Bottom turtle ha registry tests (#929)
* Bottom turtle ha registry tests Signed-off-by: Kevin Fox <[email protected]> * Fix test because of spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Fix config options Signed-off-by: Kevin Fox <[email protected]> * Fix yq issue and log better Signed-off-by: Kevin Fox <[email protected]> * Fix some things Signed-off-by: Kevin Fox <[email protected]> * Change timeout and fix image Signed-off-by: Kevin Fox <[email protected]> * Bump up zot version. Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Log less Signed-off-by: Kevin Fox <[email protected]> * Cleanup Signed-off-by: Kevin Fox <[email protected]> * Make test less different then real deployment Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
This commit is contained in:
kfox1111
@@ -0,0 +1,25 @@
|
||||
apiVersion: kubelet.config.k8s.io/v1
|
||||
kind: CredentialProviderConfig
|
||||
providers:
|
||||
- name: k8s-image-cred-spire-identity-exchange
|
||||
matchImages:
|
||||
- "zot.production.other"
|
||||
defaultCacheDuration: "0s"
|
||||
apiVersion: credentialprovider.kubelet.k8s.io/v1
|
||||
args:
|
||||
- "--username=zot"
|
||||
- "--mode=spire-identity-exchange"
|
||||
- "--url=https://spire-identity-exchange-rest-spiffe.production.other"
|
||||
- "--stack=image_pull"
|
||||
- "--registry-audience=zot"
|
||||
- "--spiffe-audience=spire-identity-exchange"
|
||||
- "--spiffe-hint=image-pull"
|
||||
- "--spiffe-id=spiffe://production.other/service/spire-identity-exchange"
|
||||
- "--timeout=10s"
|
||||
env:
|
||||
- name: SPIFFE_ENDPOINT_SOCKET
|
||||
value: unix:///var/run/spire/agent/sockets/main/public/api.sock
|
||||
tokenAttributes:
|
||||
serviceAccountTokenAudience: "spire-identity-exchange"
|
||||
cacheType: "Token"
|
||||
requireServiceAccount: true
|
||||
@@ -30,6 +30,39 @@ nodes:
|
||||
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public
|
||||
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-2-b/public
|
||||
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public
|
||||
# One spire-ha-agent on the host is shared by all three virtual nodes, with a
|
||||
# spiffe-socat-unix bridge per node in front of it. Mount that bridge where a
|
||||
# package installed spire-ha-agent@main listens, so kubelet's configuration in
|
||||
# the node is the same one a real bare metal node would use.
|
||||
- hostPath: /var/run/spiffe/socat/unix/k8s-kubelet-2/public
|
||||
containerPath: /var/run/spire/agent/sockets/main/public
|
||||
- hostPath: ./.github/kind/conf/credential-providers
|
||||
containerPath: /credential-plugins
|
||||
- hostPath: ./.github/kind/conf/credential-provider-config.yaml
|
||||
containerPath: /etc/kubernetes/credential-provider-config.yaml
|
||||
kubeadmConfigPatches:
|
||||
- |
|
||||
apiVersion: kubeadm.k8s.io/v1beta3
|
||||
kind: JoinConfiguration
|
||||
nodeRegistration:
|
||||
kubeletExtraArgs:
|
||||
image-credential-provider-config: /etc/kubernetes/credential-provider-config.yaml
|
||||
image-credential-provider-bin-dir: /credential-plugins
|
||||
kubeadmConfigPatchesJSON6902:
|
||||
- group: kubeadm.k8s.io
|
||||
version: v1beta4
|
||||
kind: JoinConfiguration
|
||||
patch: |
|
||||
- op: add
|
||||
path: /nodeRegistration/kubeletExtraArgs/-
|
||||
value:
|
||||
name: image-credential-provider-config
|
||||
value: /etc/kubernetes/credential-provider-config.yaml
|
||||
- op: add
|
||||
path: /nodeRegistration/kubeletExtraArgs/-
|
||||
value:
|
||||
name: image-credential-provider-bin-dir
|
||||
value: /credential-plugins
|
||||
- role: worker
|
||||
extraMounts:
|
||||
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
|
||||
@@ -40,6 +73,39 @@ nodes:
