mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-25 06:42:52 +08:00
Mesut Oezdil
cd70249629
* ci: pin azure/setup-helm and helm/kind-action to commit SHAs * chore(python): add py.typed marker for PEP 561 compliance * ci: use full semver in pinned action version comments Signed-off-by: mesutoezdil <mesudozdil@gmail.com> --------- Signed-off-by: mesutoezdil <mesudozdil@gmail.com>
99 lines
3.7 KiB
YAML
99 lines
3.7 KiB
YAML
name: Kubernetes E2E Test
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
image-tag:
|
|
description: "Image tag to test (typically the commit SHA)"
|
|
required: true
|
|
type: string
|
|
runner:
|
|
description: "GitHub Actions runner label"
|
|
required: false
|
|
type: string
|
|
default: "linux-amd64-cpu8"
|
|
checkout-ref:
|
|
description: "Git ref to check out for test inputs (defaults to the workflow SHA)"
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: read
|
|
|
|
jobs:
|
|
e2e-kubernetes:
|
|
name: Kubernetes E2E (Rust smoke)
|
|
# Bare runner: running kind-in-container hits nested-Docker / kubeconfig
|
|
# complications. The runner has Docker; mise installs helm, kubectl, and
|
|
# the Rust toolchain.
|
|
runs-on: ${{ inputs.runner }}
|
|
timeout-minutes: 60
|
|
permissions:
|
|
contents: read
|
|
packages: read
|
|
env:
|
|
MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
KIND_CLUSTER_NAME: kube-e2e-${{ github.run_id }}
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
with:
|
|
ref: ${{ inputs['checkout-ref'] || github.sha }}
|
|
|
|
- name: Install mise
|
|
run: |
|
|
curl https://mise.run | sh
|
|
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
|
|
echo "$HOME/.local/share/mise/shims" >> "$GITHUB_PATH"
|
|
|
|
- name: Install tools
|
|
run: mise install --locked
|
|
|
|
# The openshell-policy crate transitively pulls in z3-sys, whose
|
|
# build script needs the z3 C/C++ headers and clang/bindgen to
|
|
# compile. The bare runner doesn't ship them; the CI container
|
|
# image used by other Rust e2e jobs does, but we can't run this job
|
|
# there (the runner's container handler injects its own --network
|
|
# bridge, which conflicts with the --network host we need so kind's
|
|
# API server is reachable from the test process).
|
|
- name: Install z3 build deps
|
|
run: sudo apt-get update && sudo apt-get install -y --no-install-recommends libz3-dev clang
|
|
|
|
- name: Log in to GHCR
|
|
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
|
|
|
|
- name: Create kind cluster
|
|
uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
|
|
with:
|
|
cluster_name: ${{ env.KIND_CLUSTER_NAME }}
|
|
wait: 120s
|
|
|
|
# mise.toml sets KUBECONFIG="{{config_root}}/kubeconfig"; helm/kind-action
|
|
# writes to ~/.kube/config. Materialize the kind context at the mise path
|
|
# so `mise run e2e:kubernetes` (and the wrapper's `kubectl --context=...`)
|
|
# finds the kind cluster.
|
|
- name: Export kind kubeconfig to mise path
|
|
run: |
|
|
set -euo pipefail
|
|
kind get kubeconfig --name "$KIND_CLUSTER_NAME" > "$GITHUB_WORKSPACE/kubeconfig"
|
|
chmod 600 "$GITHUB_WORKSPACE/kubeconfig"
|
|
|
|
- name: Load gateway and supervisor images into kind
|
|
run: |
|
|
set -euo pipefail
|
|
for component in gateway supervisor; do
|
|
image="ghcr.io/nvidia/openshell/${component}:${{ inputs.image-tag }}"
|
|
archive="${RUNNER_TEMP:-/tmp}/openshell-${component}-linux-amd64.tar"
|
|
docker pull --platform linux/amd64 "$image"
|
|
docker image save --platform linux/amd64 --output "$archive" "$image"
|
|
kind load image-archive "$archive" --name "$KIND_CLUSTER_NAME"
|
|
done
|
|
|
|
- name: Run Kubernetes E2E (Rust smoke)
|
|
env:
|
|
OPENSHELL_E2E_KUBE_CONTEXT: kind-${{ env.KIND_CLUSTER_NAME }}
|
|
IMAGE_TAG: ${{ inputs.image-tag }}
|
|
OPENSHELL_REGISTRY: ghcr.io/nvidia/openshell
|
|
run: mise run --no-deps --skip-deps e2e:kubernetes
|