Skip to content

Commit dc991f2

Browse files
vector-of-boolvector-of-bool
authored
[MONGOCRYPT-838] Switch the upload target bucket based on the project/patch status (#1117)
This change replaces all references to the mciuploads bucket in the CI configuration file with a template expansion that conditionally refers to an alternate bucket in certain scenarios. This templating also sets the role_arn for S3 operations based on the same conditions.
1 parent b16e4e4 commit dc991f2

1 file changed

Lines changed: 55 additions & 61 deletions

File tree

‎.evergreen/config.yml‎

Lines changed: 55 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -80,19 +80,17 @@ functions:
8080
include: [./**]
8181
- command: s3.put
8282
params:
83-
aws_key: '${aws_key}'
84-
aws_secret: '${aws_secret}'
83+
role_arn: ${upload_arn}
8584
remote_file: '${project}/${build_variant}/${branch_name}/${libmongocrypt_s3_suffix}/libmongocrypt.tar.gz'
86-
bucket: mciuploads
85+
bucket: ${upload_bucket}
8786
permissions: public-read
8887
local_file: 'libmongocrypt.tar.gz'
8988
content_type: '${content_type|application/x-gzip}'
9089
- command: s3.put
9190
params:
92-
aws_key: '${aws_key}'
93-
aws_secret: '${aws_secret}'
91+
role_arn: ${upload_arn}
9492
remote_file: '${project}/${build_variant}/${branch_name}/${libmongocrypt_s3_suffix_copy}/libmongocrypt.tar.gz'
95-
bucket: mciuploads
93+
bucket: ${upload_bucket}
9694
permissions: public-read
9795
local_file: 'libmongocrypt.tar.gz'
9896
content_type: '${content_type|application/x-gzip}'
@@ -138,10 +136,9 @@ functions:
138136
include: [./**]
139137
- command: s3.put
140138
params:
141-
aws_key: '${aws_key}'
142-
aws_secret: '${aws_secret}'
139+
role_arn: ${upload_arn}
143140
remote_file: '${project}/${build_variant}/${branch_name}/${libmongocrypt_s3_suffix}/libmongocrypt-distro-packages.tar.gz'
144-
bucket: mciuploads
141+
bucket: ${upload_bucket}
145142
permissions: public-read
146143
local_file: 'libmongocrypt-distro-packages.tar.gz'
147144
content_type: '${content_type|application/x-gzip}'
@@ -224,10 +221,9 @@ functions:
224221
"download tarball":
225222
- command: s3.get
226223
params:
227-
aws_key: '${aws_key}'
228-
aws_secret: '${aws_secret}'
224+
role_arn: ${upload_arn}
229225
remote_file: '${project}/${variant_name}/${branch_name}/${libmongocrypt_s3_suffix}/libmongocrypt.tar.gz'
230-
bucket: mciuploads
226+
bucket: ${upload_bucket}
231227
extract_to: all/${variant_name}
232228

