e2e_aks_runtime.yml

name: e2e test aks runtime

on:
  workflow_dispatch:
  schedule:
    - cron: "16 6 * * 6" # 6:16 on Saturdays
  pull_request:
    paths:
      - .github/workflows/e2e_aks_runtime.yml
      - e2e/aks-runtime/**

env:
  container_registry: ghcr.io/edgelesssys
  azure_resource_group: contrast-ci
  DO_NOT_TRACK: 1

jobs:
  test:
    runs-on: ubuntu-22.04
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: ./.github/actions/setup_nix
        with:
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          cachixToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
      - name: Login to Azure
        uses: azure/login@a65d910e8af852a8061c627c456678983e180302 # v2.2.0
        with:
          creds: ${{ secrets.CONTRAST_CI_INFRA_AZURE }}
      - name: Log in to ghcr.io Container registry
        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Create justfile.env
        run: |
          cat <<EOF > justfile.env
          container_registry=${{ env.container_registry }}
          azure_resource_group=${{ env.azure_resource_group }}
          default_platform=AKS-CLH-SNP
          EOF
      - name: Get credentials for CI cluster
        run: |
          nix run .#just -- get-credentials
      - name: Set sync environment
        run: |
          sync_ip=$(kubectl get svc sync -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
          echo "SYNC_ENDPOINT=http://$sync_ip:8080" | tee -a "$GITHUB_ENV"
          sync_uuid=$(kubectl get configmap sync-server-fifo -o jsonpath='{.data.uuid}')
          echo "SYNC_FIFO_UUID=$sync_uuid" | tee -a "$GITHUB_ENV"
      - name: Build and prepare deployments
        run: |
          nix shell .#just --command just coordinator initializer port-forwarder openssl cryptsetup service-mesh-proxy node-installer
      # steps taken from https://learn.microsoft.com/en-us/cli/azure/install-azure-cli-linux?pivots=apt#option-2-step-by-step-installation-instructions
      - name: Install `az` with extensions
        run: |
          sudo apt-get update
          sudo apt-get -y install apt-transport-https ca-certificates curl gnupg lsb-release
          sudo mkdir -p /etc/apt/keyrings
          curl -sLS https://packages.microsoft.com/keys/microsoft.asc |
          gpg --dearmor | sudo tee /etc/apt/keyrings/microsoft.gpg > /dev/null
          sudo chmod go+r /etc/apt/keyrings/microsoft.gpg
          AZ_DIST=$(lsb_release -cs)

          sudo tee /etc/apt/sources.list.d/azure-cli.sources <<EOF
          Types: deb
          URIs: https://packages.microsoft.com/repos/azure-cli/
          Suites: ${AZ_DIST}
          Components: main
          Architectures: $(dpkg --print-architecture)
          Signed-by: /etc/apt/keyrings/microsoft.gpg
          EOF

          sudo apt-get update
          sudo apt-get -y install azure-cli

          az extension add --name aks-preview
          az extension add --name confcom
      - name: E2E test
        run: |
          nix build .#scripts.get-logs
          nix run .#scripts.get-logs start workspace/e2e.namespace &
          nix build .#contrast.e2e
          ./result/bin/aks-runtime.test -test.v \
            --image-replacements workspace/just.containerlookup \
            --namespace-file workspace/e2e.namespace \
            --platform AKS-CLH-SNP \
            --namespace-suffix="-ci"
      - name: Download logs
        if: always()
        run: |
          nix run .#scripts.get-logs download workspace/e2e.namespace
      - name: Upload logs
        if: always()
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: e2e_pod_logs-AKS-CLH-SNP-aks-runtime
          path: workspace/logs/export/logs
      - name: Notify teams channel of failure
        if: ${{ failure() && github.event_name == 'schedule' && github.run_attempt == 1 }}
        uses: ./.github/actions/post_to_teams
        with:
          webhook: ${{ secrets.TEAMS_CI_WEBHOOK }}
          title: "aks-runtime test failed"
          message: "e2e test aks-runtime failed"
          additionalFields: '[{"title": "Platform", "value": "AKS-CLH-SNP"}]'
      - name: Cleanup
        if: always()
        run: |
          kubectl delete ns "$(cat workspace/e2e.namespace)" --timeout 5m