Skip to content

Commit eeb1cf7

Browse files
vector-of-boolvector-of-bool
authored
[MONGOCRYPT-838] Switch the upload target bucket based on the project/patch status (#1118)
[MONGOCRYPT-838] Switch the upload target bucket based on the project/patch status (#1117) This change replaces all references to the mciuploads bucket in the CI configuration file with a template expansion that conditionally refers to an alternate bucket in certain scenarios. This templating also sets the role_arn for S3 operations based on the same conditions.
1 parent 506d05c commit eeb1cf7

1 file changed

Lines changed: 55 additions & 61 deletions

File tree

‎.evergreen/config.yml‎

Lines changed: 55 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -80,19 +80,17 @@ functions:
8080
include: [./**]
8181
- command: s3.put
8282
params:
83-
aws_key: '${aws_key}'
84-
aws_secret: '${aws_secret}'
83+
role_arn: ${upload_arn}
8584
remote_file: '${project}/${build_variant}/${branch_name}/${libmongocrypt_s3_suffix}/libmongocrypt.tar.gz'
86-
bucket: mciuploads
85+
bucket: ${upload_bucket}
8786
permissions: public-read
8887
local_file: 'libmongocrypt.tar.gz'
8988
content_type: '${content_type|application/x-gzip}'
9089
- command: s3.put
9190
params:
92-
aws_key: '${aws_key}'
93-
aws_secret: '${aws_secret}'
91+
role_arn: ${upload_arn}
9492
remote_file: '${project}/${build_variant}/${branch_name}/${libmongocrypt_s3_suffix_copy}/libmongocrypt.tar.gz'
95-
bucket: mciuploads
93+
bucket: ${upload_bucket}
9694
permissions: public-read
9795
local_file: 'libmongocrypt.tar.gz'
9896
content_type: '${content_type|application/x-gzip}'
@@ -138,10 +136,9 @@ functions:
138136
include: [./**]
139137
- command: s3.put
140138
params:
141-
aws_key: '${aws_key}'
142-
aws_secret: '${aws_secret}'
139+
role_arn: ${upload_arn}
143140
remote_file: '${project}/${build_variant}/${branch_name}/${libmongocrypt_s3_suffix}/libmongocrypt-distro-packages.tar.gz'
144-
bucket: mciuploads
141+
bucket: ${upload_bucket}
145142
permissions: public-read
146143
local_file: 'libmongocrypt-distro-packages.tar.gz'
147144
content_type: '${content_type|application/x-gzip}'
@@ -224,10 +221,9 @@ functions:
224221
"download tarball":
225222
- command: s3.get
226223
params:
227-
aws_key: '${aws_key}'
228-
aws_secret: '${aws_secret}'
224+
role_arn: ${upload_arn}
229225
remote_file: '${project}/${variant_name}/${branch_name}/${libmongocrypt_s3_suffix}/libmongocrypt.tar.gz'
230-
bucket: mciuploads
226+
bucket: ${upload_bucket}
231227
extract_to: all/${variant_name}
232228

