From 9b1a5f2ac23a3390b3ea3f01efd71014f987dc5f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 6 Nov 2024 23:06:17 +0100 Subject: [PATCH 1/2] tests: Add a way to run only tests which rely on attestation MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We're doing this as, at Intel, we have two different kind of machines we can plug into our CI. Without going much into details, only one of those two kinds of machines will work for the attestation tests we perform with ITA, thus in order to speed up the CI and improve test coverage (OS wise), we're going to run different tests in different machines. Signed-off-by: Fabiano Fidêncio --- .../kubernetes/run_kubernetes_tests.sh | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/tests/integration/kubernetes/run_kubernetes_tests.sh b/tests/integration/kubernetes/run_kubernetes_tests.sh index b6f62d93d2..3d75b39fd9 100755 --- a/tests/integration/kubernetes/run_kubernetes_tests.sh +++ b/tests/integration/kubernetes/run_kubernetes_tests.sh @@ -33,12 +33,15 @@ else # we need run k8s-guest-pull-image.bats test first, otherwise the test result will be affected # by other cases which are using 'alpine' and 'quay.io/prometheus/busybox:latest' image. # more details https://github.com/kata-containers/kata-containers/issues/8337 - K8S_TEST_SMALL_HOST_UNION=( \ + K8S_TEST_SMALL_HOST_ATTESTATION_REQUIRED_UNION=( \ "k8s-guest-pull-image-encrypted.bats" \ - "k8s-guest-pull-image.bats" \ "k8s-guest-pull-image-authenticated.bats" \ "k8s-guest-pull-image-signature.bats" \ "k8s-confidential-attestation.bats" \ + ) + + K8S_TEST_SMALL_HOST_UNION=( \ + "k8s-guest-pull-image.bats" \ "k8s-confidential.bats" \ "k8s-sealed-secret.bats" \ "k8s-attach-handlers.bats" \ @@ -95,14 +98,19 @@ else case ${K8S_TEST_HOST_TYPE} in small) - K8S_TEST_UNION=(${K8S_TEST_SMALL_HOST_UNION[@]}) + K8S_TEST_UNION=(${K8S_TEST_SMALL_HOST_ATTESTATION_REQUIRED_UNION[@]} ${K8S_TEST_SMALL_HOST_UNION[@]}) ;; normal) K8S_TEST_UNION=(${K8S_TEST_NORMAL_HOST_UNION[@]}) ;; all|baremetal) + K8S_TEST_UNION=(${K8S_TEST_SMALL_HOST_ATTESTATION_REQUIRED_UNION[@]} ${K8S_TEST_SMALL_HOST_UNION[@]} ${K8S_TEST_NORMAL_HOST_UNION[@]}) + ;; + baremetal-attestation) + K8S_TEST_UNION=(${K8S_TEST_SMALL_HOST_ATTESTATION_REQUIRED_UNION[@]}) + ;; + baremetal-no-attestation) K8S_TEST_UNION=(${K8S_TEST_SMALL_HOST_UNION[@]} ${K8S_TEST_NORMAL_HOST_UNION[@]}) - ;; *) echo "${K8S_TEST_HOST_TYPE} is an invalid K8S_TEST_HOST_TYPE option. Valid options are: small | normal | all | baremetal" From 9b3fe0c7474bb2b4fde265178094e654215a4a31 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabiano=20Fid=C3=AAncio?= Date: Wed, 6 Nov 2024 23:21:00 +0100 Subject: [PATCH 2/2] ci: tdx: Adjust workflows to use different machines MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This will be helpful in order to increase the OS coverage (we'll be using both Ubuntu 24.04 and CentOS 9 Stream), while also reducing the amount spent on the tests (as one machine will only run attestation related tests, and the other the tests that do *not* require attestation). Signed-off-by: Fabiano Fidêncio --- .github/workflows/run-kata-coco-tests.yaml | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/.github/workflows/run-kata-coco-tests.yaml b/.github/workflows/run-kata-coco-tests.yaml index 2710641ed7..e1fa6a0c1c 100644 --- a/.github/workflows/run-kata-coco-tests.yaml +++ b/.github/workflows/run-kata-coco-tests.yaml @@ -36,7 +36,15 @@ jobs: - nydus pull-type: - guest-pull - runs-on: tdx + k8s-test-host-type: + - baremetal-attestation + - baremetal-no-attestation + include: + - k8s-test-host-type: baremetal-attestation + machine: tdx-attestation + - k8s-test-host-type: baremetal-no-attestation + machine: tdx-no-attestation + runs-on: ${{ matrix.machine }} env: DOCKER_REGISTRY: ${{ inputs.registry }} DOCKER_REPO: ${{ inputs.repo }} @@ -46,7 +54,7 @@ jobs: KUBERNETES: "vanilla" USING_NFD: "true" KBS: "true" - K8S_TEST_HOST_TYPE: "baremetal" + K8S_TEST_HOST_TYPE: ${{ matrix.k8s-test-host-type }} KBS_INGRESS: "nodeport" SNAPSHOTTER: ${{ matrix.snapshotter }} PULL_TYPE: ${{ matrix.pull-type }} @@ -75,14 +83,17 @@ jobs: run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-tdx - name: Uninstall previous `kbs-client` + if: ${{ matrix.machine != 'tdx-no-attestation' }} timeout-minutes: 10 run: bash tests/integration/kubernetes/gha-run.sh uninstall-kbs-client - name: Deploy CoCo KBS + if: ${{ matrix.machine != 'tdx-no-attestation' }} timeout-minutes: 10 run: bash tests/integration/kubernetes/gha-run.sh deploy-coco-kbs - name: Install `kbs-client` + if: ${{ matrix.machine != 'tdx-no-attestation' }} timeout-minutes: 10 run: bash tests/integration/kubernetes/gha-run.sh install-kbs-client @@ -99,7 +110,7 @@ jobs: run: bash tests/integration/kubernetes/gha-run.sh cleanup-snapshotter - name: Delete CoCo KBS - if: always() + if: ${{ always() && matrix.machine != 'tdx-no-attestation' }} run: bash tests/integration/kubernetes/gha-run.sh delete-coco-kbs run-k8s-tests-on-sev: