generated from oracle/template-repo
-
Notifications
You must be signed in to change notification settings - Fork 11
292 lines (246 loc) · 12 KB
/
e2e-tests.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
name: E2E Tests
on:
pull_request: {}
# workflow_run:
# workflows: ["BuildnPush"]
# types:
# - completed
concurrency: dev_environment
env:
OCI_CLI_USER: ${{ secrets.OCI_CLI_USER }}
OCI_CLI_TENANCY: ${{ secrets.OCI_CLI_TENANCY }}
OCI_CLI_FINGERPRINT: ${{ secrets.OCI_CLI_FINGERPRINT }}
OCI_CLI_KEY_CONTENT: ${{ secrets.OCI_CLI_KEY_CONTENT }}
OCI_CLI_REGION: ${{ secrets.OCI_CLI_REGION }}
# OCI_CLUSTER_ID: ${{ vars.CLUSTER_ID }}
# OCI_VAULT_ID: ${{ vars.VAULT_ID }}
OCI_VAULT_SECRET_VALUE: ${{ vars.VAULT_SECRET_VALUE }}
# OCI_DEBUG: "--debug"
jobs:
build:
uses: ./.github/workflows/build-n-push.yaml
with:
IMAGE_REGISTRY: ${{ vars.IMAGE_REGISTRY }}
secrets: inherit
setup-vault:
runs-on: ubuntu-latest
name: Setup Vault and secrets
needs: [ build ]
env:
OCI_VAULT_ID: ${{ vars.VAULT_ID }}
OCI_VAULT_KEY_ID: ${{ vars.VAULT_KEY_ID }}
outputs:
OCI_VAULT_ID: ${{ env.OCI_VAULT_ID }}
OCI_VAULT_KEY_ID: ${{ env.OCI_VAULT_KEY_ID }}
VAULT_SECRET_NAME: ${{ vars.SECRET_NAME_PREFIX }}-${{ env.OCI_RANDOM }}
VAULT_SECRET_OCID: ${{ steps.extract-secret-ocid.outputs.VAULT_SECRET_OCID }}
steps:
- name: create env with random
id: gen-random
run: echo "OCI_RANDOM=${RANDOM}" >> $GITHUB_ENV
- name: Create vault if doesn't exist
if: ${{ vars.USE_EXISTING_VAULT != 'true' }}
uses: oracle-actions/[email protected]
id: create-vault
with:
silent: false
command: "kms management vault create --compartment-id ${{ vars.COMPARTMENT_ID }} --display-name ${{ vars.VAULT_NAME_PREFIX }}-${{ env.OCI_RANDOM }} --vault-type default"
query: "data.id"
- name: get vault from previous output
if: ${{ vars.USE_EXISTING_VAULT != 'true' }}
run: echo "OCI_VAULT_ID=${{ steps.create-vault.outputs.raw_output }}" >> $GITHUB_ENV
- name: create key if doesn't exist
if: ${{ vars.USE_EXISTING_VAULT != 'true' }}
uses: oracle-actions/[email protected]
id: create-vault-key
with:
silent: false
command: "kms management key create --endpoint ${{ vars.VAULT_MGMT_ENDPOINT }} --compartment-id ${{ vars.COMPARTMENT_ID }} --display-name key-${RANDOM} --key-shape '{ \"algorithm\" : \"AES\", \"length\" : 32 }'"
query: "data.id"
- name: create env for key id from create-vault-key output
if: ${{ vars.USE_EXISTING_VAULT != 'true' }}
run: echo "OCI_VAULT_KEY_ID=${{ steps.create-vault-key.outputs.raw_output }}" >> $GITHUB_ENV
- name: create secret in vault
uses: oracle-actions/[email protected]
id: create-secret
with:
silent: false
command: vault secret create-base64 --compartment-id ${{ vars.COMPARTMENT_ID }} --vault-id ${{ env.OCI_VAULT_ID }} --key-id ${{ env.OCI_VAULT_KEY_ID }} --secret-name ${{ vars.SECRET_NAME_PREFIX }}-${{ env.OCI_RANDOM }} --secret-content-content ${{ env.OCI_VAULT_SECRET_VALUE }}"
# query: "data.id"
- name: extract secret id
id: extract-secret-ocid
run: echo VAULT_SECRET_OCID=`echo ${{ steps.create-secret.outputs.output }} | jq -r ".data.id"` >> $GITHUB_OUTPUT
setup-cluster:
runs-on: ubuntu-latest
name: Setup Cluster
needs: [ build ]
env:
OCI_CLUSTER_ID: ${{ vars.CLUSTER_ID }}
outputs:
OCI_CLUSTER_ID: ${{ steps.print-cluster-id.outputs.clusterId }}
steps:
