mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-07-15 15:14:06 +00:00
375 lines
12 KiB
YAML
375 lines
12 KiB
YAML
name: CI | Run kata coco tests
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
artifact-run-id:
|
|
description: "The run id where the artifact was uploaded"
|
|
required: false
|
|
type: string
|
|
default: ${{ github.run_id }}
|
|
tarball-suffix:
|
|
required: false
|
|
type: string
|
|
registry:
|
|
required: true
|
|
type: string
|
|
repo:
|
|
required: true
|
|
type: string
|
|
tag:
|
|
required: true
|
|
type: string
|
|
pr-number:
|
|
required: true
|
|
type: string
|
|
commit-hash:
|
|
required: false
|
|
type: string
|
|
target-branch:
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
secrets:
|
|
AUTHENTICATED_IMAGE_PASSWORD:
|
|
required: true
|
|
AZ_APPID:
|
|
required: true
|
|
AZ_TENANT_ID:
|
|
required: true
|
|
AZ_SUBSCRIPTION_ID:
|
|
required: true
|
|
ITA_KEY:
|
|
required: true
|
|
workflow_dispatch:
|
|
inputs:
|
|
artifact-run-id:
|
|
description: "The workflow run id where the artifact was uploaded"
|
|
required: true
|
|
type: string
|
|
tarball-suffix:
|
|
description: "The suffix of the kata tarball to use"
|
|
required: false
|
|
type: string
|
|
registry:
|
|
description: "The oci container registry to install kata-deploy from"
|
|
required: true
|
|
type: string
|
|
repo:
|
|
description: "The oci container repository/image to install kata-deploy from"
|
|
required: true
|
|
type: string
|
|
tag:
|
|
description: "The oci container image tag to install kata-deploy using"
|
|
required: true
|
|
type: string
|
|
pr-number:
|
|
description: "Identifier used to distinguish between PRs/dev/nightly tests"
|
|
required: true
|
|
type: string
|
|
commit-hash:
|
|
description: "The code to checkout for testing"
|
|
required: false
|
|
type: string
|
|
target-branch:
|
|
description: "The target branch to rebase on and ensure the tests are up-to-date"
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
|
|
jobs:
|
|
# run-k8s-tests-on-tdx:
|
|
# strategy:
|
|
# fail-fast: false
|
|
# matrix:
|
|
# vmm:
|
|
# - qemu-tdx
|
|
# snapshotter:
|
|
# - nydus
|
|
# pull-type:
|
|
# - guest-pull
|
|
# runs-on: tdx
|
|
# env:
|
|
# DOCKER_REGISTRY: ${{ inputs.registry }}
|
|
# DOCKER_REPO: ${{ inputs.repo }}
|
|
# DOCKER_TAG: ${{ inputs.tag }}
|
|
# GH_PR_NUMBER: ${{ inputs.pr-number }}
|
|
# KATA_HYPERVISOR: ${{ matrix.vmm }}
|
|
# KUBERNETES: "vanilla"
|
|
# USING_NFD: "true"
|
|
# KBS: "true"
|
|
# K8S_TEST_HOST_TYPE: "baremetal"
|
|
# KBS_INGRESS: "nodeport"
|
|
# SNAPSHOTTER: ${{ matrix.snapshotter }}
|
|
# PULL_TYPE: ${{ matrix.pull-type }}
|
|
# AUTHENTICATED_IMAGE_USER: ${{ vars.AUTHENTICATED_IMAGE_USER }}
|
|
# AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
|
|
# ITA_KEY: ${{ secrets.ITA_KEY }}
|
|
# AUTO_GENERATE_POLICY: "yes"
|
|
# steps:
|
|
# - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
# with:
|
|
# ref: ${{ inputs.commit-hash }}
|
|
# fetch-depth: 0
|
|
# persist-credentials: false
|
|
|
|
# - name: Rebase atop of the latest target branch
|
|
# run: |
|
|
# ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
|
|
# env:
|
|
# TARGET_BRANCH: ${{ inputs.target-branch }}
|
|
|
|
# - name: Deploy Snapshotter
|
|
# timeout-minutes: 5
|
|
# run: bash tests/integration/kubernetes/gha-run.sh deploy-snapshotter
|
|
|
|
# - name: Deploy Kata
|
|
# timeout-minutes: 10
|
|
# run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-tdx
|
|
|
|
# - name: Uninstall previous `kbs-client`
|
|
# timeout-minutes: 10
|
|
# run: bash tests/integration/kubernetes/gha-run.sh uninstall-kbs-client
|
|
|
|
# - name: Deploy CoCo KBS
|
|
# timeout-minutes: 10
|
|
# run: bash tests/integration/kubernetes/gha-run.sh deploy-coco-kbs
|
|
|
|
