SERVER-85553 Require Bazel on Ubuntu 22 ARM (#18659)

GitOrigin-RevId: 0a563492b5f67d93862857cebf0b362bc1468f14

SConstruct

@@ -2,6 +2,7 @@
 
 import atexit
 import copy
+import distro
 import errno
 import functools
 import json
@@ -950,6 +951,11 @@ def fatal_error(env, msg, *args):
     Exit(1)
 
 
+def bazel_by_default():
+    return distro.name() == "Ubuntu" and distro.version().split(
+        ".")[0] == "22" and platform.machine() == "aarch64"
+
+
 # Apply the default variables files, and walk the provided
 # arguments. Interpret any falsy argument (like the empty string) as
 # resetting any prior state. This makes the argument
@@ -1078,7 +1084,7 @@ env_vars.Add(
     help=
     'Enables/disables building with bazel. Note that this project is in flight, and thus subject to breaking changes. See https://jira.mongodb.org/browse/PM-3332 for details.',
     converter=functools.partial(bool_var_converter, var='BAZEL_BUILD_ENABLED'),
-    default="0",
+    default="1" if bazel_by_default() else "0",
 )
 
 env_vars.Add(

etc/evergreen_yml_components/tasks/compile_tasks.yml

@@ -2627,6 +2627,7 @@ task_groups:
   - func: "apply compile expansions"
   - func: "set task expansion macros"
   - func: "f_expansions_write"
+  - func: "get engflow creds"
   teardown_task:
   - func: "attach scons logs"
   setup_group_can_fail_task: true

site_scons/site_tools/integrate_bazel.py

@@ -1,5 +1,6 @@
 import atexit
 import functools
+import getpass
 import json
 import os
 import platform
@@ -12,7 +13,9 @@
 import time
 from typing import List, Dict, Set, Tuple, Any
 import urllib.request
+import requests
 import sys
+import socket
 
 import SCons
 
@@ -354,6 +357,41 @@ def create_idlc_builder(env: SCons.Environment.Environment) -> None:
     env['BUILDERS']['BazelIdlc'] = create_bazel_builder(env['BUILDERS']["Idlc"])
 
 
+def validate_remote_execution_certs(env: SCons.Environment.Environment) -> bool:
+    running_in_evergreen = env.GetOption("evergreen-tmp-dir") is not None
+
+    if running_in_evergreen and not os.path.exists("./engflow.cert"):
+        print(
+            "ERROR: ./engflow.cert not found, which is required to build in evergreen without BAZEL_FLAGS=--config=local set. Please reach out to #server-dev-platform for help."
+        )
+        return False
+
+    if not running_in_evergreen and not os.path.exists("/engflow/creds/engflow.crt"):
+        # Pull the external hostname of the system from aws
+        response = requests.get(
+            "http://instance-data.ec2.internal/latest/meta-data/public-hostname")
+        if response.status_code == 200:
+            public_hostname = response.text
+        else:
+            public_hostname = "{{REPLACE_WITH_WORKSTATION_HOST_NAME}}"
+        print(
+            f"""\nERROR: /engflow/creds/engflow.crt not found. Please reach out to #server-dev-platform if you need help with the steps below.
+
+Please complete the following steps to generate a certificate:
+- (If not in the Engineering org) Request access to the MANA group https://mana.corp.mongodbgov.com/resources/659ec4b9bccf3819e5608712
+- Go to https://sodalite.cluster.engflow.com/gettingstarted (Uses mongodbcorp.okta.com auth URL)
+- Login with Okta, then click the \"GENERATE AND DOWNLOAD MTLS CERTIFICATE\" button
+- On your macbook, open a terminal and run:
+
+unzip ~/Downloads/engflow-mTLS.zip
+rsync --rsync-path="sudo mkdir -p /engflow/creds && sudo rsync" ./engflow.crt {getpass.getuser()}@{public_hostname}:/engflow/creds
+rsync --rsync-path="sudo rsync" ./engflow.key {getpass.getuser()}@{public_hostname}:/engflow/creds
+ssh {getpass.getuser()}@{public_hostname} "sudo chown -R {getpass.getuser()}:{getpass.getuser()} /engflow"
+ssh {getpass.getuser()}@{public_hostname} "sudo chmod -R u=rwX,g=rX,o= /engflow"\n""")
+        return False
+    return True
+
+
 def generate_bazel_info_for_ninja(env: SCons.Environment.Environment) -> None:
     # create a json file which contains all the relevant info from this generation
     # that bazel will need to construct the correct command line for any given targets
@@ -483,8 +521,11 @@ def bazel_debug_func(msg: str):
             formatted_options = [f'--//bazel/config:{_SANITIZER_MAP[opt]}=True' for opt in options]
             bazel_internal_flags.extend(formatted_options)
 
+        # Disable RE for external developers
+        is_external_developer = not os.path.exists("/opt/mongodbtoolchain")
+
         # TODO SERVER-85806 enable RE for amd64
-        if normalized_os != "linux" or normalized_arch not in ["arm64"]:
+        if normalized_os != "linux" or normalized_arch not in ["arm64"] or is_external_developer:
             bazel_internal_flags.append('--config=local')
 
         # Disable remote execution for public release builds.
@@ -506,6 +547,13 @@ def bazel_debug_func(msg: str):
         # if the bazel command line changes.
         env['BAZEL_FLAGS_STR'] = str(bazel_internal_flags) + env.get("BAZEL_FLAGS", "")
 
+        if "--config=local" not in env['BAZEL_FLAGS_STR']:
+            print(
+                "Running bazel with remote execution enabled. To disable bazel remote execution, please add BAZEL_FLAGS=--config=local to the end of your scons command line invocation."
+            )
+            if not validate_remote_execution_certs(env):
+                sys.exit(1)
+
         # We always use --compilation_mode debug for now as we always want -g, so assume -dbg location
         out_dir_platform = "$TARGET_ARCH"
         if normalized_os == "macos":