-
Notifications
You must be signed in to change notification settings - Fork 81
243 lines (238 loc) · 10.9 KB
/
on-safe-to-test-label.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
name: testing
# Controls when the workflow will run
on:
# Triggers the workflow on push or pull request events but only for the main branch
pull_request_target:
types: [ labeled ]
# Allows you to run this workflow manually from the Actions tab
workflow_dispatch:
jobs:
start-runner:
if: ${{ (contains(github.event.pull_request.labels.*.name, 'safe to test') && !contains(github.event.pull_request.labels.*.name, 'lgtm')) || (contains(github.event_name, 'workflow_dispatch')) }}
runs-on: ubuntu-latest
outputs:
label: ${{ steps.start-ec2-runner.outputs.label }}
ec2-instance-id: ${{ steps.start-ec2-runner.outputs.ec2-instance-id }}
permissions:
id-token: write
contents: read
steps:
- name: Setup AWS Credentials
uses: aws-actions/configure-aws-credentials@master
with:
role-to-assume: arn:aws:iam::783680406432:role/GithubActionsTestingRole-test-us-east-1
aws-region: us-east-1
- name: Configure EC2 Runner Parameters
run: |
AWS_REGION=us-east-1
VPC_ID=$(aws ec2 describe-vpcs --filters 'Name=tag-key,Values=GithubActionsTesting' --query 'Vpcs[0].VpcId' --output text)
SUBNET_ID=$(aws ec2 describe-subnets --filters "Name=vpc-id,Values=$VPC_ID" "Name=tag-key,Values=GithubActionsTesting" --query 'Subnets[0].SubnetId' --output text)
SG_ID=$(aws ec2 describe-security-groups --filters "Name=vpc-id,Values=$VPC_ID" "Name=tag-key,Values=GithubActionsTesting" --query 'SecurityGroups[0].GroupId' --output text)
AMI=$(aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2 --query 'Parameter.Value' --output text)
echo AWS_REGION=$AWS_REGION >> $GITHUB_ENV
echo SUBNET_ID=$SUBNET_ID >> $GITHUB_ENV
echo SG_ID=$SG_ID >> $GITHUB_ENV
echo AMI=$AMI >> $GITHUB_ENV
- name: Start EC2 runner
id: start-ec2-runner
uses: divyansh-gupta/ec2-github-runner@82c9d554a7e7946be1b2003eaac45af59c9f78fd
with:
mode: start
github-token: GithubToken-test-us-east-1
ec2-image-id: ${{ env.AMI }}
ec2-instance-type: t3.medium
subnet-id: ${{ env.SUBNET_ID }}
security-group-id: ${{ env.SG_ID }}
iam-role-name: K8sPluginInstanceProfile-test-us-east-1
ec2-launch-template: GithubRunnerLaunchTemplate-test-us-east-1
aws-resource-tags: >
[
{"Key": "Name", "Value": "ec2-github-runner"},
{"Key": "GitHubRepository", "Value": "${{ github.repository }}"}
]
do-the-job:
if: ${{ (contains(github.event.pull_request.labels.*.name, 'safe to test') && !contains(github.event.pull_request.labels.*.name, 'lgtm')) || (contains(github.event_name, 'workflow_dispatch')) }}
name: Do the job on the runner
needs: start-runner # required to start the main job when the runner is ready
runs-on: ${{ needs.start-runner.outputs.label }} # run the job on the newly created runner
steps:
- name: Install Git
run: sudo yum install git -y
- name: Check out code into the Go module directory
uses: actions/checkout@v3
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.head.ref }}
repository: ${{ github.event.pull_request.head.repo.full_name }}
- name: Install Development Tools
run: |
sudo yum groupinstall "Development Tools" -y
- name: Install Go
run: |
mkdir /home/ec2-user/.cache
mkdir /home/ec2-user/.cache/go-build
mkdir /home/ec2-user/.cache/go-mod
mkdir /home/ec2-user/go
mkdir /home/ec2-user/go/bin
GOVERSION=go1.21.4
wget https://go.dev/dl/$GOVERSION.linux-amd64.tar.gz
sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf $GOVERSION.linux-amd64.tar.gz
PATH="$PATH:/usr/local/go/bin"
GOPATH="/home/ec2-user/go"
GOBIN="/home/ec2-user/go/bin"
GOCACHE="/home/ec2-user/.cache/go-build"
GOMODCACHE="/home/ec2-user/.cache/go-mod"
echo GOPATH=$GOPATH >> $GITHUB_ENV
echo GOBIN=$GOBIN >> $GITHUB_ENV
echo GOCACHE=$GOCACHE >> $GITHUB_ENV
echo GOMODCACHE=$GOMODCACHE >> $GITHUB_ENV
echo PATH=$PATH >> $GITHUB_ENV
- name: Setup Cache variables
id: go-cache-paths
shell: bash
run: |
echo "go-build=${{ env.GOCACHE }}" >> $GITHUB_OUTPUT
echo "go-mod=${{ env.GOMODCACHE }}" >> $GITHUB_OUTPUT
- name: Go-Build Cache # Cache go build cache, used to speedup go test
uses: actions/cache@v3
with:
path: ${{ steps.go-cache-paths.outputs.go-build }}
key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}
- name: Go-Mod Cache # Cache go mod cache, used to speedup builds
uses: actions/cache@v3
with:
path: ${{ steps.go-cache-paths.outputs.go-mod }}
key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}
- name: Install Docker
run: |
sudo amazon-linux-extras install docker -y
sudo service docker start
- name: Install AWS CLI v2
run: |
