Skip to content

Commit cd53fd6

Browse files
hlebkanonikhlebkanonik
authored
Release 25.1 (#472)
* refactor: remove metrics-gatherer deployment and service configurations from templates and values.yaml (#459) * bump app version to 25.0.4 * Add resources to hook containers #439 * Release 25.4.8 * chore: bump chart version to 25.4.9 * Jobs service upgraded to 5.13.2 * chore: bump version to 25.4.10 * refactor: remove deprecated volume mounts and configMap for ui-nginx-conf * docs: add S3 access guide using IAM roles for Kubernetes and Docker (#471) * docs: add S3 access guide using IAM roles for Kubernetes and Docker * docs: add link for attaching IAM role to EC2 instance in S3 access guide * docs: update S3 storage guide with Docker Compose configuration instructions * docs: update S3 access guide with trust policy clarification and placeholder replacements * docs: enhance S3 access guide with additional region configuration and trust policy details * docs: add S3 access guides for EKS and EC2 Docker-based ReportPortal installations * docs: add S3 storage guide for EC2 Docker-based ReportPortal using IAM roles * docs: reorganize table of contents for clarity and update placeholder values * Release 25.1
1 parent 35d8bca commit cd53fd6

File tree

7 files changed

+373
-123
lines changed

7 files changed

+373
-123
lines changed

‎docs/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ This directory contains installation guides for ReportPortal on Kubernetes.
77
- [Certificates Management](certificates-management.md)
88
- [Cert-Manager Configuration](cert-manager-config.md)
99
- [Google Managed Certificates Configuration](gcp-managed-cert-config.md)
10+
- [S3-Based Storage Using IAM Role for Amazon EKS-based ReportPortal](s3-storage-eks.md)
11+
- [S3-Based Storage Using IAM Role for EC2 Docker-based ReportPortal](s3-storage-ec2-docker)
1012

