Additional cleanup and changes for nightly #488
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Test using Replicated's Compatibilty Matrix and chart-testing tool" | |
| on: | |
| pull_request: | |
| paths: | |
| - 'stable/enterprise/Chart.yaml' | |
| - 'stable/ecs-inventory/Chart.yaml' | |
| - 'stable/k8s-inventory/Chart.yaml' | |
| - 'stable/anchore-admission-controller/Chart.yaml' | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| cluster: [ | |
| {distribution: "openshift", version: "4.18.0-okd"}, | |
| {distribution: "gke", version: "1.34"}, | |
| {distribution: aks, version: "1.34"}, | |
| ] | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Shellcheck | |
| uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0 | |
| - uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2.3.4 | |
| with: | |
| python-version: '3.10' | |
| - name: Set up Helm | |
| uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5 | |
| with: | |
| version: v3.8.0 | |
| - name: Set up chart-testing | |
| uses: helm/chart-testing-action@b43128a8b25298e1e7b043b78ea6613844e079b1 # v2.6.0 | |
| - name: Run chart-testing (list-changed) | |
| id: list-changed | |
| env: | |
| BASE_REF: ${{ github.event.pull_request.base.ref }} | |
| run: | | |
| changed=$(ct list-changed --config 'ct-config.yaml' --target-branch "$BASE_REF") | |
| if [[ -n "$changed" ]]; then | |
| echo "CHANGED=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| if echo "$changed" | grep -qE 'anchore-admission-controller|k8s-inventory'; then | |
| echo "ENTERPRISE_REQUIRED=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Run chart-testing (lint) | |
| id: lint | |
| run: ct lint --config 'ct-config.yaml' --target-branch "$BASE_REF" | |
| env: | |
| BASE_REF: ${{ github.event.pull_request.base.ref }} | |
| if: steps.list-changed.outputs.CHANGED == 'true' && github.event.pull_request.base.ref == 'main' | |
| - name: Run chart-testing but skip version check (lint) | |
| id: lintskipversion | |
| run: ct lint --config 'ct-config.yaml' --check-version-increment=false --target-branch "$BASE_REF" | |
| env: | |
| BASE_REF: ${{ github.event.pull_request.base.ref }} | |
| if: steps.list-changed.outputs.CHANGED == 'true' && github.event.pull_request.base.ref != 'main' | |
| - name: Set up oc client and kubectl | |
| if: steps.list-changed.outputs.CHANGED == 'true' | |
| run: | | |
| wget https://mirror.openshift.com/pub/openshift-v4/clients/oc/latest/linux/oc.tar.gz | |
| sudo tar xzvf oc.tar.gz -C /usr/local/bin | |
| curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" | |
| chmod +x kubectl | |
| sudo mv kubectl /usr/local/bin/ | |
| - name: Use Replicated Compatibilty Matrix for cluster creation | |
| if: steps.list-changed.outputs.CHANGED == 'true' | |
| id: create-cluster | |
| uses: replicatedhq/replicated-actions/create-cluster@77121785951d05387334b773644c356885191f14 # v1 | |
| with: | |
| api-token: ${{ secrets.ANCHORECI_REPLICATED_API_TOKEN }} | |
| cluster-name: ${{ github.ref_name }}-${{ matrix.cluster.distribution }}-${{ matrix.cluster.version }}-${{ github.run_id }} | |
| kubernetes-distribution: ${{ matrix.cluster.distribution }} | |
| kubernetes-version: ${{ matrix.cluster.version }} | |
| ttl: 20m | |
| timeout-minutes: 20 | |
| kubeconfig-path: ./tmp/kubeconfig | |
| nodes: 2 | |
| - name: check the cluster | |
| if: steps.list-changed.outputs.CHANGED == 'true' | |
| id: check-cluster | |
| run: | | |
| kubectl get nodes | |
| kubectl create namespace anchore | |
| echo "${ANCHORE_LICENSE}" | base64 --decode > /tmp/anchore-license | |
| kubectl --namespace anchore create secret generic anchore-enterprise-license --from-file=license.yaml=/tmp/anchore-license | |
| kubectl --namespace anchore create secret docker-registry anchore-enterprise-pullcreds --docker-server=docker.io --docker-username="${DOCKER_USER}" --docker-password="${DOCKER_PASS}" | |
