-
Notifications
You must be signed in to change notification settings - Fork 661
286 lines (242 loc) · 8.87 KB
/
ci.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
name: CI
on:
push:
branches: [ main ]
pull_request:
branches: [ main ]
env:
controller_registry: docker.io
controller_repository: bitnami/sealed-secrets-controller
controller_tag: latest
jobs:
load-versions:
name: Load versions.env
runs-on: ubuntu-latest
steps:
- name: checkout repo
uses: actions/checkout@v3.1.0
- id: load-versions
run: |
source $GITHUB_WORKSPACE/versions.env
# env vars
echo "GO_VERSION=$GO_VERSION" >> $GITHUB_ENV
echo "GO_VERSION_LIST=$GO_VERSION_LIST" >> $GITHUB_ENV
# outputs
echo "go_version=${GO_VERSION}" >> $GITHUB_OUTPUT
echo "go_version_list=${GO_VERSION_LIST}" >> $GITHUB_OUTPUT
outputs:
go_version: ${{ steps.load-versions.outputs.go_version }}
go_version_list: ${{ steps.load-versions.outputs.go_version_list }}
linter:
needs: load-versions
name: Run linters
runs-on: ubuntu-latest
strategy:
matrix:
go: ${{ fromJSON(needs.load-versions.outputs.go_version_list) }}
os: [ubuntu-latest]
golangci-lint: ["1.56.1"]
gosec: ["2.19.0"]
steps:
- name: Set up Go 1.x
uses: actions/setup-go@v3.3.1
with:
go-version: ${{ matrix.go }}
id: go
- name: Check out code into the Go module directory
uses: actions/checkout@v3.1.0
- name: Install dependencies
run: |
go install github.com/golangci/golangci-lint/cmd/golangci-lint@v${{ matrix.golangci-lint }}
go install github.com/securego/gosec/v2/cmd/gosec@v${{ matrix.gosec }}
- name: Run linter
run: make lint
- name: Run gosec
run: make lint-gosec
test:
needs: load-versions
name: Build
runs-on: ${{ matrix.os }}
strategy:
matrix:
go: ${{ fromJSON(needs.load-versions.outputs.go_version_list) }}
os: [macos-latest, windows-latest, ubuntu-latest]
gotestsum: ["1.8.1"]
steps:
- name: Set up Go 1.x
uses: actions/setup-go@v3.3.1
with:
go-version: ${{ matrix.go }}
id: go
- name: Check out code into the Go module directory
uses: actions/checkout@v3.1.0
- name: Install dependencies
run: |
go install gotest.tools/gotestsum@v${{ matrix.gotestsum }}
- name: Test
run: make GO_FLAGS="--junitfile report.xml --format testname" test
- name: Test Summary
uses: test-summary/action@v2
with:
paths: |
report.xml
container:
needs: load-versions
name: Build Container
runs-on: ubuntu-latest
steps:
- name: "Set environmental variables"
run: |
echo "CONTROLLER_IMAGE=$controller_registry/$controller_repository:$controller_tag" >> $GITHUB_ENV
- name: Check out code
uses: actions/checkout@v3.1.0
- name: Install Cosign
uses: sigstore/cosign-installer@v3.4.0
with:
cosign-release: v2.2.3
- name: Distroless verify
run: |
diff <(grep FROM docker/kubeseal.Dockerfile | awk '{print $2}') \
<(grep FROM docker/controller.Dockerfile | awk '{print $2}')
cosign verify "$(grep FROM docker/controller.Dockerfile | awk '{print $2}')" --certificate-oidc-issuer https://accounts.google.com --certificate-identity keyless@distroless.iam.gserviceaccount.com
- name: Setup kubecfg
run: |
mkdir -p ~/bin
curl -sLf https://github.com/kubecfg/kubecfg/releases/download/v0.26.0/kubecfg_Linux_X64 >~/bin/kubecfg
chmod +x ~/bin/kubecfg
- name: Set up Go 1.x
uses: actions/setup-go@v3.3.1
with:
go-version: ${{ needs.load-versions.outputs.go_version }}
id: go
- name: Docker build
run: |
export PATH=~/bin:$PATH
make CONTROLLER_IMAGE=$CONTROLLER_IMAGE IMAGE_PULL_POLICY=Never controller.yaml
make CONTROLLER_IMAGE=$CONTROLLER_IMAGE controller.image.linux-amd64
docker tag $CONTROLLER_IMAGE-linux-amd64 $CONTROLLER_IMAGE
docker save $CONTROLLER_IMAGE -o /tmp/controller-image.tar
- name: Upload manifest artifact
uses: actions/upload-artifact@v3.1.0
with:
name: controller-manifest
path: controller.yaml
- name: Upload container image artifact
uses: actions/upload-artifact@v3.1.0
with:
name: controller-image
path: /tmp/controller-image.tar
integration-yaml:
needs: [ load-versions, container ]