233229
"setup packaging credentials":
@@ -323,11 +319,10 @@ functions:
323319
- "*"
324320
- command: s3.put
325321
params:
326-
aws_key: ${aws_key}
327-
aws_secret: ${aws_secret}
322+
role_arn: ${upload_arn}
328323
local_file: release-files.tgz
329324
remote_file: '${project}/python-release/${branch_name}/${libmongocrypt_s3_suffix}/${task_id}-${execution}-release-files.tar.gz'
330-
bucket: mciuploads
325+
bucket: ${upload_bucket}
331326
permissions: public-read
332327
content_type: ${content_type|application/gzip}
333328
display_name: Release Python files
@@ -358,7 +353,7 @@ functions:
358353
script: |
359354
set -o xtrace
360355
# Download all the release files.
361-
aws s3 cp --recursive s3://mciuploads/${project}/python-release/${branch_name}/${libmongocrypt_s3_suffix}/ release/
356+
aws s3 cp --recursive s3://${upload_bucket}/${project}/python-release/${branch_name}/${libmongocrypt_s3_suffix}/ release/
362357
# Combine releases into one directory.
363358
ls -la release/
364359
mkdir releases
@@ -373,11 +368,10 @@ functions:
373368
- "*"
374369
- command: s3.put
375370
params:
376-
aws_key: ${aws_key}
377-
aws_secret: ${aws_secret}
371+
role_arn: ${upload_arn}
378372
local_file: release-files-all.tgz
379373
remote_file: '${project}/python-release/${branch_name}/${libmongocrypt_s3_suffix}/${task_id}-${execution}-release-files-all.tar.gz'
380-
bucket: mciuploads
374+
bucket: ${upload_bucket}
381375
permissions: public-read
382376
content_type: ${content_type|application/gzip}
383377
display_name: Release Python files all
@@ -432,9 +426,8 @@ functions:
432426
type: test
433427
params:
434428
display_name: Augmented SBOM
435-
aws_key: ${aws_key}
436-
aws_secret: ${aws_secret}
437-
bucket: mciuploads
429+
role_arn: ${upload_arn}
430+
bucket: ${upload_bucket}
438431
content_type: application/json
439432
local_file: libmongocrypt/cyclonedx.augmented.sbom.json
440433
permissions: public-read
@@ -640,19 +633,17 @@ tasks:
640633
fi
641634
- command: s3.put
642635
params:
643-
aws_key: '${aws_key}'
644-
aws_secret: '${aws_secret}'
636+
role_arn: ${upload_arn}
645637
remote_file: 'libmongocrypt/java/${revision}/libmongocrypt-java.tar.gz'
646-
bucket: mciuploads
638+
bucket: ${upload_bucket}
647639
permissions: public-read
648640
local_file: 'libmongocrypt-java.tar.gz'
649641
content_type: '${content_type|application/x-gzip}'
650642
- command: s3.put
651643
params:
652-
aws_key: '${aws_key}'
653-
aws_secret: '${aws_secret}'
644+
role_arn: ${upload_arn}
654645
remote_file: 'libmongocrypt/java/${tag_upload_location}/libmongocrypt-java.tar.gz'
655-
bucket: mciuploads
646+
bucket: ${upload_bucket}
656647
permissions: public-read
657648
optional: true
658649
display_name: 'libmongocrypt-java-${tag_upload_location}.tar.gz'
@@ -835,50 +826,45 @@ tasks:
835826
fi
836827
- command: s3.put
837828
params:
838-
aws_key: '${aws_key}'
839-
aws_secret: '${aws_secret}'
829+
role_arn: ${upload_arn}
840830
remote_file: 'libmongocrypt/all/${branch_name}/${libmongocrypt_s3_suffix}/libmongocrypt-all.tar.gz'
841-
bucket: mciuploads
831+
bucket: ${upload_bucket}
842832
permissions: public-read
843833
local_file: 'libmongocrypt-all.tar.gz'
844834
content_type: '${content_type|application/x-gzip}'
845835
- command: s3.put
846836
params:
847-
aws_key: '${aws_key}'
848-
aws_secret: '${aws_secret}'
837+
role_arn: ${upload_arn}
849838
remote_file: 'libmongocrypt/all/${branch_name}/${libmongocrypt_s3_suffix_copy}/libmongocrypt-all.tar.gz'
850-
bucket: mciuploads
839+