|
||||
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public
|
||||
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-3-b/public
|
||||
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public
|
||||
# One spire-ha-agent on the host is shared by all three virtual nodes, with a
|
||||
# spiffe-socat-unix bridge per node in front of it. Mount that bridge where a
|
||||
# package installed spire-ha-agent@main listens, so kubelet's configuration in
|
||||
# the node is the same one a real bare metal node would use.
|
||||
- hostPath: /var/run/spiffe/socat/unix/k8s-kubelet-3/public
|
||||
containerPath: /var/run/spire/agent/sockets/main/public
|
||||
- hostPath: ./.github/kind/conf/credential-providers
|
||||
containerPath: /credential-plugins
|
||||
- hostPath: ./.github/kind/conf/credential-provider-config.yaml
|
||||
containerPath: /etc/kubernetes/credential-provider-config.yaml
|
||||
kubeadmConfigPatches:
|
||||
- |
|
||||
apiVersion: kubeadm.k8s.io/v1beta3
|
||||
kind: JoinConfiguration
|
||||
nodeRegistration:
|
||||
kubeletExtraArgs:
|
||||
image-credential-provider-config: /etc/kubernetes/credential-provider-config.yaml
|
||||
image-credential-provider-bin-dir: /credential-plugins
|
||||
kubeadmConfigPatchesJSON6902:
|
||||
- group: kubeadm.k8s.io
|
||||
version: v1beta4
|
||||
kind: JoinConfiguration
|
||||
patch: |
|
||||
- op: add
|
||||
path: /nodeRegistration/kubeletExtraArgs/-
|
||||
value:
|
||||
name: image-credential-provider-config
|
||||
value: /etc/kubernetes/credential-provider-config.yaml
|
||||
- op: add
|
||||
path: /nodeRegistration/kubeletExtraArgs/-
|
||||
value:
|
||||
name: image-credential-provider-bin-dir
|
||||
value: /credential-plugins
|
||||
- role: worker
|
||||
extraMounts:
|
||||
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-server-a/public
|
||||
@@ -50,3 +116,36 @@ nodes:
|
||||
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-a/public
|
||||
- hostPath: /var/run/spiffe/socat/unix/k8s-spire-agent-4-b/public
|
||||
containerPath: /var/run/spiffe/socat/unix/k8s-spire-agent-b/public
|
||||
# One spire-ha-agent on the host is shared by all three virtual nodes, with a
|
||||
# spiffe-socat-unix bridge per node in front of it. Mount that bridge where a
|
||||
# package installed spire-ha-agent@main listens, so kubelet's configuration in
|
||||
# the node is the same one a real bare metal node would use.
|
||||
- hostPath: /var/run/spiffe/socat/unix/k8s-kubelet-4/public
|
||||
containerPath: /var/run/spire/agent/sockets/main/public
|
||||
- hostPath: ./.github/kind/conf/credential-providers
|
||||
containerPath: /credential-plugins
|
||||
- hostPath: ./.github/kind/conf/credential-provider-config.yaml
|
||||
containerPath: /etc/kubernetes/credential-provider-config.yaml
|
||||
kubeadmConfigPatches:
|
||||
- |
|
||||
apiVersion: kubeadm.k8s.io/v1beta3
|
||||
kind: JoinConfiguration
|
||||
nodeRegistration:
|
||||
kubeletExtraArgs:
|
||||
image-credential-provider-config: /etc/kubernetes/credential-provider-config.yaml
|
||||
image-credential-provider-bin-dir: /credential-plugins
|
||||
kubeadmConfigPatchesJSON6902:
|
||||
- group: kubeadm.k8s.io
|
||||
version: v1beta4
|
||||
kind: JoinConfiguration
|
||||
patch: |
|
||||
- op: add
|
||||
path: /nodeRegistration/kubeletExtraArgs/-
|
||||
value:
|
||||
name: image-credential-provider-config
|
||||
value: /etc/kubernetes/credential-provider-config.yaml
|
||||
- op: add
|
||||