233229
"setup packaging credentials":
@@ -323,11 +319,10 @@ functions:
323319
- "*"
324320
- command: s3.put
325321
params:
326-
aws_key: ${aws_key}
327-
aws_secret: ${aws_secret}
322+
role_arn: ${upload_arn}
328323
local_file: release-files.tgz
329324
remote_file: '${project}/python-release/${branch_name}/${libmongocrypt_s3_suffix}/${task_id}-${execution}-release-files.tar.gz'
330-
bucket: mciuploads
325+
bucket: ${upload_bucket}
331326
permissions: public-read
332327
content_type: ${content_type|application/gzip}
333328
display_name: Release Python files
@@ -358,7 +353,7 @@ functions:
358353
script: |
359354
set -o xtrace
360355
# Download all the release files.
361-
aws s3 cp --recursive s3://mciuploads/${project}/python-release/${branch_name}/${libmongocrypt_s3_suffix}/ release/
356+
aws s3 cp --recursive s3://${upload_bucket}/${project}/python-release/${branch_name}/${libmongocrypt_s3_suffix}/ release/
362357
# Combine releases into one directory.
363358
ls -la release/
364359
mkdir releases
@@ -373,11 +368,10 @@ functions:
373368
- "*"
374369
- command: s3.put
375370
params:
376-
aws_key: ${aws_key}
377-
aws_secret: ${aws_secret}
371+
role_arn: ${upload_arn}
378372
local_file: release-files-all.tgz
379373
remote_file: '${project}/python-release/${branch_name}/${libmongocrypt_s3_suffix}/${task_id}-${execution}-release-files-all.tar.gz'
380-
bucket: mciuploads
374+
bucket: ${upload_bucket}
381375
permissions: public-read
382376
content_type: ${content_type|application/gzip}
383377
display_name: Release Python files all
@@ -432,9 +426,8 @@ functions:
432426
type: test
433427
params:
434428
display_name: Augmented SBOM
435-
aws_key: ${aws_key}
436-
aws_secret: ${aws_secret}
437-
bucket: mciuploads
429+
role_arn: ${upload_arn}
430+
bucket: ${upload_bucket}
438431
content_type: application/json
439432
local_file: libmongocrypt/cyclonedx.augmented.sbom.json
440433
permissions: public-read
@@ -636,19 +629,17 @@ tasks:
636629
fi
637630
- command: s3.put
638631
params:
639-
aws_key: '${aws_key}'
640-
aws_secret: '${aws_secret}'
632+
role_arn: ${upload_arn}
641633
remote_file: 'libmongocrypt/java/${revision}/libmongocrypt-java.tar.gz'
642-
bucket: mciuploads
634+
bucket: ${upload_bucket}
643635
permissions: public-read
644636
local_file: 'libmongocrypt-java.tar.gz'
645637
content_type: '${content_type|application/x-gzip}'
646638
- command: s3.put
647639
params:
648-
aws_key: '${aws_key}'
649-
aws_secret: '${aws_secret}'
640+
role_arn: ${upload_arn}
650641
remote_file: 'libmongocrypt/java/${tag_upload_location}/libmongocrypt-java.tar.gz'
651-
bucket: mciuploads
642+
bucket: ${upload_bucket}
652643
permissions: public-read
653644
optional: true
654645
display_name: 'libmongocrypt-java-${tag_upload_location}.tar.gz'
@@ -831,50 +822,45 @@ tasks:
831822
fi
832823
- command: s3.put
833824
params:
834-
aws_key: '${aws_key}'
835-
aws_secret: '${aws_secret}'
825+
role_arn: ${upload_arn}
836826
remote_file: 'libmongocrypt/all/${branch_name}/${libmongocrypt_s3_suffix}/libmongocrypt-all.tar.gz'
837-
bucket: mciuploads
827+
bucket: ${upload_bucket}
838828
permissions: public-read
839829
local_file: 'libmongocrypt-all.tar.gz'
840830
content_type: '${content_type|application/x-gzip}'
841831
- command: s3.put
842832
params:
843-
aws_key: '${aws_key}'
844-
aws_secret: '${aws_secret}'
833+
role_arn: ${upload_arn}
845834
remote_file: 'libmongocrypt/all/${branch_name}/${libmongocrypt_s3_suffix_copy}/libmongocrypt-all.tar.gz'
846-
bucket: mciuploads
835+