1113
## Google Kubernetes Engine (GKE) application
1214

‎docs/s3-storage-ec2-docker.md

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
# S3-Based Storage Using IAM Role for EC2 Docker-based ReportPortal
2+
3+
This document outlines the requirements and configuration steps to enable read/write access to Amazon S3 from a Dockerized ReportPortal installation on an Amazon EC2 instance using IAM roles (Instance Profiles). This setup leverages role-based authentication provided by the EC2 Instance Metadata Service (IMDS).
4+
5+
## Table of Contents
6+
7+
- [Requirements](#requirements)
8+
- [S3 Bucket](#1-s3-bucket)
9+
- [AWS IAM Role](#2-aws-iam-role)
10+
- [Step 1: Define the Trust Policy](#step-1-define-the-trust-policy)
11+
- [Step 2: Create the IAM Role](#step-2-create-the-iam-role)
12+
- [Step 3: Define the Permissions Policy](#step-3-define-the-permissions-policy)
13+
- [Step 4: Attach the Permissions Policy](#step-4-attach-the-permissions-policy)
14+
- [IAM Instance Profile](#3-iam-instance-profile)
15+
- [Step 1: Create an Instance Profile](#step-1-create-an-instance-profile)
16+
- [Step 2: Attach the Role to the Instance Profile](#step-2-attach-the-role-to-the-instance-profile)
17+
- [Step 3: Associate the Profile with the EC2 Instance](#step-3-associate-the-profile-with-the-ec2-instance)
18+
- [Step 4: Enable Instance Metadata Access](#step-4-enable-instance-metadata-access)
19+
- [ReportPortal Configuration](#4-reportportal-configuration)
20+
- [Docker-Based Installation](#5-docker-based-installation)
21+
22+
## Requirements
23+
24+
1. An Amazon EC2 instance with Docker and Docker Compose installed.
25+
2. An Amazon S3 bucket.
26+
3. AWS IAM role configured with appropriate trust and permissions policies.
27+
4. Instance metadata service (IMDSv2) enabled on the EC2 instance.
28+
29+
## 1. S3 Bucket
30+
31+
Create an Amazon S3 bucket to store ReportPortal data:
32+
33+
```bash
34+
aws s3api create-bucket --bucket my-rp-docker-bucket --region us-east-1
35+
```
36+
37+
> 💡 To create a bucket outside `us-east-1`, add the following option:
38+
>
39+
> ```bash
40+
> --create-bucket-configuration LocationConstraint=<region>
41+
> ```
42+
43+
Ensure your bucket name complies with [S3 bucket naming rules](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html).
44+
45+
## 2. AWS IAM Role
46+
47+
The IAM role enables the EC2 instance to assume identity and access S3 using instance metadata.
48+
49+
### Step 1: Define the Trust Policy
50+
51+
Save the following to a file named `trust-policy.json`:
52+
53+
```json
54+
{
55+
"Version": "2012-10-17",
56+
"Statement": [
57+
{
58+
"Effect": "Allow",
59+
"Action": [
60+
"sts:AssumeRole"
61+
],
62+
"Principal": {
63+
"Service": [
64+
"ec2.amazonaws.com"
65+
]
66+
}
67+
}
68+
]
69+
}
70+
```
71+
72+
### Step 2: Create the IAM Role
73+
74+
Create the role using the trust policy:
75+
76+
```bash
77+
aws iam create-role --role-name my-ec2-rp-s3-role \
78+
--assume-role-policy-document file://trust-policy.json
79+
```
80+
81+
### Step 3: Define the Permissions Policy
82+
83+
Save the following to `s3-rw-policy.json`, replacing `my-rp-docker-bucket` with your bucket name:
84+
85+
```json
86+
{
87+
"Version": "2012-10-17",
88+
"Statement": [
89+
{
90+
"Sid": "AllowListAndLocation",
91+
"Effect": "Allow",
92+
"Action": [
93+
"s3:ListBucket",
94+
"s3:GetBucketLocation"
95+
],
96+
"Resource": "arn:aws:s3:::my-rp-docker-bucket"
97+
},
98+
{
99+
"Sid": "AllowObjectOpsAnywhere",
100+
"Effect": "Allow",
101+
"Action": [
102+
"s3:PutObject",
103+
"s3:GetObject",
104+
"s3:DeleteObject",
105+
"s3:GetObjectAcl",
106+
"s3:GetObjectVersion"
107+
],
108+
"Resource": "arn:aws:s3:::my-rp-docker-bucket/*"
109+
}
110+
]
111+
}
112+
```
113+
114+
### Step 4: Attach the Permissions Policy
115+
116+
Attach the inline policy to the role:
117+
118+
```bash
119+
aws iam put-role-policy --role-name my-ec2-rp-s3-role \
120+
--policy-name S3AccessPolicy \
121+
--policy-document file://s3-rw-policy.json
122+
```
123+
124+
## 3. IAM Instance Profile
125+
126+
### Step 1: Create an Instance Profile
127+
128+
```bash
129+
aws iam create-instance-profile --instance-profile-name my-ec2-rp-s3-profile
130+
```
131+
132+
### Step 2: Attach the Role to the Instance Profile
133+
134+
```bash
135+
aws iam add-role-to-instance-profile \
136+
--instance-profile-name my-ec2-rp-s3-profile \
137+
--role-name my-ec2-rp-s3-role
138+
```
139+
140+
### Step 3: Associate the Profile with the EC2 Instance
141+
142+
Replace `INSTANCE_ID` with your EC2 instance ID:
143+
144+
```bash
145+
aws ec2 associate-iam-instance-profile \
146+
--region us-east-1 \
147+
--instance-id <INSTANCE_ID> \
148+
--iam-instance-profile Name=my-ec2-rp-s3-profile
149+
```
150+
151+
### Step 4: Enable Instance Metadata Access
152+
153+
To allow a Docker container to access IMDSv2 metadata, you must increase the instance metadata service (IMDS) hop limit in the EC2 instance configuration:
154+
155+
```bash
156+
aws ec2 modify-instance-metadata-options \
157+
--instance-id <INSTANCE_ID> \
158+
--http-put-response-hop-limit 2 \
159+
--http-endpoint enabled \
160+
--region us-east-1
161+
```
162+
Ref.: [Access instance metadata for an EC2 instance (AWS Docs)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-retrieval.html)
163+
164+
## 4. ReportPortal Configuration
165+
166+
In your `docker-compose.yml`, configure ReportPortal to use IAM-based S3 access:
167+
168+
```yaml
169+
x-environment: &common-environment
170+
# IAM Role-Based S3 Access - Leave credentials empty
171+
DATASTORE_ACCESSKEY: ""
172+
DATASTORE_SECRETKEY: ""
173+
DATASTORE_TYPE: s3
174+
DATASTORE_REGION: us-standard # JClouds alias for us-east-1
175+
DATASTORE_DEFAULTBUCKETNAME: my-rp-docker-bucket
176+
```
177+
178+
> For full configuration options, see the [ReportPortal S3 integration guide](https://reportportal.io/docs/installation-steps-advanced/FileStorageOptions).
179+
180+
## 5. Docker-Based Installation
181+
182+
Launch ReportPortal with Docker Compose:
183+
184+
```bash
185+
docker-compose -p reportportal up -d --force-recreate
186+
```
187+
188+
This step brings up all ReportPortal services configured to use S3 as the storage backend with IAM role-based credentials via EC2 instance metadata.

‎docs/s3-storage-eks.md

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
# S3-Based Storage Using IAM Role for Amazon EKS-based ReportPortal
2+
3+
This document outlines the requirements and configuration steps to enable read/write access to Amazon S3 using the AWS SDK for Java ([software.amazon.awssdk:aws-core:2.31.23](https://sdk.amazonaws.com/java/api/latest/software/amazon/awssdk/auth/credentials/DefaultCredentialsProvider.html)) in two deployment scenarios:
4+
5+
1. Kubernetes on EKS (IAM Roles for Service Accounts)
6+
2. Docker on an EC2 instance (Instance Profile)
7+
8+
## Table of Contents
9+
10+
- [Requirements](#requirements)
11+
- [S3 Bucket](#1-s3-bucket)
12+
- [AWS IAM Role](#2-aws-iam-role)
13+
- [Step 1: Define the Trust Policy](#step-1-define-the-trust-policy)
14+
- [Step 2: Create the IAM Role](#step-2-create-the-iam-role)
15+
- [Step 3: Define the Permissions Policy](#step-3-define-the-permissions-policy)
16+
- [Step 4: Attach the Permissions Policy](#step-4-attach-the-permissions-policy)
17+
- [EKS-based Installation](#3-eks-based-installation)
18+
19+
20+
## Requirements
21+
1. S3 Bucket
22+
2. AWS IAM roles granting S3 read/write permissions.
23+
3. Kubernetes-based installation:
24+
- EKS cluster version ≥ 1.28.
25+
- OIDC provider enabled for the cluster. [How to create an IAM OIDC provider for your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html).
26+
27+
28+
## 1. S3 Bucket
29+
30+
Create an Amazon S3 bucket to store your data. Replace `my-rp-bucket` with a unique bucket name and specify the desired AWS region.
31+
32+
```bash
33+
aws s3api create-bucket --bucket my-rp-bucket --region us-east-1
34+
```
35+
36+
> To create a bucket outside of the `us-east-1` region, add the following flag: `--create-bucket-configuration LocationConstraint=<region>`, replacing `<region>` with your desired AWS region.
37+
38+
Ensure that the bucket name adheres to [Amazon S3 bucket naming rules](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html).
39+
40+
## 2. AWS IAM Role
41+
42+
To enable secure access to your S3 bucket, you need to create an AWS IAM role with the appropriate trust and permissions policies.
43+
44+
### Step 1: Define the Trust Policy
45+
46+
The trust policy specifies which AWS service or entity is allowed to assume the role. Save the following JSON content to a file named `trust-policy.json`:
47+
48+
```json
49+
{
50+
"Version": "2012-10-17",
51+
"Statement": [
52+
{
53+
"Effect": "Allow",
54+
"Principal": {
55+
"Federated": "arn:aws:iam::ACCOUNT_ID:oidc-provider/oidc.eks.REGION.amazonaws.com/id/OIDC_ID"
56+
},
57+
"Action": "sts:AssumeRoleWithWebIdentity",
58+
"Condition": {
59+
"StringEquals": {
60+
"oidc.eks.REGION.amazonaws.com/id/OIDC_ID:aud": "sts.amazonaws.com",
61+
"oidc.eks.REGION.amazonaws.com/id/OIDC_ID:sub": "system:serviceaccount:NAMESPACE:reportportal"
62+
}
63+
}
64+
}
65+
]
66+
}
67+
```
68+
69+
Replace the placeholders with the appropriate values:
70+
- `ACCOUNT_ID`: Your AWS account ID.
71+
- `REGION`: The AWS region where your EKS cluster is deployed.
72+
- `OIDC_ID`: The unique identifier of your OIDC provider. [How to create an IAM OIDC provider for your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html)
73+
- `NAMESPACE`: The Kubernetes namespace of the service account.
74+
- `reportportal`: The name of the Kubernetes service account.
75+
76+
This trust policy ensures that only the specified Kubernetes service account can assume the IAM role via the OIDC provider.
