mirror of
https://github.com/external-secrets/external-secrets.git
synced 2024-12-14 11:57:59 +00:00
291 lines
9.9 KiB
YAML
291 lines
9.9 KiB
YAML
|
# Run secret-dependent e2e tests only after /ok-to-test approval
|
||
|
|
on:
|
||
|
|
pull_request:
|
||
|
|
repository_dispatch:
|
||
|
|
types: [ok-to-test-command]
|
||
|
|
|
||
|
|
env:
|
||
|
|
# Common versions
|
||
|
|
GO_VERSION: '1.17'
|
||
|
|
GOLANGCI_VERSION: 'v1.33'
|
||
|
|
DOCKER_BUILDX_VERSION: 'v0.4.2'
|
||
|
|
|
||
|
|
# Common users. We can't run a step 'if secrets.GHCR_USERNAME != ""' but we can run
|
||
|
|
# a step 'if env.GHCR_USERNAME' != ""', so we copy these to succinctly test whether
|
||
|
|
# credentials have been provided before trying to run steps that need them.
|
||
|
|
GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
|
||
|
|
GCP_SM_SA_JSON: ${{ secrets.GCP_SM_SA_JSON}}
|
||
|
|
GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID}}
|
||
|
|
TF_VAR_GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID}}
|
||
|
|
GCP_SM_SA_GKE_JSON: ${{ secrets.GCP_SM_SA_GKE_JSON}}
|
||
|
|
GCP_GKE_CLUSTER: test-cluster
|
||
|
|
GCP_GKE_ZONE: ${{ secrets.GCP_GKE_ZONE}}
|
||
|
|
GCP_GSA_NAME: ${{ secrets.GCP_GSA_NAME}} # Goolge Service Account
|
||
|
|
GCP_KSA_NAME: ${{ secrets.GCP_KSA_NAME}} # Kubernetes Service Account
|
||
|
|
TF_VAR_GCP_GSA_NAME: ${{ secrets.GCP_GSA_NAME}} # Goolge Service Account for tf
|
||
|
|
TF_VAR_GCP_KSA_NAME: ${{ secrets.GCP_KSA_NAME}} # Kubernetes Service Account for tf
|
||
|
|
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID}}
|
||
|
|
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET}}
|
||
|
|
TENANT_ID: ${{ secrets.TENANT_ID}}
|
||
|
|
VAULT_URL: ${{ secrets.VAULT_URL}}
|
||
|
|
IMAGE_REGISTRY: ghcr.io/external-secrets/external-secrets
|
||
|
|
E2E_IMAGE_REGISTRY: ghcr.io/external-secrets/external-secrets-e2e
|
||
|
|
E2E_VERSION: test
|
||
|
|
|
||
|
|
name: e2e tests
|
||
|
|
|
||
|
|
jobs:
|
||
|
|
# Branch-based pull request
|
||
|
|
integration-trusted-managed:
|
||
|
|
runs-on: ubuntu-latest
|
||
|
|
if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
|
||
|
|
steps:
|
||
|
|
|
||
|
|
- name: Branch based PR checkout
|
||
|
|
uses: actions/checkout@v2
|
||
|
|
|
||
|
|
# <insert integration tests needing secrets>
|
||
|
|
|
||
|
|
- name: Fetch History
|
||
|
|
run: git fetch --prune --unshallow
|
||
|
|
|
||
|
|
- name: Setup Go
|
||
