gatekeeper-k8s-integrationtests.yaml

name: Run gatekeeper-k8s-integrationtests.sh

on: [push, pull_request]

# Declare default permissions as read only.
permissions: read-all

jobs:
  kind:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

      - name: Find test data to validate
        shell: bash
        id: data
        run: |
          echo "files=$(find policy/* -regex '.*test_data\/integration\/.*$' | xargs)" >> "$GITHUB_OUTPUT"

      - name: Validate integration test data via kubeconform
        env:
          # renovate: datasource=github-releases depName=garethahealy/openshift-json-schema
          OCP_SCHEMA_VERSION: "4.16.0"
        uses: docker://ghcr.io/yannh/kubeconform:v0.6.7@sha256:0925177fb05b44ce18574076141b5c3d83235e1904d3f952182ac99ddc45762c
        with:
          args: -summary -kubernetes-version ${{ env.OCP_SCHEMA_VERSION }} -schema-location "https://raw.githubusercontent.com/garethahealy/openshift-json-schema/main/{{ .NormalizedKubernetesVersion }}/schemas/{{ .ResourceKind }}{{ .KindSuffix }}.json" ${{ steps.data.outputs.files }}

      - name: Create k8s Kind Cluster
        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0

      - name: Setup confbatstest
        uses: redhat-cop/github-actions/confbatstest@1a584131f8a335296e866d1fb0988870ca83aefb # v4.3
        with:
          raw: echo "Needed for next stage"

      - name: Test against KinD
        run: |
          confbatstest=$(docker images --filter=label=com.github.actions.name=confbatstest --format "{{.Repository}}:{{.Tag}}")
          docker run --rm --network host --workdir /conftest --volume "/home/runner/.kube/":"/opt/app-root/src/.kube/" --volume "/home/runner/work/rego-policies/rego-policies":"/conftest" --entrypoint .github/workflows/tests-entrypoint.sh ${confbatstest}

      - name: Get pods and events if tests failed
        if: ${{ failure() }}
        run: |
          echo "## nodes:"
          kubectl get nodes

          echo "## namespaces:"
          kubectl get namespaces

          echo "## deployments:"
          kubectl get deployments --all-namespaces

          echo "## pods:"
          kubectl get pods --all-namespaces

          echo "## events:"
          kubectl get events --all-namespaces

          echo "## api-versions:"
          kubectl api-versions
          
          echo "## describe deployment/gatekeeper-audit:"
          kubectl describe deployment/gatekeeper-audit -n gatekeeper-system
          
          echo "## logs deployment/gatekeeper-audit:"
          kubectl logs deployment/gatekeeper-audit -n gatekeeper-system
          
          echo "## describe deployment/gatekeeper-controller-manager:"
          kubectl describe deployment/gatekeeper-controller-manager -n gatekeeper-system
          
          echo "## logs deployment/gatekeeper-controller-manager:"
          kubectl logs deployment/gatekeeper-controller-manager -n gatekeeper-system