V1.11.4 n4k.nirmata.9 ga #374
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Conformance tests | |
| permissions: {} | |
| on: | |
| pull_request: | |
| branches: | |
| - 'main' | |
| - 'release*' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| prepare-images: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 | |
| - name: Setup build env | |
| uses: ./.github/actions/setup-build-env | |
| timeout-minutes: 10 | |
| with: | |
| build-cache-key: build-images | |
| - name: ko build | |
| shell: bash | |
| run: | | |
| set -e | |
| VERSION=${{ github.ref_name }} make docker-save-image-all | |
| - name: upload images archive | |
| uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 | |
| with: | |
| name: kyverno.tar | |
| path: kyverno.tar | |
| retention-days: 1 | |
| if-no-files-found: error | |
| prepare-cli: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 | |
| - name: Setup build env | |
| uses: ./.github/actions/setup-build-env | |
| timeout-minutes: 10 | |
| with: | |
| build-cache-key: build-cli | |
| - name: Build CLI | |
| shell: bash | |
| run: | | |
| set -e | |
| VERSION=${{ github.ref_name }} make build-cli | |
| - name: upload images archive | |
| uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 | |
| with: | |
| name: kubectl-kyverno | |
| path: cmd/cli/kubectl-kyverno/kubectl-kyverno | |
| retention-days: 1 | |
| if-no-files-found: error | |
| # runs conformance test suites with configuration: | |
| standard: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| packages: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| config: | |
| - name: standard | |
| values: | |
| - standard | |
| k8s-version: | |
| - name: v1.25 | |
| version: v1.25.11 | |
| - name: v1.26 | |
| version: v1.26.6 | |
| - name: v1.27 | |
| version: v1.27.3 | |
| - name: v1.28 | |
| version: v1.28.0 | |
| tests: | |
| - autogen | |
| - background-only | |
| - cleanup | |
| - deferred | |
| - events | |
| - exceptions | |
| - filter | |
| - generate/clusterpolicy | |
| - generate/policy | |
| - generate/validation | |
| - mutate | |
| - policy-validation | |
| - rangeoperators | |
| - rbac | |
| - reports | |
| - validate | |
| - verify-manifests | |
| - verifyImages | |
| - webhooks | |
| needs: prepare-images | |
| name: ${{ matrix.k8s-version.name }} - ${{ matrix.config.name }} - ${{ matrix.tests }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 | |
| - name: Setup build env | |
| uses: ./.github/actions/setup-build-env | |
| timeout-minutes: 10 | |
| with: | |
| build-cache-key: run-conformance | |
| - name: Create kind cluster | |
| shell: bash | |
| run: | | |
| set -e | |
| export KIND_IMAGE=kindest/node:${{ matrix.k8s-version.version }} | |
| make kind-create-cluster | |
| - name: Download kyverno images archive | |
| uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 | |
| with: | |
| name: kyverno.tar | |
| - name: Load kyverno images archive in kind cluster | |
| shell: bash | |
| run: | | |
| set -e | |
| make kind-load-image-archive | |
| - name: Install kyverno | |
| shell: bash | |
| run: | | |
| set -e | |
| export USE_CONFIG=${{ join(matrix.config.values, ',') }} | |
| make kind-install-kyverno | |
| - name: Wait for kyverno ready | |
| uses: ./.github/actions/kyverno-wait-ready | |
| - name: Test with kuttl | |
| shell: bash | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -e | |
| ./.tools/kubectl-kuttl test ./test/conformance/kuttl/${{ matrix.tests }} --config ./test/conformance/kuttl/_config/common.yaml | |
| - name: Debug failure | |
| if: failure() | |
| uses: ./.github/actions/kyverno-logs | |
| # runs conformance test suites with configuration: | |
| ttl: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| packages: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| config: | |
| - name: ttl | |
| values: | |
| - standard | |
| - ttl | |
| k8s-version: | |
| - name: v1.25 | |
| version: v1.25.11 | |
| - name: v1.26 | |
| version: v1.26.6 | |