# - name: Install `kbs-client`
|
|
# timeout-minutes: 10
|
|
# run: bash tests/integration/kubernetes/gha-run.sh install-kbs-client
|
|
|
|
# - name: Deploy CSI driver
|
|
# timeout-minutes: 5
|
|
# run: bash tests/integration/kubernetes/gha-run.sh deploy-csi-driver
|
|
|
|
# - name: Run tests
|
|
# timeout-minutes: 100
|
|
# run: bash tests/integration/kubernetes/gha-run.sh run-tests
|
|
|
|
# - name: Delete kata-deploy
|
|
# if: always()
|
|
# run: bash tests/integration/kubernetes/gha-run.sh cleanup-tdx
|
|
|
|
# - name: Delete Snapshotter
|
|
# if: always()
|
|
# run: bash tests/integration/kubernetes/gha-run.sh cleanup-snapshotter
|
|
|
|
# - name: Delete CoCo KBS
|
|
# if: always()
|
|
# run: bash tests/integration/kubernetes/gha-run.sh delete-coco-kbs
|
|
|
|
# - name: Delete CSI driver
|
|
# timeout-minutes: 5
|
|
# run: bash tests/integration/kubernetes/gha-run.sh delete-csi-driver
|
|
|
|
# run-k8s-tests-sev-snp:
|
|
# strategy:
|
|
# fail-fast: false
|
|
# matrix:
|
|
# vmm:
|
|
# - qemu-snp
|
|
# snapshotter:
|
|
# - nydus
|
|
# pull-type:
|
|
# - guest-pull
|
|
# runs-on: sev-snp
|
|
# env:
|
|
# DOCKER_REGISTRY: ${{ inputs.registry }}
|
|
# DOCKER_REPO: ${{ inputs.repo }}
|
|
# DOCKER_TAG: ${{ inputs.tag }}
|
|
# GH_PR_NUMBER: ${{ inputs.pr-number }}
|
|
# KATA_HYPERVISOR: ${{ matrix.vmm }}
|
|
# KUBECONFIG: /home/kata/.kube/config
|
|
# KUBERNETES: "vanilla"
|
|
# USING_NFD: "false"
|
|
# KBS: "true"
|
|
# KBS_INGRESS: "nodeport"
|
|
# K8S_TEST_HOST_TYPE: "baremetal"
|
|
# SNAPSHOTTER: ${{ matrix.snapshotter }}
|
|
# PULL_TYPE: ${{ matrix.pull-type }}
|
|
# AUTHENTICATED_IMAGE_USER: ${{ vars.AUTHENTICATED_IMAGE_USER }}
|
|
# AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
|
|
# AUTO_GENERATE_POLICY: "yes"
|
|
# steps:
|
|
# - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
# with:
|
|
# ref: ${{ inputs.commit-hash }}
|
|
# fetch-depth: 0
|
|
# persist-credentials: false
|
|
|
|
# - name: Rebase atop of the latest target branch
|
|
# run: |
|
|
# ./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
|
|
# env:
|
|
# TARGET_BRANCH: ${{ inputs.target-branch }}
|
|
|
|
# - name: Deploy Snapshotter
|
|
# timeout-minutes: 5
|
|
# run: bash tests/integration/kubernetes/gha-run.sh deploy-snapshotter
|
|
|
|
# - name: Deploy Kata
|
|
# timeout-minutes: 10
|
|
# run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-snp
|
|
|
|
# - name: Uninstall previous `kbs-client`
|
|
# timeout-minutes: 10
|
|
# run: bash tests/integration/kubernetes/gha-run.sh uninstall-kbs-client
|
|
|
|
# - name: Deploy CoCo KBS
|
|
# timeout-minutes: 10
|
|
# run: bash tests/integration/kubernetes/gha-run.sh deploy-coco-kbs
|
|
|
|
# - name: Install `kbs-client`
|
|
# timeout-minutes: 10
|
|
# run: bash tests/integration/kubernetes/gha-run.sh install-kbs-client
|
|
|
|
# - name: Deploy CSI driver
|
|
# timeout-minutes: 5
|
|
# run: bash tests/integration/kubernetes/gha-run.sh deploy-csi-driver
|
|
|
|
# - name: Run tests
|
|
# timeout-minutes: 50
|
|
# run: bash tests/integration/kubernetes/gha-run.sh run-tests
|
|
|
|
# - name: Delete kata-deploy
|
|
# if: always()
|
|
# run: bash tests/integration/kubernetes/gha-run.sh cleanup-snp
|
|
|
|
# - name: Delete Snapshotter
|
|
# if: always()
|
|
# run: bash tests/integration/kubernetes/gha-run.sh cleanup-snapshotter
|
|
|
|
# - name: Delete CoCo KBS
|
|
# if: always()
|
|
# run: bash tests/integration/kubernetes/gha-run.sh delete-coco-kbs
|
|
|
|
# - name: Delete CSI driver
|
|
# timeout-minutes: 5
|
|
# run: bash tests/integration/kubernetes/gha-run.sh delete-csi-driver
|
|
|
|
# Generate jobs for testing CoCo on non-TEE environments
|
|
run-k8s-tests-coco-nontee:
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
vmm:
|
|
- qemu-coco-dev
|
|
snapshotter:
|
|
- nydus
|
|
pull-type:
|
|
- guest-pull
|
|
runs-on: ubuntu-22.04
|
|
environment: ci
|
|
env:
|
|
DOCKER_REGISTRY: ${{ inputs.registry }}
|
|
DOCKER_REPO: ${{ inputs.repo }}
|
|
DOCKER_TAG: ${{ inputs.tag }}
|
|
GH_PR_NUMBER: ${{ inputs.pr-number }}
|
|
KATA_HYPERVISOR: ${{ matrix.vmm }}
|
|
# Some tests rely on that variable to run (or not)
|
|
KBS: "true"
|
|
# Set the KBS ingress handler (empty string disables handling)
|
|
KBS_INGRESS: "aks"
|
|
KUBERNETES: "vanilla"
|
|
PULL_TYPE: ${{ matrix.pull-type }}
|
|
AUTHENTICATED_IMAGE_USER: ${{ vars.AUTHENTICATED_IMAGE_USER }}
|
|
AUTHENTICATED_IMAGE_PASSWORD: ${{ secrets.AUTHENTICATED_IMAGE_PASSWORD }}
|
|
SNAPSHOTTER: ${{ matrix.snapshotter }}
|
|
# Caution: current ingress controller used to expose the KBS service
|
|
# requires much vCPUs, lefting only a few for the tests. Depending on the
|
|
# host type chose it will result on the creation of a cluster with
|
|
# insufficient resources.
|
|
K8S_TEST_HOST_TYPE: "all"
|
|
USING_NFD: "false"
|
|
AUTO_GENERATE_POLICY: "yes"
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
ref: ${{ inputs.commit-hash }}
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Rebase atop of the latest target branch
|
|
run: |
|
|
./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
|
|
env:
|
|
TARGET_BRANCH: ${{ inputs.target-branch }}
|
|
|
|
- name: get-kata-tarball
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
name: kata-static-tarball-amd64${{ inputs.tarball-suffix }}
|
|
run-id: ${{ inputs.artifact-run-id }}
|
|
github-token: ${{ github.token }}
|
|
repository: ${{ github.repository}}
|
|
path: kata-artifacts
|
|
|
|
- name: Install kata
|
|
run: bash tests/integration/kubernetes/gha-run.sh install-kata-tools kata-artifacts
|
|
|
|
- name: Download Azure CLI
|
|
run: bash tests/integration/kubernetes/gha-run.sh install-azure-cli
|
|
|
|
- name: Log into the Azure account
|
|
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
|
|
with:
|
|
client-id: ${{ secrets.AZ_APPID }}
|
|
tenant-id: ${{ secrets.AZ_TENANT_ID }}
|
|
subscription-id: ${{ secrets.AZ_SUBSCRIPTION_ID }}
|
|
|
|
- name: Create AKS cluster
|
|
uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
|
|
with:
|
|
timeout_minutes: 15
|
|
max_attempts: 20
|
|
retry_on: error
|
|
retry_wait_seconds: 10
|
|
command: bash tests/integration/kubernetes/gha-run.sh create-cluster
|
|
|
|
- name: Install `bats`
|
|
run: bash tests/integration/kubernetes/gha-run.sh install-bats
|
|
|
|
- name: Install `kubectl`
|
|
uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4.0.1
|
|
with:
|
|
version: 'latest'
|
|
|
|
- name: Download credentials for the Kubernetes CLI to use them
|
|
run: bash tests/integration/kubernetes/gha-run.sh get-cluster-credentials
|
|
|
|
- name: Deploy Snapshotter
|
|
timeout-minutes: 5
|
|
run: bash tests/integration/kubernetes/gha-run.sh deploy-snapshotter
|
|
|
|
- name: Deploy Kata
|
|
timeout-minutes: 10
|
|
run: bash tests/integration/kubernetes/gha-run.sh deploy-kata-aks
|
|
|
|
- name: Deploy CoCo KBS
|
|
timeout-minutes: 10
|
|
run: bash tests/integration/kubernetes/gha-run.sh deploy-coco-kbs
|
|
|
|
- name: Install `kbs-client`
|
|
timeout-minutes: 10
|
|
run: bash tests/integration/kubernetes/gha-run.sh install-kbs-client
|
|
|
|
- name: Deploy CSI driver
|
|
timeout-minutes: 5
|
|
run: bash tests/integration/kubernetes/gha-run.sh deploy-csi-driver
|
|
|
|
- name: Run tests
|
|
timeout-minutes: 80
|
|
run: bash tests/integration/kubernetes/gha-run.sh run-tests
|
|
|
|
- name: Report tests
|
|
if: always()
|
|
run: bash tests/integration/kubernetes/gha-run.sh report-tests
|
|
|
|
- name: Delete AKS cluster
|
|
if: always()
|
|
run: bash tests/integration/kubernetes/gha-run.sh delete-cluster
|