Skip to content

Commit ab5ad03

Browse files
mladen-rusev-cyberarkmladen-rusev-cyberark
authored
Merge pull request #716 from jetstack/VC-35565-automate-e2e-testsh
[VC-35565] Automate the e2e script to run in CI
2 parents 2d571e0 + 0c03b62 commit ab5ad03

File tree

6 files changed

+128
-5
lines changed

6 files changed

+128
-5
lines changed

‎.github/workflows/tests.yaml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,3 +63,76 @@ jobs:
6363
key: downloaded-${{ runner.os }}-${{ hashFiles('klone.yaml') }}-test-unit
6464

6565
- run: make -j test-unit test-helm
66+
67+
test-e2e:
68+
if: contains(github.event.pull_request.labels.*.name, 'test-e2e')
69+
runs-on: ubuntu-latest
70+
steps:
71+
- uses: actions/checkout@v4
72+
with:
73+
fetch-depth: 0
74+
75+
- uses: ./.github/actions/repo_access
76+
with:
77+
DEPLOY_KEY_READ_VENAFI_CONNECTION_LIB: ${{ secrets.DEPLOY_KEY_READ_VENAFI_CONNECTION_LIB }}
78+
79+
- name: Authenticate to Google Cloud
80+
id: auth
81+
uses: google-github-actions/auth@v2
82+
with:
83+
credentials_json: '${{ secrets.GCP_SA_KEY }}'
84+
85+
- name: Set up gcloud
86+
id: setup-gcloud
87+
uses: google-github-actions/setup-gcloud@v2
88+
with:
89+
install_components: "gke-gcloud-auth-plugin"
90+
project_id: machineidentitysecurity-jsci-e
91+
92+
- name: Configure Docker for Google Artifact Registry
93+
run: gcloud auth configure-docker europe-west1-docker.pkg.dev
94+
95+
- id: go-version
96+
run: |
97+
make print-go-version >> "$GITHUB_OUTPUT"
98+
99+
- uses: actions/setup-go@v5
100+
with:
101+
go-version: ${{ steps.go-version.outputs.result }}
102+
103+
- name: Generate timestamp for cluster name
104+
id: timestamp # Give the step an ID to reference its output
105+
run: |
106+
# Generate a timestamp in the format YYMMDD-HHMMSS.
107+
# Extracting from PR name would require sanitization due to GKE cluster naming constraints
108+
TIMESTAMP=$(date +'%y%m%d-%H%M%S')
109+
CLUSTER_NAME="test-secretless-${TIMESTAMP}"
110+
echo "Generated cluster name: ${CLUSTER_NAME}"
111+
echo "cluster_name=${CLUSTER_NAME}" >> $GITHUB_OUTPUT
112+
113+
- run: |
114+
make helm-plugins
115+
make -j test-e2e-gke
116+
# The VEN_API_KEY_PULL secret is set to my API key (Mladen) for glow.in.the.dark tenant.
117+
env:
118+
VEN_API_KEY: ${{ secrets.VEN_API_KEY_PULL }}
119+
VEN_API_KEY_PULL: ${{ secrets.VEN_API_KEY_PULL }}
120+
OCI_BASE: europe-west1-docker.pkg.dev/machineidentitysecurity-jsci-e/js-agent-ci-repo
121+
VEN_API_HOST: api.venafi.cloud
122+
VEN_ZONE: k8s-agent-CI\Default
123+
VEN_VCP_REGION: us
124+
CLOUDSDK_CORE_PROJECT: machineidentitysecurity-jsci-e
125+
CLOUDSDK_COMPUTE_ZONE: europe-west1-b
126+
CLUSTER_NAME: ${{ steps.timestamp.outputs.cluster_name }}
127+
128+
- name: Delete GKE Cluster
129+
# 'always()' - Run this step regardless of success or failure.
130+
# '!contains(...)' - AND only run if the list of PR labels DOES NOT contain 'keep-e2e-cluster'.
131+
# NOTE: You will have to delete the test cluster manually when finished with debugging or incur costs.
132+
if: always() && !contains(github.event.pull_request.labels.*.name, 'keep-e2e-cluster')
133+
run: |
134+
echo "Label 'keep-e2e-cluster' not found. Cleaning up GKE cluster ${{ steps.timestamp.outputs.cluster_name }}"
135+
gcloud container clusters delete ${{ steps.timestamp.outputs.cluster_name }} \
136+
--project=machineidentitysecurity-jsci-e \
137+
--zone=europe-west1-b \
138+
--quiet