| env: | |
| ANCHORE_LICENSE: ${{ secrets.B64_ANCHORE_LICENSE }} | |
| DOCKER_USER: ${{ secrets.ANCHOREREADONLY_DH_USERNAME }} | |
| DOCKER_PASS: ${{ secrets.ANCHOREREADONLY_DH_PAT }} | |
| KUBECONFIG: ./tmp/kubeconfig | |
| - name: Install CNPG operator | |
| if: steps.list-changed.outputs.CHANGED == 'true' | |
| env: | |
| KUBECONFIG: ./tmp/kubeconfig | |
| CLUSTER_DISTRIBUTION: ${{ matrix.cluster.distribution }} | |
| run: | | |
| helm repo add cnpg https://cloudnative-pg.github.io/charts | |
| helm repo update | |
| if [[ "$CLUSTER_DISTRIBUTION" == "openshift" ]]; then | |
| helm install cnpg cnpg/cloudnative-pg --namespace cnpg-system --create-namespace -f scripts/cnpg/cnpg-openshift-install.yaml --wait | |
| else | |
| helm install cnpg cnpg/cloudnative-pg --namespace cnpg-system --create-namespace --wait | |
| fi | |
| - name: Deploy CNPG PostgreSQL cluster | |
| if: steps.list-changed.outputs.CHANGED == 'true' | |
| run: | | |
| kubectl apply -f scripts/cnpg/cnpg-cluster.yaml | |
| kubectl wait --for=condition=Ready cluster/anchore-db -n anchore --timeout=300s | |
| kubectl --namespace anchore get pods | |
| env: | |
| KUBECONFIG: ./tmp/kubeconfig | |
| - name: Deploy enterprise for admission-controller/k8s-inventory testing | |
| if: steps.list-changed.outputs.ENTERPRISE_REQUIRED == 'true' | |
| env: | |
| KUBECONFIG: ./tmp/kubeconfig | |
| CLUSTER_DISTRIBUTION: ${{ matrix.cluster.distribution }} | |
| ANCHORE_LICENSE: ${{ secrets.B64_ANCHORE_LICENSE }} | |
| DOCKER_USER: ${{ secrets.ANCHOREREADONLY_DH_USERNAME }} | |
| DOCKER_PASS: ${{ secrets.ANCHOREREADONLY_DH_PAT }} | |
| run: | | |
| kubectl create namespace anchore-enterprise | |
| echo "${ANCHORE_LICENSE}" | base64 --decode > /tmp/anchore-license | |
| kubectl --namespace anchore-enterprise create secret generic anchore-enterprise-license --from-file=license.yaml=/tmp/anchore-license | |
| kubectl --namespace anchore-enterprise create secret docker-registry anchore-enterprise-pullcreds --docker-server=docker.io --docker-username="${DOCKER_USER}" --docker-password="${DOCKER_PASS}" | |
| kubectl apply -f scripts/cnpg/cnpg-cluster-ci-enterprise.yaml | |
| kubectl wait --for=condition=Ready cluster/anchore-db -n anchore-enterprise --timeout=300s | |
| helm repo add anchore https://charts.anchore.io || echo "anchore repo already added" | |
| helm repo add bitnami https://charts.bitnami.com/bitnami || echo "bitnami repo already added" | |
| helm repo add prometheus-community https://prometheus-community.github.io/helm-charts || echo "prometheus-community repo already added" | |
| helm repo update | |
| if [[ "$CLUSTER_DISTRIBUTION" == "openshift" ]]; then | |
| echo "Installing enterprise on openshift" | |
| helm install enterprise anchore/enterprise --namespace anchore-enterprise -f stable/anchore-admission-controller/ci/enterprise-openshift-vals.yaml --wait | |
| else | |
| echo "Installing enterprise" | |
| helm install enterprise anchore/enterprise --namespace anchore-enterprise -f stable/anchore-admission-controller/ci/enterprise-vals.yaml --wait | |
| fi | |
| kubectl --namespace anchore get pods | |
| kubectl --namespace anchore-enterprise get pods | |
| - name: Update to rc image if needed | |
| if: ${{ github.event.pull_request.base.ref == 'rc5x' || github.ref_name == 'rc5x' }} | |
| env: | |
| HEAD_REF: ${{ github.event.pull_request.head.ref }} | |
| CLUSTER_DISTRIBUTION: ${{ matrix.cluster.distribution }} | |
| run: | | |
| echo "Branch: $HEAD_REF" | |
| echo "Distribution: $CLUSTER_DISTRIBUTION" | |
| if [[ "$CLUSTER_DISTRIBUTION" == "openshift" ]]; then | |
| echo "updating openshift-test.yaml with rc image" | |
| echo 'image: "docker.io/anchore/enterprise-dev:rc"' >> stable/enterprise/ci/openshift-test.yaml | |
| echo 'ui:' >> stable/enterprise/ci/openshift-test.yaml | |