bucket: ${upload_bucket}
851840
permissions: public-read
852841
local_file: 'libmongocrypt-all.tar.gz'
853842
content_type: '${content_type|application/x-gzip}'
854843
- command: s3.put
855844
params:
856-
aws_key: '${aws_key}'
857-
aws_secret: '${aws_secret}'
845+
role_arn: ${upload_arn}
858846
remote_file: 'libmongocrypt/all/${tag_upload_location}/libmongocrypt-all.tar.gz'
859-
bucket: mciuploads
847+
bucket: ${upload_bucket}
860848
permissions: public-read
861849
optional: true # Do not fail task if `local_file` does not exist. `local_file` only exists for tagged release.
862850
display_name: 'libmongocrypt-all-${tag_upload_location}.tar.gz'
863851
local_file: 'libmongocrypt-all-${tag_upload_location}.tar.gz'
864852
content_type: '${content_type|application/x-gzip}'
865853
- command: s3.put
866854
params:
867-
aws_key: '${aws_key}'
868-
aws_secret: '${aws_secret}'
855+
role_arn: ${upload_arn}
869856
remote_file: 'libmongocrypt/all/latest/stable/libmongocrypt-all.tar.gz'
870-
bucket: mciuploads
857+
bucket: ${upload_bucket}
871858
permissions: public-read
872859
optional: true # Do not fail task if `local_file` does not exist. `local_file` only exists for stable release.
873860
display_name: 'stable/libmongocrypt-all-${tag_upload_location}.tar.gz'
874861
local_file: 'stable/libmongocrypt-all-${tag_upload_location}.tar.gz'
875862
content_type: '${content_type|application/x-gzip}'
876863
- command: s3.put
877864
params:
878-
aws_key: '${aws_key}'
879-
aws_secret: '${aws_secret}'
865+
role_arn: ${upload_arn}
880866
remote_file: 'libmongocrypt/all/latest/unstable/libmongocrypt-all.tar.gz'
881-
bucket: mciuploads
867+
bucket: ${upload_bucket}
882868
permissions: public-read
883869
optional: true # Do not fail task if `local_file` does not exist. `local_file` only exists for unstable release.
884870
display_name: 'unstable/libmongocrypt-all-${tag_upload_location}.tar.gz'
@@ -931,10 +917,9 @@ tasks:
931917
file: libmongocrypt/expansions.yml
932918
- command: s3.get # Download Windows build.
933919
params:
934-
aws_key: '${aws_key}'
935-
aws_secret: '${aws_secret}'
920+
role_arn: ${upload_arn}
936921
remote_file: '${project}/windows-test/${branch_name}/${libmongocrypt_s3_suffix}/libmongocrypt.tar.gz'
937-
bucket: mciuploads
922+
bucket: ${upload_bucket}
938923
extract_to: libmongocrypt_download
939924
- command: shell.exec
940925
params:
@@ -960,21 +945,19 @@ tasks:
960945
# Documentation now refers to the GitHub release page, which includes the per-release tarball.
961946
# The fixed URL upload is kept to avoid possibly breaking expectations. Consider removing in the future.
962947
params:
963-
aws_key: '${aws_key}'
964-
aws_secret: '${aws_secret}'
948+
role_arn: ${upload_arn}
965949
remote_file: 'libmongocrypt/windows/latest_release/libmongocrypt${upload_suffix}.tar.gz'
966950
display_name: (Deprecated) libmongocrypt${upload_suffix}.tar.gz
967-
bucket: mciuploads
951+
bucket: ${upload_bucket}
968952
permissions: public-read
969953
local_file: 'libmongocrypt_upload.tar.gz'
970954
content_type: 'application/x-gzip'
971955
- command: s3.put # Upload tarball for GitHub Release.
972956
params:
973-
aws_key: '${aws_key}'
974-
aws_secret: '${aws_secret}'
957+
role_arn: ${upload_arn}
975958
remote_file: '${project}/${build_variant}/${branch_name}/${revision}/${version_id}/libmongocrypt-windows-x86_64-${libmongocrypt_release_version}.tar.gz'
976959
display_name: libmongocrypt-windows-x86_64-${libmongocrypt_release_version}.tar.gz
977-
