Тестирование Multi-Cloud Инфраструктуры: Стратегии для AWS, Azure и GCP

package test

import (
    "testing"
    "time"

    "github.com/gruntwork-io/terratest/modules/aws"
    "github.com/gruntwork-io/terratest/modules/azure"
    "github.com/gruntwork-io/terratest/modules/gcp"
    "github.com/gruntwork-io/terratest/modules/terraform"
    "github.com/stretchr/testify/assert"
)

func TestMultiCloudNetworking(t *testing.T) {
    t.Parallel()

    // Деплой AWS инфраструктуры
    awsOpts := &terraform.Options{
        TerraformDir: "../fixtures/aws/networking",
        Vars: map[string]interface{}{
            "environment": "test",
            "vpc_cidr":    "10.0.0.0/16",
        },
        EnvVars: map[string]string{
            "AWS_DEFAULT_REGION": "us-east-1",
        },
    }
    defer terraform.Destroy(t, awsOpts)
    terraform.InitAndApply(t, awsOpts)

    // Деплой GCP инфраструктуры
    gcpOpts := &terraform.Options{
        TerraformDir: "../fixtures/gcp/networking",
        Vars: map[string]interface{}{
            "environment": "test",
            "vpc_cidr":    "10.1.0.0/16",
        },
        EnvVars: map[string]string{
            "GOOGLE_PROJECT": "my-project",
            "GOOGLE_REGION":  "us-central1",
        },
    }
    defer terraform.Destroy(t, gcpOpts)
    terraform.InitAndApply(t, gcpOpts)

    // Получение outputs для cross-cloud валидации
    awsVpcId := terraform.Output(t, awsOpts, "vpc_id")
    gcpNetworkName := terraform.Output(t, gcpOpts, "network_name")

    // Валидация AWS стороны
    vpc := aws.GetVpcById(t, awsVpcId, "us-east-1")
    assert.Equal(t, "10.0.0.0/16", vpc.CidrBlock)

    // Валидация GCP стороны
    network := gcp.GetNetwork(t, "my-project", gcpNetworkName)
    assert.True(t, network.AutoCreateSubnetworks == false)

    // Тест cross-cloud connectivity (через VPN/interconnect)
    testCrossCloudConnectivity(t, awsOpts, gcpOpts)
}

func testCrossCloudConnectivity(t *testing.T, awsOpts, gcpOpts *terraform.Options) {
    awsInstanceIP := terraform.Output(t, awsOpts, "test_instance_private_ip")
    gcpInstanceIP := terraform.Output(t, gcpOpts, "test_instance_private_ip")

    // SSH на AWS инстанс и ping GCP инстанса
    aws.CheckSshCommand(t,
        terraform.Output(t, awsOpts, "test_instance_public_ip"),
        "ubuntu",
        fmt.Sprintf("ping -c 3 %s", gcpInstanceIP),
    )
}

# AWS credentials
export AWS_ACCESS_KEY_ID="..."
export AWS_SECRET_ACCESS_KEY="..."
export AWS_DEFAULT_REGION="us-east-1"

# Azure credentials
export ARM_CLIENT_ID="..."
export ARM_CLIENT_SECRET="..."
export ARM_SUBSCRIPTION_ID="..."
export ARM_TENANT_ID="..."

# GCP credentials
export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account.json"
export GOOGLE_PROJECT="my-project"

# GitHub Actions с multi-cloud OIDC
jobs:
  multi-cloud-test:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789:role/github-actions
          aws-region: us-east-1

      - name: Configure Azure credentials
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Configure GCP credentials
        uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: projects/123/locations/global/workloadIdentityPools/github/providers/github-actions
          service_account: github-actions@my-project.iam.gserviceaccount.com

      - name: Run multi-cloud tests
        run: go test -v ./tests/integration/...

package assertions

import (
    "testing"
    "github.com/stretchr/testify/assert"
)

// NetworkConfig представляет cloud-агностичные свойства сети
type NetworkConfig struct {
    CIDR          string
    SubnetCount   int
    HasNATGateway bool
    HasVPNGateway bool
}