|
|
uses: actions/setup-go@v2
|
||
|
|
with:
|
||
|
|
go-version: ${{ env.GO_VERSION }}
|
||
|
|
|
||
|
|
- name: Find the Go Cache
|
||
|
|
id: go
|
||
|
|
run: |
|
||
|
|
echo "::set-output name=build-cache::$(go env GOCACHE)"
|
||
|
|
echo "::set-output name=mod-cache::$(go env GOMODCACHE)"
|
||
|
|
|
||
|
|
- name: Cache the Go Build Cache
|
||
|
|
uses: actions/cache@v2.1.7
|
||
|
|
with:
|
||
|
|
path: ${{ steps.go.outputs.build-cache }}
|
||
|
|
key: ${{ runner.os }}-build-unit-tests-${{ hashFiles('**/go.sum') }}
|
||
|
|
restore-keys: ${{ runner.os }}-build-unit-tests-
|
||
|
|
|
||
|
|
- name: Cache Go Dependencies
|
||
|
|
uses: actions/cache@v2.1.7
|
||
|
|
with:
|
||
|
|
path: ${{ steps.go.outputs.mod-cache }}
|
||
|
|
key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }}
|
||
|
|
restore-keys: ${{ runner.os }}-pkg-
|
||
|
|
|
||
|
|
- name: Setup gcloud CLI
|
||
|
|
uses: google-github-actions/setup-gcloud@master
|
||
|
|
with:
|
||
|
|
service_account_key: ${{ env.GCP_SM_SA_GKE_JSON }}
|
||
|
|
project_id: ${{ env.GCP_PROJECT_ID }}
|
||
|
|
|
||
|
|
- name: Setup TFLint
|
||
|
|
uses: terraform-linters/setup-tflint@v1
|
||
|
|
with:
|
||
|
|
tflint_version: v0.28.0 # Must be specified. See: https://github.com/terraform-linters/tflint/releases for latest versions
|
||
|
|
|
||
|
|
- name: Run TFLint
|
||
|
|
run: find ${{ github.workspace }} | grep tf$ | xargs -n1 dirname | xargs -IXXX -n1 /bin/sh -c 'set -o errexit; cd XXX; pwd; tflint --loglevel=info .; cd - >/dev/null'
|
||
|
|
|
||
|
|
- name: Setup TF Gcloud Provider
|
||
|
|
run: |-
|
||
|
|
mkdir -p terraform/gcp/secrets
|
||
|
|
echo ${GCP_SM_SA_GKE_JSON} > terraform/gcp/secrets/gcloud-service-account-key.json
|
||
|
|
|
||
|
|
- name: Show TF GKE
|
||
|
|
run: |-
|
||
|
|
make tf.show.gcp
|
||
|
|
|
||
|
|
- name: Setup Infracost
|
||
|
|
uses: infracost/actions/setup@v1
|
||
|
|
with:
|
||
|
|
api-key: ${{ secrets.INFRACOST_API_KEY }}
|
||
|
|
|
||
|
|
- name: Generate Infracost JSON
|
||
|
|
run: infracost breakdown --path terraform/gcp/plan.json --format json --out-file /tmp/infracost.json
|
||
|
|
|
||
|
|
- name: Post Infracost comment
|
||
|
|
uses: infracost/actions/comment@v1
|
||
|
|
with:
|
||
|
|
path: /tmp/infracost.json
|
||
|
|
# Choose the commenting behavior, 'update' is a good default:
|
||
|
|
behavior: update # Create a single comment and update it. The "quietest" option.