| - name: v1.27 | |
| version: v1.27.3 | |
| - name: v1.28 | |
| version: v1.28.0 | |
| tests: | |
| - ttl | |
| needs: prepare-images | |
| name: ${{ matrix.k8s-version.name }} - ${{ matrix.config.name }} - ${{ matrix.tests }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 | |
| - name: Setup build env | |
| uses: ./.github/actions/setup-build-env | |
| timeout-minutes: 10 | |
| with: | |
| build-cache-key: run-conformance | |
| - name: Create kind cluster | |
| shell: bash | |
| run: | | |
| set -e | |
| export KIND_IMAGE=kindest/node:${{ matrix.k8s-version.version }} | |
| make kind-create-cluster | |
| - name: Download kyverno images archive | |
| uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 | |
| with: | |
| name: kyverno.tar | |
| - name: Load kyverno images archive in kind cluster | |
| shell: bash | |
| run: | | |
| set -e | |
| make kind-load-image-archive | |
| - name: Install kyverno | |
| shell: bash | |
| run: | | |
| set -e | |
| export USE_CONFIG=${{ join(matrix.config.values, ',') }} | |
| make kind-install-kyverno | |
| - name: Wait for kyverno ready | |
| uses: ./.github/actions/kyverno-wait-ready | |
| - name: Test with kuttl | |
| shell: bash | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -e | |
| ./.tools/kubectl-kuttl test ./test/conformance/kuttl/${{ matrix.tests }} --config ./test/conformance/kuttl/_config/common.yaml | |
| - name: Debug failure | |
| if: failure() | |
| uses: ./.github/actions/kyverno-logs | |
| # runs conformance test suites with configuration: | |
| force-failure-policy-ignore: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| packages: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| config: | |
| - name: force-failure-policy-ignore | |
| values: | |
| - standard | |
| - force-failure-policy-ignore | |
| k8s-version: | |
| - name: v1.25 | |
| version: v1.25.11 | |
| - name: v1.26 | |
| version: v1.26.6 | |
| - name: v1.27 | |
| version: v1.27.3 | |
| - name: v1.28 | |
| version: v1.28.0 | |
| tests: | |
| - force-failure-policy-ignore | |
| - rbac | |
| needs: prepare-images | |
| name: ${{ matrix.k8s-version.name }} - ${{ matrix.config.name }} - ${{ matrix.tests }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 | |
| - name: Setup build env | |
| uses: ./.github/actions/setup-build-env | |
| timeout-minutes: 10 | |
| with: | |
| build-cache-key: run-conformance | |
| - name: Create kind cluster | |
| shell: bash | |
| run: | | |
| set -e | |
| export KIND_IMAGE=kindest/node:${{ matrix.k8s-version.version }} | |
| make kind-create-cluster | |
| - name: Download kyverno images archive | |
| uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 | |
| with: | |
| name: kyverno.tar | |
| - name: Load kyverno images archive in kind cluster | |
| shell: bash | |
| run: | | |
| set -e | |
| make kind-load-image-archive | |
| - name: Install kyverno | |
| shell: bash | |
| run: | | |
| set -e | |
| export USE_CONFIG=${{ join(matrix.config.values, ',') }} | |
| make kind-install-kyverno | |
| - name: Wait for kyverno ready | |
| uses: ./.github/actions/kyverno-wait-ready | |
| - name: Test with kuttl | |
| shell: bash | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -e | |
| ./.tools/kubectl-kuttl test ./test/conformance/kuttl/${{ matrix.tests }} --config ./test/conformance/kuttl/_config/common.yaml | |
| - name: Debug failure | |
| if: failure() | |
| uses: ./.github/actions/kyverno-logs | |
| # runs conformance test suites with configuration: | |
| validating-admission-policies-v1alpha1: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| packages: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| config: | |
| - name: validating-admission-policies | |
| values: | |
| - standard | |
| - generate-validating-admission-policy | |
| k8s-version: | |
| - name: v1.27 | |
| version: v1.27.3 | |
| tests: | |
| - generate-validating-admission-policy | |
| needs: prepare-images | |