| echo ' image: "docker.io/anchore/anchore-on-prem-ui-dev:rc"' >> stable/enterprise/ci/openshift-test.yaml | |
| echo "Appended to stable/enterprise/ci/openshift-test.yaml" | |
| else | |
| echo "updating ci-values.yaml with rc image" | |
| echo 'image: "docker.io/anchore/enterprise-dev:rc"' >> stable/enterprise/ci/ci-values.yaml | |
| echo 'ui:' >> stable/enterprise/ci/ci-values.yaml | |
| echo ' image: "docker.io/anchore/anchore-on-prem-ui-dev:rc"' >> stable/enterprise/ci/ci-values.yaml | |
| echo "Appended to stable/enterprise/ci/ci-values.yaml" | |
| fi | |
| - name: Update to nightly image if needed | |
| if: ${{ github.event.pull_request.base.ref == 'nightly' || github.ref_name == 'nightly' }} | |
| env: | |
| CLUSTER_DISTRIBUTION: ${{ matrix.cluster.distribution }} | |
| run: | | |
| if [[ "$CLUSTER_DISTRIBUTION" == "openshift" ]]; then | |
| echo "updating openshift-test.yaml with nightly image" | |
| echo 'image: "docker.io/anchore/enterprise-dev:nightly"' >> stable/enterprise/ci/openshift-test.yaml | |
| echo 'ui:' >> stable/enterprise/ci/openshift-test.yaml | |
| echo ' image: "docker.io/anchore/anchore-on-prem-ui-dev:nightly"' >> stable/enterprise/ci/openshift-test.yaml | |
| echo "Appended to stable/enterprise/ci/openshift-test.yaml" | |
| else | |
| echo "updating ci-values.yaml with nightly image" | |
| echo 'image: "docker.io/anchore/enterprise-dev:nightly"' >> stable/enterprise/ci/ci-values.yaml | |
| echo 'ui:' >> stable/enterprise/ci/ci-values.yaml | |
| echo ' image: "docker.io/anchore/anchore-on-prem-ui-dev:nightly"' >> stable/enterprise/ci/ci-values.yaml | |
| echo "Appended to stable/enterprise/ci/ci-values.yaml" | |
| fi | |
| - name: Run chart-testing | |
| if: steps.list-changed.outputs.CHANGED == 'true' | |
| run: | | |
| ls -al | |
| echo ${PWD} | |
| files_changed="$(git diff --name-only origin/${TARGET_BRANCH} | sort | uniq)" | |
| charts_dirs_changed="$(echo "$files_changed" | xargs dirname | grep -o "stable/[^/]*" | sort | uniq || true)" | |
| for chart in ${charts_dirs_changed}; do | |
| # if distribution is openshift, then echo openshift-test.yaml | |
| if [[ "$CLUSTER_DISTRIBUTION" == "openshift" ]]; then | |
| echo "creating openshift-test-values.yaml for ${chart}" | |
| pushd "${chart}" | |
| rm -rvf ci/*-values.yaml | |
| mv ci/openshift-test.yaml ci/openshift-test-values.yaml | |
| popd | |
| fi | |
| done | |
| changed_charts=$(ct list-changed --config ct-config.yaml --target-branch "$TARGET_BRANCH") | |
| other_charts=$(echo "$changed_charts" | grep -v 'anchore-admission-controller' || true) | |
| if echo "$changed_charts" | grep -q 'anchore-admission-controller'; then | |
| if [[ -n "$other_charts" ]]; then | |
| echo "Admission controller changed alongside other charts. Installing other charts first, then admission controller." | |
| ct install --config ct-config.yaml --target-branch "$TARGET_BRANCH" --excluded-charts "anchore-admission-controller" --helm-extra-args "--timeout 600s" | |
| fi | |
| ct install --config ct-config.yaml --target-branch "$TARGET_BRANCH" --charts stable/anchore-admission-controller --helm-extra-args "--timeout 600s" | |
| else | |
| ct install --config ct-config.yaml --target-branch "$TARGET_BRANCH" --helm-extra-args "--timeout 600s" | |
| fi | |
| env: | |
| KUBECONFIG: ./tmp/kubeconfig | |
| TARGET_BRANCH: "${{ github.event.pull_request.base.ref }}" | |
| CLUSTER_DISTRIBUTION: ${{ matrix.cluster.distribution }} | |
| - name: Remove Cluster | |
| if: steps.list-changed.outputs.CHANGED == 'true' | |
| id: remove-cluster | |
| uses: replicatedhq/replicated-actions/remove-cluster@77121785951d05387334b773644c356885191f14 # v1 | |
| continue-on-error: true # It could be that the cluster is already removed | |
| with: | |
| api-token: ${{ secrets.ANCHORECI_REPLICATED_API_TOKEN }} | |
| cluster-id: ${{ steps.create-cluster.outputs.cluster-id }} |