|
| 1 | +name: Integration Responses & Conversations Auth Tests |
| 2 | + |
| 3 | +run-name: Run responses and conversations auth tests with Kubernetes authentication |
| 4 | + |
| 5 | +on: |
| 6 | + push: |
| 7 | + branches: |
| 8 | + - main |
| 9 | + - 'release-[0-9]+.[0-9]+.x' |
| 10 | + pull_request: |
| 11 | + branches: |
| 12 | + - main |
| 13 | + - 'release-[0-9]+.[0-9]+.x' |
| 14 | + paths: |
| 15 | + - 'distributions/**' |
| 16 | + - 'src/llama_stack/**' |
| 17 | + - '!src/llama_stack_ui/**' |
| 18 | + - 'tests/integration/**' |
| 19 | + - 'uv.lock' |
| 20 | + - 'pyproject.toml' |
| 21 | + - 'requirements.txt' |
| 22 | + - '.github/workflows/integration-responses-conversations-auth-tests.yml' # This workflow |
| 23 | + - 'scripts/integration-responses-conversations-auth-tests.sh' |
| 24 | + |
| 25 | +concurrency: |
| 26 | + group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && github.run_id || github.ref }} |
| 27 | + cancel-in-progress: true |
| 28 | + |
| 29 | +permissions: |
| 30 | + contents: read |
| 31 | + |
| 32 | +jobs: |
| 33 | + test-matrix: |
| 34 | + runs-on: ubuntu-latest |
| 35 | + strategy: |
| 36 | + matrix: |
| 37 | + auth-provider: [oauth2_token] |
| 38 | + fail-fast: false # we want to run all tests regardless of failure |
| 39 | + |
| 40 | + steps: |
| 41 | + - name: Checkout repository |
| 42 | + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 43 | + |
| 44 | + - name: Install dependencies |
| 45 | + uses: ./.github/actions/setup-runner |
| 46 | + |
| 47 | + - name: Install minikube |
| 48 | + if: ${{ matrix.auth-provider == 'kubernetes' }} |
| 49 | + uses: medyagh/setup-minikube@e9e035a86bbc3caea26a450bd4dbf9d0c453682e # v0.0.21 |
| 50 | + |
| 51 | + - name: Start minikube |
| 52 | + if: ${{ matrix.auth-provider == 'oauth2_token' }} |
| 53 | + run: | |
| 54 | + minikube start |
| 55 | + kubectl get pods -A |
| 56 | +
|
| 57 | + - name: Configure Kube Auth |
| 58 | + if: ${{ matrix.auth-provider == 'oauth2_token' }} |
| 59 | + run: | |
| 60 | + kubectl create namespace llama-stack |
| 61 | + for account in llama-stack-auth llama-stack-user1 llama-stack-user2; do |
| 62 | + kubectl create serviceaccount $account -n llama-stack |
| 63 | + kubectl create token $account -n llama-stack > $account-token |
| 64 | + done |
| 65 | +
|
| 66 | + - name: Set Kubernetes Config |
| 67 | + if: ${{ matrix.auth-provider == 'oauth2_token' }} |
| 68 | + run: | |
| 69 | + echo "KUBERNETES_API_SERVER_URL=$(kubectl get --raw /.well-known/openid-configuration| jq -r .jwks_uri)" >> $GITHUB_ENV |
| 70 | + echo "KUBERNETES_CA_CERT_PATH=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.certificate-authority}')" >> $GITHUB_ENV |
| 71 | + echo "KUBERNETES_ISSUER=$(kubectl get --raw /.well-known/openid-configuration| jq -r .issuer)" >> $GITHUB_ENV |
| 72 | + echo "KUBERNETES_AUDIENCE=$(kubectl create token llama-stack-auth -n llama-stack --duration=1h | cut -d. -f2 | base64 -d | jq -r '.aud[0]')" >> $GITHUB_ENV |
| 73 | + echo "TOKEN=$(cat llama-stack-auth-token)" >> $GITHUB_ENV |
| 74 | +
|
| 75 | + - name: List response recordings (replay) |
| 76 | + if: ${{ matrix.auth-provider == 'oauth2_token' }} |
| 77 | + run: | |
| 78 | + echo "Response recordings in checkout:" |
| 79 | + ls -la tests/integration/responses/recordings/ || true |
| 80 | +
|
| 81 | + - name: Set Kube Auth Config and run server |
| 82 | + env: |
| 83 | + OPENAI_API_KEY: "dummy-key-for-replay-mode" |
| 84 | + # Enable replay so the server uses checked-in recordings instead of calling the API |