bucket: mciuploads
960+
bucket: ${upload_bucket}
978961
permissions: public-read
979962
local_file: 'libmongocrypt_upload.tar.gz'
980963
content_type: 'application/x-gzip'
@@ -990,11 +973,10 @@ tasks:
990973
args: --secret garasign_username=${garasign_username} --secret garasign_password=${garasign_password} +sign --file_to_sign=libmongocrypt_upload.tar.gz --output_file=libmongocrypt_upload.asc
991974
- command: s3.put # Upload signature for GitHub Release.
992975
params:
993-
aws_key: '${aws_key}'
994-
aws_secret: '${aws_secret}'
976+
role_arn: ${upload_arn}
995977
remote_file: '${project}/${build_variant}/${branch_name}/${revision}/${version_id}/libmongocrypt-windows-x86_64-${libmongocrypt_release_version}.asc'
996978
display_name: libmongocrypt-windows-x86_64-${libmongocrypt_release_version}.asc
997-
bucket: mciuploads
979+
bucket: ${upload_bucket}
998980
permissions: public-read
999981
local_file: 'libmongocrypt/libmongocrypt_upload.asc'
1000982
content_type: 'application/pgp-signature'
@@ -1017,11 +999,10 @@ tasks:
1017999
bash .evergreen/debian_package_build.sh --is-patch=${is_patch}
10181000
- command: s3.put
10191001
params:
1020-
aws_key: ${aws_key}
1021-
aws_secret: ${aws_secret}
1002+
role_arn: ${upload_arn}
10221003
local_file: deb.tar.gz
10231004
remote_file: libmongocrypt/${branch_name}/${revision}/${version_id}/${build_id}/${execution}/debian-packages.tar.gz
1024-
bucket: mciuploads
1005+
bucket: ${upload_bucket}
10251006
permissions: public-read
10261007
content_type: ${content_type|application/x-gzip}
10271008
display_name: "deb.tar.gz"
@@ -1042,11 +1023,10 @@ tasks:
10421023
bash .evergreen/debian_package_build.sh --arch=i386 --is-patch=${is_patch}
10431024
- command: s3.put
10441025
params:
1045-
aws_key: ${aws_key}
1046-
aws_secret: ${aws_secret}
1026+
role_arn: ${upload_arn}
10471027
local_file: deb.tar.gz
10481028
remote_file: libmongocrypt/${branch_name}/${revision}/${version_id}/${build_id}/${execution}/debian-packages-i386.tar.gz
1049-
bucket: mciuploads
1029+
bucket: ${upload_bucket}
10501030
permissions: public-read
10511031
content_type: ${content_type|application/x-gzip}
10521032
display_name: "deb.tar.gz"
@@ -1142,15 +1122,29 @@ pre:
11421122
REMOTE_SUFFIX_COPY="latest-${branch_name}"
11431123
fi
11441124
1125+
# If we are a non-patch build in the libmongocrypt-release project, we upload to a restricted
1126+
# CDN S3 bucket. Otherwise, we upload to a less restricted bucket for convenience. The corresponding
1127+
# role_arn_... values come from EVG project configuration variables stored on the EVG server
1128+
if test "${is_patch}" = 'true' || "${project_name}" != 'libmongocrypt-release'; then
1129+
upload_bucket='mciuploads'
1130+
upload_arn='${role_arn_for_mciuploads}'
1131+
else
1132+
upload_bucket='cdn-origin-libmongocrypt'
1133+
upload_arn='${role_arn_for_release}'
1134+
fi
1135+
11451136
PROJECT_DIRECTORY="$(pwd)"
11461137
echo "libmongocrypt_s3_suffix: $REMOTE_SUFFIX"
11471138
echo "libmongocrypt_s3_suffix_copy: $REMOTE_SUFFIX_COPY"
11481139
echo "project_directory: $PROJECT_DIRECTORY"
1140+
echo "Upload S3 bucket: $upload_bucket"
11491141
11501142
cat <<EOT > expansion.yml
11511143
libmongocrypt_s3_suffix: "$REMOTE_SUFFIX"
11521144
libmongocrypt_s3_suffix_copy: "$REMOTE_SUFFIX_COPY"
11531145
project_directory: "$PROJECT_DIRECTORY"
1146+
upload_bucket: "$upload_bucket"
1147+
upload_arn: "$upload_arn"
11541148
EOT
11551149
- command: expansions.update
11561150
params:

0 commit comments

Comments
 (0)