| name: ${{ matrix.k8s-version.name }} - ${{ matrix.config.name }} - ${{ matrix.tests }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 | |
| - name: Setup build env | |
| uses: ./.github/actions/setup-build-env | |
| with: | |
| build-cache-key: run-conformance | |
| - name: Create kind cluster | |
| run: | | |
| export KIND_IMAGE=kindest/node:${{ matrix.k8s-version.version }} | |
| export KIND_CONFIG=vap-v1alpha1 | |
| make kind-create-cluster | |
| - name: Download kyverno images archive | |
| uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 | |
| with: | |
| name: kyverno.tar | |
| - name: Load kyverno images archive in kind cluster | |
| run: make kind-load-image-archive | |
| - name: Install kyverno | |
| run: | | |
| export USE_CONFIG=${{ join(matrix.config.values, ',') }} | |
| make kind-install-kyverno | |
| - name: Wait for kyverno ready | |
| uses: ./.github/actions/kyverno-wait-ready | |
| - name: Test with kuttl | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| ./.tools/kubectl-kuttl test ./test/conformance/kuttl/${{ matrix.tests }} \ | |
| --config ./test/conformance/kuttl/_config/common.yaml | |
| - name: Debug failure | |
| if: failure() | |
| uses: ./.github/actions/kyverno-logs | |
| # runs conformance test suites with configuration: | |
| validating-admission-policies-v1beta1: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| packages: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| config: | |
| - name: validating-admission-policies | |
| values: | |
| - standard | |
| - generate-validating-admission-policy | |
| k8s-version: | |
| - name: v1.28 | |
| version: v1.28.0 | |
| tests: | |
| - generate-validating-admission-policy | |
| needs: prepare-images | |
| name: ${{ matrix.k8s-version.name }} - ${{ matrix.config.name }} - ${{ matrix.tests }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 | |
| - name: Setup build env | |
| uses: ./.github/actions/setup-build-env | |
| with: | |
| build-cache-key: run-conformance | |
| - name: Create kind cluster | |
| run: | | |
| export KIND_IMAGE=kindest/node:${{ matrix.k8s-version.version }} | |
| export KIND_CONFIG=vap-v1beta1 | |
| make kind-create-cluster | |
| - name: Download kyverno images archive | |
| uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 | |
| with: | |
| name: kyverno.tar | |
| - name: Load kyverno images archive in kind cluster | |
| run: make kind-load-image-archive | |
| - name: Install kyverno | |
| run: | | |
| export USE_CONFIG=${{ join(matrix.config.values, ',') }} | |
| make kind-install-kyverno | |
| - name: Wait for kyverno ready | |
| uses: ./.github/actions/kyverno-wait-ready | |
| - name: Test with kuttl | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| ./.tools/kubectl-kuttl test ./test/conformance/kuttl/${{ matrix.tests }} \ | |
| --config ./test/conformance/kuttl/_config/common.yaml | |
| - name: Debug failure | |
| if: failure() | |
| uses: ./.github/actions/kyverno-logs | |
| # runs conformance test suites with configuration: | |
| validating-admission-policy-reports-v1alpha1: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| packages: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| config: | |
| - name: validating-admission-policy-reports | |
| values: | |
| - standard | |
| - validating-admission-policy-reports | |
| k8s-version: | |
| - name: v1.26 | |
| version: v1.26.6 | |
| - name: v1.27 | |
| version: v1.27.3 | |
| tests: | |
| - validating-admission-policy-reports | |
| needs: prepare-images | |
| name: ${{ matrix.k8s-version.name }} - ${{ matrix.config.name }} - ${{ matrix.tests }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 | |
| - name: Setup build env | |
| uses: ./.github/actions/setup-build-env | |
| with: | |
| build-cache-key: run-conformance | |
| - name: Create kind cluster | |
| run: | | |
| export KIND_IMAGE=kindest/node:${{ matrix.k8s-version.version }} | |
| export KIND_CONFIG=vap-v1alpha1 | |
| make kind-create-cluster | |
| - name: Download kyverno images archive | |
| uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 | |
| with: | |
| name: kyverno.tar | |
| - name: Load kyverno images archive in kind cluster | |
| run: make kind-load-image-archive | |
| - name: Install kyverno | |
| run: | | |
| export USE_CONFIG=${{ join(matrix.config.values, ',') }} | |
| make kind-install-kyverno | |
| - name: Wait for kyverno ready | |
| uses: ./.github/actions/kyverno-wait-ready | |
| - name: Test with kuttl | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| ./.tools/kubectl-kuttl test ./test/conformance/kuttl/${{ matrix.tests }} \ | |
| --config ./test/conformance/kuttl/_config/common.yaml | |
| - name: Debug failure | |
| if: failure() | |
| uses: ./.github/actions/kyverno-logs | |
| # runs conformance test suites with configuration: | |
| validating-admission-policy-reports-v1beta1: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| packages: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| config: | |
| - name: validating-admission-policy-reports | |
| values: | |
| - standard | |
| - validating-admission-policy-reports | |
| k8s-version: | |
| - name: v1.28 | |
| version: v1.28.0 | |
| tests: | |
| - validating-admission-policy-reports | |
| needs: prepare-images | |
| name: ${{ matrix.k8s-version.name }} - ${{ matrix.config.name }} - ${{ matrix.tests }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 | |
| - name: Setup build env | |
| uses: ./.github/actions/setup-build-env | |
| with: | |
| build-cache-key: run-conformance | |
| - name: Create kind cluster | |
| run: | | |
| export KIND_IMAGE=kindest/node:${{ matrix.k8s-version.version }} | |
| export KIND_CONFIG=vap-v1beta1 | |
| make kind-create-cluster | |
| - name: Download kyverno images archive | |
| uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 | |
| with: | |
| name: kyverno.tar | |
| - name: Load kyverno images archive in kind cluster | |
| run: make kind-load-image-archive | |
| - name: Install kyverno | |
| run: | | |
| export USE_CONFIG=${{ join(matrix.config.values, ',') }} | |
| make kind-install-kyverno | |
| - name: Wait for kyverno ready | |
| uses: ./.github/actions/kyverno-wait-ready | |
| - name: Test with kuttl | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| ./.tools/kubectl-kuttl test ./test/conformance/kuttl/${{ matrix.tests }} \ | |
| --config ./test/conformance/kuttl/_config/common.yaml | |
| - name: Debug failure | |
| if: failure() | |
| uses: ./.github/actions/kyverno-logs | |
| # runs conformance test suites with configuration: | |
| custom-sigstore: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| packages: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| config: | |
| - name: custom-sigstore | |
| values: | |
| - standard | |
| - custom-sigstore | |
| k8s-version: | |
| - name: v1.27 | |
| version: v1.27.x | |
| - name: v1.28 | |
| version: v1.28.x | |
| tests: | |
| - custom-sigstore | |
| needs: prepare-images | |
| name: ${{ matrix.k8s-version.name }} - ${{ matrix.config.name }} - ${{ matrix.tests }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 | |
| - name: Setup build env | |
| uses: ./.github/actions/setup-build-env | |
| timeout-minutes: 10 | |
| with: | |
| build-cache-key: run-conformance | |
| - name: Create kind cluster and setup Sigstore Scaffolding | |
| uses: sigstore/scaffolding/actions/setup@26f31cb72ca848bb0273fcbd7a4ebf187ec4d711 | |
| with: | |
| version: main | |
| k8s-version: ${{ matrix.k8s-version.version }} | |
| knative-version: '1.10.0' | |
| - name: Create TUF values config map | |
| run: | | |
| kubectl create namespace kyverno | |
| kubectl -n kyverno create configmap tufvalues --from-literal=TUF_MIRROR=$TUF_MIRROR --from-literal=FULCIO_URL=$FULCIO_URL --from-literal=REKOR_URL=$REKOR_URL --from-literal=CTLOG_URL=$CTLOG_URL --from-literal=ISSUER_URL=$ISSUER_URL | |
| kubectl -n tuf-system get secrets tuf-root -oyaml | sed 's/namespace: .*/namespace: kyverno/' | kubectl create -f - | |
