Skip to content

Commit 094c4b8

Browse files
tommyp1cklestommyp1ckles
committed
ci: run only minimal conformance for PR CI.
The full suite is too large, we will run this strictly on a schedule. Signed-off-by: Tom Hadlaw <[email protected]>
1 parent 0cdf86f commit 094c4b8

File tree

4 files changed

+258
-18
lines changed

4 files changed

+258
-18
lines changed

‎.github/workflows/conformance-13-pr.yml

+131
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
# Due to difference in configuring v1.13 and v1.14+ we split v1.13 into
2+
# seperate workflow.
3+
# TODO: We can delete this and rely on just the primary conformance.yml to
4+
# test v1.14/v1.15/v1.16 upon the release of v1.16.
5+
name: Talos Conformance (v1.13) (PR)
6+
on:
7+
pull_request_target:
8+
types:
9+
- opened
10+
- synchronize
11+
- reopened
12+
pull_request:
13+
jobs:
14+
setup-and-test:
15+
runs-on: ubuntu-22.04
16+
permissions:
17+
id-token: write
18+
contents: read
19+
strategy:
20+
fail-fast: false
21+
max-parallel: 2
22+
matrix:
23+
cilium:
24+
# renovate: datasource=github-releases depName=cilium/cilium
25+
- 'v1.13.10'
26+
talos:
27+
# renovate: datasource=github-releases depName=siderolabs/talos
28+
- 'v1.6.5'
29+
# renovate: datasource=github-releases depName=siderolabs/talos
30+
- 'v1.5.4'
31+
config:
32+
- name: 'Vanilla'
33+
kube-proxy: false
34+
kube-proxy-replacement: "strict"
35+
socketlb: false
36+
bpf-masquerade: true
37+
ipam-mode: 'kubernetes'
38+
ipv4: true
39+
ipv6: false
40+
encryption-enabled: false
41+
encryption-type: ipsec
42+
tunnel-mode: vxlan
43+
nodeport: true
44+
l7: true
45+
ingress: true
46+
steps:
47+
- name: Checkout
48+
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
49+
with:
50+
ref: ${{ github.event.pull_request.head.sha }}
51+
- name: Configure AWS credentials from shared services account
52+
uses: aws-actions/configure-aws-credentials@v2
53+
with:
54+
role-to-assume: arn:aws:iam::478566851380:role/TalosConformanceCI
55+
aws-region: us-east-2
56+
- uses: hashicorp/setup-terraform@v3
57+
- name: Create Talos Cluster
58+
run: |
59+
cd test/conformance
60+
./create-ci-env.sh \
61+
--kube-proxy ${{ matrix.config.kube-proxy}} \
62+
--talos-version ${{ matrix.talos }} \
63+
--pr ${{ github.run_number }} \
64+
--owner "isovalent/terraform-aws-talos"
65+
make apply
66+
- name: Install Cilium CLI
67+
uses: cilium/cilium-cli@2d69d3f50d783ae22ead9054f14b18074c70b108 # v0.16.1
68+
with:
69+
repository: cilium/cilium-cli
70+
release-version: v0.15.20
71+
ci-version: ""
72+
binary-name: cilium-cli
73+
binary-dir: /usr/local/bin
74+
- name: Install Cilium
75+
run: |
76+
cd test/conformance
77+
export $(make print-kubeconfig)
78+
kubectl create -n kube-system secret generic cilium-ipsec-keys \
79+
--from-literal=keys="3 rfc4106(gcm(aes)) $(echo $(dd if=/dev/urandom count=20 bs=1 2> /dev/null | xxd -p -c 64)) 128"
80+
kubectl create -n kube-system -f ipmasq-config.yaml
81+
cilium-cli install --version="${{ matrix.cilium }}" \
82+
--values=values.yaml \
83+
--set ipv4.enabled=${{ matrix.config.ipv4 }} \
84+
--set ipv6.enabled=${{ matrix.config.ipv6 }} \
85+
--set bpf.masquerade=${{ matrix.config.bpf-masquerade }} \
86+
--set kubeProxyReplacement=${{ matrix.config.kube-proxy-replacement }} \
87+
--set socketLB.enabled=${{ matrix.config.socketlb }} \
88+
--set ipam.mode=${{ matrix.config.ipam-mode }} \
89+
--set ingressController.enabled=${{ matrix.config.ingress }} \
90+
--set encryption.enabled=${{ matrix.config.encryption-enabled }} \
91+
--set encryption.type=${{ matrix.config.encryption-type }} \
92+
--set tunnelProtocol=${{ matrix.config.tunnel-mode }} \
93+
--set nodePort.enabled=${{ matrix.config.nodeport }} \
94+
--set l7Proxy=${{ matrix.config.l7 }}
95+
cilium-cli status --wait
96+
97+
- name: Run E2E Connectivity Tests
98+
run: |
99+
cd test/conformance
100+
export $(make print-kubeconfig)
101+
./wait
102+
kubectl create ns cilium-test
103+
kubectl label ns cilium-test pod-security.kubernetes.io/enforce=privileged
104+
kubectl label ns cilium-test pod-security.kubernetes.io/warn=privileged
105+
cilium-cli connectivity test --collect-sysdump-on-failure
106+
107+
- name: Fetch artifacts
108+
if: ${{ !success() && steps.run-tests.outcome != 'skipped' }}
109+
shell: bash
110+
run: |
111+
cd test/conformance
112+
export $(make print-kubeconfig)
113+
kubectl get svc -o wide -A
114+
kubectl get pods --all-namespaces -o wide
115+
cilium-cli status
116+
mkdir -p cilium-sysdumps
117+
cilium-cli sysdump --output-filename cilium-sysdump-${{ github.run_id }}-${{ github.run_number }}
118+
119+
- name: Upload artifacts
120+
if: ${{ !success() }}
121+
uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
122+
with:
123+
name: cilium-sysdumps-${{ github.run_id }}-${{ github.run_number }}
124+
path: ./test/conformance/cilium-sysdump-*.zip
125+
126+
- name: Cleanup
127+
if: always()
128+
run: |
129+
cd test/conformance
130+
make destroy
131+

