration_tests.sh index 6e46d3021..73bc64a3d 100755 --- a/bin/run_integration_tests.sh +++ b/bin/run_integration_tests.sh @@ -28,20 +28,18 @@ done APP_HSM_NORMANDY_ROOT_HASH=$(docker compose exec app-hsm yq -r '.signers[] | select(.id == "normandy").cacert' /app/autograph.softhsm.yaml | \ openssl x509 -outform DER | sha256sum | awk '{print $1}') -# start the monitor lambda emulators +# start the monitor containers echo "checking autograph monitors" docker compose run \ --rm \ -e AUTOGRAPH_URL=http://app:8000/ \ - --entrypoint /usr/local/bin/lambda-selftest-entrypoint.sh \ - monitor-lambda-emulator /go/bin/autograph-monitor + monitor /go/bin/autograph-monitor docker compose run \ --rm \ -e AUTOGRAPH_URL=http://autograph-app-hsm:8001/ \ -e AUTOGRAPH_ROOT_HASH=$APP_HSM_NORMANDY_ROOT_HASH \ - --entrypoint /usr/local/bin/lambda-selftest-entrypoint.sh \ - monitor-hsm-lambda-emulator /go/bin/autograph-monitor + monitor-hsm /go/bin/autograph-monitor echo "checking read-only API" # user bob doesn't exist in the softhsm config diff --git a/docker-compose.yml b/docker-compose.yml index 2ced9b40d..ea7c8fcb3 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -65,42 +65,27 @@ services: monitor: container_name: autograph-monitor - image: autograph-app - command: ["/go/bin/autograph-monitor"] - - monitor-lambda-emulator: - container_name: autograph-monitor-lambda-emulator - image: autograph-monitor-lambda-emulator + image: autograph-monitor build: context: tools/autograph-monitor/ - dockerfile: Dockerfile.lambda-emulator + dockerfile: Dockerfile.monitor-selftest environment: - AUTOGRAPH_URL=http://autograph-app:8000/ - AUTOGRAPH_KEY=19zd4w3xirb5syjgdx8atq6g91m03bdsmzjifs2oddivswlu9qs - # set a non-empty value to use the lambda handler - - LAMBDA_TASK_ROOT=/usr/local/bin/ - - AUTOGRAPH_ROOT_HASH - command: ["/go/bin/autograph-monitor"] - ports: - - "9000:8080" links: - app depends_on: - app - monitor-hsm-lambda-emulator: - container_name: autograph-monitor-hsm-lambda-emulator - image: autograph-monitor-lambda-emulator + monitor-hsm: + container_name: autograph-monitor-hsm + image: autograph-monitor build: context: tools/autograph-monitor/ - dockerfile: Dockerfile.lambda-emulator + dockerfile: Dockerfile.monitor-selftest environment: - AUTOGRAPH_URL=http://autograph-app-hsm:8001/ - AUTOGRAPH_KEY=19zd4w3xirb5syjgdx8atq6g91m03bdsmzjifs2oddivswlu9qs - # set a non-empty value to use the lambda handler - - LAMBDA_TASK_ROOT=/usr/local/bin/ - - AUTOGRAPH_ROOT_HASH - command: ["/go/bin/autograph-monitor"] ports: - "9001:8080" links: diff --git a/tools/autograph-client/integration-tests.yml b/tools/autograph-client/integration-tests.yml index ffb218343..e9399777c 100644 --- a/tools/autograph-client/integration-tests.yml +++ b/tools/autograph-client/integration-tests.yml @@ -63,8 +63,7 @@ services: container_name: test-monitor-app extends: file: ../../docker-compose.yml - service: monitor-lambda-emulator - entrypoint: [ "/usr/local/bin/lambda-selftest-entrypoint.sh" ] + service: monitor - # TODO: Add a monitor test for the HSM lambda - tricky because we need + # TODO: Add a monitor test for the HSM container - tricky because we need # a way to dynamically grab the root hash from the HSM. diff --git a/tools/autograph-monitor/Dockerfile.lambda-emulator b/tools/autograph-monitor/Dockerfile.lambda-emulator deleted file mode 100644 index 2bc095d3d..000000000 --- a/tools/autograph-monitor/Dockerfile.lambda-emulator +++ /dev/null @@ -1,14 +0,0 @@ -FROM autograph-app - -USER root - -RUN curl -Lo /usr/local/bin/aws-lambda-rie \ - https://github.com/aws/aws-lambda-runtime-interface-emulator/releases/latest/download/aws-lambda-rie \ - && \ - chmod +x /usr/local/bin/aws-lambda-rie - -COPY lambda-selftest-entrypoint.sh /usr/local/bin/lambda-selftest-entrypoint.sh - -USER app -ENTRYPOINT ["/usr/local/bin/aws-lambda-rie"] -CMD ["/go/bin/autograph-monitor"] diff --git a/tools/autograph-monitor/Dockerfile.monitor-selftest b/tools/autograph-monitor/Dockerfile.monitor-selftest new file mode 100644 index 000000000..a514f2d0c --- /dev/null +++ b/tools/autograph-monitor/Dockerfile.monitor-selftest @@ -0,0 +1,8 @@ +FROM autograph-app + +USER root + +COPY selftest-entrypoint.sh /usr/local/bin/selftest-entrypoint.sh + +USER app +CMD ["/usr/local/bin/selftest-entrypoint.sh"] diff --git a/tools/autograph-monitor/lambda-selftest-entrypoint.sh b/tools/autograph-monitor/lambda-selftest-entrypoint.sh deleted file mode 100755 index 4b250c11e..000000000 --- a/tools/autograph-monitor/lambda-selftest-entrypoint.sh +++ /dev/null @@ -1,30 +0,0 @@ -#!/bin/bash - -set -e -set -o pipefail - -# Fork to start the AWS runtime emulator -/usr/local/bin/aws-lambda-rie "$@" & -AWS_RUNTIME_PID=$! -cleanup() { - kill -TERM $AWS_RUNTIME_PID - wait $AWS_RUNTIME_PID -} -trap cleanup EXIT SIGINT SIGTERM - -# invoke a test monitor run in a lambda monitor -MONITOR_ERROR=$(curl -s -w '\n' -X POST 'http://localhost:8080/2015-03-31/functions/function/invocations' -d '{}') - -# If the result was null - then we succeeded! -if [ "${MONITOR_ERROR}" == "null" ]; then - exit 0 -fi - -# Otherwise - some kind of error occured -MONITOR_ERROR_TYPE=$(echo "${MONITOR_ERROR}" | jq -r '.errorType') -if [ "${MONITOR_ERROR_TYPE}" == "errorString" ]; then - echo "${MONITOR_ERROR}" | jq -r '.errorMessage' >&2 -else - echo "${MONITOR_ERROR}" | jq >&2 -fi -exit 1 diff --git a/tools/autograph-monitor/selftest-entrypoint.sh b/tools/autograph-monitor/selftest-entrypoint.sh new file mode 100755 index 000000000..0d0540d90 --- /dev/null +++ b/tools/autograph-monitor/selftest-entrypoint.sh @@ -0,0 +1,10 @@ +#!/bin/bash + +set -o pipefail + +/go/bin/autograph-monitor +EXIT_CODE=$? +if [ $EXIT_CODE -ne 0 ]; then + echo "Monitor test failure detected" + exit 1 +fi