path: /nodeRegistration/kubeletExtraArgs/-
|
||||
value:
|
||||
name: image-credential-provider-bin-dir
|
||||
value: /credential-plugins
|
||||
|
||||
+37
@@ -0,0 +1,37 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
VERSION="${IMAGE_CRED_PROVIDER_VERSION:-v0.5.0}"
|
||||
BIN_NAME="k8s-image-cred-spire-identity-exchange"
|
||||
|
||||
SCRIPTPATH="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
BIN_DIR="${SCRIPTPATH}/../kind/conf/credential-providers"
|
||||
|
||||
case "$(uname -m)" in
|
||||
x86_64|amd64) ARCH="x86_64" ;;
|
||||
aarch64|arm64) ARCH="arm64" ;;
|
||||
*) echo "unsupported architecture: $(uname -m)" >&2; exit 1 ;;
|
||||
esac
|
||||
|
||||
if [ -x "${BIN_DIR}/${BIN_NAME}" ]; then
|
||||
echo "${BIN_NAME} already staged in ${BIN_DIR}"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
BASE_URL="https://github.com/spiffe/spire-identity-exchange/releases/download/${VERSION}"
|
||||
ARCHIVE="${BIN_NAME}_Linux_${ARCH}.tar.gz"
|
||||
CHECKSUMS="spire-identity-exchange_${VERSION#v}_checksums.txt"
|
||||
|
||||
WORKDIR="$(mktemp -d)"
|
||||
trap 'rm -rf "${WORKDIR}"' EXIT
|
||||
|
||||
curl -fsSL --retry 5 --retry-all-errors -o "${WORKDIR}/${ARCHIVE}" "${BASE_URL}/${ARCHIVE}"
|
||||
curl -fsSL --retry 5 --retry-all-errors -o "${WORKDIR}/${CHECKSUMS}" "${BASE_URL}/${CHECKSUMS}"
|
||||
(cd "${WORKDIR}" && grep " ${ARCHIVE}\$" "${CHECKSUMS}" | sha256sum -c -)
|
||||
|
||||
tar -xzf "${WORKDIR}/${ARCHIVE}" -C "${WORKDIR}" "${BIN_NAME}"
|
||||
mkdir -p "${BIN_DIR}"
|
||||
install -m 0755 "${WORKDIR}/${BIN_NAME}" "${BIN_DIR}/${BIN_NAME}"
|
||||
|
||||
echo "Staged ${BIN_NAME} ${VERSION} in ${BIN_DIR}"
|
||||
@@ -13,5 +13,10 @@
|
||||
"name": "ingress-nginx",
|
||||
"repo": "https://kubernetes.github.io/ingress-nginx",
|
||||
"version": "4.15.1"
|
||||
},
|
||||
{
|
||||
"name": "zot",
|
||||
"repo": "https://zotregistry.dev/helm-charts",
|
||||
"version": "0.1.122"
|
||||
}
|
||||
]
|
||||
|
||||
@@ -31,9 +31,9 @@ jobs:
|
||||
strategy:
|
||||
matrix:
|
||||
k8s:
|
||||
- v1.33.7
|
||||
- v1.34.3
|
||||
- v1.35.1
|
||||
- v1.34.8
|
||||
- v1.35.5
|
||||
- v1.36.1
|
||||
|
||||
steps:
|
||||
- run: 'echo "Skipping tests"'
|
||||
@@ -75,9 +75,9 @@ jobs:
|
||||
strategy:
|
||||
matrix:
|
||||
k8s:
|
||||
- v1.33.7
|
||||
- v1.34.3
|
||||
- v1.35.1
|
||||
- v1.34.8
|
||||
- v1.35.5
|
||||
- v1.36.1
|
||||
example:
|
||||
- ${{ fromJson(needs.build-matrix.outputs.examples) }}
|
||||
|
||||
@@ -93,9 +93,9 @@ jobs:
|
||||
strategy:
|
||||
matrix:
|
||||
k8s:
|
||||
- v1.33.7
|
||||
- v1.34.3
|
||||
- v1.35.1
|
||||
- v1.34.8
|
||||
- v1.35.5
|
||||
- v1.36.1
|
||||
example:
|
||||
- ${{ fromJson(needs.build-matrix.outputs.integrationtests) }}
|
||||
|
||||
@@ -111,9 +111,9 @@ jobs:
|
||||
strategy:
|
||||
matrix:
|
||||
k8s:
|
||||
- v1.33.7
|
||||
- v1.34.3
|
||||
- v1.35.1
|
||||
- v1.34.8
|
||||
- v1.35.5
|
||||
- v1.36.1
|
||||
|
||||
steps:
|
||||
- run: 'echo "Skipping upgrade-test"'
|
||||
|
||||
@@ -17,6 +17,7 @@ on:
|
||||
- '.github/tests/**/*.sh'
|
||||
- '.github/tests/**/*.json'
|
||||
- '.github/scripts/check-readme-versions.sh'
|
||||
- '.github/scripts/install-image-cred-provider.sh'
|
||||
- 'examples/**/*.yaml'
|
||||
- 'examples/**/*.sh'
|
||||
- 'tests/**/*'
|
||||
@@ -31,6 +32,7 @@ env:
|
||||
PYTHON_VERSION: 3.11.3
|
||||
KIND_VERSION: v0.32.0
|
||||
CHART_TESTING_VERSION: v3.8.0
|
||||
IMAGE_CRED_PROVIDER_VERSION: v0.5.0
|
||||
|
||||
jobs:
|
||||
checks:
|
||||
@@ -160,9 +162,9 @@ jobs:
|
||||
# Kubernetes, but can go back farther as long as we don't need heroics
|
||||
# to pull it off (i.e. kubectl version juggling).
|
||||
k8s:
|
||||
- v1.33.7
|
||||
- v1.34.3
|
||||
- v1.35.1
|
||||
- v1.34.8
|
||||
- v1.35.5
|
||||
- v1.36.1
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
@@ -185,6 +187,9 @@ jobs:
|
||||
with:
|
||||
version: ${{ env.CHART_TESTING_VERSION }}
|
||||
|
||||
- name: Install image credential provider
|
||||
run: ./.github/scripts/install-image-cred-provider.sh
|
||||
|
||||
- name: Create kind ${{ matrix.k8s }} cluster
|
||||
uses: helm/[email protected]
|
||||
# Only build a kind cluster if there are chart changes to test.
|
||||
@@ -251,9 +256,9 @@ jobs:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
k8s:
|
||||
- v1.33.7
|
||||
- v1.34.3
|
||||
- v1.35.1
|
||||
- v1.34.8
|
||||
- v1.35.5
|
||||
- v1.36.1
|
||||
example:
|
||||
- ${{ fromJson(needs.build-matrix.outputs.examples) }}
|
||||
|
||||
@@ -271,6 +276,9 @@ jobs:
|
||||
with:
|
||||
python-version: ${{ env.PYTHON_VERSION }}
|
||||
|
||||
- name: Install image credential provider
|
||||
run: ./.github/scripts/install-image-cred-provider.sh
|
||||
|
||||
- name: Create kind cluster
|
||||
uses: helm/[email protected]
|
||||
# Only build a kind cluster if there are chart changes to test.
|
||||
@@ -306,9 +314,9 @@ jobs:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
k8s:
|
||||
- v1.33.7
|
||||
- v1.34.3
|
||||
- v1.35.1
|
||||
- v1.34.8
|
||||
- v1.35.5
|
||||
- v1.36.1
|
||||
integrationtest:
|
||||
- ${{ fromJson(needs.build-matrix.outputs.integrationtests) }}
|
||||
|
||||
@@ -326,6 +334,9 @@ jobs:
|
||||
with:
|
||||
python-version: ${{ env.PYTHON_VERSION }}
|
||||
|
||||
- name: Install image credential provider
|
||||
run: ./.github/scripts/install-image-cred-provider.sh
|
||||
|
||||
- name: Create kind cluster
|
||||
uses: helm/[email protected]
|
||||
# Only build a kind cluster if there are chart changes to test.
|
||||
@@ -354,9 +365,9 @@ jobs:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
k8s:
|
||||
- v1.33.7
|
||||
- v1.34.3
|
||||
- v1.35.1
|
||||
- v1.34.8
|
||||
- v1.35.5
|
||||
- v1.36.1
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
@@ -372,6 +383,9 @@ jobs:
|
||||
with:
|
||||
python-version: ${{ env.PYTHON_VERSION }}
|
||||
|
||||
- name: Install image credential provider
|
||||
run: ./.github/scripts/install-image-cred-provider.sh
|
||||
|
||||
- name: Create kind cluster
|
||||
uses: helm/[email protected]
|
||||
# Only build a kind cluster if there are chart changes to test.
|
||||
|
||||
Reference in New Issue
Block a user