POC Localstack for local integration testing#2
Conversation
cazlo
changed the title
| return InitiateAuthResult( | ||
| challenge_name="challenge_name", | ||
| session="session", | ||
| auth={ |
There was a problem hiding this comment.
this is a total hack not mean to be any kind of production worthy anything. it's just enough to get past the login without cognito. it's a very basic jwt from jwt.io with only an added kid claim.
while enough to bypass auth initially, later calls which happen on the page are still failing apparently due to trying to call out to {kid}/.well-known/jwks.json.
more effort will need to be done to bypass the tight coupling with cognito.
we could probably setup some kind of dependency injection for the identity provider used in the auth layer and inject something other than cognito optionally.
otherwise cognito is locked behind paywall in localstack which is something like 20 bucks per dev per month
There was a problem hiding this comment.
The good news is this does break 5 unit tests:
FAILED tests/unit/idea-cluster-manager/test_accounts.py::test_accounts_initiate_auth_user_password_auth_flow - AssertionError: assert 'role' == 'admin'
FAILED tests/unit/idea-cluster-manager/test_accounts.py::test_accounts_initiate_auth_user_password_auth_flow_fail - Failed: DID NOT RAISE <class 'containres.ideadatamodel.exceptions.exceptions.SocaException'>
FAILED tests/unit/idea-cluster-manager/test_accounts.py::test_accounts_initiate_auth_refresh_token_auth_flow - Failed: DID NOT RAISE <class 'containres.ideadatamodel.exceptions.exceptions.SocaException'>
FAILED tests/unit/idea-cluster-manager/test_accounts.py::test_accounts_initiate_sso_auth_flow - Failed: DID NOT RAISE <class 'containres.ideadatamodel.exceptions.exceptions.SocaException'>
FAILED tests/unit/idea-cluster-manager/test_accounts.py::test_accounts_initiate_sso_refresh_auth_flow - Failed: DID NOT RAISE <class 'containres.ideadatamodel.exceptions.exceptions.SocaException'>
| self.apply_sanic_extensions(self._unix_app) | ||
|
|
||
| if self.options.enable_metrics: | ||
| if False: # todo self.options.enable_metrics: |
There was a problem hiding this comment.
should probably revert this and find some better solution around this.
in tracing through how this is used, it is apparently a UUID which can be used as an auth token to the metrics/healthcheck endpoint.
this makes sense in certain context such as exposing loadbalancer and/or synthetic healthchecks
| .PHONY: build-webapp | ||
| build-webapp: | ||
| docker build -f infra/webapp.Dockerfile -t containres-webapp webapp | ||
| #.PHONY: build-webapp |
There was a problem hiding this comment.
in this iteration of the build this is merged in with the python webapp backend to facilitate the current CORS setup of the app
|
|
||
| def get_use_vpc_endpoints(self) -> bool: | ||
| return Utils.get_value_as_bool('use_vpc_endpoints', self.user_values, False) | ||
| return Utils.get_value_as_bool('use_vpc_endpoints', self.user_values, True) |
There was a problem hiding this comment.
As VPC endpoints represents the generally more secure approach for communication between nodes and AWS services, I desire the app to use VPC endpoints by default.
This additionally facilitates local override of these endpoints facilitating local integration testing using localstack
| @@ -0,0 +1,56 @@ | |||
| #!/bin/bash | |||
|
|
|||
There was a problem hiding this comment.
note: this is very similar conceptually to the installer's config bootstrapping process
I also added most of the config items which were previously places by the CDK sub-stacks that get invoked by the installer stack
|
|
||
| # Install dependencies | ||
| COPY webapp/package.json webapp/yarn.lock ./ | ||
| RUN yarn install |
There was a problem hiding this comment.
should be using lockfile here
note in unit tests now the AWSProvider is monkey patched with mock endpoints, rather than using dependency injection at the app level to inject the mock. if we instead used dependency injection, we could probably get better test coverage by using it in basic integration tests run in pytest
at this point it is mostly butting up against a few restriction with free localstack (no cognito-idp svc avail in free version, no ec2 svc ail in free version)
just basic JWT from jwt.io
add dockerignore to remove need to change build context and sometimes unnecessarily trigger rebuild when these files change plain progress builds to reduce flicker during build
1 participant
What
Why
Refactor most of the logic contained within the installer stack into a localstack + terraform test-able platform.
Dependency Tree
The below diagram details the local deployment dependency diagram, however can likely be extended with minimal modification to the production deployment context.
graph LR dcv-broker dcv-gateway config-bootstrapper --> cluster-manager config-bootstrapper --> virtual-desktop-controller subgraph Emulated-AWS-Resources localstack --> terraform terraform -. Creates .-> config-db[(Config DB)] terraform -. Creates .-> config-secrets[(Config Secrets DB)] terraform -. Creates .-> sqs[/Task Queues/] terraform --> config-bootstrapper -. WritesTo .-> config-db end