[release/v0.5] prepare 0.5.1 release

.github/workflows/release.yml

@@ -15,6 +15,7 @@ on:
 
 env:
   container_registry: ghcr.io/edgelesssys
+  azure_resource_group: contrast-ci
 
 concurrency:
   group: ${{ github.ref }}
@@ -187,17 +188,24 @@ jobs:
       - name: Push containers with release tag
         run: |
           coordinatorImg=$(nix run .#containers.push-coordinator -- "$container_registry/contrast/coordinator")
-          nix run .#containers.push-initializer -- "$container_registry/contrast/initializer"
+          initializerImg=$(nix run .#containers.push-initializer -- "$container_registry/contrast/initializer")
           echo "coordinatorImg=$coordinatorImg" | tee -a "$GITHUB_ENV"
+          echo "initializerImg=$initializerImg" | tee -a "$GITHUB_ENV"
       - name: Add tag to Coordinator image
         run: |
-          front=${coordinatorImg%@*}
-          back=${coordinatorImg#*@}
-          echo "coordinatorImgTagged=${front}:${{ inputs.version }}@${back}" | tee -a "$GITHUB_ENV"
+          frontCoord=${coordinatorImg%@*}
+          backCoord=${coordinatorImg#*@}
+          echo "coordinatorImgTagged=${frontCoord}:${{ inputs.version }}@${backCoord}" | tee -a "$GITHUB_ENV"
+      - name: Create file with image replacements
+        run: |
+          echo "ghcr.io/edgelesssys/contrast/coordinator:latest=$coordinatorImgTagged" > image-replacements.txt
+          echo "ghcr.io/edgelesssys/contrast/initializer:latest=$initializerImg" >> image-replacements.txt
       - name: Create portable coordinator resource definitions
         run: |
           mkdir -p workspace
           nix run .#scripts.write-coordinator-yaml -- "${coordinatorImgTagged}" > workspace/coordinator.yml
+          nix run .#scripts.write-emojivoto-demo -- "./image-replacements.txt" "deployments/emojivoto-demo.yml"
+          zip -r deployments/emojivoto-demo.zip deployments/emojivoto-demo.yml
       - name: Update coordinator policy hash
         run: |
           yq < workspace/coordinator.yml \
@@ -221,6 +229,7 @@ jobs:
           files: |
             result-cli/bin/contrast
             workspace/coordinator.yml
+            deployments/emojivoto-demo.zip
       - name: Reset temporary changes
         run: |
           git reset --hard ${{ needs.process-inputs.outputs.WORKING_BRANCH }}
@@ -230,6 +239,45 @@ jobs:
           version: ${{ needs.process-inputs.outputs.NEXT_PATCH_PRE_WITHOUT_V }}
           commit: true
 
+  test:
+    runs-on: ubuntu-22.04
+    permissions:
+      # Job needs content:write to see draft releases.
+      contents: write
+      packages: read
+    needs: release
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: ./.github/actions/setup_nix
+        with:
+          githubToken: ${{ secrets.GITHUB_TOKEN }}
+          cachixToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - name: Log in to ghcr.io Container registry
+        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Login to Azure
+        uses: azure/login@6b2456866fc08b011acb422a92a4aa20e2c4de32 # v2.1.0
+        with:
+          creds: ${{ secrets.CONTRAST_CI_INFRA_AZURE }}
+      - uses: nicknovitski/nix-develop@a2060d116a50b36dfab02280af558e73ab52427d # v1.1.0
+      - name: Create justfile.env
+        run: |
+          cat <<EOF > justfile.env
+          container_registry=${{ env.container_registry }}
+          azure_resource_group=${{ env.azure_resource_group }}
+          EOF
+      - name: Get credentials for CI cluster
+        run: |
+          just get-credentials
+      - name: E2E Test
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          nix shell .#contrast.e2e --command release.test -test.v --tag ${{ inputs.version }}
+
   create-github-stuff:
     name: Create backport label and milestone
     if: ${{ inputs.kind == 'minor' }}

e2e/internal/kubeclient/deploy.go

@@ -4,7 +4,9 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"net"
 	"sort"
+	"strconv"
 	"time"
 
 	appsv1 "k8s.io/api/apps/v1"
@@ -99,6 +101,63 @@ func (c *Kubeclient) WaitForDeployment(ctx context.Context, namespace, name stri
 	}
 }
 
+// WaitForLoadBalancer waits until the given service is configured with an external IP and returns it.
+func (c *Kubeclient) WaitForLoadBalancer(ctx context.Context, namespace, name string) (string, error) {
+	watcher, err := c.client.CoreV1().Services(namespace).Watch(ctx, metav1.ListOptions{FieldSelector: "metadata.name=" + name})
+	if err != nil {
+		return "", err
+	}
+	var ip string
+	var port int
+loop:
+	for {
+		select {
+		case evt := <-watcher.ResultChan():
+			switch evt.Type {
+			case watch.Added:
+				fallthrough
+			case watch.Modified:
+				svc, ok := evt.Object.(*corev1.Service)
+				if !ok {
+					return "", fmt.Errorf("watcher received unexpected type %T", evt.Object)
+				}
+				for _, ingress := range svc.Status.LoadBalancer.Ingress {
+					if ingress.IP != "" {
+						ip = ingress.IP
+						// TODO(burgerdev): deal with more than one port, and protocols other than TCP
+						port = int(svc.Spec.Ports[0].Port)
+						break loop
+					}
+				}
+			case watch.Deleted:
+				return "", fmt.Errorf("service %s/%s was deleted while waiting for it", namespace, name)
+			default:
+				c.log.Warn("ignoring unexpected watch event", "type", evt.Type, "object", evt.Object)
+			}
+		case <-ctx.Done():
+			return "", fmt.Errorf("LoadBalancer %s/%s did not get a public IP before %w", namespace, name, ctx.Err())
+		}
+	}
+
+	ticker := time.NewTicker(time.Second)
+	defer ticker.Stop()
+
+	dialer := &net.Dialer{}
+	for {
+		select {
+		case <-ticker.C:
+			conn, err := dialer.DialContext(ctx, "tcp", net.JoinHostPort(ip, strconv.Itoa(port)))
+			if err == nil {
+				conn.Close()
+				return ip, nil
+			}
+			c.log.Info("probe failed", "namespace", namespace, "name", name, "error", err)
+		case <-ctx.Done():
+			return "", fmt.Errorf("LoadBalancer %s/%s never responded to probing before %w", namespace, name, ctx.Err())
+		}
+	}
+}
+
 func (c *Kubeclient) toJSON(a any) string {
 	s, err := json.Marshal(a)
 	if err != nil {

