mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-21 06:11:31 +08:00
Matthew Grossman
fc8d0d7ada
* test(tmachine): add K3s PostgreSQL and mTLS conformance installer Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(tmachine): reach the HA TLS gateway through its ClusterIP Drop the port-forward restart removed by the ClusterIP change, resolve the Service DNS name covered by the server certificate to the ClusterIP, bound each authenticated API wait attempt, and collect diagnostics from every gateway Pod. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * ci(tmachine): run K3s PostgreSQL and mTLS conformance Add the k3s-ha-tls installer to every core conformance matrix so Branch E2E, Release Dev, Release Tag, and manual Integration Tests cover three gateway replicas sharing PostgreSQL behind mTLS. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * refactor(tmachine): rename k3s-ha-tls installer to k3s-ha TLS is part of the supported HA configuration once gateway replicas share PostgreSQL, so the installer name only needs to distinguish HA from the single-replica k3s lane. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * refactor(tmachine): install K3s HA in a single Helm rollout Add an optional Helm values overlay to the K3s installer so the k3s-ha installer stages PostgreSQL first and installs the three-replica TLS gateway directly, instead of installing a plaintext gateway and upgrading. Drop the redundant unauthenticated-users override and the install-time API wait, which the conformance playbook already performs. Share K3s installer inputs in the tmachine configuration. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> * fix(tmachine): make K3s HA staging rerunnable and wait for PostgreSQL Apply the OpenShell namespace instead of creating it so the staging play tolerates an existing namespace, and wait for the PostgreSQL rollout so gateway Pods do not start crash-looping against a missing database. Reflow and pluralize the K3s lane notes in CI.md. Signed-off-by: Matthew Grossman <mgrossman@nvidia.com> --------- Signed-off-by: Matthew Grossman <mgrossman@nvidia.com>
102 lines
3.6 KiB
YAML
102 lines
3.6 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
name: Integration Test Runner
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
source-sha:
|
|
description: Source revision of the prepared candidate artifacts
|
|
required: true
|
|
type: string
|
|
integration-inputs-artifact-id:
|
|
description: Immutable ID of the prepared integration inputs artifact
|
|
required: true
|
|
type: string
|
|
category:
|
|
description: Integration-test category, used for the job name and concurrency key
|
|
required: false
|
|
type: string
|
|
test-matrix:
|
|
description: JSON array of environment, installer, and testsuite combinations
|
|
required: false
|
|
type: string
|
|
default: >-
|
|
[
|
|
{"environment":"ubuntu-docker-rootful","installer":"deb","testsuite":"conformance"},
|
|
{"environment":"ubuntu-k3s","installer":"k3s","testsuite":"conformance"},
|
|
{"environment":"ubuntu-k3s","installer":"k3s-ha","testsuite":"conformance"},
|
|
{"environment":"fedora-podman-rootful","installer":"rpm","testsuite":"conformance"},
|
|
{"environment":"fedora-podman-rootless","installer":"rpm","testsuite":"conformance"}
|
|
]
|
|
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
packages: read
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-integration-${{ inputs.category }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
integration:
|
|
name: Integration test (${{ inputs.category }}, ${{ matrix.environment }}, ${{ matrix.installer }}, ${{ matrix.testsuite }})
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include: ${{ fromJSON(inputs['test-matrix']) }}
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 90
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ inputs['source-sha'] }}
|
|
persist-credentials: false
|
|
|
|
- name: Enable KVM access
|
|
run: |
|
|
set -euo pipefail
|
|
if [[ ! -c /dev/kvm ]]; then
|
|
echo "::error::The runner did not expose /dev/kvm"
|
|
exit 1
|
|
fi
|
|
sudo chmod 0666 /dev/kvm
|
|
exec 3<>/dev/kvm
|
|
exec 3>&-
|
|
|
|
- uses: ./.github/actions/setup-nix
|
|
|
|
- name: Cache tmachine disks
|
|
if: matrix.environment != 'ubuntu-k3s'
|
|
uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
|
|
with:
|
|
path: ~/.cache/tmachine
|
|
key: tmachine-${{ runner.os }}-${{ runner.arch }}
|
|
|
|
- name: Download integration inputs
|
|
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
artifact-ids: ${{ inputs['integration-inputs-artifact-id'] }}
|
|
path: artifacts
|
|
|
|
- name: Run test suite
|
|
env:
|
|
ENVIRONMENT: ${{ matrix.environment }}
|
|
INSTALLER: ${{ matrix.installer }}
|
|
TESTSUITE: ${{ matrix.testsuite }}
|
|
run: |
|
|
# Retry dependency preparation, then execute the test suite once.
|
|
nix build --no-link .#tmachine || nix build --no-link .#tmachine
|
|
nix run .#tmachine -- test "${ENVIRONMENT}" "${INSTALLER}" "${TESTSUITE}"
|
|
|
|
- name: Upload tmachine diagnostics
|
|
if: always()
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
|
|
with:
|
|
name: tmachine-diagnostics-${{ inputs.category }}-${{ matrix.environment }}-${{ matrix.installer }}-${{ matrix.testsuite }}
|
|
path: artifacts/tmachine-diagnostics
|
|
if-no-files-found: ignore
|
|
retention-days: 7
|