[v10] Add AWS Roles to the buildbox pipeline

.cloudbuild/ci/doc-tests.yaml

@@ -1,5 +1,5 @@
 steps:
-  - name: quay.io/gravitational/next:main
+  - name: public.ecr.aws/gravitational/docs:latest
     id: docs-test
     entrypoint: /bin/bash
     dir: /src

.cloudbuild/ci/integration-tests.yaml

@@ -12,7 +12,7 @@ options:
 steps:
   # Run the integration tests. Actual content of this job depends on the changes
   # detected in the PR
-  - name: quay.io/gravitational/teleport-buildbox:teleport10
+  - name: public.ecr.aws/gravitational/teleport-buildbox:teleport10
     id: run-tests
     dir: /workspace/.cloudbuild/scripts
     entrypoint: bash

.cloudbuild/ci/lint.yaml

@@ -1,6 +1,8 @@
 steps:
-  - name: quay.io/gravitational/teleport-buildbox:teleport10
+  - name: public.ecr.aws/gravitational/teleport-buildbox:teleport10
     id: lint
     args: ['make', 'lint']
 options:
-  machineType: 'E2_HIGHCPU_32'
+  pool:
+    name: projects/ci-account/locations/us-west1/workerPools/high-cpu-pool
+

.cloudbuild/ci/os-compatibility-test.yaml

@@ -0,0 +1,23 @@
+timeout: 25m
+
+options:
+   machineType: E2_HIGHCPU_32
+
+steps:
+  - name: public.ecr.aws/gravitational/teleport-buildbox-centos7:teleport10
+    id: build-teleport
+    dir: /workspace
+    entrypoint: "/bin/bash"
+    args: 
+      - '-c'
+      - 'make build/tctl build/tsh build/tbot build/teleport'  
+    timeout: 10m
+    env:
+      - GOCACHE=/tmp/gocache
+
+  - name: gcr.io/cloud-builders/docker
+    id: compatibility-test
+    entrypoint: "/bin/bash"
+    args: 
+      - './build.assets/build-test-compat.sh'
+    timeout: 10m

.cloudbuild/ci/unit-tests.yaml

@@ -1,4 +1,4 @@
-timeout: 25m
+timeout: 30m
 
 options:
   machineType: E2_HIGHCPU_32
@@ -12,7 +12,7 @@ options:
 steps:
   # Run the unit tests. Actual content of this job depends on the changes
   # detected in the PR
-  - name: quay.io/gravitational/teleport-buildbox:teleport10
+  - name: public.ecr.aws/gravitational/teleport-buildbox:teleport10
     id: run-tests
     dir: /workspace/.cloudbuild/scripts
     entrypoint: bash

.cloudbuild/scripts/cmd/unit-tests/main.go

@@ -1,3 +1,5 @@
+//go:build linux
+
 /*
 Copyright 2021 Gravitational, Inc.
 
@@ -23,10 +25,12 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"strings"
 	"time"
 
 	"github.com/gravitational/trace"
 	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/unix"
 
 	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/artifacts"
 	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/changes"
@@ -36,8 +40,11 @@ import (
 	"github.com/gravitational/teleport/.cloudbuild/scripts/internal/secrets"
 )
 
+// debugFsPath is the path where debugfs should be mounted.
+const debugFsPath = "/sys/kernel/debug"
+
 // main is just a stub that prints out an error message and sets a nonzero exit
-// code on failure. All of the work happens in `innerMain()`.
+// code on failure. All the work happens in `innerMain()`.
 func main() {
 	if err := run(); err != nil {
 		log.Fatalf("FAILED: %s", err.Error())
@@ -165,8 +172,13 @@ func run() error {
 		artifacts.FindAndUpload(timeoutCtx, args.bucket, prefix, args.artifactSearchPatterns)
 	}()
 
+	log.Printf("Mounting debugfs")
+	if err := mountDebugFS(); err != nil {
+		return trace.Wrap(err)
+	}
+
 	log.Printf("Running unit tests...")
-	err = runUnitTests(args.workspace)
+	err = runUnitTests(args.workspace, ch)
 	if err != nil {
 		return trace.Wrap(err, "unit tests failed")
 	}
@@ -176,14 +188,65 @@ func run() error {
 	return nil
 }
 