e2e/internal/kuberesource/resourcegen/main.go

@@ -1,21 +1,31 @@
 package main
 
 import (
+	"flag"
 	"fmt"
+	"log"
 	"os"
 	"path"
 
 	"github.com/edgelesssys/contrast/e2e/internal/kuberesource"
 )
 
 func main() {
-	if len(os.Args) != 3 {
-		fmt.Println("Usage: kuberesource <set> <dest>")
+	imageReplacementsPath := flag.String("image-replacements", "", "Path to the image replacements file")
+	flag.Usage = func() {
+		fmt.Fprintf(os.Stderr, "Usage: %s <set> <dest>\n", os.Args[0])
+		flag.PrintDefaults()
+	}
+
+	flag.Parse()
+
+	if len(flag.Args()) != 2 {
+		flag.Usage()
 		os.Exit(1)
 	}
 
-	set := os.Args[1]
-	dest := os.Args[2]
+	set := flag.Arg(0)
+	dest := flag.Arg(1)
 
 	var resources []any
 	var err error
@@ -39,6 +49,22 @@ func main() {
 		os.Exit(1)
 	}
 
+	var replacements map[string]string
+	if *imageReplacementsPath != "" {
+		f, err := os.Open(*imageReplacementsPath)
+		if err != nil {
+			log.Fatalf("could not open image definition file %q: %v", *imageReplacementsPath, err)
+		}
+		defer f.Close()
+
+		replacements, err = kuberesource.ImageReplacementsFromFile(f)
+		if err != nil {
+			log.Fatalf("could not parse image definition file %q: %v", *imageReplacementsPath, err)
+		}
+	}
+
+	kuberesource.PatchImages(resources, replacements)
+
 	b, err := kuberesource.EncodeResources(resources...)
 	if err != nil {
 		fmt.Printf("Error: %v\n", err)

e2e/internal/kuberesource/sets.go

@@ -473,7 +473,7 @@ func generateEmojivoto() ([]any, error) {
 			WithSelector(
 				map[string]string{"app.kubernetes.io/name": "web-svc"},
 			).
-			WithType("ClusterIP").
+			WithType("LoadBalancer").
 			WithPorts(
 				ServicePort().
 					WithName("https").
@@ -486,22 +486,10 @@ func generateEmojivoto() ([]any, error) {
 		WithAPIVersion("v1").
 		WithKind("ServiceAccount")
 
-	portforwarderCoordinator := PortForwarder("coordinator", ns).
-		WithListenPort(1313).
-		WithForwardTarget("coordinator", 1313).
-		PodApplyConfiguration
-
-	portforwarderemojivotoWeb := PortForwarder("emojivoto-web", ns).
-		WithListenPort(8080).
-		WithForwardTarget("web-svc", 443).
-		PodApplyConfiguration
-
 	resources := []any{
 		emoji,
 		emojiService,
 		emojiserviceAccount,
-		portforwarderCoordinator,
-		portforwarderemojivotoWeb,
 		voteBot,
 		voting,
 		votingService,
@@ -557,34 +545,17 @@ func PatchNamespaces(resources []any, namespace string) []any {
 	return resources
 }
 
-// EmojivotoDemo returns patched resources for deploying an Emojivoto demo.
-func EmojivotoDemo(replacements map[string]string) ([]any, error) {
-	resources, err := generateEmojivoto()
-	if err != nil {
-		return nil, err
-	}
-	patched := PatchImages(resources, replacements)
-	patched = PatchNamespaces(patched, "default")
-	return patched, nil
-}
-
 // Emojivoto returns resources for deploying Emojivoto application.
 func Emojivoto() ([]any, error) {
 	resources, err := generateEmojivoto()
 	if err != nil {
 		return nil, err
 	}
 
-	// Add coordinator
-	ns := "edg-default"
-	namespace := Namespace(ns)
-	coordinator := Coordinator(ns).DeploymentApplyConfiguration
-	coordinatorService := ServiceForDeployment(coordinator)
-	coordinatorForwarder := PortForwarder("coordinator", ns).
-		WithListenPort(1313).
-		WithForwardTarget("coordinator", 1313).
-		PodApplyConfiguration
-	resources = append(resources, namespace, coordinator, coordinatorService, coordinatorForwarder)
+	namespace := Namespace("edg-default")
+	var out []any
+	out = append(out, namespace)
+	out = append(out, resources...)
 
-	return resources, nil
+	return out, nil
 }