From 0ea145705780535735c99ef3676a8d3eb9bc1143 Mon Sep 17 00:00:00 2001 From: Steven Silvester Date: Mon, 28 Sep 2026 10:22:48 -0500 Subject: [PATCH] PYTHON-6083 Assume drivers-test-secrets-role for latest server downloads The latest/latest-build MongoDB server binaries are now downloaded from a private S3 bucket (origin-mongodb-server-latest) requiring an AWS identity, instead of the public downloads.10gen.com hosts. Every Evergreen task that downloads VERSION=latest now assumes ${aws_test_secrets_role} before the server download, and the AWS credentials are passed to the server orchestration step. Local runs default to latest-stable, which needs no credentials. --- .evergreen/generated_configs/functions.yml | 3 +++ .evergreen/scripts/generate_config.py | 5 +++++ .evergreen/scripts/setup_tests.py | 4 +++- CONTRIBUTING.md | 4 +++- 4 files changed, 14 insertions(+), 2 deletions(-) diff --git a/.evergreen/generated_configs/functions.yml b/.evergreen/generated_configs/functions.yml index 57f1182377..e442973c30 100644 --- a/.evergreen/generated_configs/functions.yml +++ b/.evergreen/generated_configs/functions.yml @@ -110,6 +110,9 @@ functions: - LOAD_BALANCER - LOCAL_ATLAS - NO_EXT + - AWS_ACCESS_KEY_ID + - AWS_SECRET_ACCESS_KEY + - AWS_SESSION_TOKEN type: test - command: expansions.update params: diff --git a/.evergreen/scripts/generate_config.py b/.evergreen/scripts/generate_config.py index e4251141be..9b4313c423 100644 --- a/.evergreen/scripts/generate_config.py +++ b/.evergreen/scripts/generate_config.py @@ -1321,6 +1321,11 @@ def create_run_server_func(): "LOAD_BALANCER", "LOCAL_ATLAS", "NO_EXT", + # The AWS credentials are needed to download the "latest" nightly + # build from the private S3 bucket, see DRIVERS-3628. + "AWS_ACCESS_KEY_ID", + "AWS_SECRET_ACCESS_KEY", + "AWS_SESSION_TOKEN", ] args = [".evergreen/just.sh", "run-server", "${TEST_NAME}"] sub_cmd = get_subprocess_exec(include_expansions_in_env=includes, args=args) diff --git a/.evergreen/scripts/setup_tests.py b/.evergreen/scripts/setup_tests.py index 4f8b03b5ec..b57188eee1 100644 --- a/.evergreen/scripts/setup_tests.py +++ b/.evergreen/scripts/setup_tests.py @@ -360,7 +360,9 @@ def handle_test_env() -> None: # The mock OCSP responder MUST BE started before the mongod as the mongod expects that # a responder will be available upon startup. - version = os.environ.get("VERSION", "latest") + # Default to the newest stable release; the "latest" nightly build is + # downloaded from a private S3 bucket and needs AWS credentials. + version = os.environ.get("VERSION", "latest-stable") cmd = [ "bash", f"{DRIVERS_TOOLS}/.evergreen/run-mongodb.sh", diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 42a8606cd9..9fd0df1d13 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -206,7 +206,9 @@ the pages will re-render and the browser will automatically refresh. - Ensure you have started the appropriate Mongo Server(s). You can run `just run-server` with optional args to set up the server. All given options will be passed to [`run-mongodb.sh`](https://github.com/mongodb-labs/drivers-evergreen-tools/blob/master/.evergreen/run-mongodb.sh). Run `$DRIVERS_TOOLS/.evergreen/run-mongodb.sh start -h` - for a full list of options. + for a full list of options. By default the newest stable server release is used. To test against the + nightly build instead, pass `--version latest`, which is downloaded from a private S3 bucket and requires + an `AWS_PROFILE` with [Drivers test secrets](https://github.com/mongodb-labs/drivers-evergreen-tools/tree/master/.evergreen/secrets_handling#secrets-handling) credentials. - Run `just test` or `pytest` to run all of the tests. - Append `test/.py::::` to run specific tests. You can omit the `` to test a full class