[cosmos] Use fixed self-owned accounts for key-based live tests#49735
Draft
tvaron3 wants to merge 2 commits into
Draft
[cosmos] Use fixed self-owned accounts for key-based live tests#49735tvaron3 wants to merge 2 commits into
tvaron3 wants to merge 2 commits into
Conversation
Point the main Cosmos live-test stage and the Http2 stage at fixed,
self-owned Cosmos accounts (RG sdk-ci) instead of provisioning an account
per pipeline run. This removes the central EngSys service-connection /
on-the-fly-provisioning dependency for the key-based tests.
- Add sdk/cosmos/pipeline/ with a single-secret JSON mechanism:
- live-test-accounts.schema.json + sample
- resolve-cosmos-test-account.sh (bash+jq) resolves one account from the
single secret (sub-config-cosmos-azure-cloud-test-resources) by selector
and exports ACCOUNT_HOST/ACCOUNT_KEY(+SECONDARY) using the azure-sdk
double-set convention so the key is masked in logs yet reaches the test env
- resolve-cosmos-test-account.tests.sh (local tests)
- resolve-test-account-steps.yml (reusable PreTestRunSteps template)
- tests.yml: Cosmos_live_test + Cosmos_Live_Test_Http2 set
DisableAzureResourceCreation:true and run the resolve pre-step.
- live-platform-matrix.json: add per-leg AccountSelector.
Thin-client, GSI, Kafka and Spring stages are intentionally left on the
existing provisioning path (they need feature-enabled accounts or a separate
AAD pipeline) and will be migrated in follow-ups.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Member
Author
|
/azp run java - cosmos - tests |
|
Azure Pipelines will not run the associated pipelines, because the pull request was updated after the run command was issued. Review the pull request again and issue a new run command. |
Member
Author
|
/azp run java - cosmos - tests |
|
Azure Pipelines will not run the associated pipelines, because the pull request was updated after the run command was issued. Review the pull request again and issue a new run command. |
…test-sub-tenant # Conflicts: # sdk/cosmos/live-platform-matrix.json
Member
Author
|
/azp run java - cosmos - tests |
|
Azure Pipelines successfully started running 1 pipeline(s). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Point the key-based Cosmos live tests at fixed, self-owned Cosmos accounts (resource group
sdk-ci) instead of provisioning a new account per pipeline run. This removes the central EngSys service-connection / on-the-fly-provisioning dependency for these tests, which is required so the tests can run against accounts in an ephemeral tenant that is recreated every ~90 days.This PR wires up two stages as the first step: the main
Cosmos_live_teststage andCosmos_Live_Test_Http2.What changed
sdk/cosmos/pipeline/mechanism — a single ADO variable-group secret (sub-config-cosmos-azure-cloud-test-resources) holds a versioned JSON mapping a logical account name →{ endpoint, key, secondaryKey, ... }:live-test-accounts.schema.json+live-test-accounts.sample.jsonresolve-cosmos-test-account.sh(bash + jq): resolves one account by selector and exportsACCOUNT_HOST/ACCOUNT_KEY(+SECONDARY_ACCOUNT_KEY). The key uses the azure-sdk double-set convention (_ACCOUNT_KEYsecret to mask it in logs + a plainACCOUNT_KEYso it propagates to the Maven test env). It does not emitACCOUNT_CONSISTENCY/PREFERRED_LOCATIONS— those stay matrix-controlled.resolve-cosmos-test-account.tests.sh(8 local tests, all pass)resolve-test-account-steps.yml(reusablePreTestRunStepstemplate)README.mdtests.yml—Cosmos_live_testandCosmos_Live_Test_Http2setDisableAzureResourceCreation: trueand run the resolve pre-step.live-platform-matrix.json— each leg gets anAccountSelectorso the multi-config main stage picks the right fixed account per leg.Not included (follow-ups)
Left on the existing provisioning path because they need feature-enabled accounts or a separate pipeline:
AZURE_SPRING_TENANT_ID).The companion account-provisioning + Key Vault scripts live in the
cosmos-sdk-copilot-toolkitrepo (separate PR).Verification
resolve-cosmos-test-account.sh: 8/8 local unit tests pass; YAML/JSON validated.secondaryKey(required byAzureKeyCredentialTestin the-Pfastlegs).Draft
Draft while the two wired stages are validated end-to-end in a real pipeline run.