forked from kubearmor/KubeArmor
-
Notifications
You must be signed in to change notification settings - Fork 0
126 lines (110 loc) · 4.39 KB
/
ci-test-ginkgo-k0s.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
name: ci-test-k0s
on:
push:
branches: [k0s-tests]
paths:
- "KubeArmor/**"
- "tests/**"
- "protobuf/**"
- ".github/workflows/ci-test-ginkgo-k0s.yml"
- "pkg/KubeArmorOperator/**"
- "deployments/helm/**"
release:
types: [published]
schedule:
- cron: '0 0 * * 0' # Weekly on Sunday at midnight
# Declare default permissions as read only.
permissions: read-all
jobs:
k0s-test:
name: K0s Auto-testing Framework / ${{ matrix.os }} / ${{ matrix.runtime }}
runs-on: ${{ matrix.os }}
env:
RUNTIME: ${{ matrix.runtime }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-20.04]
runtime: ["containerd", "crio"]
steps:
- uses: actions/checkout@v3
with:
submodules: true
- uses: actions/setup-go@v5
with:
go-version-file: 'KubeArmor/go.mod'
- name: Install the latest LLVM toolchain
run: ./.github/workflows/install-llvm.sh
- name: Compile libbpf
run: ./.github/workflows/install-libbpf.sh
- name: Setup a k0s Kubernetes environment
run: ./.github/workflows/install-k0s.sh
- name: Generate KubeArmor artifacts
run: |
GITHUB_SHA=$GITHUB_SHA ./KubeArmor/build/build_kubearmor.sh
- name: Build Kubearmor-Operator
working-directory: pkg/KubeArmorOperator
run: |
make docker-build
- name: deploy pre existing pod
run: |
kubectl apply -f ./tests/k8s_env/ksp/pre-run-pod.yaml
sleep 60
kubectl get pods -A
- name: Run KubeArmor
run: |
if [ ${{ matrix.runtime }} == "containerd" ]; then
docker save kubearmor/kubearmor-init:latest | sudo k0s ctr images import -
docker save kubearmor/kubearmor:latest | sudo k0s ctr images import -
docker save kubearmor/kubearmor-operator:latest | sudo k0s ctr images import -
docker save kubearmor/kubearmor-snitch:latest | sudo k0s ctr images import -
else
if [ ${{ matrix.runtime }} == "crio" ]; then
sudo podman pull docker-daemon:kubearmor/kubearmor-init:latest
sudo podman pull docker-daemon:kubearmor/kubearmor:latest
sudo podman pull docker-daemon:kubearmor/kubearmor-operator:latest
sudo podman pull docker-daemon:kubearmor/kubearmor-snitch:latest
fi
fi
helm upgrade --install kubearmor-operator ./deployments/helm/KubeArmorOperator -n kubearmor --create-namespace --set kubearmorOperator.image.tag=latest
kubectl wait --for=condition=ready --timeout=5m -n kubearmor pod -l kubearmor-app=kubearmor-operator
kubectl get pods -A
kubectl apply -f pkg/KubeArmorOperator/config/samples/kubearmor-test.yaml
kubectl wait -n kubearmor --timeout=5m --for=jsonpath='{.status.phase}'=Running kubearmorconfigs/kubearmorconfig-test
kubectl wait --timeout=7m --for=condition=ready pod -l kubearmor-app,kubearmor-app!=kubearmor-snitch,kubearmor-app!=kubearmor-controller -n kubearmor
kubectl wait --timeout=1m --for=condition=ready pod -l kubearmor-app=kubearmor-controller -n kubearmor
kubectl get pods -A
- name: Test KubeArmor using Ginkgo
run: |
go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo
go mod tidy
ginkgo --vv --flake-attempts=10 --timeout=10m smoke/
working-directory: ./tests/k8s_env
timeout-minutes: 10
- name: Get karmor sysdump
if: ${{ failure() }}
run: |
kubectl describe pod -n kubearmor -l kubearmor-app=kubearmor
curl -sfL http://get.kubearmor.io/ | sudo sh -s -- -b /usr/local/bin
mkdir -p /tmp/kubearmor/ && cd /tmp/kubearmor && karmor sysdump
- name: Archive log artifacts
if: ${{ failure() }}
uses: actions/upload-artifact@v3
with:
name: kubearmor.logs
path: |
/tmp/kubearmor/
/tmp/kubearmor.*
- name: Measure code coverage
if: ${{ always() }}
run: |
go install github.com/modocache/gover@latest
gover
go tool cover -func=gover.coverprofile
working-directory: KubeArmor
env:
GOPATH: /home/runner/go
- uses: codecov/codecov-action@v3
if: ${{ always() }}
with:
files: ./KubeArmor/gover.coverprofile