ci: rewrite E2E workflow for Docker image approach
Replaces the PVC + kubectl-patch E2E workflow with the new custom Docker image approach from PR #73: - Split into 2 jobs: build-image (ubuntu-latest) builds and pushes the E2E image to ghcr.io, e2e (ARC runners) deploys via Helm and tests - Removes HEADLAMP_NAMESPACE/HEADLAMP_DEPLOY env vars - Removes azure/setup-kubectl step (kubectl available on ARC runners) - Removes PVC creation, deployment patching, and volume mount steps - Adds Helm-based deploy/teardown with always() cleanup - Auto-generates service account token for E2E auth - No kube-system access needed — uses headlamp-e2e namespace Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
+84
-96
@@ -7,15 +7,16 @@ on:
|
|||||||
branches: [main]
|
branches: [main]
|
||||||
workflow_dispatch:
|
workflow_dispatch:
|
||||||
|
|
||||||
env:
|
permissions:
|
||||||
HEADLAMP_NAMESPACE: kube-system
|
contents: read
|
||||||
HEADLAMP_DEPLOY: headlamp
|
packages: write
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
e2e:
|
build-image:
|
||||||
runs-on: runners-privilegedescalation
|
runs-on: ubuntu-latest
|
||||||
timeout-minutes: 15
|
timeout-minutes: 10
|
||||||
|
outputs:
|
||||||
|
image-tag: ${{ steps.meta.outputs.tag }}
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout
|
- name: Checkout
|
||||||
uses: actions/checkout@v6
|
uses: actions/checkout@v6
|
||||||
@@ -32,100 +33,83 @@ jobs:
|
|||||||
- name: Build plugin
|
- name: Build plugin
|
||||||
run: npm run build
|
run: npm run build
|
||||||
|
|
||||||
- name: Setup kubectl
|
- name: Set image tag
|
||||||
uses: azure/setup-kubectl@v4
|
id: meta
|
||||||
|
run: echo "tag=sha-$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
|
||||||
|
|
||||||
- name: Ensure PVC exists
|
- name: Set up Docker Buildx
|
||||||
run: kubectl apply -f deployment/headlamp-plugins-pvc.yaml
|
uses: docker/setup-buildx-action@v3
|
||||||
|
|
||||||
- name: Patch Headlamp deployment with shared volume mount
|
- name: Log in to ghcr.io
|
||||||
run: |
|
uses: docker/login-action@v3
|
||||||
NS="$HEADLAMP_NAMESPACE"
|
with:
|
||||||
DEPLOY="$HEADLAMP_DEPLOY"
|
registry: ghcr.io
|
||||||
|
username: ${{ github.actor }}
|
||||||
|
password: ${{ secrets.GITHUB_TOKEN }}
|
||||||
|
|
||||||
# Check if the plugins volume and mount already exist (by name or mountPath)
|
- name: Build and push E2E image
|
||||||
DEPLOY_JSON=$(kubectl get deploy "$DEPLOY" -n "$NS" -o json)
|
uses: docker/build-push-action@v6
|
||||||
HAS_VOL=$(echo "$DEPLOY_JSON" | \
|
with:
|
||||||
python3 -c "import sys,json; d=json.load(sys.stdin); vols=d['spec']['template']['spec'].get('volumes',[]); print('yes' if any(v.get('persistentVolumeClaim',{}).get('claimName')=='headlamp-plugins' or v.get('name')=='plugins' for v in vols) else '')")
|
context: .
|
||||||
HAS_MOUNT=$(echo "$DEPLOY_JSON" | \
|
file: Dockerfile.e2e
|
||||||
python3 -c "import sys,json; d=json.load(sys.stdin); mounts=d['spec']['template']['spec']['containers'][0].get('volumeMounts',[]); print('yes' if any(m.get('mountPath')=='/headlamp/plugins' or m.get('name')=='plugins' for m in mounts) else '')")
|
push: true
|
||||||
|
tags: ghcr.io/privilegedescalation/headlamp-polaris-e2e:${{ steps.meta.outputs.tag }}
|
||||||
|
|
||||||
NEEDS_PATCH=false
|
e2e:
|
||||||
|
needs: build-image
|
||||||
if [ -z "$HAS_VOL" ]; then
|
runs-on: runners-privilegedescalation
|
||||||
echo "Adding plugins PVC volume..."