‎README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,3 +56,10 @@ The following metrics are collected:
5656
- Go collector: via the [default registry](https://github.com/prometheus/client_golang/blob/34e02e282dc4a3cb55ca6441b489ec182e654d59/prometheus/registry.go#L60-L63) in Prometheus `client_golang`.
5757
- Process collector: via the [default registry](https://github.com/prometheus/client_golang/blob/34e02e282dc4a3cb55ca6441b489ec182e654d59/prometheus/registry.go#L60-L63) in Prometheus `client_golang`.
5858
- Agent metrics: `data_readings_upload_size`: Data readings upload size (in bytes) sent by the in-cluster agent.
59+
60+
## End to end testing
61+
62+
An end to end test script is available in the [./hack/e2e/test.sh](./hack/e2e/test.sh) directory. It is configured to run in CI
63+
in the tests.yaml GitHub Actions workflow. To run the script you will need to add the `test-e2e` label to the PR.
64+
The script creates a cluster in GKE and cleanups after itself unless the `keep-e2e-cluster` label is set on the PR. Adding that
65+
label will leave the cluster running for further debugging but it will incur costs so manually delete the cluster when done.

‎hack/e2e/test.sh‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@
2626
set -o nounset
2727
set -o errexit
2828
set -o pipefail
29-
set -o xtrace
29+
# Commenting out for CI, uncomment for local debugging
30+
#set -o xtrace
3031

3132
script_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)
3233
root_dir=$(cd "${script_dir}/../.." && pwd)
@@ -87,9 +88,9 @@ kubectl create ns venafi || true
8788
# workload identity service account as it doesn't matter.
8889
if ! kubectl get secret venafi-image-pull-secret -n venafi; then
8990
venctl iam service-accounts registry create \
90-
--api-key "${VEN_API_KEY_PULL}" \
91+
--api-key $VEN_API_KEY_PULL \
9192
--no-prompts \
92-
--owning-team "$(curl --fail-with-body -sS "https://${VEN_API_HOST}/v1/teams" -H "tppl-api-key: $VEN_API_KEY_PULL" | jq '.teams[0].id' -r)" \
93+
--owning-team "$(curl --fail-with-body -sS "https://${VEN_API_HOST}/v1/teams" -H "tppl-api-key: ${VEN_API_KEY_PULL}" | jq '.teams[0].id' -r)" \
9394
--name "venafi-kubernetes-agent-e2e-registry-${RANDOM}" \
9495
--scopes enterprise-cert-manager,enterprise-venafi-issuer,enterprise-approver-policy \
9596
| jq '{

‎hack/e2e/values.venafi-kubernetes-agent.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,4 @@ authentication:
1010

1111
extraArgs:
1212
- --logging-format=json
13-
- --log-level=6
13+
- --log-level=4

‎make/02_mod.mk‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
include make/test-unit.mk
22
include make/ark/02_mod.mk
3+
include make/extra_tools.mk
34

45
GITHUB_OUTPUT ?= /dev/stderr
56
.PHONY: release
@@ -51,7 +52,7 @@ shared_generate_targets += generate-crds-venconn
5152
## Wait for it to log a message indicating successful data upload.
5253
## See `hack/e2e/test.sh` for the full test script.
5354
## @category Testing
54-
test-e2e-gke:
55+
test-e2e-gke: | $(NEEDS_HELM) $(NEEDS_STEP) $(NEEDS_VENCTL)
5556
./hack/e2e/test.sh
5657

5758
.PHONY: test-helm
@@ -66,6 +67,15 @@ test-helm: | $(NEEDS_HELM-UNITTEST)
6667
test-helm-snapshot: | $(NEEDS_HELM-UNITTEST)
6768
$(HELM-UNITTEST) ./deploy/charts/venafi-kubernetes-agent/ -u
6869