|
||
|
|
# behavior: delete-and-new # Delete previous comments and create a new one.
|
||
|
|
# behavior: hide-and-new # Minimize previous comments and create a new one.
|
||
|
|
# behavior: new # Create a new cost estimate comment on every push.
|
||
|
|
|
||
|
|
- name: Apply TF GKE
|
||
|
|
run: |-
|
||
|
|
make tf.apply.gcp
|
||
|
|
|
||
|
|
- name: Get the GKE credentials
|
||
|
|
run: |-
|
||
|
|
gcloud container clusters get-credentials "$GCP_GKE_CLUSTER" --zone "$GCP_GKE_ZONE" --project "$GCP_PROJECT_ID"
|
||
|
|
|
||
|
|
- name: Login to Docker
|
||
|
|
uses: docker/login-action@v1
|
||
|
|
if: env.GHCR_USERNAME != ''
|
||
|
|
with:
|
||
|
|
registry: ghcr.io
|
||
|
|
username: ${{ secrets.GHCR_USERNAME }}
|
||
|
|
password: ${{ secrets.GHCR_TOKEN }}
|
||
|
|
|
||
|
|
- name: Run e2e Tests for GCP
|
||
|
|
run: |
|
||
|
|
export E2E_VERSION=$GITHUB_SHA
|
||
|
|
export PR_IMG_TAG=$GITHUB_SHA
|
||
|
|
export PATH=$PATH:$(go env GOPATH)/bin
|
||
|
|
go get github.com/onsi/ginkgo/ginkgo
|
||
|
|
make test.e2e.managed FOCUS="gcpmanaged"
|
||
|
|
|
||
|
|
- name: Destroy TF GKE
|
||
|
|
if: always()
|
||
|
|
run: |-
|
||
|
|
make tf.destroy.gcp
|
||
|
|
|
||
|
|
|
||
|
|
# Repo owner has commented /ok-to-test on a (fork-based) pull request
|
||
|
|
integration-fork-managed:
|
||
|
|
runs-on: ubuntu-latest
|
||
|
|
if:
|
||
|
|
github.event_name == 'repository_dispatch'
|
||
|
|
steps:
|
||
|
|
|
||
|
|
- name: Branch based PR checkout
|
||
|
|
uses: actions/checkout@v2
|
||
|
|
|
||
|
|
# <insert integration tests needing secrets>
|
||
|
|
|
||
|
|
- name: Fetch History
|
||
|
|
run: git fetch --prune --unshallow
|
||
|
|
|
||
|
|
- name: Setup Go
|
||
|
|
uses: actions/setup-go@v2
|
||
|
|
with:
|
||
|
|
go-version: ${{ env.GO_VERSION }}
|
||
|
|
|
||
|
|
- name: Find the Go Cache
|
||
|
|
id: go
|
||
|
|
run: |
|
||
|
|
echo "::set-output name=build-cache::$(go env GOCACHE)"
|
||
|
|
echo "::set-output name=mod-cache::$(go env GOMODCACHE)"
|
||
|
|
|
||
|
|
- name: Cache the Go Build Cache
|
||
|
|
uses: actions/cache@v2.1.7
|
||
|
|
with:
|
||
|
|
path: ${{ steps.go.outputs.build-cache }}
|
||
|
|
key: ${{ runner.os }}-build-unit-tests-${{ hashFiles('**/go.sum') }}
|
||
|
|
restore-keys: ${{ runner.os }}-build-unit-tests-
|
||
|
|
|
||
|
|
- name: Cache Go Dependencies
|
||
|
|
uses: actions/cache@v2.1.7
|
||
|
|
with:
|
||
|
|
path: ${{ steps.go.outputs.mod-cache }}
|
||
|
|
key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }}
|
||
|
|
restore-keys: ${{ runner.os }}-pkg-
|
||
|
|
|
||
|
|
- name: Setup gcloud CLI
|
||
|
|
uses: google-github-actions/setup-gcloud@master
|
||
|
|
with:
|
||
|
|
service_account_key: ${{ env.GCP_SM_SA_GKE_JSON }}
|
||
|
|
project_id: ${{ env.GCP_PROJECT_ID }}
|
||
|
|
|
||
|
|
- name: Setup TFLint
|
||
|
|
uses: terraform-linters/setup-tflint@v1
|
||
|
|
with:
|
||
|
|
tflint_version: v0.28.0 # Must be specified. See: https://github.com/terraform-linters/tflint/releases for latest versions
|
||
|
|
|
||
|
|
- name: Run TFLint
|
||
|
|
run: find ${{ github.workspace }} | grep tf$ | xargs -n1 dirname | xargs -IXXX -n1 /bin/sh -c 'set -o errexit; cd XXX; pwd; tflint --loglevel=info .; cd - >/dev/null'
|
||
|
|
|
||
|
|
- name: Setup TF Gcloud Provider
|
||
|
|
run: |-
|
||
|
|
mkdir -p terraform/gcp/secrets
|
||
|
|
echo ${GCP_SM_SA_GKE_JSON} > terraform/gcp/secrets/gcloud-service-account-key.json
|
||
|
|
|
||
|
|
- name: Show TF GKE
|
||
|
|
run: |-
|
||
|
|
make tf.show.gcp
|
||
|
|
|
||
|
|
- name: Setup Infracost
|
||
|
|
uses: infracost/actions/setup@v1
|
||
|
|
with:
|
||
|
|
api-key: ${{ secrets.INFRACOST_API_KEY }}
|
||
|
|
|
||
|
|
- name: Generate Infracost JSON for GKE
|
||
|
|
run: infracost breakdown --path terraform/gcp/plan.json --format json --out-file /tmp/infracost.json
|
||
|
|
|
||
|
|
- name: Post Infracost comment
|
||
|
|
uses: infracost/actions/comment@v1
|
||
|
|
with:
|
||
|
|
path: /tmp/infracost.json
|
||
|
|
# Choose the commenting behavior, 'update' is a good default:
|
||
|
|
behavior: update # Create a single comment and update it. The "quietest" option.