-func runUnitTests(workspace string) error {
-	cmd := exec.Command("make", "test")
+func runUnitTests(workspace string, ch changes.Changes) error {
+	enableTests := []string{
+		"TELEPORT_ETCD_TEST=yes",
+		"TELEPORT_XAUTH_TEST=yes",
+		"TELEPORT_BPF_TEST=yes",
+	}
+
+	targets := []string{"test-go", "test-sh", "test-api"}
+	if ch.Helm {
+		targets = append(targets, "test-helm")
+	}
+	if ch.CI {
+		targets = append(targets, "test-ci")
+	}
+	if ch.Rust {
+		targets = append(targets, "test-rust")
+	}
+	if ch.Operator {
+		targets = append(targets, "test-operator")
+	}
+
+	log.Printf("Running test targets: %v", strings.Join(targets, " "))
+	cmd := exec.Command("make", targets...)
 	cmd.Dir = workspace
 	cmd.Env = os.Environ()
-	cmd.Env = append(cmd.Env, "TELEPORT_ETCD_TEST=yes")
-	cmd.Env = append(cmd.Env, "TELEPORT_XAUTH_TEST=yes")
+	cmd.Env = append(cmd.Env, enableTests...)
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 
 	return cmd.Run()
 }
+
+// mountDebugFS mounts debugfs at /sys/kernel/debug, so BPF test can run in GCB.
+func mountDebugFS() error {
+	if isDebugFsMounted() {
+		return nil
+	}
+	// equivalent to: mount -t debugfs none /sys/kernel/debug/
+	if err := unix.Mount("debugfs", debugFsPath, "debugfs", 0, ""); err != nil {
+		return trace.Wrap(err, "failed to mount debugfs")
+	}
+
+	return nil
+}
+
+// isDebugFsMounted returns true if debugfs is mounted, false otherwise.
+func isDebugFsMounted() bool {
+	mounts, err := os.ReadFile("/proc/mounts")
+	if err != nil {
+		log.Warningf("Failed to read /proc/mounts: %v", err)
+		return false
+	}
+
+	for _, line := range strings.Split(string(mounts), "\n") {
+		tokens := strings.Fields(line)
+		if len(tokens) == 6 && tokens[0] == "debugfs" && tokens[1] == debugFsPath {
+			return true
+		}
+	}
+
+	return false
+}

.cloudbuild/scripts/go.mod

@@ -1,6 +1,6 @@
 module github.com/gravitational/teleport/.cloudbuild/scripts
 
-go 1.17
+go 1.18
 
 require (
 	cloud.google.com/go/secretmanager v1.2.0
@@ -11,6 +11,7 @@ require (
 	github.com/sirupsen/logrus v1.8.1
 	github.com/stretchr/testify v1.7.0
 	golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b
+	golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27
 	google.golang.org/genproto v0.0.0-20220218161850-94dd64e39d7c
 )
 
@@ -42,7 +43,6 @@ require (
 	go.opencensus.io v0.23.0 // indirect
 	golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420 // indirect
 	golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 // indirect
-	golang.org/x/sys v0.0.0-20220128215802-99c3d69c2c27 // indirect
 	golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 // indirect
 	golang.org/x/text v0.3.6 // indirect
 	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect

.cloudbuild/scripts/internal/changes/changes.go

@@ -31,9 +31,13 @@ import (
 
 // Changes describes the kind of changes found in the analysed workspace.
 type Changes struct {
+	CI         bool
 	Docs       bool
 	Code       bool
 	Enterprise bool
+	Helm       bool
+	Operator   bool
+	Rust       bool
 }
 
 // Analyze examines the workspace for specific changes using its git history,
@@ -64,6 +68,18 @@ func Analyze(workspaceDir string, targetBranch string, commitSHA string) (Change
 		case isDocChange(path):
 			report.Docs = true
 
+		case isHelmChange(path):
+			report.Helm = true
+
+		case isRustChange(path):
+			report.Rust = true
+
+		case isCIChange(path):
+			report.CI = true
+
+		case isOperatorChange(path):
+			report.Operator = true
+
 		default:
 			report.Code = true
 		}
@@ -78,6 +94,23 @@ func Analyze(workspaceDir string, targetBranch string, commitSHA string) (Change
 	return report, nil
 }
 
+func isCIChange(path string) bool {
+	path = strings.ToLower(path)
+	return strings.HasPrefix(path, ".cloudbuild/scripts")
+}
+
+func isOperatorChange(path string) bool {
+	path = strings.ToLower(path)
+	// dependency updates can impact CRD generation,
+	// so ensure that operator tests are run when
+	// dependencies change
+	return path == "go.mod" ||
+		path == "go.sum" ||
+		strings.HasPrefix(path, "operator/") ||
+		strings.HasPrefix(path, "api/types") || // the operator uses directly Teleport types
+		strings.HasPrefix(path, "lib/tbot") // the operator embeds a tbot instance
+}
+
 func isDocChange(path string) bool {
 	path = strings.ToLower(path)
 	return strings.HasPrefix(path, "docs/") ||
@@ -86,6 +119,18 @@ func isDocChange(path string) bool {
 		strings.HasPrefix(path, "rfd/")
 }
 
+func isRustChange(path string) bool {
+	path = strings.ToLower(path)
+	return strings.HasSuffix(path, ".rs") ||
+		strings.HasSuffix(path, "Cargo.toml") ||
+		strings.HasSuffix(path, "Cargo.lock")
+}
+
+func isHelmChange(path string) bool {
+	path = strings.ToLower(path)
+	return strings.HasPrefix(path, "examples/chart/")
+}
+
 // getChanges resolves the head of target branch and compares the trees at the
 // the target branch and the supplied commit SHA.
 func getChanges(repo *git.Repository, targetBranch, commit string) (object.Changes, error) {