draft: attempt to Fix gitlab test

build/int.cloudbuild.yaml

@@ -279,7 +279,18 @@ steps:
   waitFor:
       - create-all
   name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
-  args: ['/bin/bash', '-c', 'cft test run TestCloudBuildRepoConnectionGitLab --stage apply --verbose']
+  entrypoint: "bash"
+  args:
+    - "-c"
+    - |-
+      cft test run TestValidateStartupScript --stage verify --verbose
+      gcloud storage cp gs://$(terraform -chdir=/workspace/test/setup output -raw gitlab_secret_project)-ssl-cert/gitlab.crt /usr/local/share/ca-certificates
+      update-ca-certificates
+      if (ls /etc/ssl/certs | grep gitlab.pem); then
+          cft test run TestCloudBuildRepoConnectionGitLab --stage apply --verbose || exit 1
+      else
+          echo ERROR: Was not able to download certificate and update system bundle. && exit 1
+      fi
   secretEnv: ['IM_GITLAB_PAT']
 - id: verify-cloudbuild-connection-gitlab
   waitFor:

test/integration/cloudbuild_repo_connection_gitlab/cloudbuild_repo_connection_gitlab_test.go

@@ -16,14 +16,15 @@ package cloudbuild_repo_connection_gitlab
 
 import (
 	"fmt"
+	"os"
 	"regexp"
 	"strings"
 	"testing"
 
 	"github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test/pkg/gcloud"
 	"github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test/pkg/tft"
-	cftutils "github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test/pkg/utils"
 	"github.com/stretchr/testify/assert"
+	"github.com/terraform-google-modules/enterprise-application/test/integration/testutils"
 	"github.com/terraform-google-modules/terraform-google-bootstrap/test/integration/utils"
 	"github.com/xanzy/go-gitlab"
 )
@@ -101,8 +102,28 @@ func (gl *GitLabClient) DeleteProject() {
 }
 
 func TestCloudBuildRepoConnectionGitLab(t *testing.T) {
+	setup := tft.NewTFBlueprintTest(t,
+		tft.WithTFDir("../../setup"),
+	)
+
+	gitlabSecretProject := setup.GetStringOutput("gitlab_secret_project")
+	external_url := setup.GetStringOutput("gitlab_url")
+	url := "https://gitlab.example.com"
+	serviceDirectory := setup.GetStringOutput("gitlab_service_directory")
+	gitlabPersonalTokenSecretName := setup.GetStringOutput("gitlab_pat_secret_name")
+	// get token secret
+	token, err := testutils.GetSecretFromSecretManager(t, gitlabPersonalTokenSecretName, gitlabSecretProject)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// read crt from file
+	caCert, err := os.ReadFile("/usr/local/share/ca-certificates/gitlab.crt")
+
+	if err != nil {
+		t.Fatalf("Failed to read CA certificate: %v", err)
+	}
 	repoName := fmt.Sprintf("conn-gl-%s", utils.GetRandomStringFromSetup(t))
-	gitlabPAT := cftutils.ValFromEnv(t, "IM_GITLAB_PAT")
+	gitlabPAT := token
 	owner := "infrastructure-manager"
 
 	client := NewGitLabClient(t, gitlabPAT, owner, repoName)
@@ -113,10 +134,13 @@ func TestCloudBuildRepoConnectionGitLab(t *testing.T) {
 
 	resourcesLocation := "us-central1"
 	vars := map[string]interface{}{
-		"gitlab_read_authorizer_credential": gitlabPAT,
-		"gitlab_authorizer_credential":      gitlabPAT,
-		"repository_name":                   repoName,
-		"repository_url":                    client.project.HTTPURLToRepo,
+		"gitlab_read_authorizer_credential":   gitlabPAT,
+		"gitlab_authorizer_credential":        gitlabPAT,
+		"repository_name":                     repoName,
+		"repository_url":                      client.project.HTTPURLToRepo,
+		"gitlab_enterprise_host_uri":          external_url,
+		"gitlab_enterprise_service_directory": serviceDirectory,
+		"gitlab_enterprise_ca_certificate":    string(caCert),
 	}
 	bpt := tft.NewTFBlueprintTest(t, tft.WithVars(vars))
 

test/integration/setup-gitlab/bootstrap_gitlab_environment_test.go

@@ -0,0 +1,60 @@
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package bootstrap_gitlab
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/blueprint-test/pkg/tft"
+	"github.com/gruntwork-io/terratest/modules/shell"
+)
+
+// connects to a Google Cloud VM instance using SSH and retrieves the logs from the VM's Startup Script service
+func readLogsFromVm(t *testing.T, instanceName string, instanceZone string, instanceProject string) (string, error) {
+	args := []string{"compute", "ssh", instanceName, fmt.Sprintf("--zone=%s", instanceZone), fmt.Sprintf("--project=%s", instanceProject), "-q", "--command=journalctl -u google-startup-scripts.service -n 20"}
+	gcloudCmd := shell.Command{
+		Command: "gcloud",
+		Args:    args,
+	}
+	return shell.RunCommandAndGetStdOutE(t, gcloudCmd)
+}
+
+func TestValidateStartupScript(t *testing.T) {
+	// Retrieve output values from test setup
+	setup := tft.NewTFBlueprintTest(t,
+		tft.WithTFDir("../../setup"),
+	)
+	instanceName := setup.GetStringOutput("gitlab_instance_name")
+	instanceZone := setup.GetStringOutput("gitlab_instance_zone")
+	gitlabSecretProject := setup.GetStringOutput("gitlab_secret_project")
+	// Periodically read logs from startup script running on the VM instance
+	for count := 0; count < 100; count++ {
+		logs, err := readLogsFromVm(t, instanceName, instanceZone, gitlabSecretProject)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if strings.Contains(logs, "Finished Google Compute Engine Startup Scripts") {
+			if strings.Contains(logs, "exit status 1") {
+				t.Fatal("ERROR: Startup Script finished with invalid exit status.")
+			}
+			break
+		}
+		time.Sleep(12 * time.Second)
+	}
+}