| 85 | + LLAMA_STACK_TEST_INFERENCE_MODE: "replay" |
| 86 | + # Pin recording dir to workspace so the server finds tests/integration/*/recordings/ |
| 87 | + LLAMA_STACK_TEST_RECORDING_DIR: ${{ github.workspace }}/tests/integration/common |
| 88 | + # Tell the server to sync test context from client headers so recordings |
| 89 | + # are looked up in the correct per-test-directory (e.g. responses/recordings/) |
| 90 | + LLAMA_STACK_TEST_STACK_CONFIG_TYPE: "server" |
| 91 | + if: ${{ matrix.auth-provider == 'oauth2_token' }} |
| 92 | + run: | |
| 93 | + run_dir=$(mktemp -d) |
| 94 | + cat <<EOF > $run_dir/config.yaml |
| 95 | + version: '2' |
| 96 | + image_name: kube |
| 97 | + distro_name: kube |
| 98 | + apis: |
| 99 | + - files |
| 100 | + - inference |
| 101 | + - vector_io |
| 102 | + - tool_runtime |
| 103 | + - agents |
| 104 | + providers: |
| 105 | + files: |
| 106 | + - provider_id: meta-reference-files |
| 107 | + provider_type: inline::localfs |
| 108 | + config: |
| 109 | + storage_dir: $run_dir/files |
| 110 | + metadata_store: |
| 111 | + table_name: files_metadata |
| 112 | + backend: sql_default |
| 113 | + inference: |
| 114 | + - provider_id: openai |
| 115 | + provider_type: remote::openai |
| 116 | + config: |
| 117 | + api_key: \${env.OPENAI_API_KEY} |
| 118 | + vector_io: |
| 119 | + - provider_id: faiss |
| 120 | + provider_type: inline::faiss |
| 121 | + config: |
| 122 | + persistence: |
| 123 | + namespace: vector_io::faiss |
| 124 | + backend: kv_default |
| 125 | + tool_runtime: |
| 126 | + - provider_id: rag-runtime |
| 127 | + provider_type: inline::rag-runtime |
| 128 | + config: {} |
| 129 | + agents: |
| 130 | + - provider_id: meta-reference |
| 131 | + provider_type: inline::meta-reference |
| 132 | + config: |
| 133 | + persistence: |
| 134 | + agent_state: |
| 135 | + namespace: agents |
| 136 | + backend: kv_default |
| 137 | + responses: |
| 138 | + table_name: responses |
| 139 | + backend: sql_default |
| 140 | + max_write_queue_size: 10000 |
| 141 | + num_writers: 4 |
| 142 | + storage: |
| 143 | + backends: |
| 144 | + kv_default: |
| 145 | + type: kv_sqlite |
| 146 | + db_path: $run_dir/kvstore.db |
| 147 | + sql_default: |
| 148 | + type: sql_sqlite |
| 149 | + db_path: $run_dir/sql_store.db |
| 150 | + stores: |
| 151 | + metadata: |
| 152 | + namespace: registry |
| 153 | + backend: kv_default |
| 154 | + inference: |
| 155 | + table_name: inference_store |
| 156 | + backend: sql_default |
| 157 | + conversations: |
| 158 | + table_name: openai_conversations |
| 159 | + backend: sql_default |
| 160 | + prompts: |
| 161 | + namespace: prompts |
| 162 | + backend: kv_default |
| 163 | + models: |
| 164 | + - model_id: openai/gpt-4o |
| 165 | + model_type: llm |
| 166 | + provider_id: openai |
| 167 | + server: |
| 168 | + port: 8321 |
| 169 | + auth: |
| 170 | + access_policy: |
| 171 | + - permit: |
| 172 | + actions: [read] |
| 173 | + resource: model::* |
| 174 | + description: Any authenticated user can use configured models (inference, responses) |
| 175 | + - permit: |
| 176 | + actions: [create] |
| 177 | + resource: sql_record::openai_files::* |
| 178 | + description: Any authenticated user can create files |
| 179 | + - permit: |
| 180 | + actions: [read, delete] |
| 181 | + resource: sql_record::openai_files::* |
| 182 | + when: |
| 183 | + - user is owner |
| 184 | + description: Users can read and delete their own files |
| 185 | + - permit: |
| 186 | + actions: [create] |
| 187 | + resource: sql_record::openai_conversations::* |