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install
- name: Install kubectl
run: |
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
- name: Install Jq
run: |
sudo yum install jq -y
- name: Install Helm
run: |
curl -sSL https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
- name: Setup test environment
run: |
export PLUGIN_USER_NAME_OVERRIDE=K8sPluginUser-test-us-east-1
export PLUGIN_CROSS_ACCOUNT_ROLE=arn:aws:iam::874411242420:role/CrossAccountTestingRole-crossaccount-us-east-1
export HOME=$GITHUB_WORKSPACE
echo PLUGIN_USER_NAME_OVERRIDE=$PLUGIN_USER_NAME_OVERRIDE >> $GITHUB_ENV
echo PLUGIN_CROSS_ACCOUNT_ROLE=$PLUGIN_CROSS_ACCOUNT_ROLE >> $GITHUB_ENV
echo HOME=$HOME >> $GITHUB_ENV
- name: Run test cases with EC2 Instance Profiles and K8s Secret
run: |
make cluster
make e2etest
- name: Copy Kind logs to S3
if: ${{ always() }}
run: |
mkdir logs
export E2E_ARTIFACTS_DIRECTORY=logs
make kind-export-logs
aws s3 cp --recursive logs s3://aws-privateca-issuer-k8s-logs-test-us-east-1/${{ needs.start-runner.outputs.ec2-instance-id }}/
- name: Terminate Kind cluster and setup for next test
if: ${{ always() }}
run: |
make kind-cluster-delete
export OIDC_IAM_ROLE=arn:aws:iam::783680406432:role/IrsaTestingRole-test-us-east-1
export OIDC_S3_BUCKET_NAME=aws-privateca-issuer-irsa-test-us-east-1
echo OIDC_IAM_ROLE=$OIDC_IAM_ROLE >> $GITHUB_ENV
echo OIDC_S3_BUCKET_NAME=$OIDC_S3_BUCKET_NAME >> $GITHUB_ENV
- name: Run test cases with IRSA and K8s Secret
if: ${{ always() }}
run: |
make cluster
make install-eks-webhook
make e2etest
- name: Copy Kind logs to S3
if: ${{ always() }}
run: |
mkdir logs-irsa
export E2E_ARTIFACTS_DIRECTORY=logs-irsa
make kind-export-logs
aws s3 cp --recursive logs-irsa s3://aws-privateca-issuer-k8s-logs-test-us-east-1/${{ needs.start-runner.outputs.ec2-instance-id }}-irsa/
- name: Terminate Kind cluster
if: ${{ always() }}
run: |
make kind-cluster-delete
- name: Run helm test
if: ${{ !contains(github.event.pull_request.labels.*.name, 'chart update') }}
run: |
make helm-test
- name: Copy Kind logs to S3
if: ${{ !contains(github.event.pull_request.labels.*.name, 'chart update') }}
run: |
mkdir logs-helm-test
export E2E_ARTIFACTS_DIRECTORY=logs-helm-test
make kind-export-logs
aws s3 cp --recursive logs-helm-test s3://aws-privateca-issuer-k8s-logs-test-us-east-1/${{ needs.start-runner.outputs.ec2-instance-id }}-logs-helm-test/
- name: Terminate Kind cluster
if: ${{ !contains(github.event.pull_request.labels.*.name, 'chart update') }}
run: |
make kind-cluster-delete
- name: Run Blog Test
run: |
make cluster
make install-eks-webhook
make blog-test
- name: Copy Kind logs to S3
if: ${{ always() }}
run: |
mkdir logs-blog
export E2E_ARTIFACTS_DIRECTORY=logs-blog
make kind-export-logs
aws s3 cp --recursive logs-blog s3://aws-privateca-issuer-k8s-logs-test-us-east-1/${{ needs.start-runner.outputs.ec2-instance-id }}-blog/
stop-runner:
name: Stop self-hosted EC2 runner
needs:
- start-runner # required to get output from the start-runner job
- do-the-job # required to wait when the main job is done
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
if: ${{ (contains(github.event.pull_request.labels.*.name, 'safe to test') && !contains(github.event.pull_request.labels.*.name, 'lgtm') && always()) || (contains(github.event_name, 'workflow_dispatch')) }} # required to stop the runner even if the error happened in the previous jobs
steps:
- name: Setup AWS Credentials
uses: aws-actions/configure-aws-credentials@master
with:
role-to-assume: arn:aws:iam::783680406432:role/GithubActionsTestingRole-test-us-east-1
aws-region: us-east-1
- name: Setup AWS Region
run: |
AWS_REGION=us-east-1
echo AWS_REGION=$AWS_REGION >> $GITHUB_ENV
- name: Stop EC2 runner
uses: divyansh-gupta/ec2-github-runner@82c9d554a7e7946be1b2003eaac45af59c9f78fd
with:
mode: stop
github-token: GithubToken-test-us-east-1
label: ${{ needs.start-runner.outputs.label }}
ec2-instance-id: ${{ needs.start-runner.outputs.ec2-instance-id }}
remove-safe-to-test:
name: Remove Safe to Test Label
needs:
- stop-runner
runs-on: ubuntu-latest
if: ${{ contains(github.event.pull_request.labels.*.name, 'safe to test') && !contains(github.event.pull_request.labels.*.name, 'lgtm') && always() }} # required to stop the runner even if the error happened in the previous jobs
steps:
- name: Remove Label
uses: divyansh-gupta/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0
with:
labels:
'safe to test'
#We want to make this false because if we run into some edge case
#we don't want to fail out. Worst case
#the label stays and we remove/re-add.
fail_on_error: 'false'