name: Integration (controller.yaml)
runs-on: ubuntu-latest
strategy:
matrix:
k8s: ["1.24.15","1.25.11","1.26.6","1.27.3"]
env:
MINIKUBE_WANTUPDATENOTIFICATION: "false"
MINIKUBE_WANTREPORTERRORPROMPT: "false"
CHANGE_MINIKUBE_NONE_USER: "true"
steps:
- name: "Set environmental variables"
run: |
echo "CONTROLLER_IMAGE=$controller_registry/$controller_repository:$controller_tag" >> $GITHUB_ENV
- name: Set up Go 1.x
uses: actions/setup-go@v3.3.1
with:
go-version: ${{ needs.load-versions.outputs.go_version }}
id: go
- name: Set up Ginkgo
run: |
go install github.com/onsi/ginkgo/ginkgo@v1.16.4
- name: Check out code into the Go module directory
uses: actions/checkout@v3.1.0
- uses: medyagh/setup-minikube@v0.0.13
with:
minikube-version: 1.30.1
kubernetes-version: ${{ matrix.k8s }}
# need to delete old state of the cluster, see:
# https://github.com/kubernetes/minikube/issues/8765
- name: K8s setup
run: |
minikube delete
minikube config set kubernetes-version v${{ matrix.k8s }}
minikube start --vm-driver=docker
minikube update-context
kubectl cluster-info
- name: Download manifest artifact
uses: actions/download-artifact@v3.0.1
with:
name: controller-manifest
- name: Download container image artifact
uses: actions/download-artifact@v3.0.1
with:
name: controller-image
- name: Load docker image
run: |
eval $(minikube docker-env)
docker load -i controller-image.tar
docker inspect $CONTROLLER_IMAGE
- name: Testing environment setup
run: |
kubectl apply -f controller.yaml
kubectl rollout status deployment/sealed-secrets-controller -n kube-system -w --timeout=1m || kubectl -n kube-system describe pod -lname=sealed-secrets-controller
- name: Integration tests
run: make integrationtest CONTROLLER_IMAGE=$CONTROLLER_IMAGE GINKGO="ginkgo -v --randomizeSuites --failOnPending --trace --progress --compilers=2 --nodes=4"
integration-chart:
needs: [ load-versions, container ]
name: Integration (Helm Chart)
runs-on: ubuntu-latest
strategy:
matrix:
k8s: ["1.24.15","1.25.11","1.26.6","1.27.3"]
env:
MINIKUBE_WANTUPDATENOTIFICATION: "false"
MINIKUBE_WANTREPORTERRORPROMPT: "false"
CHANGE_MINIKUBE_NONE_USER: "true"
steps:
- name: "Set environmental variables"
run: |
echo "CONTROLLER_IMAGE=$controller_registry/$controller_repository:$controller_tag" >> $GITHUB_ENV
- name: Set up Go 1.x
uses: actions/setup-go@v3.3.1
with:
go-version: ${{ needs.load-versions.outputs.go_version }}
id: go
- name: Set up Ginkgo
run: |
go install github.com/onsi/ginkgo/ginkgo@v1.16.4
- name: Check out code into the Go module directory
uses: actions/checkout@v3.1.0
- uses: medyagh/setup-minikube@v0.0.13
with:
minikube-version: 1.30.1
kubernetes-version: ${{ matrix.k8s }}
- name: Install Helm
uses: azure/setup-helm@v3.5
with:
version: v3.12.0
# need to delete old state of the cluster, see:
# https://github.com/kubernetes/minikube/issues/8765
- name: K8s setup
run: |
minikube delete
minikube config set kubernetes-version v${{ matrix.k8s }}
minikube start --vm-driver=docker
minikube update-context
kubectl cluster-info
- name: Download container image artifact
uses: actions/download-artifact@v3.0.1
with:
name: controller-image
- name: Load docker image
run: |
eval $(minikube docker-env)
docker load -i controller-image.tar
docker inspect $CONTROLLER_IMAGE
- name: Testing environment setup
run: |
helm install sealed-secrets -n kube-system --set fullnameOverride=sealed-secrets-controller --set image.registry=$controller_registry --set image.repository=$controller_repository --set image.tag=$controller_tag --set image.pullPolicy=Never helm/sealed-secrets
kubectl rollout status deployment/sealed-secrets-controller -n kube-system -w --timeout=1m || kubectl -n kube-system describe pod -lapp.kubernetes.io/name=sealed-secrets
- name: Integration tests
run: make integrationtest CONTROLLER_IMAGE=$CONTROLLER_IMAGE GINKGO="ginkgo -v --randomizeSuites --failOnPending --trace --progress --compilers=2 --nodes=4"