Skip to content

Commit bfc6d04

Browse files
tommyp1cklestommyp1ckles
committed
Add conformance e2e workflow for Cilium on Talos.
Signed-off-by: Tom Hadlaw <[email protected]>
1 parent 4aef106 commit bfc6d04

18 files changed

+923
-1
lines changed

‎.github/workflows/conformance.yml

+213
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,213 @@
1+
name: Talos Conformance
2+
on:
3+
pull_request_target:
4+
types:
5+
- opened
6+
- synchronize
7+
- reopened
8+
schedule:
9+
# Run weekly.
10+
- cron: '0 9 * * 1'
11+
push:
12+
branches:
13+
- main
14+
pull_request:
15+
jobs:
16+
setup-and-test:
17+
runs-on: ubuntu-22.04
18+
permissions:
19+
id-token: write
20+
contents: read
21+
strategy:
22+
fail-fast: false
23+
max-parallel: 8
24+
matrix:
25+
cilium:
26+
# renovate: datasource=github-releases depName=cilium/cilium
27+
- 'v1.15.1'
28+
# renovate: datasource=github-releases depName=cilium/cilium
29+
- 'v1.14.5'
30+
talos:
31+
# renovate: datasource=github-releases depName=siderolabs/talos
32+
- 'v1.6.5'
33+
# renovate: datasource=github-releases depName=siderolabs/talos
34+
- 'v1.5.4'
35+
config:
36+
# --- Cilium v1.15 ---
37+
- name: 'Vanilla'
38+
kube-proxy: false
39+
kube-proxy-replacement: "true"
40+
socketlb: false
41+
bpf-masquerade: true
42+
ipam-mode: 'kubernetes'
43+
ipv4: true
44+
ipv6: false
45+
encryption-enabled: false
46+
encryption-type: ipsec
47+
tunnel-mode: vxlan
48+
nodeport: true
49+
50+
- name: 'Wireguard'
51+
kube-proxy: true
52+
kube-proxy-replacement: "true"
53+
socketlb: false
54+
bpf-masquerade: true
55+
ipam-mode: 'kubernetes'
56+
ipv4: true
57+
ipv6: false
58+
encryption-enabled: true
59+
encryption-type: wireguard
60+
tunnel-mode: vxlan
61+
nodeport: true
62+
63+
- name: 'IPSEC'
64+
kube-proxy: true
65+
kube-proxy-replacement: "false"
66+
socketlb: true
67+
bpf-masquerade: false
68+
ipam-mode: 'kubernetes'
69+
ipv4: true
70+
ipv6: false
71+
encryption-enabled: true
72+
encryption-type: ipsec
73+
tunnel-mode: vxlan
74+
nodeport: false
75+
76+
- name: 'No KPR and w/ BPF Masq'
77+
kube-proxy: true
78+
kube-proxy-replacement: "false"
79+
socketlb: true
80+
bpf-masquerade: true
81+
ipam-mode: 'kubernetes'
82+
ipv4: true
83+
ipv6: false
84+
encryption-enabled: false
85+
tunnel-mode: vxlan
86+
nodeport: true
87+
88+
- name: 'Clusterpool IPAM Mode'
89+
kube-proxy: false
90+
kube-proxy-replacement: "true"
91+
socketlb: false
92+
bpf-masquerade: true
93+
ipam-mode: 'cluster-pool'
94+
ipv4: true
95+
ipv6: false
96+
encryption-enabled: false
97+
encryption-type: ipsec
98+
tunnel-mode: vxlan
99+
nodeport: true
100+
101+
- name: 'With Geneve Tunnel'
102+
kube-proxy: false
103+
kube-proxy-replacement: "true"
104+
socketlb: false
105+
bpf-masquerade: true
106+
ipam-mode: 'kubernetes'
107+
ipv4: true
108+
ipv6: false
109+
encryption-enabled: false
110+
encryption-type: ipsec
111+
tunnel-mode: geneve
112+
nodeport: true
113+
114+
steps:
115+
- name: Checkout
116+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
117+
with:
118+
ref: ${{ github.event.pull_request.head.sha }}
119+
- name: Configure AWS credentials from shared services account
120+
uses: aws-actions/configure-aws-credentials@v2
121+
with:
122+
role-to-assume: arn:aws:iam::478566851380:role/TalosConformanceCI
123+
aws-region: us-east-2
124+
- uses: hashicorp/setup-terraform@v3
125+
- name: Create Talos Cluster
126+
run: |
127+
cd test/conformance
128+
./create-ci-env.sh \
129+
--kube-proxy ${{ matrix.config.kube-proxy}} \
130+
--talos-version ${{ matrix.talos }} \
131+
--owner "isovalent/terraform-aws-talos"
132+
make apply
133+
- name: Install Cilium CLI
134+