|
timeout-minutes: 15
|
||||||
kubectl patch deploy "$DEPLOY" -n "$NS" --type=json -p '[
|
|
||||||
{"op":"add","path":"/spec/template/spec/volumes/-","value":{
|
|
||||||
"name":"plugins",
|
|
||||||
"persistentVolumeClaim":{"claimName":"headlamp-plugins"}
|
|
||||||
}}
|
|
||||||
]'
|
|
||||||
NEEDS_PATCH=true
|
|
||||||
else
|
|
||||||
echo "Plugins volume already present, skipping."
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ -z "$HAS_MOUNT" ]; then
|
|
||||||
echo "Adding plugins volume mount..."
|
|
||||||
kubectl patch deploy "$DEPLOY" -n "$NS" --type=json -p '[
|
|
||||||
{"op":"add","path":"/spec/template/spec/containers/0/volumeMounts/-","value":{
|
|
||||||
"name":"plugins",
|
|
||||||
"mountPath":"/headlamp/plugins",
|
|
||||||
"readOnly":true
|
|
||||||
}}
|
|
||||||
]'
|
|
||||||
NEEDS_PATCH=true
|
|
||||||
else
|
|
||||||
echo "Plugins volume mount already present, skipping."
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Set the plugins directory via env var
|
|
||||||
kubectl set env deploy/"$DEPLOY" -n "$NS" \
|
|
||||||
HEADLAMP_CONFIG_PLUGIN_DIR=/headlamp/plugins
|
|
||||||
|
|
||||||
# Wait for rollout
|
|
||||||
kubectl rollout status deploy/"$DEPLOY" -n "$NS" --timeout=120s
|
|
||||||
|
|
||||||
- name: Deploy plugin via shared volume
|
|
||||||
run: scripts/deploy-plugin-via-volume.sh
|
|
||||||
|
|
||||||
- name: Preflight — verify Headlamp and plugin availability
|
|
||||||
env:
|
env:
|
||||||
HEADLAMP_URL: ${{ secrets.HEADLAMP_URL || 'http://headlamp.kube-system.svc.cluster.local' }}
|
E2E_NAMESPACE: headlamp-e2e
|
||||||
|
E2E_RELEASE: headlamp-e2e
|
||||||
|
IMAGE_TAG: ${{ needs.build-image.outputs.image-tag }}
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@v6
|
||||||
|
|
||||||
|
- name: Setup Helm
|
||||||
|
uses: azure/setup-helm@v4
|
||||||
|
with:
|
||||||
|
version: v3.17.0
|
||||||
|
|
||||||
|
- name: Deploy E2E Headlamp
|
||||||
run: |
|
run: |
|
||||||
PLUGIN_NAME=$(node -p "require('./package.json').name")
|
helm repo add headlamp https://headlamp-k8s.github.io/headlamp/ --force-update
|
||||||
EXPECTED=$(node -p "require('./package.json').version")
|
helm repo update
|
||||||
echo "Expecting: $PLUGIN_NAME@$EXPECTED"
|
|
||||||
|
|
||||||
# Wait for Headlamp to be reachable
|
kubectl create namespace "$E2E_NAMESPACE" --dry-run=client -o yaml | kubectl apply -f -
|
||||||
for i in $(seq 1 30); do
|
|
||||||
HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout 5 "$HEADLAMP_URL" || true)
|
|
||||||
if [ "$HTTP_CODE" != "000" ]; then
|
|
||||||
echo "Headlamp responded HTTP $HTTP_CODE"
|
|
||||||
break
|
|
||||||
fi
|
|
||||||
echo "Waiting for Headlamp... ($i/30)"
|
|
||||||
sleep 2
|
|
||||||
done
|
|
||||||
|
|
||||||
if [ "$HTTP_CODE" = "000" ]; then
|
helm upgrade --install "$E2E_RELEASE" headlamp/headlamp \
|
||||||
echo "::error::Cannot reach Headlamp at $HEADLAMP_URL after 60s"
|
-n "$E2E_NAMESPACE" \
|
||||||
exit 1
|
