Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update the cert IDs for e2e test scripts #3391

Closed
oliviassss opened this issue Sep 19, 2023 · 8 comments
Closed

Update the cert IDs for e2e test scripts #3391

oliviassss opened this issue Sep 19, 2023 · 8 comments
Assignees

Comments

@oliviassss
Copy link
Collaborator

oliviassss commented Sep 19, 2023

Describe the bug
There's recently a migration to a new AWS account for the CI jobs, which caused the failure for the pull-aws-load-balancer-controller-e2e-test in aws-load-balancer-controller repo.
By checking the test logs, I noticed it's the TLS test suites failing because of TIMEOUT, it should be of the out-of-date certs since we are changing the AWS account.

To fix the failure, we need to:

  1. generate TLS certificates with the domain name *.elb.us-west-2.amazonaws.com and import them in ACM in the new accounts
  2. update the cert IDs here: https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/scripts/ci_e2e_test.sh#L208

Steps to reproduce

Expected outcome
A concise description of what you expected to happen.

Environment

  • AWS Load Balancer controller version
  • Kubernetes version
  • Using EKS (yes/no), if so version?

Additional Context:

@oliviassss
Copy link
Collaborator Author

/assign @dims

@dims
Copy link
Member

dims commented Sep 19, 2023

@oliviassss here's what i did:

1. Generate the certificate and private key for a domain name, for example, test.example.com 
    1. openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -sha256 -days 365 -addext "subjectAltName = DNS:*.elb.us-west-2.amazonaws.com"
    2. openssl rsa -in key.pem -out key.pem
2. Go to AWS console, AWS Certificate Manager, click on Import certificate. Paste the content of cert.pem file to the Certificate body, and the content of key.pem file to the Certificate private key

@dims
Copy link
Member

dims commented Sep 19, 2023

Here's the screen shot:
image

@dims
Copy link
Member

dims commented Sep 19, 2023

@oliviassss please go ahead and try the update the cert IDs here step

@dims
Copy link
Member

dims commented Sep 19, 2023

Oh looks like you need 3 of them in total! doing that now

@dims
Copy link
Member

dims commented Sep 19, 2023

Done!

arn:aws:acm:us-west-2:209411653980:certificate/d39a65e5-44f6-4734-9034-6c82ae7df73b
arn:aws:acm:us-west-2:209411653980:certificate/35d7e09b-c4a9-447e-ba8c-7f9f29b77c8f
arn:aws:acm:us-west-2:209411653980:certificate/f44d1a16-409a-4937-a420-b42dab2d384a
image

@dims
Copy link
Member

dims commented Sep 19, 2023

/unassign
/assign @oliviassss

@oliviassss i've taken care of updating the account with the 3 freshly generated certs, please go ahead and update the scripts as needed.

@oliviassss
Copy link
Collaborator Author

oliviassss commented Sep 25, 2023

We also need to grant the permission to the s3 bucket lb-controller-e2e-${ACCOUNT_ID}

{
    "Version": "2012-10-17",
    "Id": "AWSConsole-AccessLogs-Policy-1607736912301",
    "Statement": [
        {
            "Sid": "AWSConsoleStmt-1607736912301",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::797873946194:root"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::lb-controller-e2e-209411653980/nlb-pfx/AWSLogs/209411653980/*"
        },
        {
            "Sid": "AWSLogDeliveryWrite",
            "Effect": "Allow",
            "Principal": {
                "Service": "delivery.logs.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::lb-controller-e2e-209411653980/nlb-pfx/AWSLogs/209411653980/*",
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-acl": "bucket-owner-full-control"
                }
            }
        },
        {
            "Sid": "AWSLogDeliveryAclCheck",
            "Effect": "Allow",
            "Principal": {
                "Service": "delivery.logs.amazonaws.com"
            },
            "Action": "s3:GetBucketAcl",
            "Resource": "arn:aws:s3:::lb-controller-e2e-209411653980"
        }
    ]
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants