chore: add integ test that validates full proxy traversal #33140

rix0rrr · 2025-01-24T13:58:15Z

(Re-roll of #33092)

Add a CLI integ test to validate that cdk deploy works in a fully network-isolated environment, with only a proxy to go through.

This validates that no parts of the CLI setup ignore the proxy configuration, which would otherwise be hard to test.

We achieve the network isolation by running the code inside a Docker container where we use iptables to drop all network traffic that doesn't go through the Docker host, where we run a proxy.

I temporarily bumped the tsconfig target to try out the using syntax (didn't work out with Jest), but that caused some compiler errors around class member initialization that I fixed as well.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

codecov · 2025-01-24T14:10:37Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 80.79%. Comparing base (aec64f0) to head (e196059).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #33140   +/-   ##
=======================================
  Coverage   80.79%   80.79%           
=======================================
  Files         232      232           
  Lines       14106    14106           
  Branches     2452     2452           
=======================================
  Hits        11397    11397           
  Misses       2429     2429           
  Partials      280      280

Flag	Coverage Δ
suite.unit	`80.79% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`79.53% <ø> (ø)`
packages/aws-cdk-lib/core	`82.17% <ø> (ø)`

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

aws-cdk-automation

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

Add a CLI integ test to validate that `cdk deploy` works in a fully network-isolated environment, with only a proxy to go through. This validates that no parts of the CLI setup ignore the proxy configuration, which would otherwise be hard to test. We achieve the network isolation by running the code inside a Docker container where we use `iptables` to drop all network traffic that doesn't go through the Docker host, where we run a proxy. I temporarily bumped the `tsconfig` `target` to try out the `using` syntax (didn't work out with Jest), but that caused some compiler errors around class member initialization that I fixed as well.

…xy-test-2

rix0rrr · 2025-01-28T14:20:58Z

Argh, the tests pass when I run them interactively in CodeBuild, but fail when I run them as part of the pipeline.

…xy-test-2

aws-cdk-automation · 2025-01-29T15:57:34Z

➡️ PR build request submitted to test-main-pipeline ⬅️

A maintainer must now check the pipeline and add the pr-linter/cli-integ-tested label once the pipeline succeeds.

rix0rrr · 2025-01-29T18:53:46Z

This was only a week of my life!

mergify · 2025-01-30T08:39:00Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2025-01-30T09:08:56Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: e196059
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2025-01-30T09:09:19Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2025-01-30T09:09:38Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

rix0rrr requested a review from a team as a code owner January 24, 2025 13:58

rix0rrr added the pr/do-not-merge This PR should not be merged at this time. label Jan 24, 2025

github-actions bot added the p2 label Jan 24, 2025

aws-cdk-automation requested a review from a team January 24, 2025 13:58

mergify bot added the contribution/core This is a PR that came from AWS. label Jan 24, 2025

rix0rrr requested a deployment to test-pipeline January 24, 2025 13:59 — with GitHub Actions Waiting

aws-cdk-automation previously requested changes Jan 24, 2025

View reviewed changes

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Jan 24, 2025

aws-cdk-automation previously requested changes Jan 26, 2025

View reviewed changes

rix0rrr added the pr-linter/exempt-codecov The PR linter will not require codecov checks to pass label Jan 26, 2025

rix0rrr temporarily deployed to test-pipeline January 27, 2025 10:40 — with GitHub Actions Inactive

rix0rrr force-pushed the huijbers/isolated-proxy-test-2 branch from 944f31f to 18e1b32 Compare January 27, 2025 10:46

rix0rrr requested a deployment to test-pipeline January 27, 2025 10:47 — with GitHub Actions Waiting

Merge remote-tracking branch 'origin/main' into huijbers/isolated-pro…

8eee2ac

…xy-test-2

rix0rrr temporarily deployed to test-pipeline January 27, 2025 10:50 — with GitHub Actions Inactive

