work on cache CI

Author: Lillecarl

.github/actions/setup-nix/action.yaml

@@ -42,7 +42,13 @@ runs:
       shell: bash
       run: |
         mkdir -p ~/.ssh
-        echo "${{ inputs.nixbuild_key }}" > ~/.ssh/id_ed25519
-        chmod 600 ~/.ssh/id_ed25519
-        echo -e "Host *\n\tStrictHostKeyChecking no" | sudo tee -a ~/.ssh/config > /dev/null
+        echo "${{ inputs.nixbuild_key }}" > ~/.ssh/nixbuild_key
+        chmod 600 ~/.ssh/nixbuild_key
+        {
+          echo "Host eu.nixbuild.net"
+          echo "  IdentityFile ~/.ssh/nixbuild_key"
+          echo "Host *"
+          echo "  StrictHostKeyChecking no"
+        } >> ~/.ssh/config
+        chmod 644 ~/.ssh/config
 

.github/workflows/ci.yaml

@@ -67,6 +67,12 @@ jobs:
       - name: Create Kind cluster
         uses: helm/kind-action@main
 
+      - name: Setup upterm session
+        uses: owenthereal/action-upterm@v1
+        with:
+          limit-access-to-actor: true
+          wait-timeout-minutes: 5
+
       - name: Clean runner
         run: |
           # Remove cache because permissions can get fucked up preventing kluctl from creating it's cache directory
@@ -99,28 +105,43 @@ jobs:
           echo "=== Node pod logs ==="
           kubectl logs -l app.kubernetes.io/name=csi -n nix-csi --tail -1
 
-      - name: Debug on failure
+      - name: Cluster state all
         if: failure()
         run: |
-          echo "=== Cluster state ==="
-          kubectl get all -A
+          echo "=== Cluster state all ==="
+          kubectl get all -A || true
 
-          echo "=== Cache pod logs ==="
-          kubectl logs -l app.kubernetes.io/name=cache -n nix-csi --tail -1 || true
+      - name: Cluster state configmaps
+        if: failure()
+        run: |
+          echo "=== Cluster configmaps ==="
+          kubectl get configmaps -A || true
+
+      - name: Cluster state secrets
+        if: failure()
+        run: |
+          kubectl get secrets -A || true
 
-          echo "=== Cache pod describe ==="
+      - name: Cache
+        if: failure()
+        run: |
+          kubectl logs -l app.kubernetes.io/name=cache -n nix-csi --tail -1 || true
           kubectl describe pod -l app.kubernetes.io/name=cache-n nix-csi || true
 
-          echo "=== Node pod logs ==="
+      - name: Node
+        if: failure()
+        run: |
           kubectl logs -l app.kubernetes.io/name=csi -n nix-csi --tail -1 || true
-
-          echo "=== Node pod describe ==="
           kubectl describe pod -l app.kubernetes.io/name=csi -n nix-csi || true
 
-          echo "=== Init pod logs ==="
+      - name: Init
+        if: failure()
+        run: |
           kubectl logs -l app.kubernetes.io/name=init -n nix-csi --tail -1 || true
 
-          echo "=== Events ==="
+      - name: Events
+        if: failure()
+        run: |
           kubectl get events -n nix-csi --sort-by='.lastTimestamp'
 
   test-kind-nocache:

kubenix/secret.nix

@@ -61,30 +61,34 @@ in
         };
       };
       ConfigMap.init-scripts = {
-        data.init-secrets = # bash
+        data.init-secrets = let
+          kc = "kubectl -n ${cfg.namespace}";
+        in
+        # bash
           ''
+            set -x
             mkdir -p /tmp/{ssh-key,nix-key,ssh-auth}
-            if ! kubectl get secret ssh-key &>/dev/null || ! kubectl get configmap ssh-dynauth &>/dev/null; then
+            if ! ${kc} get secret ssh-key &>/dev/null || ! ${kc} get configmap ssh-dynauth &>/dev/null; then
               # Create ssh secret
               ssh-keygen -t ed25519 -C "" -N "" -f /tmp/ssh-key/id_ed25519
-              kubectl delete --ignore-not-found secret ssh-key
-              kubectl create secret generic ssh-key --from-file=/tmp/ssh-key
+              ${kc} delete --ignore-not-found secret ssh-key
+              ${kc} create secret generic ssh-key --from-file=/tmp/ssh-key
 
               # Create pubkey configmap
               cp /tmp/ssh-key/id_ed25519.pub /tmp/ssh-auth/authorized_keys
               echo "* $(cat /tmp/ssh-key/id_ed25519.pub)" > /tmp/ssh-auth/ssh_known_hosts
-              kubectl delete --ignore-not-found configmap ssh-dynauth
-              kubectl create configmap ssh-dynauth --from-file=/tmp/ssh-auth
+              ${kc} delete --ignore-not-found configmap ssh-dynauth
+              ${kc} create configmap ssh-dynauth --from-file=/tmp/ssh-auth
             fi
 
-            if ! kubectl get secret nix-key &>/dev/null; then
+            if ! ${kc} get secret nix-key &>/dev/null; then
               # create nix binary cache key
               nix-store --generate-binary-cache-key \
                 nix-cache-1 \
                 /tmp/nix-key/nix_ed25519 \
                 /tmp/nix-key/nix_ed25519.pub
-              kubectl delete --ignore-not-found secret nix-key
-              kubectl create secret generic nix-key --from-file=/tmp/nix-key
+              ${kc} delete --ignore-not-found secret nix-key
+              ${kc} create secret generic nix-key --from-file=/tmp/nix-key
             fi
           '';
       };