Blaine Gardner
3e76de7868
For nightly jobs, canary tests are all running with the same job IDs, making the last-run jobs cancel previous runs. Add a workflow-id parameter to canary jobs that can be used to give each job in a canary suite a unique job ID to prevent this. Signed-off-by: Blaine Gardner <blaine.gardner@ibm.com>
86 lines
3.9 KiB
YAML
86 lines
3.9 KiB
YAML
name: Encryption KMS IBM Key Protect
|
|
description: Reusable workflow to test Encryption KMS IBM Key Protect
|
|
inputs:
|
|
ibm-instance-id:
|
|
description: IBM_KP_SERVICE_INSTANCE_ID from the calling workflow
|
|
required: true
|
|
ibm-service-api-key:
|
|
description: IBM_KP_SERVICE_API_KEY from the calling workflow
|
|
required: true
|
|
artifact-name:
|
|
description: the name of the artifact where logs will be stored
|
|
required: true
|
|
|
|
runs:
|
|
using: "composite"
|
|
steps:
|
|
- name: fail if env no present
|
|
if: "env.IBM_KP_SERVICE_INSTANCE_ID == '' || env.IBM_KP_SERVICE_API_KEY == ''"
|
|
env:
|
|
IBM_KP_SERVICE_INSTANCE_ID: ${{ inputs.ibm-instance-id }}
|
|
IBM_KP_SERVICE_API_KEY: ${{ inputs.ibm-service-api-key }}
|
|
shell: bash --noprofile --norc -eo pipefail -x {0}
|
|
run: echo "IBM_KP_SERVICE_INSTANCE_ID and IBM_KP_SERVICE_API_KEY must be set in the environment" && exit 0
|
|
|
|
- name: setup cluster resources
|
|
uses: ./.github/workflows/canary-test-config
|
|
|
|
- name: set Ceph version in CephCluster manifest
|
|
shell: bash --noprofile --norc -eo pipefail -x {0}
|
|
run: tests/scripts/github-action-helper.sh replace_ceph_image "deploy/examples/cluster-test.yaml" "${{ github.event.inputs.ceph-image }}"
|
|
|
|
- name: use local disk and create partitions for osds
|
|
shell: bash --noprofile --norc -eo pipefail -x {0}
|
|
run: |
|
|
tests/scripts/github-action-helper.sh use_local_disk
|
|
tests/scripts/github-action-helper.sh create_partitions_for_osds
|
|
|
|
- name: create cluster prerequisites
|
|
shell: bash --noprofile --norc -eo pipefail -x {0}
|
|
run: |
|
|
export BLOCK="/dev/$(tests/scripts/github-action-helper.sh find_extra_block_dev)"
|
|
tests/scripts/localPathPV.sh "$BLOCK"
|
|
tests/scripts/github-action-helper.sh create_cluster_prerequisites
|
|
|
|
- name: deploy cluster
|
|
shell: bash --noprofile --norc -eo pipefail -x {0}
|
|
env:
|
|
IBM_KP_SERVICE_INSTANCE_ID: ${{ inputs.ibm-instance-id }}
|
|
IBM_KP_SERVICE_API_KEY: ${{ inputs.ibm-service-api-key }}
|
|
run: |
|
|
tests/scripts/github-action-helper.sh deploy_manifest_with_local_build deploy/examples/operator.yaml
|
|
envsubst < "tests/manifests/test-kms-ibm-kp-secret.in" > "tests/manifests/test-kms-ibm-kp-secret.yaml"
|
|
envsubst < "tests/manifests/test-kms-ibm-kp-spec.in" > "tests/manifests/test-kms-ibm-kp-spec.yaml"
|
|
cat tests/manifests/test-kms-ibm-kp-secret.yaml >> tests/manifests/test-cluster-on-pvc-encrypted.yaml
|
|
yq merge --inplace --arrays append tests/manifests/test-cluster-on-pvc-encrypted.yaml tests/manifests/test-kms-ibm-kp-spec.yaml
|
|
yq write -i tests/manifests/test-cluster-on-pvc-encrypted.yaml "spec.storage.storageClassDeviceSets[0].count" 2
|
|
yq write -i tests/manifests/test-cluster-on-pvc-encrypted.yaml "spec.storage.storageClassDeviceSets[0].volumeClaimTemplates[0].spec.resources.requests.storage" 6Gi
|
|
kubectl create -f tests/manifests/test-cluster-on-pvc-encrypted.yaml
|
|
tests/scripts/github-action-helper.sh deploy_manifest_with_local_build deploy/examples/toolbox.yaml
|
|
|
|
- name: wait for prepare pod
|
|
shell: bash --noprofile --norc -eo pipefail -x {0}
|
|
run: tests/scripts/github-action-helper.sh wait_for_prepare_pod 2
|
|
|
|
- name: wait for ceph to be ready
|
|
shell: bash --noprofile --norc -eo pipefail -x {0}
|
|
run: |
|
|
tests/scripts/github-action-helper.sh wait_for_ceph_to_be_ready osd 2
|
|
kubectl -n rook-ceph get pods
|
|
kubectl -n rook-ceph get secrets
|
|
|
|
- name: validate encrypted osd
|
|
shell: bash --noprofile --norc -eo pipefail -x {0}
|
|
run: |
|
|
sudo lsblk
|
|
|
|
- name: collect common logs
|
|
if: always()
|
|
uses: ./.github/workflows/collect-logs
|
|
with:
|
|
name: ${{ inputs.artifact-name }}
|
|
|
|
- name: teardown cluster so that keys are removed from the KMS
|
|
shell: bash --noprofile --norc -eo pipefail -x {0}
|
|
run: kubectl -n rook-ceph delete cephcluster rook-ceph --wait
|