Skip to content

test(integration): use pre-provisioned no-user service account (FB-4691) #539

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fstr merged 2 commits into from
Oct 7, 2026
Merged

test(integration): use pre-provisioned no-user service account (FB-4691) #539

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
83a26f6
test(integration): use pre-provisioned no-user service account (FB-4691)
fstr Oct 7, 2026
9451a75
Merge remote-tracking branch 'origin/main' into florian/fb-4691-stati…
fstr Oct 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .github/workflows/integration-tests-v2.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,10 @@ on:
required: true
FIREBOLT_CLIENT_SECRET_STG_NEW_IDN:
required: true
ECOSYSTEM_FIREBOLT_SA_NO_USER_CLIENT_ID_STG:
required: true
ECOSYSTEM_FIREBOLT_SA_NO_USER_CLIENT_SECRET_STG:
required: true
inputs:
engine-version:
description: 'Engine version to use for integration tests'
Expand Down Expand Up @@ -52,6 +56,8 @@ jobs:
env:
SERVICE_ID: ${{ secrets.FIREBOLT_CLIENT_ID_STG_NEW_IDN }}
SERVICE_SECRET: ${{ secrets.FIREBOLT_CLIENT_SECRET_STG_NEW_IDN }}
SERVICE_ID_NO_USER: ${{ secrets.ECOSYSTEM_FIREBOLT_SA_NO_USER_CLIENT_ID_STG }}
SERVICE_SECRET_NO_USER: ${{ secrets.ECOSYSTEM_FIREBOLT_SA_NO_USER_CLIENT_SECRET_STG }}
DATABASE_NAME: ${{ steps.setup.outputs.database_name }}
ENGINE_NAME: ${{ steps.setup.outputs.engine_name }}
STOPPED_ENGINE_NAME: ${{ steps.setup.outputs.stopped_engine_name }}
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/integration-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,10 @@ on:
required: true
FIREBOLT_CLIENT_SECRET_STG_NEW_IDN:
required: true
ECOSYSTEM_FIREBOLT_SA_NO_USER_CLIENT_ID_STG:
required: true
ECOSYSTEM_FIREBOLT_SA_NO_USER_CLIENT_SECRET_STG:
required: true

permissions:
contents: read
Expand All @@ -17,6 +21,8 @@ jobs:
secrets:
FIREBOLT_CLIENT_ID_STG_NEW_IDN: ${{ secrets.FIREBOLT_CLIENT_ID_STG_NEW_IDN }}
FIREBOLT_CLIENT_SECRET_STG_NEW_IDN: ${{ secrets.FIREBOLT_CLIENT_SECRET_STG_NEW_IDN }}
ECOSYSTEM_FIREBOLT_SA_NO_USER_CLIENT_ID_STG: ${{ secrets.ECOSYSTEM_FIREBOLT_SA_NO_USER_CLIENT_ID_STG }}
ECOSYSTEM_FIREBOLT_SA_NO_USER_CLIENT_SECRET_STG: ${{ secrets.ECOSYSTEM_FIREBOLT_SA_NO_USER_CLIENT_SECRET_STG }}
integration-test-core:
uses: ./.github/workflows/integration-tests-core.yml
report-test-results:
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/nightly-v2.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,8 @@ jobs:
env:
SERVICE_ID: ${{ secrets.FIREBOLT_CLIENT_ID_STG_NEW_IDN }}
SERVICE_SECRET: ${{ secrets.FIREBOLT_CLIENT_SECRET_STG_NEW_IDN }}
SERVICE_ID_NO_USER: ${{ secrets.ECOSYSTEM_FIREBOLT_SA_NO_USER_CLIENT_ID_STG }}
SERVICE_SECRET_NO_USER: ${{ secrets.ECOSYSTEM_FIREBOLT_SA_NO_USER_CLIENT_SECRET_STG }}
DATABASE_NAME: ${{ steps.setup.outputs.database_name }}
ENGINE_NAME: ${{ steps.setup.outputs.engine_name }}
STOPPED_ENGINE_NAME: ${{ steps.setup.outputs.stopped_engine_name }}
Expand Down
2 changes: 2 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,8 @@ jobs:
secrets:
FIREBOLT_CLIENT_ID_STG_NEW_IDN: ${{ secrets.FIREBOLT_CLIENT_ID_STG_NEW_IDN }}
FIREBOLT_CLIENT_SECRET_STG_NEW_IDN: ${{ secrets.FIREBOLT_CLIENT_SECRET_STG_NEW_IDN }}
ECOSYSTEM_FIREBOLT_SA_NO_USER_CLIENT_ID_STG: ${{ secrets.ECOSYSTEM_FIREBOLT_SA_NO_USER_CLIENT_ID_STG }}
ECOSYSTEM_FIREBOLT_SA_NO_USER_CLIENT_SECRET_STG: ${{ secrets.ECOSYSTEM_FIREBOLT_SA_NO_USER_CLIENT_SECRET_STG }}

publish:
runs-on: ubuntu-latest
Expand Down
11 changes: 11 additions & 0 deletions tests/integration/conftest.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,10 @@
API_ENDPOINT_ENV = "API_ENDPOINT"
SERVICE_ID_ENV = "SERVICE_ID"
SERVICE_SECRET_ENV = "SERVICE_SECRET"
# Pre-provisioned service account that has no user attached, used to check
# that such an account cannot connect
SERVICE_ID_NO_USER_ENV = "SERVICE_ID_NO_USER"
SERVICE_SECRET_NO_USER_ENV = "SERVICE_SECRET_NO_USER"
CORE_URL_ENV = "CORE_URL"