uses: cilium/cilium-cli@4aa6347c532075df28027772fa1e4ec2f7415341 # v0.15.20
135+
with:
136+
repository: cilium/cilium-cli
137+
release-version: v0.15.20
138+
ci-version: ""
139+
binary-name: cilium-cli
140+
binary-dir: /usr/local/bin
141+
- name: Install Cilium
142+
run: |
143+
cd test/conformance
144+
export $(make print-kubeconfig)
145+
kubectl create -n kube-system secret generic cilium-ipsec-keys \
146+
--from-literal=keys="3 rfc4106(gcm(aes)) $(echo $(dd if=/dev/urandom count=20 bs=1 2> /dev/null | xxd -p -c 64)) 128"
147+
kubectl create -n kube-system -f ipmasq-config.yaml
148+
cilium-cli install --version="${{ matrix.cilium }}" \
149+
--values=values.yaml \
150+
--set ipv4.enabled=${{ matrix.config.ipv4 }} \
151+
--set ipv6.enabled=${{ matrix.config.ipv6 }} \
152+
--set bpf.masquerade=${{ matrix.config.bpf-masquerade }} \
153+
--set kubeProxyReplacement=${{ matrix.config.kube-proxy-replacement }} \
154+
--set socketLB.enabled=${{ matrix.config.socketlb }} \
155+
--set ipam.mode=${{ matrix.config.ipam-mode }} \
156+
--set ingressController.enabled=true \
157+
--set encryption.enabled=${{ matrix.config.encryption-enabled }} \
158+
--set encryption.type=${{ matrix.config.encryption-type }} \
159+
--set tunnelProtocol=${{ matrix.config.tunnel-mode }} \
160+
--set nodePort.enabled=${{ matrix.config.nodeport }}
161+
cilium-cli status --wait
162+
163+
- name: Run E2E Connectivity Tests
164+
run: |
165+
cd test/conformance
166+
export $(make print-kubeconfig)
167+
./wait
168+
kubectl create ns cilium-test
169+
kubectl label ns cilium-test pod-security.kubernetes.io/enforce=privileged
170+
kubectl label ns cilium-test pod-security.kubernetes.io/warn=privileged
171+
cilium-cli connectivity test
172+
173+
- name: Fetch artifacts
174+
if: ${{ !success() && steps.run-tests.outcome != 'skipped' }}
175+
shell: bash
176+
run: |
177+
cd test/conformance
178+
export $(make print-kubeconfig)
179+
kubectl get svc -o wide -A
180+
kubectl get pods --all-namespaces -o wide
181+
cilium-cli status
182+
mkdir -p cilium-sysdumps
183+
cilium-cli sysdump --output-filename cilium-sysdump-${{ github.run_id }}-${{ github.run_number }}
184+
185+
- name: Upload artifacts
186+
if: ${{ !success() }}
187+
uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
188+
with:
189+
name: cilium-sysdumps-${{ github.run_id }}-${{ github.run_number }}
190+
path: ./test/conformance/cilium-sysdump-*.zip
191+
192+
- name: Cleanup
193+
if: always()
194+
run: |
195+
cd test/conformance
196+
make destroy
197+
198+
finalize:
199+
runs-on: ubuntu-22.04
200+
if: always()
201+
permissions:
202+
id-token: write
203+
contents: read
204+
needs: setup-and-test
205+
steps:
206+
- name: Send notification
207+
uses: slackapi/slack-github-action@6c661ce58804a1a20f6dc5fbee7f0381b469e001 # v1.25.0
208+
env:
209+
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
210+
with:
211+
channel-id: 'C02T57KV69Y'
212+
slack-message: "Talos AWS Terraform: <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ needs.setup-and-test.result == 'success' && 'workflow passed!> :tada::tada::tada:' || 'workflow failed!> :rotating_light::rotating_light::rotating_light:' }}"
213+

‎.gitignore

+7-1
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
11
/.workspace-*/
22
.terraform/
3+
*/.terraform/*
4+
*/.terraform.lock.hcl
35
.terraform.lock.hcl
6+
*/.terraform.tfstate.lock.info
47
.terraform.tfstate.lock.info
58
.vscode/
9+
*/terraform.tfstate*
610
terraform.tfstate*
11+
*/terraform.tfvars
712
terraform.tfvars
813
tf/
914
*.DS_Store*
10-
.timestamp
15+
.timestamp
16+
test/conformance/env.tfvars

0 commit comments

Comments
 (0)