77+
78+
### Step 2: Create the IAM Role
79+
80+
Use the AWS CLI to create the IAM role with the trust policy:
81+
82+
```bash
83+
aws iam create-role --role-name my-rp-s3-role \
84+
--assume-role-policy-document file://trust-policy.json
85+
```
86+
87+
### Step 3: Define the Permissions Policy
88+
89+
The permissions policy specifies the actions the IAM role can perform on the S3 bucket. Save the following JSON content to a file named `s3-rw-policy.json`:
90+
91+
```json
92+
{
93+
"Version": "2012-10-17",
94+
"Statement": [
95+
{
96+
"Sid": "AllowListAndLocation",
97+
"Effect": "Allow",
98+
"Action": [
99+
"s3:ListBucket",
100+
"s3:GetBucketLocation"
101+
],
102+
"Resource": "arn:aws:s3:::my-rp-bucket"
103+
},
104+
{
105+
"Sid": "AllowObjectOpsAnywhere",
106+
"Effect": "Allow",
107+
"Action": [
108+
"s3:PutObject",
109+
"s3:GetObject",
110+
"s3:DeleteObject",
111+
"s3:GetObjectAcl",
112+
"s3:GetObjectVersion"
113+
],
114+
"Resource": "arn:aws:s3:::my-rp-bucket/*"
115+
}
116+
]
117+
}
118+
```
119+
120+
### Step 4: Attach the Permissions Policy
121+
122+
Attach the permissions policy to the IAM role using the AWS CLI:
123+
124+
```bash
125+
aws iam put-role-policy --role-name my-rp-s3-role \
126+
--policy-name S3AccessPolicy \
127+
--policy-document file://s3-rw-policy.json
128+
```
129+
130+
By completing these steps, the IAM role will have the necessary permissions to interact with the specified S3 bucket securely.
131+
132+
## 3. Kubernetes-based Installation
133+
134+
To grant a Kubernetes pod on EKS read/write access to S3, use IAM Roles for Service Accounts (IRSA). This approach issues temporary credentials by having the pod assume an IAM role via OIDC
135+
136+
Update the `values.yaml` file with the appropriate storage configuration:
137+
138+
```yaml
139+
# Activate Service Account for the ReportPortal application
140+
global:
141+
serviceAccount:
142+
create: true
143+
name: reportportal
144+
annotations:
145+
eks.amazonaws.com/role-arn: "arn:aws:iam::ACCOUNT_ID:role/my-rp-s3-role"
146+
147+
148+
storage:
149+
# Ref.: https://reportportal.io/docs/installation-steps-advanced/FileStorageOptions
150+
type: s3
151+
# Leave `accesskey` and `secretkey` empty for IAM role-based access
152+
accesskey:
153+
secretkey:
154+
# Specify the AWS region. Ref.: https://jclouds.apache.org/reference/javadoc/2.6.x/org/jclouds/aws/domain/Region.html
155+
region: "us-standard" # JCloud ref. to `us-east-1`
156+
bucket:
157+
type: single
158+
bucketDefaultName: "my-rp-bucket" # Bucket created from step 1
159+
160+
# Disable the MinIO dependency
161+
minio:
162+
enable: false
163+
```
164+
165+
Install ReportPortal using Helm:
166+
167+
```bash
168+
helm install my-release \
169+
--set uat.superadminInitPasswd.password="MyPassword" \
170+
-f values.yaml \
171+
reportportal/reportportal
172+
```
173+
174+
This configuration ensures that ReportPortal uses Amazon S3 for storage with IAM role-based access, while disabling the default MinIO dependency.

‎reportportal/Chart.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
apiVersion: v2
2-
appVersion: "25.0.6"
2+
appVersion: "25.1"
33
description: |
44
ReportPortal.io is a TestOps service, that provides increased capabilities
55
to speed up results analysis and reporting through the use of built-in analytic features.
66
name: reportportal
7-
version: 25.4.10
7+
version: 25.5.28
88
sources:
99
- https://github.com/reportportal/kubernetes/tree/master/reportportal
1010
keywords:

0 commit comments

Comments
 (0)