fix(docker-compose): make cert validity periods overridable, fix token cert's silent 30-day default #805
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: KBS e2e Suite | |
| on: | |
| pull_request: | |
| branches: ["main"] | |
| # `labeled` lets the TDX Helm e2e leg trigger when the `tdx-e2e` label is added. | |
| types: [opened, synchronize, reopened, labeled] | |
| paths-ignore: | |
| - '**/*.md' | |
| workflow_dispatch: | |
| permissions: {} | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # Common checkout + source archive for all e2e jobs | |
| code-checkout: | |
| name: KBS - checkout & archive | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Archive source | |
| run: git archive -o kbs.tar.gz HEAD | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| path: ./kbs.tar.gz | |
| # Sample TEE e2e (reuses kbs-e2e template) | |
| sample-e2e-amd64: | |
| name: Sample TEE e2e (amd64) | |
| needs: code-checkout | |
| uses: ./.github/workflows/workflow-call-kbs-e2e.yml | |
| permissions: | |
| contents: read | |
| packages: write | |
| with: | |
| tee: sample | |
| tarball: kbs.tar.gz | |
| sample-e2e-arm64: | |
| name: Sample TEE e2e (arm64) | |
| needs: code-checkout | |
| uses: ./.github/workflows/workflow-call-kbs-e2e.yml | |
| permissions: | |
| contents: read | |
| packages: write | |
| with: | |
| tee: sample | |
| arch: aarch64 | |
| runs-on-build: '["ubuntu-22.04-arm"]' | |
| runs-on-test: '["ubuntu-22.04-arm"]' | |
| tarball: kbs.tar.gz | |
| kbs-client-features: "cca-attester" | |
| # Vault integration e2e | |
| vault-e2e-test: | |
| name: Vault e2e | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| env: | |
| OS_VERSION: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust toolchain | |
| uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | |
| with: | |
| rustflags: "" | |
| cache: false | |
| - name: Set up rust build cache | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| continue-on-error: false | |
| with: | |
| path: | | |
| ~/.cargo/registry/index/ | |
| ~/.cargo/registry/cache/ | |
| target/ | |
| key: rust-${{ runner.arch }}-${{ env.OS_VERSION }}-${{ hashFiles('./Cargo.lock') }} | |
| - name: Run KBS Vault integration e2e (no SSL + SSL) | |
| run: make test-kbs-vault-e2e | |
| # Docker Compose/Helm e2e materials (shared via workflow artifacts) | |
| build-docker-e2e-materials: | |
| name: Build Docker/Helm e2e materials | |
| uses: ./.github/workflows/workflow-call-build-docker-e2e-materials.yml | |
| permissions: | |
| contents: read | |
| # Docker Compose cluster e2e | |
| docker-e2e-test: | |
| name: Docker Compose e2e | |
| needs: build-docker-e2e-materials | |
| strategy: | |
| matrix: | |
| instance: | |
| - ubuntu-24.04 | |
| - ubuntu-24.04-arm | |
| include: | |
| - instance: ubuntu-24.04 | |
| platform_slug: linux-amd64 | |
| - instance: ubuntu-24.04-arm | |
| platform_slug: linux-arm64 | |
| runs-on: ${{ matrix.instance }} | |
| permissions: | |
| contents: read | |
| env: | |
| OS_VERSION: ${{ matrix.instance }} | |
| steps: | |
| - name: Checkout KBS | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Download pre-built images | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: docker-e2e-images-${{ matrix.platform_slug }} | |
| path: ${{ runner.temp }}/docker-e2e-images | |
| - name: Load images | |
| run: docker load --input "${{ runner.temp }}/docker-e2e-images/images.tar" | |
| - name: Install Rust toolchain | |
| uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | |
| with: | |
| rustflags: "" | |
| cache: false | |
| - name: Set up rust build cache | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| continue-on-error: false | |
| with: | |
| path: | | |
| ~/.cargo/registry/index/ | |
| ~/.cargo/registry/cache/ | |
| target/ | |
