Add how-to for capi in place upgrades #2816
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Integration Tests | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - autoupdate/strict | |
| - autoupdate/moonray | |
| - 'release-[0-9]+.[0-9]+' | |
| - 'autoupdate/release-[0-9]+.[0-9]+-strict' | |
| - 'autoupdate/sync/**' | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| build: | |
| name: Build | |
| runs-on: ubuntu-20.04 | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@v2 | |
| with: | |
| egress-policy: audit | |
| - name: Checking out repo | |
| uses: actions/checkout@v4 | |
| - name: Install lxd | |
| run: | | |
| sudo snap refresh lxd --channel 5.21/stable | |
| sudo lxd init --auto | |
| sudo usermod --append --groups lxd $USER | |
| sg lxd -c 'lxc version' | |
| - name: Install snapcraft | |
| run: | | |
| sudo snap install snapcraft --classic | |
| - name: Build snap | |
| run: | | |
| sg lxd -c 'snapcraft --use-lxd' | |
| mv k8s_*.snap k8s.snap | |
| - name: Uploading snap | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: k8s.snap | |
| path: k8s.snap | |
| test-branches: | |
| name: Test Branch Management | |
| runs-on: ubuntu-20.04 | |
| steps: | |
| - name: Check out code | |
| uses: actions/checkout@v4 | |
| - name: Setup Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.8' | |
| - name: Install tox | |
| run: pip install tox | |
| - name: Run branch_management tests | |
| run: | | |
| tox -c tests/branch_management -e integration | |
| test-integration: | |
| name: Test ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: ["ubuntu:20.04", "ubuntu:22.04", "ubuntu:24.04"] | |
| runs-on: ubuntu-20.04 | |
| needs: build | |
| steps: | |
| - name: Check out code | |
| uses: actions/checkout@v4 | |
| - name: Setup Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.8' | |
| - name: Install tox | |
| run: pip install tox | |
| - name: Install lxd | |
| run: | | |
| sudo snap refresh lxd --channel 5.21/stable | |
| sudo lxd init --auto | |
| sudo usermod --append --groups lxd $USER | |
| sg lxd -c 'lxc version' | |
| - name: Download snap | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: k8s.snap | |
| path: build | |
| - name: Run end to end tests | |
| run: | | |
| export TEST_SNAP="$PWD/build/k8s.snap" | |
| export TEST_SUBSTRATE=lxd | |
| export TEST_LXD_IMAGE=${{ matrix.os }} | |
| export TEST_INSPECTION_REPORTS_DIR="$HOME/inspection-reports" | |
| cd tests/integration && sg lxd -c 'tox -e integration -- -k test_control_plane_nodes' | |
| - name: Prepare inspection reports | |
| if: failure() | |
| run: | | |
| tar -czvf inspection-reports.tar.gz -C $HOME inspection-reports | |
| echo "artifact_name=inspection-reports-${{ matrix.os }}" | sed 's/:/-/g' >> $GITHUB_ENV | |
| - name: Upload inspection report artifact | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ${{ env.artifact_name }} | |
| path: inspection-reports.tar.gz | |
| security-scan: | |
| permissions: | |
| contents: read # for actions/checkout to fetch code | |
| security-events: write # for github/codeql-action/upload-sarif to upload SARIF results | |
| name: Security scan | |
| runs-on: ubuntu-20.04 | |
| needs: build | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@v2 | |
| with: | |
| egress-policy: audit | |
| - name: Checking out repo | |
| uses: actions/checkout@v4 | |
| - name: Fetch snap | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: k8s.snap | |
| path: build | |
| - name: Setup Trivy vulnerability scanner | |
| run: | | |
| mkdir -p sarifs | |
| VER=$(curl --silent -qI https://github.com/aquasecurity/trivy/releases/latest | awk -F '/' '/^location/ {print substr($NF, 1, length($NF)-1)}'); | |
| wget https://github.com/aquasecurity/trivy/releases/download/${VER}/trivy_${VER#v}_Linux-64bit.tar.gz | |
| tar -zxvf ./trivy_${VER#v}_Linux-64bit.tar.gz | |
| - name: Run Trivy vulnerability scanner in repo mode | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| scan-type: "fs" | |
| ignore-unfixed: true | |
| format: "sarif" | |
| output: "trivy-k8s-repo-scan--results.sarif" | |
| severity: "MEDIUM,HIGH,CRITICAL" | |
| - name: Gather Trivy repo scan results | |
| run: | | |
| cp trivy-k8s-repo-scan--results.sarif ./sarifs/ | |
| - name: Run Trivy vulnerability scanner on the snap | |
| run: | | |
| cp build/k8s.snap . | |
| unsquashfs k8s.snap | |
| ./trivy rootfs ./squashfs-root/ --format sarif > sarifs/snap.sarif | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: "sarifs" |