ci-test-ginkgo-k0s.yml

name: ci-test-k0s

on:
  push:
    branches: [k0s-tests]
    paths:
      - "KubeArmor/**"
      - "tests/**"
      - "protobuf/**"
      - ".github/workflows/ci-test-ginkgo-k0s.yml"
      - "pkg/KubeArmorOperator/**"
      - "deployments/helm/**"
  release:
    types: [published]
  schedule:
    - cron: '0 0 * * 0' # Weekly on Sunday at midnight

# Declare default permissions as read only.
permissions: read-all

jobs:
  k0s-test:
    name: K0s Auto-testing Framework / ${{ matrix.os }} / ${{ matrix.runtime }}
    runs-on: ${{ matrix.os }}
    env:
      RUNTIME: ${{ matrix.runtime }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-22.04]
        runtime: ["containerd", "crio"]
    steps:
      - uses: actions/checkout@v3
        with:
          submodules: true

      - uses: actions/setup-go@v5
        with:
          go-version-file: 'KubeArmor/go.mod'

      - name: Install the latest LLVM toolchain
        run: ./.github/workflows/install-llvm.sh

      - name: Compile libbpf
        run: ./.github/workflows/install-libbpf.sh

      - name: Setup a k0s Kubernetes environment
        run: ./.github/workflows/install-k0s.sh

      - name: Generate KubeArmor artifacts
        run: |
          GITHUB_SHA=$GITHUB_SHA ./KubeArmor/build/build_kubearmor.sh

      - name: Build Kubearmor-Operator
        working-directory: pkg/KubeArmorOperator
        run: |
          make docker-build

      - name: deploy pre existing pod 
        run: |
          kubectl apply -f ./tests/k8s_env/ksp/pre-run-pod.yaml
          sleep 60
          kubectl get pods -A

      - name: Run KubeArmor
        run: |
            if [ ${{ matrix.runtime }} == "containerd" ]; then
                docker save kubearmor/kubearmor-init:latest | sudo k0s ctr images import -
                docker save kubearmor/kubearmor:latest | sudo k0s ctr images import -
                docker save kubearmor/kubearmor-operator:latest | sudo k0s ctr images import -
                docker save kubearmor/kubearmor-snitch:latest | sudo k0s ctr images import -
            else
                if [ ${{ matrix.runtime }} == "crio" ]; then
                    sudo podman pull docker-daemon:kubearmor/kubearmor-init:latest
                    sudo podman pull docker-daemon:kubearmor/kubearmor:latest
                    sudo podman pull docker-daemon:kubearmor/kubearmor-operator:latest
                    sudo podman pull docker-daemon:kubearmor/kubearmor-snitch:latest
                fi
            fi
            kubectl get pods -A
            helm upgrade --install kubearmor-operator ./deployments/helm/KubeArmorOperator -n kubearmor --create-namespace --set kubearmorOperator.image.tag=latest
            kubectl get pods -A
            kubectl wait --for=condition=ready --timeout=10m -n kubearmor pod -l kubearmor-app=kubearmor-operator || true
            kubectl get pods -A
            kubectl apply -f pkg/KubeArmorOperator/config/samples/kubearmor-test.yaml
            kubectl get pods -A
            kubectl wait --timeout=5m --for=jsonpath='{.status.phase}'=Running kubearmorconfigs/kubearmorconfig-test || true
            kubectl get pods -A
            kubectl wait --timeout=6m --for=condition=ready pod -l kubearmor-app,kubearmor-app!=kubearmor-snitch,kubearmor-app!=kubearmor-controller -n kubearmor || true
            kubectl get pods -A
            kubectl wait --timeout=1m --for=condition=ready pod -l kubearmor-app=kubearmor-controller -n kubearmor || true
            kubectl get pods -A
            for pod in $(kubectl get pods -n kubearmor -o jsonpath='{.items[*].metadata.name}'); do
                echo "Logs for $pod"
                kubectl logs -n kubearmor $pod > $pod.log
            done
            kubectl get pods -A
        continue-on-error: true

      - name: Test KubeArmor using Ginkgo
        run: |
          go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo
          go mod tidy
          ginkgo --vv --flake-attempts=10 --timeout=10m smoke/
        working-directory: ./tests/k8s_env
        timeout-minutes: 10

      - name: Get karmor sysdump
        if: ${{ failure() }}
        run: |
          kubectl describe pod -n kubearmor -l kubearmor-app=kubearmor
          curl -sfL http://get.kubearmor.io/ | sudo sh -s -- -b /usr/local/bin
          mkdir -p /tmp/kubearmor/ && cd /tmp/kubearmor && karmor sysdump

      - name: Archive log artifacts
        if: ${{ failure() }}
        uses: actions/upload-artifact@v3
        with:
          name: kubearmor.logs
          path: |
            /tmp/kubearmor/
            /tmp/kubearmor.*

      - name: Measure code coverage
        if: ${{ always() }}
        run: |
          go install github.com/modocache/gover@latest
          gover
          go tool cover -func=gover.coverprofile
        working-directory: KubeArmor
        env:
          GOPATH: /home/runner/go

      - uses: codecov/codecov-action@v3
        if: ${{ always() }}
        with:
          files: ./KubeArmor/gover.coverprofile