| 188 | + description: Any authenticated user can create conversations |
| 189 | + - permit: |
| 190 | + actions: [read, update, delete] |
| 191 | + resource: sql_record::openai_conversations::* |
| 192 | + when: |
| 193 | + - user is owner |
| 194 | + description: Users can access their own conversations |
| 195 | + - permit: |
| 196 | + actions: [create] |
| 197 | + resource: sql_record::conversation_items::* |
| 198 | + description: Any authenticated user can create conversation items |
| 199 | + - permit: |
| 200 | + actions: [read, update, delete] |
| 201 | + resource: sql_record::conversation_items::* |
| 202 | + when: |
| 203 | + - user is owner |
| 204 | + description: Users can access items in their own conversations |
| 205 | + - permit: |
| 206 | + actions: [create] |
| 207 | + resource: sql_record::responses::* |
| 208 | + description: Any authenticated user can create responses |
| 209 | + - permit: |
| 210 | + actions: [read, update, delete] |
| 211 | + resource: sql_record::responses::* |
| 212 | + when: |
| 213 | + - user is owner |
| 214 | + description: Users can access their own responses |
| 215 | + EOF |
| 216 | + yq eval '.server.auth.provider_config.type = "${{ matrix.auth-provider }}"' -i $run_dir/config.yaml |
| 217 | + yq eval '.server.auth.provider_config.tls_cafile = "${{ env.KUBERNETES_CA_CERT_PATH }}"' -i $run_dir/config.yaml |
| 218 | + yq eval '.server.auth.provider_config.issuer = "${{ env.KUBERNETES_ISSUER }}"' -i $run_dir/config.yaml |
| 219 | + yq eval '.server.auth.provider_config.audience = "${{ env.KUBERNETES_AUDIENCE }}"' -i $run_dir/config.yaml |
| 220 | + yq eval '.server.auth.provider_config.jwks.uri = "${{ env.KUBERNETES_API_SERVER_URL }}"' -i $run_dir/config.yaml |
| 221 | + yq eval '.server.auth.provider_config.jwks.token = "${{ env.TOKEN }}"' -i $run_dir/config.yaml |
| 222 | + cat $run_dir/config.yaml |
| 223 | +
|
| 224 | + # avoid line breaks in the server log, especially because we grep it below. |
| 225 | + export LLAMA_STACK_LOG_WIDTH=200 |
| 226 | + # OPENAI_API_KEY is set via env at step level |
| 227 | + nohup uv run llama stack run $run_dir/config.yaml > server.log 2>&1 & |
| 228 | +
|
| 229 | + - name: Wait for Llama Stack server to be ready |
| 230 | + run: | |
| 231 | + echo "Waiting for Llama Stack server..." |
| 232 | + for i in {1..30}; do |
| 233 | + # Note: /v1/health does not require authentication |
| 234 | + if curl -s -L http://localhost:8321/v1/health | grep -q "OK"; then |
| 235 | + echo "Llama Stack server is up!" |
| 236 | + if grep -q "Enabling authentication with provider: ${{ matrix.auth-provider }}" server.log; then |
| 237 | + echo "Llama Stack server is configured to use ${{ matrix.auth-provider }} auth" |
| 238 | + exit 0 |
| 239 | + else |
| 240 | + echo "Llama Stack server is not configured to use ${{ matrix.auth-provider }} auth" |
| 241 | + cat server.log |
| 242 | + exit 1 |
| 243 | + fi |
| 244 | + fi |
| 245 | + sleep 1 |
| 246 | + done |
| 247 | + echo "Llama Stack server failed to start" |
| 248 | + cat server.log |
| 249 | + exit 1 |
| 250 | +
|
| 251 | + - name: Test auth |
| 252 | + run: | |
| 253 | + export INFERENCE_MODEL=openai/gpt-4o |
| 254 | + # Run the auth tests |
| 255 | + ./scripts/integration-responses-conversations-auth-tests.sh |
| 256 | +
|
| 257 | + - name: Server log on failure |
| 258 | + if: failure() |
| 259 | + run: | |
| 260 | + echo "=== Llama Stack server log (last 500 lines) ===" |
| 261 | + tail -500 server.log |
0 commit comments