Add Azure VM and AKS integration test jobs to the test-artifacts workflow#2216
Open
movence wants to merge 6 commits into
Open
Add Azure VM and AKS integration test jobs to the test-artifacts workflow#2216movence wants to merge 6 commits into
movence wants to merge 6 commits into
Conversation
movence
added
the
ready for testing
Inline AzureVMIntegrationTest job that provisions an Azure VM, installs the pre-built agent .deb via SSH, and runs the Go integration test from the test repo's terraform/azure/vm directory.
Transaction Search (CloudWatchLogs trace segment destination) is required for the OTLP endpoint but breaks legacy PutTraceSegments-based tests in us-west-2. Since the setting is per-region, isolate the Azure test by running it in us-east-2 where Transaction Search is enabled, and revert us-west-2 to the XRay destination so existing xray_test/otlp_test jobs pass as before.
Adds AKS-default-otel job that provisions an AKS cluster, deploys the CWA DaemonSet from the pre-built ECR image, generates OTLP load via a hostNetwork Job, and validates delivery via CloudWatch APIs.
The AKS job referenced a setup-go commit SHA that does not exist, causing the job to fail at action resolution. Use the same v4.3.0 pin as the other jobs in this workflow.
The pull secret is generated inside terraform via the aws_ecr_authorization_token data source, so the step output and the terraform variable are no longer consumed.
- AzureVM job now only fires when the filter matches ./test/azure/vm or the broader ./test/azure (same pattern as the AKS job). - Pass github_test_repo and github_test_repo_branch to terraform destroy for both AzureVM and AKS jobs so state files resolve correctly during teardown.
movence
force-pushed
the
feature/azure-integration-test-workflow
branch
from
July 24, 2026 15:37
69c92b8 to
e79c5fe
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of the issue
No CI coverage existed for the agent running on non-AWS hosts (Azure VM / AKS) with the default OTel config. The test suites live in the test repo (companion PR: aws/amazon-cloudwatch-agent-test#730) but need workflow jobs to provision and run them.
Description of changes
Adds two jobs to
test-artifacts.yml(+168 lines, workflow-only change):AzureVM-default-otel— terraform-provisions an Azure VM, installs the built.deb, and runs the on-VM Go test suite (test/azure/vm).AKS-default-otel— terraform-provisions an AKS cluster, deploys the agent DaemonSet from the integration-test ECR image, and runs the runner-side Go test suite (test/azure/aks).Both jobs gate on
test_dir_filtercontaining their test path (a./test/azurefilter runs both), authenticate to Azure via OIDC, and always runterraform destroyon teardown. TheLogin ECRstep's registry output feeds the image repo; the AKS pull-secret token is minted inside terraform, so no docker config JSON passes through shell interpolation.License
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
Tests
e79c5fe6), 30048181167, 30029802668, 30018222183. All three AKS subtests pass; Azure VM passing across 11 consecutive runs.Worth noting
test_dir_filter=./test/azure) the run-level conclusion showsfailureeven when every created job succeeds. This is pre-existing onmain: ~12 jobs have no!= '[]'guard on their matrix, so an empty filtered matrix fails at job startup (invisible in the jobs API but counted in the run conclusion). Job-level checks are the meaningful signal; adding the same guard the ITAR/CN jobs already use would fix the badge and can be a follow-up.AZURE_CLIENT_ID/AZURE_CLIENT_SECRET/AZURE_TENANT_ID/AZURE_SUBSCRIPTION_ID(service-principal login) and variablesAZURE_RESOURCE_GROUP/AZURE_VNET_NAME/AZURE_OIDC_PROVIDER_ARN/AZURE_TOKEN_AUDIENCE.