diff --git a/.github/workflows/pr_build.yml b/.github/workflows/pr_build.yml new file mode 100644 index 0000000..12b811c --- /dev/null +++ b/.github/workflows/pr_build.yml @@ -0,0 +1,29 @@ +name: PR Build +on: + push: + branches: + - master + pull_request: {} + workflow_dispatch: {} +env: + GO_VERSION: 1.16.5 + CHANGE_MINIKUBE_NONE_USER: true + TERM: xterm +jobs: + test-all: + runs-on: ubuntu-18.04 + timeout-minutes: 30 + steps: + - name: Checkout + uses: actions/checkout@v2 + - name: Setup go + uses: actions/setup-go@v2 + with: + go-version: ${{ env.GO_VERSION }} + - name: install minikube + id: minikube + uses: medyagh/setup-minikube@master + - name: Envoy + run: docker-compose/test-all.sh + - name: K8s + run: k8s/test-all.sh diff --git a/docker-compose/metrics/spire/server/server.conf b/docker-compose/metrics/spire/server/server.conf index 20ea11c..9b8ce6a 100644 --- a/docker-compose/metrics/spire/server/server.conf +++ b/docker-compose/metrics/spire/server/server.conf @@ -1,6 +1,7 @@ server { bind_address = "0.0.0.0" bind_port = "8081" + socket_path = "/tmp/spire-server/private/api.sock" trust_domain = "example.org" data_dir = "/opt/spire/data/server" log_level = "DEBUG" diff --git a/docker-compose/metrics/test.sh b/docker-compose/metrics/test.sh index 9e45dac..78174de 100755 --- a/docker-compose/metrics/test.sh +++ b/docker-compose/metrics/test.sh @@ -1,4 +1,3 @@ - #!/bin/bash norm=$(tput sgr0) || true @@ -15,7 +14,7 @@ log() { clean-env() { log "Cleaning up..." - bash "${DIR}"/scripts/clean-env.sh > /dev/null + bash "${DIR}"/scripts/clean-env.sh } trap clean-env EXIT @@ -23,16 +22,16 @@ trap clean-env EXIT log "Preparing environment..." clean-env -bash "${DIR}"/scripts/set-env.sh > /dev/null -bash "${DIR}"/scripts/create-workload-registration-entry.sh > /dev/null +bash "${DIR}"/scripts/set-env.sh +bash "${DIR}"/scripts/create-workload-registration-entry.sh log "Checking Statsd received metrics pushed by SPIRE..." STATSD_LOG_LINE="MetricLineReceiver connection with .* established" for ((i=0;i<60;i++)); do if ! docker-compose -f "${DIR}"/docker-compose.yaml logs --tail=10 -t graphite-statsd | grep -qe "${STATSD_LOG_LINE}" ; then - sleep 1 - continue + sleep 1 + continue fi METRIC_RECEIVED=1 break @@ -44,9 +43,9 @@ fi log "Checking that Prometheus can reach the endpoint exposed by SPIRE..." for ((i=0;i<60;i++)); do - if ! docker-compose -f "${DIR}"/docker-compose.yaml exec prometheus wget -S spire-server:8088/ | grep -qe "200 OK" ; then - sleep 1 - continue + if ! docker-compose -f "${DIR}"/docker-compose.yaml exec -T prometheus wget -S spire-server:8088/ 2>&1 | grep -qe "200 OK" ; then + sleep 1 + continue fi CONNECTION_OK=1 break diff --git a/docker-compose/nested-spire/root/agent/agent.conf b/docker-compose/nested-spire/root/agent/agent.conf index 523ac85..6384eea 100644 --- a/docker-compose/nested-spire/root/agent/agent.conf +++ b/docker-compose/nested-spire/root/agent/agent.conf @@ -3,7 +3,7 @@ agent { log_level = "DEBUG" server_address = "root-server" server_port = "8081" - socket_path ="/opt/spire/sockets/workload_api.sock" + socket_path = "/opt/spire/sockets/workload_api.sock" trust_bundle_path = "/opt/spire/conf/agent/bootstrap.crt" trust_domain = "example.org" } @@ -22,6 +22,8 @@ plugins { } WorkloadAttestor "docker" { plugin_data { + # GitHub worklow activate groups for testing + #container_id_cgroup_matchers = [CGROUP_MATCHERS] } } } diff --git a/docker-compose/nested-spire/scripts/set-env.sh b/docker-compose/nested-spire/scripts/set-env.sh index 22e4e30..295455e 100755 --- a/docker-compose/nested-spire/scripts/set-env.sh +++ b/docker-compose/nested-spire/scripts/set-env.sh @@ -48,6 +48,15 @@ check-entry-is-propagated() { } +# Configure the environment-dependent CGROUP matchers for the docker workload +# attestors. +CGROUP_MATCHERS="TEreso" +if [ -n "${GITHUB_WORKFLOW}" ]; then + CGROUP_MATCHERS='"/actions_job/"' +fi +sed -i.bak "s#\#container_id_cgroup_matchers#container_id_cgroup_matchers#" "${PARENT_DIR}"/root/agent/agent.conf +sed -i.bak "s#CGROUP_MATCHERS#$CGROUP_MATCHERS#" "${PARENT_DIR}"/root/agent/agent.conf + # create a shared folder for root agent socket to be accessed by nestedA and nestedB servers mkdir -p "${PARENT_DIR}"/sharedRootSocket diff --git a/docker-compose/nested-spire/test.sh b/docker-compose/nested-spire/test.sh index b122497..c5a512b 100755 --- a/docker-compose/nested-spire/test.sh +++ b/docker-compose/nested-spire/test.sh @@ -30,10 +30,10 @@ trap clean-env EXIT log "Preparing Nested SPIRE environment..." clean-env -bash "${DIR}"/scripts/set-env.sh > /dev/null +bash "${DIR}"/scripts/set-env.sh log "Creating workload registration entries..." -bash "${DIR}"/scripts/create-workload-registration-entries.sh > /dev/null +bash "${DIR}"/scripts/create-workload-registration-entries.sh log "checking nested JWT-SVID..." # Fetch JWT-SVID and extract token diff --git a/k8s/quickstart/test.sh b/k8s/quickstart/test.sh index 0d6c8f5..ee972f5 100755 --- a/k8s/quickstart/test.sh +++ b/k8s/quickstart/test.sh @@ -13,18 +13,15 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" MINIKUBEPROFILE="SPIRE-SYSTEMS-TEST" MINIKUBECMD="minikube -p ${MINIKUBEPROFILE}" CHECKINTERVAL=1 -if [ -n "${TRAVIS}" ]; then - # Use the default profile inside of Travis - MINIKUBECMD="/usr/local/bin/minikube" - # Travis is slow. Give our containers more time. +if [ -n "${GITHUB_WORKFLOW}" ]; then CHECKINTERVAL=5 fi TMPDIR=$(mktemp -d) SERVERLOGS=${TMPDIR}/spire-server-logs.log start_minikube() { - # Travis will start up minikube (via .travis.yml) - if [ -z "${TRAVIS}" ]; then + # GH actions will start up minikube + if [ -z "${GITHUB_WORKFLOW}" ]; then echo "${bold}Starting minikube... ${norm}" ${MINIKUBECMD} start eval $(${MINIKUBECMD} docker-env) @@ -36,8 +33,8 @@ tear_down_config() { } stop_minikube() { - # Don't stop the minikube inside of travis - if [ -z "${TRAVIS}" ]; then + # Don't stop the minikube inside of GH actions + if [ -z "${GITHUB_WORKFLOW}" ]; then ${MINIKUBECMD} stop > /dev/null || true fi } diff --git a/k8s/test-all.sh b/k8s/test-all.sh index e6b1c53..3186a9b 100755 --- a/k8s/test-all.sh +++ b/k8s/test-all.sh @@ -38,4 +38,5 @@ done if [ -n "${FAILED}" ]; then fail "There were test failures" fi -echo "${green}Done. All test passed!${norm}" \ No newline at end of file +echo "${green}Done. All test passed!${norm}" +