‎.github/workflows/conformance-13.yml

-9
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,9 @@
44
# test v1.14/v1.15/v1.16 upon the release of v1.16.
55
name: Talos Conformance (v1.13)
66
on:
7-
pull_request_target:
8-
types:
9-
- opened
10-
- synchronize
11-
- reopened
127
schedule:
138
# Run weekly.
149
- cron: '0 9 * * 1'
15-
push:
16-
branches:
17-
- main
18-
pull_request:
1910
jobs:
2011
setup-and-test:
2112
runs-on: ubuntu-22.04

‎.github/workflows/conformance-pr.yml

+127
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
name: Talos Conformance (PR)
2+
on:
3+
pull_request_target:
4+
types:
5+
- opened
6+
- synchronize
7+
- reopened
8+
pull_request:
9+
jobs:
10+
setup-and-test:
11+
runs-on: ubuntu-22.04
12+
permissions:
13+
id-token: write
14+
contents: read
15+
strategy:
16+
fail-fast: false
17+
max-parallel: 2
18+
matrix:
19+
cilium:
20+
# renovate: datasource=github-releases depName=cilium/cilium
21+
- 'v1.15.1'
22+
# renovate: datasource=github-releases depName=cilium/cilium
23+
- 'v1.14.5'
24+
talos:
25+
# renovate: datasource=github-releases depName=siderolabs/talos
26+
- 'v1.6.5'
27+
# renovate: datasource=github-releases depName=siderolabs/talos
28+
- 'v1.5.4'
29+
config:
30+
# --- Cilium v1.15 ---
31+
- name: 'Vanilla'
32+
kube-proxy: false
33+
kube-proxy-replacement: "true"
34+
socketlb: false
35+
bpf-masquerade: true
36+
ipam-mode: 'kubernetes'
37+
ipv4: true
38+
ipv6: false
39+
encryption-enabled: false
40+
encryption-type: ipsec
41+
tunnel-mode: vxlan
42+
nodeport: true
43+
steps:
44+
- name: Checkout
45+
uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633
46+
with:
47+
ref: ${{ github.event.pull_request.head.sha }}
48+
- name: Configure AWS credentials from shared services account
49+
uses: aws-actions/configure-aws-credentials@v4
50+
with:
51+
role-to-assume: arn:aws:iam::478566851380:role/TalosConformanceCI
52+
aws-region: us-east-2
53+
- uses: hashicorp/setup-terraform@v3
54+
- name: Create Talos Cluster
55+
run: |
56+
cd test/conformance
57+
./create-ci-env.sh \
58+
--kube-proxy ${{ matrix.config.kube-proxy}} \
59+
--talos-version ${{ matrix.talos }} \
60+
--pr ${{ github.run_number }} \
61+
--owner "isovalent/terraform-aws-talos"
62+
make apply
63+
- name: Install Cilium CLI
64+
uses: cilium/cilium-cli@2d69d3f50d783ae22ead9054f14b18074c70b108 # v0.16.1
65+
with:
66+
repository: cilium/cilium-cli
67+
release-version: v0.15.20
68+
ci-version: ""
69+
binary-name: cilium-cli
70+
binary-dir: /usr/local/bin
71+
- name: Install Cilium
72+
run: |
73+
cd test/conformance
74+
export $(make print-kubeconfig)