70+
.PHONY: helm-plugins
71+
## Install required helm plugins
72+
helm-plugins: $(NEEDS_HELM)
73+
@if ! $(HELM) plugin list | grep -q diff; then \
74+
echo ">>> Installing helm-diff plugin"; \
75+
$(HELM) plugin install https://github.com/databus23/helm-diff; \
76+
else \
77+
echo "helm-diff plugin already installed"; \
78+
fi
6979

7080
.PHONY: verify-govulncheck
7181
## Verify all Go modules for vulnerabilities using govulncheck Copied from makefile-modules

‎make/extra_tools.mk‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,35 @@ ADDITIONAL_GO_DEPENDENCIES :=
44
# https://pkg.go.dev/github.com/helm-unittest/helm-unittest?tab=versions
55
ADDITIONAL_TOOLS += helm-unittest=v0.8.2
66
ADDITIONAL_GO_DEPENDENCIES += helm-unittest=github.com/helm-unittest/helm-unittest/cmd/helm-unittest
7+
8+
ADDITIONAL_TOOLS += venctl=1.16.0
9+
ADDITIONAL_TOOLS += step=0.28.2
10+
11+
# https://docs.venafi.cloud/vaas/venctl/c-venctl-releases/
12+
venctl_linux_amd64_SHA256SUM=26e7b7a7e134f1cf1f3ffacf4ae53ec6849058db5007ce4088d51f404ededb4a
13+
venctl_darwin_amd64_SHA256SUM=2e76693901abcb2c018f66d3a10558c66ca09d1a3be912258bcd6c58e89aae80
14+
venctl_darwin_arm64_SHA256SUM=4350912d67683773302655e2a0151320514d1ccf82ee99c895e6780f86b6f031
15+
16+
.PRECIOUS: $(DOWNLOAD_DIR)/tools/venctl@$(VENCTL_VERSION)_$(HOST_OS)_$(HOST_ARCH)
17+
$(DOWNLOAD_DIR)/tools/venctl@$(VENCTL_VERSION)_$(HOST_OS)_$(HOST_ARCH): | $(DOWNLOAD_DIR)/tools
18+
@source $(lock_script) $@; \
19+
$(CURL) https://dl.venafi.cloud/venctl/$(VENCTL_VERSION)/venctl-$(HOST_OS)-$(HOST_ARCH).zip -o $(outfile).zip; \
20+
$(checkhash_script) $(outfile).zip $(venctl_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM); \
21+
unzip -p $(outfile).zip venctl > $(outfile); \
22+
chmod +x $(outfile); \
23+
rm -f $(outfile).zip
24+
25+
# https://github.com/smallstep/cli/releases/
26+
step_linux_amd64_SHA256SUM=2908f3c7d90181eec430070b231da5c0861e37537bf8e2388d031d3bd6c7b8c6
27+
step_linux_arm64_SHA256SUM=96636a6cc980d53a98c72aa3b99e04f0b874a733d9ddf43fc6b0f1725f425c37
28+
step_darwin_amd64_SHA256SUM=f6e9a9078cfc5f559c8213e023df6e8ebf8d9d36ffbd82749a41ee1c40a23623
29+
step_darwin_arm64_SHA256SUM=b856702ee138a9badbe983e88758c0330907ea4f97e429000334ba038597db5b
30+
31+
.PRECIOUS: $(DOWNLOAD_DIR)/tools/step@$(STEP_VERSION)_$(HOST_OS)_$(HOST_ARCH)
32+
$(DOWNLOAD_DIR)/tools/step@$(STEP_VERSION)_$(HOST_OS)_$(HOST_ARCH): | $(DOWNLOAD_DIR)/tools
33+
@source $(lock_script) $@; \
34+
$(CURL) https://dl.smallstep.com/gh-release/cli/gh-release-header/v$(STEP_VERSION)/step_$(HOST_OS)_$(STEP_VERSION)_$(HOST_ARCH).tar.gz -o $(outfile).tar.gz; \
35+
$(checkhash_script) $(outfile).tar.gz $(step_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM); \
36+
tar xfO $(outfile).tar.gz step_$(STEP_VERSION)/bin/step > $(outfile); \
37+
chmod +x $(outfile); \
38+
rm -f $(outfile).tar.gz

0 commit comments

Comments
 (0)