# - name: create vcn if doesn't exist
# - name: get vcn id from previous output or existing var
# - name: create cluster
# if: ${{ vars.USE_EXISTING_CLUSTER != 'true' }}
# uses: oracle-actions/[email protected]
# id: create-cluster
# with:
# silent: false
# command: "ce cluster create --compartment-id ${{ vars.COMPARTMENT_ID }}
# --vcn-id ${{ vars.VCN_ID }} --kubernetes-version ${{ vars.K8S_VERSION }}
# --wait-for-state succeeded"
# query: "data.secret-name"
# - name: create env for key id from create-vault-key output
# if: ${{ vars.USE_EXISTING_CLUSTER != 'true' }}
# run: echo "OCI_CLUSTER_ID=${{ steps.create-cluster.outputs.raw_output }}" >> $GITHUB_ENV
# - name: create nodepool
# if: ${{ vars.USE_EXISTING_CLUSTER != 'true' }}
# - name: get kubeconfig
# uses: oracle-actions/[email protected]
# id: get-kube-config
# with:
# silent: false
# command: "ce cluster create-kubeconfig --cluster-id ${{ env.OCI_CLUSTER_ID }} --file $HOME/.kube/config --region ${{ env.OCI_CLI_REGION }} --token-version 2.0.0 --kube-endpoint PUBLIC_ENDPOINT"
- name: print cluster id from vars
id: print-cluster-id
run: echo "clusterId=${{ env.OCI_CLUSTER_ID }}" >> $GITHUB_OUTPUT
deploy-provider:
runs-on: ubuntu-latest
name: Deploy Provider
needs: [ setup-vault , setup-cluster , build ]
env:
OCI_VAULT_ID: ${{ needs.setup-vault.outputs.OCI_VAULT_ID }}
OCI_VAULT_SECRET_NAME: ${{ needs.setup-vault.outputs.VAULT_SECRET_NAME }}
OCI_VAULT_SECRET_OCID: ${{ needs.setup-vault.outputs.VAULT_SECRET_OCID }}
OCI_VAULT_SECRET_OCID_1: ${{ needs.setup-vault.outputs.VAULT_SECRET_OCID_1 }}
OCI_CLUSTER_ID: ${{ needs.setup-cluster.outputs.OCI_CLUSTER_ID }}
PROVIDER_NAMESPACE: ${{ vars.PROVIDER_NAMESPACE }}
IMAGE_PATH : ${{ needs.build.outputs.IMAGE_PATH }}
outputs:
OCI_VAULT_SECRET_NAME: ${{ needs.setup-vault.outputs.VAULT_SECRET_NAME }}
OCI_VAULT_SECRET_OCID: ${{ needs.setup-vault.outputs.VAULT_SECRET_OCID }}
OCI_CLUSTER_ID: ${{ needs.setup-cluster.outputs.OCI_CLUSTER_ID }}
steps:
- name: Configure Kubectl
uses: oracle-actions/[email protected]
id: test-configure-kubectl-oke-action
with:
cluster: ${{ env.OCI_CLUSTER_ID }}
- name: test cluster access
run: kubectl get nodes -A
- name: create namespace in the cluster
continue-on-error: true
run: kubectl create namespace ${{ env.PROVIDER_NAMESPACE }}
# - name: Install Helm
# uses: azure/setup-helm@v3
- name: Checkout
uses: actions/checkout@v3
with:
fetch-depth: 0
- name: split image path into repo and tag
id: split-image-path
run: |
echo PROVIDER_IMAGE_REPO=`echo ${{ env.IMAGE_PATH }} | sed -e "s/:.*$//"` >> $GITHUB_OUTPUT
echo PROVIDER_IMAGE_TAG=`echo ${{ env.IMAGE_PATH }} | sed -e "s/.*://"` >> $GITHUB_OUTPUT
- name: print image values
run: |
echo ${{ steps.split-image-path.outputs.PROVIDER_IMAGE_REPO }}
echo ${{ steps.split-image-path.outputs.PROVIDER_IMAGE_TAG }}
- name: Deploy Helm chart
run: |
helm upgrade --install oci-provider charts/oci-secrets-store-csi-driver-provider \
--namespace ${{ env.PROVIDER_NAMESPACE }} \
--set "provider.image.repository=${{ steps.split-image-path.outputs.PROVIDER_IMAGE_REPO }},provider.image.tag=${{ steps.split-image-path.outputs.PROVIDER_IMAGE_TAG }}"
- name: list pods
run: |
kubectl get daemonset --namespace oci-provider \
--selector='app.kubernetes.io/name in (oci-secrets-store-csi-driver-provider, secrets-store-csi-driver)'
- name: update auth file with correct values
run: |
sed -e 's/region:.*/region: ${{ env.OCI_CLI_REGION }}/' \
-e 's/tenancy:.*/tenancy: ${{ env.OCI_CLI_TENANCY }}/' \
-e 's/user:.*/user: ${{ env.OCI_CLI_USER }}/' \
-e 's/fingerprint:.*/fingerprint: ${{ env.OCI_CLI_FINGERPRINT }}/' e2e/example/user-auth-config-example.yaml > e2e/example/user-auth-config-example.yaml.tmp
# - name: print updated yaml file
# run: cat e2e/example/user-auth-config-example.yaml.tmp
- name: delete secret if exists