-f deployment/headlamp-e2e-values.yaml \
|
||||||
fi
|
--set "image.registry=ghcr.io" \
|
||||||
|
--set "image.repository=privilegedescalation/headlamp-polaris-e2e" \
|
||||||
|
--set "image.tag=${IMAGE_TAG}" \
|
||||||
|
--wait \
|
||||||
|
--timeout 120s
|
||||||
|
|
||||||
# Verify plugin is visible
|
kubectl rollout status "deployment/${E2E_RELEASE}-headlamp" \
|
||||||
PLUGIN_JSON=$(curl -sf --connect-timeout 10 "$HEADLAMP_URL/plugins" 2>/dev/null || echo "[]")
|
-n "$E2E_NAMESPACE" --timeout=120s
|
||||||
node -e "
|
|
||||||
const plugins = JSON.parse(process.argv[1]);
|
- name: Generate E2E auth token
|
||||||
console.log('Installed plugins:');
|
id: token
|
||||||
for (const p of plugins) console.log(' ' + p.name + '@' + (p.version||'unknown'));
|
run: |
|
||||||
const ours = plugins.find(p => p.name === '$PLUGIN_NAME' || p.name === 'polaris' || p.name.includes('polaris'));
|
kubectl create serviceaccount headlamp-e2e-test \
|
||||||
if (!ours) {
|
-n "$E2E_NAMESPACE" --dry-run=client -o yaml | kubectl apply -f -
|
||||||
console.log('::warning::Plugin $PLUGIN_NAME not yet visible — Headlamp may need a restart');
|
TOKEN=$(kubectl create token headlamp-e2e-test -n "$E2E_NAMESPACE" --duration=1h)
|
||||||
} else {
|
echo "::add-mask::${TOKEN}"
|
||||||
console.log('Found plugin: ' + ours.name + ' at path ' + ours.path);
|
echo "token=${TOKEN}" >> "$GITHUB_OUTPUT"
|
||||||
}
|
echo "url=http://${E2E_RELEASE}-headlamp.${E2E_NAMESPACE}.svc.cluster.local" >> "$GITHUB_OUTPUT"
|
||||||
" "$PLUGIN_JSON"
|
|
||||||
|
- name: Setup Node.js
|
||||||
|
uses: actions/setup-node@v4
|
||||||
|
with:
|
||||||
|
node-version: '22'
|
||||||
|
cache: 'npm'
|
||||||
|
|
||||||
|
- name: Install dependencies
|
||||||
|
run: npm ci
|
||||||
|
|
||||||
- name: Install Playwright browsers
|
- name: Install Playwright browsers
|
||||||
run: npx playwright install --with-deps chromium
|
run: npx playwright install --with-deps chromium
|
||||||
@@ -133,10 +117,14 @@ jobs:
|
|||||||
- name: Run E2E tests
|
- name: Run E2E tests
|
||||||
run: npm run e2e
|
run: npm run e2e
|
||||||
env:
|
env:
|
||||||
HEADLAMP_URL: ${{ secrets.HEADLAMP_URL || 'http://headlamp.kube-system.svc.cluster.local' }}
|
HEADLAMP_URL: ${{ steps.token.outputs.url }}
|
||||||
HEADLAMP_TOKEN: ${{ secrets.HEADLAMP_TOKEN }}
|
HEADLAMP_TOKEN: ${{ steps.token.outputs.token }}
|
||||||
AUTHENTIK_USERNAME: ${{ secrets.AUTHENTIK_USERNAME }}
|
|
||||||
AUTHENTIK_PASSWORD: ${{ secrets.AUTHENTIK_PASSWORD }}
|
- name: Teardown E2E Headlamp
|
||||||
|
if: always()
|
||||||
|
run: |
|
||||||
|
helm uninstall "$E2E_RELEASE" -n "$E2E_NAMESPACE" 2>/dev/null || true
|
||||||
|
kubectl delete namespace "$E2E_NAMESPACE" --ignore-not-found --wait=false
|
||||||
|
|
||||||
- name: Upload Playwright report
|
- name: Upload Playwright report
|
||||||
uses: actions/upload-artifact@v4
|
uses: actions/upload-artifact@v4
|
||||||
|
|||||||
Reference in New Issue
Block a user