# Only these values are safe to print. Anything else, including renamed
Expand Down Expand Up @@ -130,6 +134,13 @@ def auth(service_id: str, service_secret: Secret) -> ClientCredentials:
return ClientCredentials(service_id, service_secret.value)


@fixture(scope="session")
def auth_no_user() -> ClientCredentials:
return ClientCredentials(
must_env(SERVICE_ID_NO_USER_ENV), must_env(SERVICE_SECRET_NO_USER_ENV)
)


@fixture(scope="session")
def core_auth() -> FireboltCore:
return FireboltCore()
Expand Down
40 changes: 0 additions & 40 deletions tests/integration/dbapi/async/V2/conftest.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,10 @@
import random
import string
from typing import Any, Callable, Tuple

from pytest import fixture

import firebolt.async_db
from firebolt.async_db import Connection, connect
from firebolt.client.auth.base import Auth
from firebolt.client.auth.client_credentials import ClientCredentials
from tests.integration.conftest import Secret


@fixture
Expand Down Expand Up @@ -96,42 +92,6 @@ async def connection_system_engine_no_db(
yield connection


@fixture
async def service_account_no_user(
connection_system_engine_no_db: Connection,
database_name: str,
) -> Tuple[str, Secret]:
# function-level fixture so we need to make sa name is unique
randomness = "".join(random.choices(string.ascii_letters + string.digits, k=2))
sa_account_name = f"{database_name}_no_user_{randomness}"
async with connection_system_engine_no_db.cursor() as cursor:
await cursor.execute(
f'CREATE SERVICE ACCOUNT "{sa_account_name}" '
"WITH DESCRIPTION = 'Ecosytem test with no user'"
)
await cursor.execute(f"CALL fb_GENERATESERVICEACCOUNTKEY('{sa_account_name}')")
# service_account_name, service_account_id, secret
_, s_id, key = await cursor.fetchone()
# Currently this is bugged so retrieve id via a query. FIR-28719
if not s_id:
await cursor.execute(
"SELECT service_account_id FROM information_schema.service_accounts "
f"WHERE service_account_name='{sa_account_name}'"
)
s_id = (await cursor.fetchone())[0]
# Wrap in secret to avoid leaking the key in the logs
yield s_id, Secret(key)
await cursor.execute(f'DROP SERVICE ACCOUNT "{sa_account_name}"')


@fixture
async def auth_no_user(
service_account_no_user: Tuple[str, Secret],
) -> ClientCredentials:
s_id, s_secret = service_account_no_user
return ClientCredentials(s_id, s_secret.value)


@fixture
async def mixed_case_db_and_engine(
connection_system_engine: Connection,
Expand Down
40 changes: 0 additions & 40 deletions tests/integration/dbapi/sync/V2/conftest.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,10 @@
import random
import string
from typing import Any, Callable, Tuple

from pytest import fixture

import firebolt.db
from firebolt.client.auth.base import Auth
from firebolt.client.auth.client_credentials import ClientCredentials
from firebolt.db import Connection, connect
from tests.integration.conftest import Secret


@fixture
Expand Down Expand Up @@ -104,42 +100,6 @@ def connection_system_engine_no_db(
yield connection


@fixture
def service_account_no_user(
connection_system_engine_no_db: Connection,
database_name: str,
) -> Tuple[str, Secret]:
# function-level fixture so we need to make sa name is unique
randomness = "".join(random.choices(string.ascii_letters + string.digits, k=2))
sa_account_name = f"{database_name}_no_user_{randomness}"
with connection_system_engine_no_db.cursor() as cursor:
cursor.execute(
f'CREATE SERVICE ACCOUNT "{sa_account_name}" '
"WITH DESCRIPTION = 'Ecosytem test with no user'"
)
cursor.execute(f"CALL fb_GENERATESERVICEACCOUNTKEY('{sa_account_name}')")
# service_account_name, service_account_id, secret
_, s_id, key = cursor.fetchone()
# Currently this is bugged so retrieve id via a query. FIR-28719
if not s_id:
cursor.execute(
"SELECT service_account_id FROM information_schema.service_accounts "
f"WHERE service_account_name='{sa_account_name}'"
)
s_id = cursor.fetchone()[0]
# Wrap in secret to avoid leaking the key in the logs
yield s_id, Secret(key)
cursor.execute(f'DROP SERVICE ACCOUNT "{sa_account_name}"')


@fixture
def auth_no_user(
service_account_no_user: Tuple[str, Secret],
) -> ClientCredentials:
s_id, s_secret = service_account_no_user
return ClientCredentials(s_id, s_secret.value)


@fixture
def mixed_case_db_and_engine(
connection_system_engine: Connection,
Expand Down
Loading