Add an instruction to map the special hostname

074d413

rix0rrr temporarily deployed to test-pipeline January 27, 2025 12:27 — with GitHub Actions Inactive

Try both the special hostname and the magic IP address

5b8f1d3

rix0rrr temporarily deployed to test-pipeline January 27, 2025 13:24 — with GitHub Actions Inactive

Clarify both testing platforms

3f616ad

rix0rrr requested a deployment to test-pipeline January 27, 2025 16:34 — with GitHub Actions Waiting

rix0rrr added 2 commits January 28, 2025 09:55

Log verbosity

e3cfd14

Got it for CodeBuild!

f9e2539

rix0rrr temporarily deployed to test-pipeline January 28, 2025 09:20 — with GitHub Actions Inactive

aws-cdk-automation removed the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Jan 28, 2025

Verbose verbositas

4e54bca

rix0rrr temporarily deployed to test-pipeline January 28, 2025 14:22 — with GitHub Actions Inactive

Merge remote-tracking branch 'origin/main' into huijbers/isolated-pro…

fd55086

…xy-test-2

rix0rrr requested a deployment to test-pipeline January 28, 2025 15:05 — with GitHub Actions Waiting

Try a random port for every test, see if that makes a diff

c05426f

rix0rrr temporarily deployed to test-pipeline January 28, 2025 15:20 — with GitHub Actions Inactive

aws-cdk-automation added the pr/needs-maintainer-review This PR needs a review from a Core Team Member label Jan 28, 2025

Je suis un idiot

c5fa4ed

rix0rrr temporarily deployed to test-pipeline January 29, 2025 12:22 — with GitHub Actions Inactive

Use ECR public for pull

b280d2a

rix0rrr temporarily deployed to test-pipeline January 29, 2025 15:34 — with GitHub Actions Inactive

rix0rrr added pr-linter/cli-integ-tested Assert that any CLI changes have been integ tested and removed pr/do-not-merge This PR should not be merged at this time. labels Jan 29, 2025

otaviomacedo approved these changes Jan 30, 2025

View reviewed changes

Merge branch 'main' into huijbers/isolated-proxy-test-2

e196059

mergify bot requested a deployment to test-pipeline January 30, 2025 08:39 Waiting

mergify bot merged commit c40a9e2 into main Jan 30, 2025
19 of 20 checks passed

mergify bot deleted the huijbers/isolated-proxy-test-2 branch January 30, 2025 09:09

github-actions bot locked as resolved and limited conversation to collaborators Jan 30, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: add integ test that validates full proxy traversal #33140

chore: add integ test that validates full proxy traversal #33140

rix0rrr commented Jan 24, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

codecov bot commented Jan 24, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

rix0rrr commented Jan 28, 2025

aws-cdk-automation commented Jan 29, 2025

rix0rrr commented Jan 29, 2025 •

edited

Loading

mergify bot commented Jan 30, 2025

aws-cdk-automation commented Jan 30, 2025

mergify bot commented Jan 30, 2025

github-actions bot commented Jan 30, 2025

chore: add integ test that validates full proxy traversal #33140

chore: add integ test that validates full proxy traversal #33140

Conversation

rix0rrr commented Jan 24, 2025 • edited Loading

aws-cdk-automation left a comment • edited Loading

Choose a reason for hiding this comment

codecov bot commented Jan 24, 2025 • edited Loading

Codecov Report

aws-cdk-automation left a comment • edited Loading

Choose a reason for hiding this comment

rix0rrr commented Jan 28, 2025

aws-cdk-automation commented Jan 29, 2025

rix0rrr commented Jan 29, 2025 • edited Loading

mergify bot commented Jan 30, 2025

aws-cdk-automation commented Jan 30, 2025

AWS CodeBuild CI Report

mergify bot commented Jan 30, 2025

github-actions bot commented Jan 30, 2025

rix0rrr commented Jan 24, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

codecov bot commented Jan 24, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

rix0rrr commented Jan 29, 2025 •

edited

Loading