continue-on-error: true
run: kubectl delete secret oci-config
- name: create kubernetes secret for user auth config
run: |
kubectl create secret generic oci-config \
--from-file=config=e2e/example/user-auth-config-example.yaml.tmp \
--from-literal=private-key="${{ env.OCI_CLI_KEY_CONTENT }}"
- name: update spc file with correct values
run: |
sed -e 's/vaultId:.*/vaultId: ${{ env.OCI_VAULT_ID }}/' \
-e 's/authType:.*/authType: user/' \
-e 's/- name:.*/- name: ${{ env.OCI_VAULT_SECRET_NAME }}/' e2e/example/secret-provider-class.yaml > e2e/example/secret-provider-class.yaml.tmp
- name: update deployment file with secret name
run: |
sed -e 's/testingSecretName:.*/testingSecretName: ${{ env.OCI_VAULT_SECRET_NAME }}/' \
e2e/example/app.deployment.yaml > e2e/example/app.deployment.yaml.tmp
- name: print updated yaml file
run: cat e2e/example/secret-provider-class.yaml.tmp
- name: deploy spc
run: kubectl apply -f e2e/example/secret-provider-class.yaml.tmp
- name: deploy workload
run: kubectl apply -f e2e/example/app.deployment.yaml.tmp
- name: Wait for pod to run
id: wait-on-pod
# run: kubectl wait --for=jsonpath='{.status.phase}'=Running pods/${{ env.POD_NAME }} --timeout=90s
run: sleep 90
- name: Verify pods are running
id: pod-names
run: kubectl get pods -l testingSecretName=${{ env.OCI_VAULT_SECRET_NAME }} -o='custom-columns=PodName:.metadata.name' --no-headers
- name: capture pod name into env
run: echo "POD_NAME=`kubectl get pods -l testingSecretName=${{ env.OCI_VAULT_SECRET_NAME }} -o='custom-columns=PodName:.metadata.name' --no-headers`" >> $GITHUB_ENV
- name: print secret value
id: print-secret-content
run: echo "SECRET_CONTENT=`kubectl exec -it ${{ env.POD_NAME }} -- cat /mnt/secrets-store/${{ env.OCI_VAULT_SECRET_NAME }} 2> /dev/null | base64`" >> $GITHUB_ENV
# - name: convert to base64
# id: convert-to-base64
# run: echo -n ${{ steps.print-secret-content.outputs.output }} | base64
- name: print values
run: echo "${{ env.SECRET_CONTENT }} == ${{ env.OCI_VAULT_SECRET_VALUE}}"
- name: verify value
run: if [ "${{ env.SECRET_CONTENT }}" == "${{ env.OCI_VAULT_SECRET_VALUE}}" ]; then exit 0; else exit 1; fi
# cleanup
- name: remove deployment
if: ${{ always() }}
run: |
kubectl delete -f e2e/example/app.deployment.yaml.tmp \
-f e2e/example/secret-provider-class.yaml.tmp
- name: delete secret
if: ${{ always() }}
run: kubectl delete secret oci-config
- name: uninstall provider
if: ${{ always() }}
run: helm uninstall oci-provider -n ${{ env.PROVIDER_NAMESPACE }}
cleanup:
runs-on: ubuntu-latest
needs: [deploy-provider]
name: Cleanup resources
env:
OCI_VAULT_SECRET_NAME: ${{ needs.deploy-provider.outputs.OCI_VAULT_SECRET_NAME }}
OCI_VAULT_SECRET_OCID: ${{ needs.deploy-provider.outputs.OCI_VAULT_SECRET_OCID }}
OCI_CLUSTER_ID: ${{ needs.deploy-provider.outputs.OCI_CLUSTER_ID }}
steps:
- name: delete cluster
if: ${{ vars.USE_EXISTING_CLUSTER != 'true' }}
uses: oracle-actions/[email protected]
with:
command: "ce cluster delete --cluster-id ${{ env.OCI_CLUSTER_ID }} --wait-for-state SUCCEEDED"
# - name: get secret id
# id: get-secret-ocid
# uses: oracle-actions/[email protected]
# with:
# command: "vault secret list --name ${{ env.OCI_VAULT_SECRET_NAME }} --compartment-id ${{ vars.COMPARTMENT_ID }}"
# query: data[0].id
- name: delete secrets
uses: oracle-actions/[email protected]
with:
command: "vault secret schedule-secret-deletion --secret-id ${{ env.OCI_VAULT_SECRET_OCID }}"
# - name: delete vcn if created
# - name: delete vault if created