| - name: Download kyverno images archive | |
| uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 | |
| with: | |
| name: kyverno.tar | |
| - name: Load kyverno images archive in kind cluster | |
| shell: bash | |
| run: | | |
| set -e | |
| make kind-load-image-archive | |
| - name: Install kyverno | |
| shell: bash | |
| run: | | |
| set -e | |
| export USE_CONFIG=${{ join(matrix.config.values, ',') }} | |
| make kind-install-kyverno | |
| - name: Install crane | |
| uses: imjasonh/setup-crane@00c9e93efa4e1138c9a7a5c594acd6c75a2fbf0c | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 | |
| - name: Create test image | |
| shell: bash | |
| run: | | |
| DIGEST=$(crane digest cgr.dev/chainguard/static) | |
| IMAGE_NAME=$(uuidgen | tr "[:upper:]" "[:lower:]") | |
| TEST_IMAGE_URL=ttl.sh/${IMAGE_NAME}:1h | |
| crane copy cgr.dev/chainguard/static@$DIGEST $TEST_IMAGE_URL | |
| cosign initialize --mirror $TUF_MIRROR --root $TUF_MIRROR/root.json | |
| COSIGN_EXPERIMENTAL=1 cosign sign --rekor-url $REKOR_URL --fulcio-url $FULCIO_URL $TEST_IMAGE_URL --identity-token $OIDC_TOKEN -y | |
| echo "TEST_IMAGE_URL=$TEST_IMAGE_URL" >> $GITHUB_ENV | |
| - name: Wait for kyverno ready | |
| uses: ./.github/actions/kyverno-wait-ready | |
| - name: Test with kuttl | |
| shell: bash | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -e | |
| ./.tools/kubectl-kuttl test ./test/conformance/kuttl/${{ matrix.tests }} --config ./test/conformance/kuttl/_config/common.yaml | |
| - name: Debug failure | |
| if: failure() | |
| uses: ./.github/actions/kyverno-logs | |
| chainsaw: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| packages: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| k8s-version: | |
| - name: v1.27 | |
| version: v1.27.13 | |
| - name: v1.28 | |
| version: v1.28.9 | |
| - name: v1.29 | |
| version: v1.29.4 | |
| tests: | |
| - chainsaw | |
| needs: prepare-images | |
| name: ${{ matrix.k8s-version.name }} - ${{ matrix.tests }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6 | |
| # install tools | |
| - name: Install helm | |
| id: helm | |
| uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install chainsaw | |
| uses: kyverno/action-install-chainsaw@dd64b5d7b2b7d36fdf701d48ac8b216aa94414db # v0.2.4 | |
| # create cluster | |
| - name: Create kind cluster | |
| uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0 | |
| with: | |
| node_image: kindest/node:${{ matrix.k8s-version.version }} | |
| cluster_name: kind | |
| config: ./scripts/config/kind/default.yaml | |
| # deploy kyverno | |
| - name: Download kyverno images archive | |
| uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 | |
| with: | |
| name: kyverno.tar | |
| - name: Load kyverno images archive in kind cluster | |
| shell: bash | |
| run: | | |
| set -e | |
| kind load image-archive kyverno.tar --name kind | |
| - name: Install kyverno | |
| shell: bash | |
| run: | | |
| set -e | |
| export HELM=${{ steps.helm.outputs.helm-path }} | |
| export USE_CONFIG=${{ join(matrix.config.values, ',') }} | |
| make kind-install-kyverno | |
| - name: Wait for kyverno ready | |
| uses: ./.github/actions/kyverno-wait-ready | |
| # run tests | |
| - name: Test with Chainsaw | |
| shell: bash | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -e | |
| cd ./test/conformance/chainsaw/ && chainsaw test --config ../../../.chainsaw.yaml | |
| # debug | |
| - name: Debug failure | |
| if: failure() | |
| uses: ./.github/actions/kyverno-logs | |
| # runs conformance test suites with configuration: | |
| default: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| packages: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| config: | |
| - name: default | |
| values: | |
| - default | |
| k8s-version: | |
| - name: v1.25 | |
| version: v1.25.11 | |
| - name: v1.26 | |
| version: v1.26.6 | |
| - name: v1.27 | |
| version: v1.27.3 | |
| - name: v1.28 | |
| version: v1.28.0 | |
| tests: | |
| - rbac | |