75+
kubectl create -n kube-system secret generic cilium-ipsec-keys \
76+
--from-literal=keys="3 rfc4106(gcm(aes)) $(echo $(dd if=/dev/urandom count=20 bs=1 2> /dev/null | xxd -p -c 64)) 128"
77+
kubectl create -n kube-system -f ipmasq-config.yaml
78+
cilium-cli install --version="${{ matrix.cilium }}" \
79+
--values=values.yaml \
80+
--set ipv4.enabled=${{ matrix.config.ipv4 }} \
81+
--set ipv6.enabled=${{ matrix.config.ipv6 }} \
82+
--set bpf.masquerade=${{ matrix.config.bpf-masquerade }} \
83+
--set kubeProxyReplacement=${{ matrix.config.kube-proxy-replacement }} \
84+
--set socketLB.enabled=${{ matrix.config.socketlb }} \
85+
--set ipam.mode=${{ matrix.config.ipam-mode }} \
86+
--set ingressController.enabled=true \
87+
--set encryption.enabled=${{ matrix.config.encryption-enabled }} \
88+
--set encryption.type=${{ matrix.config.encryption-type }} \
89+
--set tunnelProtocol=${{ matrix.config.tunnel-mode }} \
90+
--set nodePort.enabled=${{ matrix.config.nodeport }}
91+
cilium-cli status --wait
92+
93+
- name: Run E2E Connectivity Tests
94+
run: |
95+
cd test/conformance
96+
export $(make print-kubeconfig)
97+
./wait
98+
kubectl create ns cilium-test
99+
kubectl label ns cilium-test pod-security.kubernetes.io/enforce=privileged
100+
kubectl label ns cilium-test pod-security.kubernetes.io/warn=privileged
101+
cilium-cli connectivity test --collect-sysdump-on-failure
102+
103+
- name: Fetch artifacts
104+
if: ${{ !success() && steps.run-tests.outcome != 'skipped' }}
105+
shell: bash
106+
run: |
107+
cd test/conformance
108+
export $(make print-kubeconfig)
109+
kubectl get svc -o wide -A
110+
kubectl get pods --all-namespaces -o wide
111+
cilium-cli status
112+
mkdir -p cilium-sysdumps
113+
cilium-cli sysdump --output-filename cilium-sysdump-${{ github.run_id }}-${{ github.run_number }}
114+
115+
- name: Upload artifacts
116+
if: ${{ !success() }}
117+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
118+
with:
119+
name: cilium-sysdumps-${{ github.run_id }}-${{ github.run_number }}
120+
path: ./test/conformance/cilium-sysdump-*.zip
121+
122+
- name: Cleanup
123+
if: always()
124+
run: |
125+
cd test/conformance
126+
make destroy
127+

‎.github/workflows/conformance.yml

-9
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,8 @@
11
name: Talos Conformance
22
on:
3-
pull_request_target:
4-
types:
5-
- opened
6-
- synchronize
7-
- reopened
83
schedule:
94
# Run weekly.
105
- cron: '0 9 * * 1'
11-
push:
12-
branches:
13-
- main
14-
pull_request:
156
jobs:
167
setup-and-test:
178
runs-on: ubuntu-22.04

0 commit comments

Comments
 (0)