|
||
|
|
# behavior: delete-and-new # Delete previous comments and create a new one.
|
||
|
|
# behavior: hide-and-new # Minimize previous comments and create a new one.
|
||
|
|
# behavior: new # Create a new cost estimate comment on every push.
|
||
|
|
|
||
|
|
- name: Apply TF GKE
|
||
|
|
run: |-
|
||
|
|
make tf.apply.gcp
|
||
|
|
|
||
|
|
- name: Get the GKE credentials
|
||
|
|
run: |-
|
||
|
|
gcloud container clusters get-credentials "$GCP_GKE_CLUSTER" --zone "$GCP_GKE_ZONE" --project "$GCP_PROJECT_ID"
|
||
|
|
|
||
|
|
- name: Login to Docker
|
||
|
|
uses: docker/login-action@v1
|
||
|
|
if: env.GHCR_USERNAME != ''
|
||
|
|
with:
|
||
|
|
registry: ghcr.io
|
||
|
|
username: ${{ secrets.GHCR_USERNAME }}
|
||
|
|
password: ${{ secrets.GHCR_TOKEN }}
|
||
|
|
|
||
|
|
- name: Run e2e Tests for GCP
|
||
|
|
run: |
|
||
|
|
export E2E_VERSION=$GITHUB_SHA
|
||
|
|
export PR_IMG_TAG=$GITHUB_SHA
|
||
|
|
export PATH=$PATH:$(go env GOPATH)/bin
|
||
|
|
go get github.com/onsi/ginkgo/ginkgo
|
||
|
|
make test.e2e.managed FOCUS="gcpmanaged"
|
||
|
|
|
||
|
|
- name: Destroy TF GKE
|
||
|
|
if: always()
|
||
|
|
run: |-
|
||
|
|
make tf.destroy.gcp
|
||
|
|
|
||
|
|
# Update check run called "integration-fork"
|
||
|
|
- uses: actions/github-script@v1
|
||
|
|
id: update-check-run
|
||
|
|
if: ${{ always() }}
|
||
|
|
env:
|
||
|
|
number: ${{ github.event.client_payload.pull_request.number }}
|
||
|
|
job: ${{ github.job }}
|
||
|
|
# Conveniently, job.status maps to https://developer.github.com/v3/checks/runs/#update-a-check-run
|
||
|
|
conclusion: ${{ job.status }}
|
||
|
|
with:
|
||
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
||
|
|
script: |
|
||
|
|
const { data: pull } = await github.pulls.get({
|
||
|
|
...context.repo,
|
||
|
|
pull_number: process.env.number
|
||
|
|
});
|
||
|
|
const ref = pull.head.sha;
|
||
|
|
console.log("\n\nPR sha: " + ref)
|
||
|
|
const { data: checks } = await github.checks.listForRef({
|
||
|
|
...context.repo,
|
||
|
|
ref
|
||
|
|
});
|
||
|
|
console.log("\n\nPR CHECKS: " + checks)
|
||
|
|
const check = checks.check_runs.filter(c => c.name === process.env.job);
|
||
|
|
console.log("\n\nPR Filtered CHECK: " + check)
|
||
|
|
console.log(check)
|
||
|
|
const { data: result } = await github.checks.update({
|
||
|
|
...context.repo,
|
||
|
|
check_run_id: check[0].id,
|
||
|
|
status: 'completed',
|
||
|
|
conclusion: process.env.conclusion
|
||
|
|
});
|
||
|
|
return result;
|