| needs: prepare-images | |
| name: ${{ matrix.k8s-version.name }} - ${{ matrix.config.name }} - ${{ matrix.tests }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 | |
| - name: Setup build env | |
| uses: ./.github/actions/setup-build-env | |
| timeout-minutes: 10 | |
| with: | |
| build-cache-key: run-conformance | |
| - name: Create kind cluster | |
| shell: bash | |
| run: | | |
| set -e | |
| export KIND_IMAGE=kindest/node:${{ matrix.k8s-version.version }} | |
| make kind-create-cluster | |
| - name: Download kyverno images archive | |
| uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 | |
| with: | |
| name: kyverno.tar | |
| - name: Load kyverno images archive in kind cluster | |
| shell: bash | |
| run: | | |
| set -e | |
| make kind-load-image-archive | |
| - name: Install kyverno | |
| shell: bash | |
| run: | | |
| set -e | |
| export USE_CONFIG=${{ join(matrix.config.values, ',') }} | |
| make kind-install-kyverno | |
| - name: Wait for kyverno ready | |
| uses: ./.github/actions/kyverno-wait-ready | |
| - name: Test with kuttl | |
| shell: bash | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -e | |
| ./.tools/kubectl-kuttl test ./test/conformance/kuttl/${{ matrix.tests }} --config ./test/conformance/kuttl/_config/common.yaml | |
| - name: Debug failure | |
| if: failure() | |
| uses: ./.github/actions/kyverno-logs | |
| monitor-helm-secret-size: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| packages: read | |
| needs: prepare-images | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 | |
| - name: Setup build env | |
| uses: ./.github/actions/setup-build-env | |
| timeout-minutes: 10 | |
| with: | |
| build-cache-key: run-conformance | |
| - name: Create kind cluster | |
| shell: bash | |
| run: | | |
| set -e | |
| make kind-create-cluster | |
| - name: Download kyverno images archive | |
| uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 | |
| with: | |
| name: kyverno.tar | |
| - name: Load kyverno images archive in kind cluster | |
| shell: bash | |
| run: | | |
| set -e | |
| make kind-load-image-archive | |
| - name: Install kyverno | |
| shell: bash | |
| run: | | |
| make kind-install-kyverno | |
| - name: Wait for kyverno ready | |
| uses: ./.github/actions/kyverno-wait-ready | |
| - name: Check secret size | |
| shell: bash | |
| run: | | |
| set -e | |
| set -u | |
| SIZE=$(kubectl get secrets -n kyverno sh.helm.release.v1.kyverno.v1 -o jsonpath='{.data.release}' | base64 -d | wc -c | awk '{print $1}') | |
| MAX_ALLOWED=1030000 | |
| if [ "$SIZE" -gt "$MAX_ALLOWED" ]; then | |
| echo "Helm secret size ($SIZE bytes) is above the max allowed ($MAX_ALLOWED bytes)" | |
| exit 1 | |
| else | |
| echo "Helm secret size ($SIZE bytes) is below the max allowed ($MAX_ALLOWED bytes)" | |
| fi | |
| check-tests: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| packages: read | |
| needs: prepare-cli | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 | |
| - name: Download kyverno CLI archive | |
| uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 | |
| with: | |
| name: kubectl-kyverno | |
| - name: Install Kyverno CLI | |
| shell: bash | |
| run: | | |
| set -e | |
| chmod +x kubectl-kyverno && mv kubectl-kyverno ./cmd/cli/kubectl-kyverno/kyverno | |
| echo "$PWD/cmd/cli/kubectl-kyverno" >> $GITHUB_PATH | |
| - name: Fix test files | |
| shell: bash | |
| run: | | |
| set -e | |
| KYVERNO_EXPERIMENTAL=true kyverno fix test ./test/cli --save --compress | |
| make verify-cli-tests | |
| required: | |
| needs: | |
| - standard | |
| - ttl | |
| - force-failure-policy-ignore | |
| - validating-admission-policies-v1alpha1 | |
| - validating-admission-policies-v1beta1 | |
| - validating-admission-policy-reports-v1alpha1 | |
| - validating-admission-policy-reports-v1beta1 | |
| - custom-sigstore | |
| - default | |
| - monitor-helm-secret-size | |
| - check-tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - run: echo "Required jobs success!" |