e2e-aks.yml

name: e2e-aks

permissions:
  contents: read

on:
  workflow_call:
    inputs:
      k8s_version:
        description: "Kubernetes version"
        required: true
        default: "1.30.6"
        type: string
      gatekeeper_version:
        description: "Gatekeeper version"
        required: true
        default: "3.17.0"
        type: string

jobs:
  build_test_aks_e2e:
    name: "Build and run e2e Test on AKS"
    runs-on: ubuntu-latest
    timeout-minutes: 30
    environment: azure-test
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
        with:
          egress-policy: audit

      - name: Check out code into the Go module directory
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Set up Go 1.22
        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: "1.22"
      - name: Az CLI login
        uses: azure/login@a65d910e8af852a8061c627c456678983e180302 # v2.2.0
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      - name: Cache AAD tokens
        run: |
          az version
          # Key Vault: 
          az account get-access-token --scope https://vault.azure.net/.default --output none
          # Container Registry:
          az account get-access-token --scope https://containerregistry.azure.net/.default --output none

      - name: Restore Trivy cache
        uses: ./.github/actions/restore_trivy_cache

      - name: Dependencies e2e
        run: |
          mkdir -p $GITHUB_WORKSPACE/bin
          echo "$GITHUB_WORKSPACE/bin" >> $GITHUB_PATH
          make e2e-docker-credential-store-setup
          make e2e-dependencies

      - name: Run e2e on Azure
        run: |
          make e2e-aks KUBERNETES_VERSION=${{ inputs.k8s_version }} GATEKEEPER_VERSION=${{ inputs.gatekeeper_version }} TENANT_ID=${{ secrets.AZURE_TENANT_ID }} AZURE_SP_OBJECT_ID=${{ secrets.AZURE_SP_OBJECT_ID }}

      - name: Upload artifacts
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        if: ${{ always() }}
        with:
          name: e2e-logs-aks-${{ inputs.k8s_version }}-${{ inputs.gatekeeper_version }}
          path: |
            logs-*.json