// DatabaseConfig представляет cloud-агностичные свойства БД
type DatabaseConfig struct {
    Engine            string // "postgres", "mysql"
    Version           string
    MultiAZ           bool
    EncryptedAtRest   bool
    BackupRetention   int
}

// AssertNetworkConfig валидирует сеть независимо от cloud
func AssertNetworkConfig(t *testing.T, expected, actual NetworkConfig) {
    assert.Equal(t, expected.CIDR, actual.CIDR, "CIDR mismatch")
    assert.Equal(t, expected.SubnetCount, actual.SubnetCount, "Subnet count mismatch")
    assert.Equal(t, expected.HasNATGateway, actual.HasNATGateway, "NAT gateway mismatch")
}

// AssertDatabaseConfig валидирует базу данных независимо от cloud
func AssertDatabaseConfig(t *testing.T, expected, actual DatabaseConfig) {
    assert.Equal(t, expected.Engine, actual.Engine)
    assert.True(t, actual.EncryptedAtRest, "Database must be encrypted at rest")
    assert.GreaterOrEqual(t, actual.BackupRetention, 7, "Backup retention must be >= 7 days")
}

// aws/adapter.go
func GetNetworkConfig(t *testing.T, vpcId, region string) NetworkConfig {
    vpc := aws.GetVpcById(t, vpcId, region)
    subnets := aws.GetSubnetsForVpc(t, vpcId, region)
    natGateways := aws.GetNatGatewaysForVpc(t, vpcId, region)

    return NetworkConfig{
        CIDR:          vpc.CidrBlock,
        SubnetCount:   len(subnets),
        HasNATGateway: len(natGateways) > 0,
    }
}

// gcp/adapter.go
func GetNetworkConfig(t *testing.T, projectId, networkName string) NetworkConfig {
    network := gcp.GetNetwork(t, projectId, networkName)
    subnets := gcp.GetSubnetsForNetwork(t, projectId, networkName)
    routers := gcp.GetRoutersForNetwork(t, projectId, networkName)

    hasNAT := false
    for _, router := range routers {
        if len(router.Nats) > 0 {
            hasNAT = true
            break
        }
    }

    return NetworkConfig{
        CIDR:          subnets[0].IpCidrRange, // GCP использует CIDR subnet
        SubnetCount:   len(subnets),
        HasNATGateway: hasNAT,
    }
}

func TestCrossCloudDatabaseAccess(t *testing.T) {
    // Деплой AWS RDS
    awsOpts := terraform.Options{
        TerraformDir: "../fixtures/aws/rds",
    }
    defer terraform.Destroy(t, &awsOpts)
    terraform.InitAndApply(t, &awsOpts)

    // Деплой GCP VM которая подключается к AWS RDS
    gcpOpts := terraform.Options{
        TerraformDir: "../fixtures/gcp/client-vm",
        Vars: map[string]interface{}{
            "database_host": terraform.Output(t, &awsOpts, "rds_endpoint"),
        },
    }
    defer terraform.Destroy(t, &gcpOpts)
    terraform.InitAndApply(t, &gcpOpts)

    // Запуск SQL query из GCP VM в AWS RDS
    vmIP := terraform.Output(t, &gcpOpts, "instance_ip")
    result := gcp.RunCommandOnInstance(t, vmIP, "psql -h $DB_HOST -c 'SELECT 1'")
    assert.Contains(t, result, "1 row")
}

func TestMultiCloudInParallel(t *testing.T) {
    t.Parallel()

    // Эти могут запускаться одновременно
    t.Run("AWS", func(t *testing.T) {
        t.Parallel()
        testAWSInfrastructure(t)
    })

    t.Run("Azure", func(t *testing.T) {
        t.Parallel()
        testAzureInfrastructure(t)
    })

    t.Run("GCP", func(t *testing.T) {
        t.Parallel()
        testGCPInfrastructure(t)
    })
}

func TestCrossCloudDependent(t *testing.T) {
    // Эти должны запускаться последовательно - GCP зависит от AWS
    awsResult := testAWSNetworking(t)
    testGCPWithAWSConnection(t, awsResult)
}