chore(ci): use 1pass to access konnect PAT for tests

Kong · Dec 2, 2024 · 9ea35a8 · 9ea35a8
1 parent a44f743
commit 9ea35a8
Show file tree

Hide file tree

Showing 3 changed files with 46 additions and 4 deletions.
diff --git a/.github/workflows/_e2e_tests.yaml b/.github/workflows/_e2e_tests.yaml
@@ -165,6 +165,17 @@ jobs:
 
       - run: echo "GOTESTSUM_JUNITFILE=e2e-kind-${{ matrix.test }}-${{ matrix.kubernetes-version }}-tests.xml" >> $GITHUB_ENV
 
+      - uses: 1password/load-secrets-action@v2
+        id: konnect-pat
+        with:
+          export-env: false
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN_TEAM_K8S_PUBLIC }}
+          PAT: 'op://team-k8s-public/team-k8s - konnect - KIC tests PAT/password'
+
+      - if: ${{ steps.konnect-pat.outputs.PAT == '' }}
+        run: exit 1
+
       - name: run ${{ matrix.test }}
         run: make test.e2e
         env:
@@ -178,7 +189,7 @@ jobs:
           TEST_KONG_IMAGE: ${{ steps.split.outputs.kong-image }}
           TEST_KONG_TAG: ${{ steps.split.outputs.kong-tag }}
           TEST_KONG_EFFECTIVE_VERSION: ${{ inputs.kong-effective-version }}
-          TEST_KONG_KONNECT_ACCESS_TOKEN: ${{ secrets.K8S_TEAM_KONNECT_ACCESS_TOKEN }}
+          TEST_KONG_KONNECT_ACCESS_TOKEN: ${{ steps.konnect-pat.outputs.PAT }}
           KONG_LICENSE_DATA: ${{ steps.license.outputs.license }}
           GOTESTSUM_JUNITFILE: ${{ env.GOTESTSUM_JUNITFILE }}
 
@@ -266,6 +277,17 @@ jobs:
 
       - run: echo "GOTESTSUM_JUNITFILE=e2e-gke-${{ matrix.test }}-${{ matrix.kubernetes-version }}-tests.xml" >> $GITHUB_ENV
 
+      - uses: 1password/load-secrets-action@v2
+        id: konnect-pat
+        with:
+          export-env: false
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN_TEAM_K8S_PUBLIC }}
+          PAT: 'op://team-k8s-public/team-k8s - konnect - KIC tests PAT/password'
+
+      - if: ${{ steps.konnect-pat.outputs.PAT == '' }}
+        run: exit 1
+
       - name: run ${{ matrix.test }}
         run: make test.e2e
         env:
@@ -280,8 +302,8 @@ jobs:
           TEST_KONG_IMAGE: ${{ steps.split.outputs.kong-image }}
           TEST_KONG_TAG: ${{ steps.split.outputs.kong-tag }}
           TEST_KONG_EFFECTIVE_VERSION: ${{ inputs.kong-effective-version }}
+          TEST_KONG_KONNECT_ACCESS_TOKEN: ${{ steps.konnect-pat.outputs.PAT }}
           KONG_LICENSE_DATA: ${{ steps.license.outputs.license }}
-          TEST_KONG_KONNECT_ACCESS_TOKEN: ${{ secrets.K8S_TEAM_KONNECT_ACCESS_TOKEN }}
           KONG_CLUSTER_VERSION: ${{ matrix.kubernetes-version }}
           KONG_CLUSTER_PROVIDER: gke
           E2E_TEST_RUN: ${{ matrix.test }}

diff --git a/.github/workflows/_kongintegration_tests.yaml b/.github/workflows/_kongintegration_tests.yaml
@@ -47,13 +47,24 @@ jobs:
 
       - run: echo "GOTESTSUM_JUNITFILE=kongintegration-${{ matrix.name }}-tests.xml" >> $GITHUB_ENV
 
+      - uses: 1password/load-secrets-action@v2
+        id: konnect-pat
+        with:
+          export-env: false
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN_TEAM_K8S_PUBLIC }}
+          PAT: 'op://team-k8s-public/team-k8s - konnect - KIC tests PAT/password'
+
+      - if: ${{ steps.konnect-pat.outputs.PAT == '' }}
+        run: exit 1
+
       - name: run kong integration tests
         run: make test.kongintegration
         env:
           MISE_VERBOSE: 1
           MISE_DEBUG: 1
           GOTESTSUM_JUNITFILE: ${{ env.GOTESTSUM_JUNITFILE }}
-          TEST_KONG_KONNECT_ACCESS_TOKEN: ${{ secrets.K8S_TEAM_KONNECT_ACCESS_TOKEN }}
+          TEST_KONG_KONNECT_ACCESS_TOKEN: ${{ steps.konnect-pat.outputs.PAT }}
           KONG_LICENSE_DATA: ${{ steps.license.outputs.license }}
           TEST_KONG_ENTERPRISE: ${{ matrix.enterprise }}
 

diff --git a/.github/workflows/cleanup.yaml b/.github/workflows/cleanup.yaml
@@ -34,11 +34,20 @@ jobs:
         uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
+      - uses: 1password/load-secrets-action@v2
+        id: konnect-pat
+        with:
+          export-env: false
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN_TEAM_K8S_PUBLIC }}
+          PAT: 'op://team-k8s-public/team-k8s - konnect - KIC tests PAT/password'
+      - if: ${{ steps.konnect-pat.outputs.PAT == '' }}
+        run: exit 1
       - name: cleanup orphaned test clusters
         run: go run ./hack/cleanup konnect
         env:
           # Ref: https://github.com/Kong/sdk-konnect-go/issues/20
           KONG_CUSTOM_DOMAIN: konghq.tech
           # NOTE: This token has to align with the domain above until the linked
           # issue is resolved.
-          TEST_KONG_KONNECT_ACCESS_TOKEN: ${{ secrets.K8S_TEAM_KONNECT_ACCESS_TOKEN }}
+          TEST_KONG_KONNECT_ACCESS_TOKEN: ${{ steps.konnect-pat.outputs.PAT }}