| key: rust-${{ runner.arch }}-${{ env.OS_VERSION }}-${{ hashFiles('./Cargo.lock') }} | |
| - name: Run KBS Docker Compose e2e | |
| env: | |
| SKIP_DOCKER_COMPOSE_BUILD: "1" | |
| run: make test-kbs-docker-e2e | |
| # External plugin e2e | |
| ext-plugin-e2e-test: | |
| name: External Plugin e2e | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| env: | |
| OS_VERSION: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust toolchain | |
| uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | |
| with: | |
| rustflags: "" | |
| cache: false | |
| - name: Set up rust build cache | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| continue-on-error: false | |
| with: | |
| path: | | |
| ~/.cargo/registry/index/ | |
| ~/.cargo/registry/cache/ | |
| target/ | |
| key: rust-${{ runner.arch }}-${{ env.OS_VERSION }}-${{ hashFiles('./Cargo.lock') }} | |
| - name: Install build dependencies | |
| run: sudo apt-get update && sudo apt-get install -y protobuf-compiler libprotobuf-dev libtss2-dev | |
| - name: Install TDX build dependencies | |
| run: | | |
| curl -L https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | sudo gpg --dearmor --output /usr/share/keyrings/intel-sgx.gpg | |
| echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/intel-sgx.gpg] https://download.01.org/intel-sgx/sgx_repo/ubuntu noble main' | sudo tee /etc/apt/sources.list.d/intel-sgx.list | |
| sudo apt-get update | |
| sudo apt-get install -y libsgx-dcap-quote-verify-dev | |
| - name: Run external plugin unit tests | |
| working-directory: kbs | |
| run: make check TEST_FEATURES="external-plugin" | |
| - name: Install e2e test dependencies | |
| working-directory: kbs/test | |
| run: make install-dev-dependencies | |
| - name: Run external plugin e2e tests | |
| working-directory: kbs/test | |
| run: make e2e-ext-plugin | |
| # Sample TEE Helm e2e on a GitHub-hosted runner (always runs). | |
| helm-trustee-e2e-amd64: | |
| name: Helm Trustee e2e (amd64) | |
| needs: build-docker-e2e-materials | |
| uses: ./.github/workflows/workflow-call-helm-e2e.yml | |
| permissions: | |
| contents: read | |
| with: | |
| leg: amd64 | |
| runs-on: '["ubuntu-24.04"]' | |
| client-artifact: helm-e2e-kbs-client-linux-amd64 | |
| self-hosted: false | |
| # Real TDX Helm e2e on a self-hosted runner. Only runs when the PR carries the | |
| # `tdx-e2e` label (or on manual dispatch), so unlabelled PRs never queue onto it. | |
| helm-trustee-e2e-tdx: | |
| name: Helm Trustee e2e (TDX) | |
| needs: build-docker-e2e-materials | |
| if: github.event_name == 'workflow_dispatch' || contains(github.event.pull_request.labels.*.name, 'tdx-e2e') | |
| uses: ./.github/workflows/workflow-call-helm-e2e.yml | |
| permissions: | |
| contents: read | |
| with: | |
| leg: tdx | |
| # Runner group hosting the TDX runner(s); add `labels` here to narrow further. | |
| runs-on: '{"group":"Intel TDX"}' | |
| client-artifact: helm-e2e-kbs-client-tdx-linux-amd64 | |
| self-hosted: true | |
| # Azure vTPM TEE e2e (manual trigger only) | |
| tdx-e2e-test: | |
| name: KBS e2e (Azure TDX vTPM) | |
| needs: code-checkout | |
| if: github.event_name == 'workflow_dispatch' | |
| uses: ./.github/workflows/workflow-call-kbs-e2e.yml | |
| permissions: | |
| packages: write | |
| contents: read | |
| with: | |
| runs-on-test: '["self-hosted","azure-cvm-tdx"]' | |
| tee: az-tdx-vtpm | |
| tarball: kbs.tar.gz | |
| kbs-client-features: az-tdx-vtpm-attester | |
| snp-e2e-test: | |
| name: KBS e2e (Azure SNP vTPM) | |
| needs: code-checkout | |
| if: github.event_name == 'workflow_dispatch' | |
| uses: ./.github/workflows/workflow-call-kbs-e2e.yml | |
| permissions: | |
| packages: write | |
| contents: read | |
| with: | |
| runs-on-test: '["self-hosted","azure-cvm"]' | |
| tee: az-snp-vtpm | |
| tarball: kbs.tar.gz | |
| kbs-client-features: az-snp-vtpm-attester |