bucket: ${upload_bucket}
847836
permissions: public-read
848837
local_file: 'libmongocrypt-all.tar.gz'
849838
content_type: '${content_type|application/x-gzip}'
850839
- command: s3.put
851840
params:
852-
aws_key: '${aws_key}'
853-
aws_secret: '${aws_secret}'
841+
role_arn: ${upload_arn}
854842
remote_file: 'libmongocrypt/all/${tag_upload_location}/libmongocrypt-all.tar.gz'
855-
bucket: mciuploads
843+
bucket: ${upload_bucket}
856844
permissions: public-read
857845
optional: true # Do not fail task if `local_file` does not exist. `local_file` only exists for tagged release.
858846
display_name: 'libmongocrypt-all-${tag_upload_location}.tar.gz'
859847
local_file: 'libmongocrypt-all-${tag_upload_location}.tar.gz'
860848
content_type: '${content_type|application/x-gzip}'
861849
- command: s3.put
862850
params:
863-
aws_key: '${aws_key}'
864-
aws_secret: '${aws_secret}'
851+
role_arn: ${upload_arn}
865852
remote_file: 'libmongocrypt/all/latest/stable/libmongocrypt-all.tar.gz'
866-
bucket: mciuploads
853+
bucket: ${upload_bucket}
867854
permissions: public-read
868855
optional: true # Do not fail task if `local_file` does not exist. `local_file` only exists for stable release.
869856
display_name: 'stable/libmongocrypt-all-${tag_upload_location}.tar.gz'
870857
local_file: 'stable/libmongocrypt-all-${tag_upload_location}.tar.gz'
871858
content_type: '${content_type|application/x-gzip}'
872859
- command: s3.put
873860
params:
874-
aws_key: '${aws_key}'
875-
aws_secret: '${aws_secret}'
861+
role_arn: ${upload_arn}
876862
remote_file: 'libmongocrypt/all/latest/unstable/libmongocrypt-all.tar.gz'
877-
bucket: mciuploads
863+
bucket: ${upload_bucket}
878864
permissions: public-read
879865
optional: true # Do not fail task if `local_file` does not exist. `local_file` only exists for unstable release.
880866
display_name: 'unstable/libmongocrypt-all-${tag_upload_location}.tar.gz'
@@ -927,10 +913,9 @@ tasks:
927913
file: libmongocrypt/expansions.yml
928914
- command: s3.get # Download Windows build.
929915
params:
930-
aws_key: '${aws_key}'
931-
aws_secret: '${aws_secret}'
916+
role_arn: ${upload_arn}
932917
remote_file: '${project}/windows-test/${branch_name}/${libmongocrypt_s3_suffix}/libmongocrypt.tar.gz'
933-
bucket: mciuploads
918+
bucket: ${upload_bucket}
934919
extract_to: libmongocrypt_download
935920
- command: shell.exec
936921
params:
@@ -956,21 +941,19 @@ tasks:
956941
# Documentation now refers to the GitHub release page, which includes the per-release tarball.
957942
# The fixed URL upload is kept to avoid possibly breaking expectations. Consider removing in the future.
958943
params:
959-
aws_key: '${aws_key}'
960-
aws_secret: '${aws_secret}'
944+
role_arn: ${upload_arn}
961945
remote_file: 'libmongocrypt/windows/latest_release/libmongocrypt${upload_suffix}.tar.gz'
962946
display_name: (Deprecated) libmongocrypt${upload_suffix}.tar.gz
963-
bucket: mciuploads
947+
bucket: ${upload_bucket}
964948
permissions: public-read
965949
local_file: 'libmongocrypt_upload.tar.gz'
966950
content_type: 'application/x-gzip'
967951
- command: s3.put # Upload tarball for GitHub Release.
968952
params:
969-
aws_key: '${aws_key}'
970-
aws_secret: '${aws_secret}'
953+
role_arn: ${upload_arn}
971954
remote_file: '${project}/${build_variant}/${branch_name}/${revision}/${version_id}/libmongocrypt-windows-x86_64-${libmongocrypt_release_version}.tar.gz'
972955
display_name: libmongocrypt-windows-x86_64-${libmongocrypt_release_version}.tar.gz
973-
