Keyless Azure Auth in test-linux (#2384)

* Use OIDC to login to azure * fix * Update .github/workflows/test-linux.yml * Increase timeout and re-enable azure-tests
elastic · Jun 28, 2024 · 2b897d0 · 2b897d0
1 parent 67f465f
commit 2b897d0
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 12 deletions.
diff --git a/.github/workflows/test-linux.yml b/.github/workflows/test-linux.yml
@@ -77,31 +77,35 @@ jobs:
   azure-tests:
     runs-on: ubuntu-latest
     needs: [ 'format', 'tests' ]
-    if: ${{ false }}
-    #if: |
-    #  github.event_name != 'pull_request'
-    #  || github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
+    if: |
+      github.event_name != 'pull_request'
+      || github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
     env:
       ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
-      ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
       ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
       ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
+      ARM_USE_OIDC: true
+      AZURE_RESOURCE_GROUP_PREFIX: ci-dotnet-${{ github.run_id }}
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - name: Bootstrap Action Workspace
         uses: ./.github/workflows/bootstrap
         with:
           azure: 'true'
 
-      - name: 'Login to Azure'
-        run: |
-          az login --service-principal --username ${{ env.ARM_CLIENT_ID }} --password ${{ env.ARM_CLIENT_SECRET }} --tenant ${{ env.ARM_TENANT_ID }}
-          az account set --subscription ${{ env.ARM_SUBSCRIPTION_ID }}
-          echo "AZURE_RESOURCE_GROUP_PREFIX=ci-dotnet-${GITHUB_RUN_ID}" >> ${GITHUB_ENV}
+      - name: 'Az CLI login'
+        uses: azure/login@6c251865b4e6290e7b78be643ea2d005bc51f69a # v2.1.1
+        with:
+          client-id: ${{ secrets.ARM_CLIENT_ID }}
+          tenant-id: ${{ secrets.ARM_TENANT_ID }}
+          subscription-id: ${{ secrets.ARM_SUBSCRIPTION_ID }}
 
       - name: 'Tests: Azure'
         run: ./build.sh test --test-suite azure
-        
+
       - name: 'Teardown tests infra'
         if: ${{ always() }}
         run: |

diff --git a/test/Elastic.Apm.Tests.Utilities/Terraform/TerraformResources.cs b/test/Elastic.Apm.Tests.Utilities/Terraform/TerraformResources.cs
@@ -21,7 +21,7 @@ namespace Elastic.Apm.Tests.Utilities.Terraform
 	/// </summary>
 	public class TerraformResources
 	{
-		private static readonly TimeSpan _defaultTimeout = TimeSpan.FromMinutes(15);
+		private static readonly TimeSpan _defaultTimeout = TimeSpan.FromMinutes(180);
 
 		private readonly string _resourceDirectory;
 		private readonly IMessageSink _messageSink;