ipsec: Safely delete Xfrm state #3712
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Conformance Kind Envoy Embedded | |
| # Any change in triggers needs to be reflected in the concurrency group. | |
| on: | |
| pull_request: | |
| paths-ignore: | |
| - 'Documentation/**' | |
| - 'test/**' | |
| push: | |
| branches: | |
| - main | |
| - ft/main/** | |
| paths-ignore: | |
| - 'Documentation/**' | |
| - 'test/**' | |
| permissions: read-all | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.after }} | |
| cancel-in-progress: true | |
| env: | |
| kind_config: .github/kind-config.yaml | |
| cilium_cli_ci_version: | |
| jobs: | |
| installation-and-connectivity: | |
| name: "Installation and Connectivity Test" | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| env: | |
| job_name: "Installation and Connectivity Test" | |
| steps: | |
| - name: Collect Workflow Telemetry | |
| uses: catchpoint/workflow-telemetry-action@94c3c3d9567a0205de6da68a76c428ce4e769af1 # v2.0.0 | |
| with: | |
| comment_on_pr: false | |
| - name: Checkout target branch to access local actions | |
| uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 | |
| with: | |
| ref: ${{ github.base_ref || github.ref }} | |
| persist-credentials: false | |
| - name: Set Environment Variables | |
| uses: ./.github/actions/set-env-variables | |
| - name: Get Cilium's default values | |
| id: default_vars | |
| uses: ./.github/actions/helm-default | |
| with: | |
| image-tag: ${{ github.event.pull_request.head.sha }} | |
| - name: Set up job variables | |
| id: vars | |
| run: | | |
| # Note: On Kind, we install Cilium with HostPort (portmap CNI chaining) enabled, | |
| # to ensure coverage of that feature in cilium connectivity test | |
| CILIUM_INSTALL_DEFAULTS="${{ steps.default_vars.outputs.cilium_install_defaults }} \ | |
| --helm-set=hubble.relay.enabled=true | |
| --helm-set=cni.chainingMode=portmap \ | |
| --helm-set-string=kubeProxyReplacement=true \ | |
| --helm-set=loadBalancer.l7.backend=envoy \ | |
| --helm-set=tls.secretsBackend=k8s \ | |
| --helm-set=envoy.enabled=false \ | |
| --wait=false" | |
| CONNECTIVITY_TEST_DEFAULTS="--flow-validation=disabled --hubble=false --collect-sysdump-on-failure" | |
| echo cilium_install_defaults=${CILIUM_INSTALL_DEFAULTS} >> $GITHUB_OUTPUT | |
| echo connectivity_test_defaults=${CONNECTIVITY_TEST_DEFAULTS} >> $GITHUB_OUTPUT | |
| echo sha=${{ steps.default_vars.outputs.sha }} >> $GITHUB_OUTPUT | |
| - name: Install Cilium CLI | |
| uses: cilium/cilium-cli@bfa4f93a41da410a1b4c9373c1694ca6d5c35ade # v0.16.6 | |
| with: | |
| repository: ${{ env.CILIUM_CLI_RELEASE_REPO }} | |
| release-version: ${{ env.CILIUM_CLI_VERSION }} | |
| ci-version: ${{ env.cilium_cli_ci_version }} | |
| - name: Checkout code | |
| uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 | |
| with: | |
| ref: ${{ steps.vars.outputs.sha }} | |
| persist-credentials: false | |
| - name: Create kind cluster | |
| uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0 | |
| with: | |
| version: ${{ env.KIND_VERSION }} | |
| node_image: ${{ env.KIND_K8S_IMAGE }} | |
| kubectl_version: ${{ env.KIND_K8S_VERSION }} | |
| config: ${{ env.kind_config }} | |
| wait: 0 # The control-plane never becomes ready, since no CNI is present | |
| - name: Wait for images to be available | |
| timeout-minutes: 30 | |
| shell: bash | |
| run: | | |
| for image in cilium-ci operator-generic-ci hubble-relay-ci ; do | |
| until docker manifest inspect quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/$image:${{ steps.vars.outputs.sha }} &> /dev/null; do sleep 45s; done | |
| done | |
| - name: Install Cilium | |
| id: install-cilium | |
| run: | | |
| cilium install ${{ steps.vars.outputs.cilium_install_defaults }} | |
| - name: Wait for Cilium status to be ready | |
| run: | | |
| cilium status --wait | |
| kubectl -n kube-system get pods | |
| - name: Port forward Relay | |
| run: | | |
| cilium hubble port-forward& | |
| sleep 10s | |
| [[ $(pgrep -f "cilium.*hubble.*port-forward|kubectl.*port-forward.*hubble-relay" | wc -l) == 2 ]] | |
| - name: Make JUnit report directory | |
| run: | | |
| mkdir -p cilium-junits | |
| - name: Run connectivity test | |
| run: | | |
| cilium connectivity test ${{ steps.vars.outputs.connectivity_test_defaults }} \ | |
| --junit-file "cilium-junits/${{ env.job_name }}.xml" --junit-property github_job_step="Run connectivity test" | |
| - name: Post-test information gathering | |
| if: ${{ !success() && steps.install-cilium.outcome != 'skipped' }} | |
| run: | | |
| kubectl get pods --all-namespaces -o wide | |
| cilium status | |
| cilium sysdump --output-filename cilium-sysdump-final | |
| shell: bash {0} # Disable default fail-fast behaviour so that all commands run independently | |
| - name: Upload artifacts | |
| if: ${{ !success() }} | |
| uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 | |
| with: | |
| name: cilium-sysdumps | |
| path: cilium-sysdump-*.zip | |
| retention-days: 5 | |
| - name: Upload JUnits [junit] | |
| if: ${{ always() }} | |
| uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3 | |
| with: | |
| name: cilium-junits | |
| path: cilium-junits/*.xml | |
| retention-days: 5 | |
| - name: Publish Test Results As GitHub Summary | |
| if: ${{ always() }} | |
| uses: aanm/junit2md@332ebf0fddd34e91b03a832cfafaa826306558f9 # v0.0.3 | |
| with: | |
| junit-directory: "cilium-junits" |