bucket: mciuploads
956+
bucket: ${upload_bucket}
974957
permissions: public-read
975958
local_file: 'libmongocrypt_upload.tar.gz'
976959
content_type: 'application/x-gzip'
@@ -986,11 +969,10 @@ tasks:
986969
args: --secret garasign_username=${garasign_username} --secret garasign_password=${garasign_password} +sign --file_to_sign=libmongocrypt_upload.tar.gz --output_file=libmongocrypt_upload.asc
987970
- command: s3.put # Upload signature for GitHub Release.
988971
params:
989-
aws_key: '${aws_key}'
990-
aws_secret: '${aws_secret}'
972+
role_arn: ${upload_arn}
991973
remote_file: '${project}/${build_variant}/${branch_name}/${revision}/${version_id}/libmongocrypt-windows-x86_64-${libmongocrypt_release_version}.asc'
992974
display_name: libmongocrypt-windows-x86_64-${libmongocrypt_release_version}.asc
993-
bucket: mciuploads
975+
bucket: ${upload_bucket}
994976
permissions: public-read
995977
local_file: 'libmongocrypt/libmongocrypt_upload.asc'
996978
content_type: 'application/pgp-signature'
@@ -1013,11 +995,10 @@ tasks:
1013995
bash .evergreen/debian_package_build.sh --is-patch=${is_patch}
1014996
- command: s3.put
1015997
params:
1016-
aws_key: ${aws_key}
1017-
aws_secret: ${aws_secret}
998+
role_arn: ${upload_arn}
1018999
local_file: deb.tar.gz
10191000
remote_file: libmongocrypt/${branch_name}/${revision}/${version_id}/${build_id}/${execution}/debian-packages.tar.gz
1020-
bucket: mciuploads
1001+
bucket: ${upload_bucket}
10211002
permissions: public-read
10221003
content_type: ${content_type|application/x-gzip}
10231004
display_name: "deb.tar.gz"
@@ -1038,11 +1019,10 @@ tasks:
10381019
bash .evergreen/debian_package_build.sh --arch=i386 --is-patch=${is_patch}
10391020
- command: s3.put
10401021
params:
1041-
aws_key: ${aws_key}
1042-
aws_secret: ${aws_secret}
1022+
role_arn: ${upload_arn}
10431023
local_file: deb.tar.gz
10441024
remote_file: libmongocrypt/${branch_name}/${revision}/${version_id}/${build_id}/${execution}/debian-packages-i386.tar.gz
1045-
bucket: mciuploads
1025+
bucket: ${upload_bucket}
10461026
permissions: public-read
10471027
content_type: ${content_type|application/x-gzip}
10481028
display_name: "deb.tar.gz"
@@ -1138,15 +1118,29 @@ pre:
11381118
REMOTE_SUFFIX_COPY="latest-${branch_name}"
11391119
fi
11401120
1121+
# If we are a non-patch build in the libmongocrypt-release project, we upload to a restricted
1122+
# CDN S3 bucket. Otherwise, we upload to a less restricted bucket for convenience. The corresponding
1123+
# role_arn_... values come from EVG project configuration variables stored on the EVG server
1124+
if test "${is_patch}" = 'true' || "${project_name}" != 'libmongocrypt-release'; then
1125+
upload_bucket='mciuploads'
1126+
upload_arn='${role_arn_for_mciuploads}'
1127+
else
1128+
upload_bucket='cdn-origin-libmongocrypt'
1129+
upload_arn='${role_arn_for_release}'
1130+
fi
1131+
11411132
PROJECT_DIRECTORY="$(pwd)"
11421133
echo "libmongocrypt_s3_suffix: $REMOTE_SUFFIX"
11431134
echo "libmongocrypt_s3_suffix_copy: $REMOTE_SUFFIX_COPY"
11441135
echo "project_directory: $PROJECT_DIRECTORY"
1136+
echo "Upload S3 bucket: $upload_bucket"
11451137
11461138
cat <<EOT > expansion.yml
11471139
libmongocrypt_s3_suffix: "$REMOTE_SUFFIX"
11481140
libmongocrypt_s3_suffix_copy: "$REMOTE_SUFFIX_COPY"
11491141
project_directory: "$PROJECT_DIRECTORY"
1142+
upload_bucket: "$upload_bucket"
1143+
upload_arn: "$upload_arn"
11501144
EOT
11511145
- command: expansions.update
11521146
params:

0 commit comments

Comments
 (0)