eks-tunnel.yaml

name: EKS (tunnel)

# Any change in triggers needs to be reflected in the concurrency group.
on:
  ### FOR TESTING PURPOSES
  # This workflow runs in the context of `main`, and ignores changes to
  # workflow files in PRs. For testing changes to this workflow from a PR:
  # - Make sure the PR uses a branch from the base repository (requires write
  #   privileges). It will not work with a branch from a fork (missing secrets).
  # - Uncomment the `pull_request` event below, commit separately with a `DO
  #   NOT MERGE` message, and push to the PR. As long as the commit is present,
  #   any push to the PR will trigger this workflow.
  # - Don't forget to remove the `DO NOT MERGE` commit once satisfied. The run
  #   will disappear from the PR checks: please provide a direct link to the
  #   successful workflow run (can be found from Actions tab) in a comment.
  #
  # pull_request: {}
  ###
  pull_request_target: {}
  # Run every 6 hours
  schedule:
    - cron:  '30 1/6 * * *'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || 'scheduled' }}
  cancel-in-progress: true

env:
  region: us-east-2
  eksctl_version: v0.147.0
  # renovate: datasource=github-releases depName=cilium/cilium
  cilium_version: v1.15.5
  kubectl_version: v1.23.6

jobs:
  installation-and-connectivity:
    name: EKS (tunnel) Installation and Connectivity Test
    if: ${{ github.repository == 'cilium/cilium-cli' }}
    runs-on: ubuntu-22.04
    permissions:
      # To be able to request the JWT from GitHub's OIDC provider
      id-token: write
    timeout-minutes: 45
    steps:
      - name: Set cluster name
        run: |
          echo "clusterName=${{ github.repository_owner }}-${{ github.event.repository.name }}-${{ github.run_id }}-${{ github.run_attempt }}" >> $GITHUB_ENV

      - name: Checkout
        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4

      - name: Install kubectl
        run: |
          curl -sLO "https://dl.k8s.io/release/${{ env.kubectl_version }}/bin/linux/amd64/kubectl"
          curl -sLO "https://dl.k8s.io/${{ env.kubectl_version }}/bin/linux/amd64/kubectl.sha256"
          echo "$(cat kubectl.sha256)  kubectl" | sha256sum --check
          sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
          kubectl version --client

      - name: Install eksctl CLI
        run: |
          curl -LO "https://github.com/weaveworks/eksctl/releases/download/${{ env.eksctl_version }}/eksctl_$(uname -s)_amd64.tar.gz"
          sudo tar xzvfC eksctl_$(uname -s)_amd64.tar.gz /usr/bin
          rm eksctl_$(uname -s)_amd64.tar.gz

      - name: Install helm
        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
        with:
          # Due to the below issue, v3.8.2 is pinned currently to avoid
          # exec plugin: invalid apiVersion "client.authentication.k8s.io/v1alpha1"
          # https://github.com/helm/helm/issues/10975
          version: v3.8.2

      - name: Set up AWS CLI credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
        with:
          role-to-assume: ${{ secrets.AWS_PR_ASSUME_ROLE }}
          aws-region: ${{ env.region }}

      - name: Set up job variables
        id: vars
        run: |
          if [ ${{ github.event.issue.pull_request || github.event.pull_request }} ]; then
            PR_API_JSON=$(curl \
              -H "Accept: application/vnd.github.v3+json" \
              -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
              ${{ github.event.issue.pull_request.url || github.event.pull_request.url }})
            SHA=$(echo "$PR_API_JSON" | jq -r ".head.sha")
            OWNER=$(echo "$PR_API_JSON" | jq -r ".number")
          else
            SHA=${{ github.sha }}
            OWNER=${{ github.sha }}
          fi

          echo "sha=${SHA}" >> $GITHUB_OUTPUT
          echo "owner=${OWNER}" >> $GITHUB_OUTPUT

      - name: Create EKS cluster
        run: |
          cat <<EOF > eks-config.yaml
            apiVersion: eksctl.io/v1alpha5
            kind: ClusterConfig

            metadata:
              name: ${{ env.clusterName }}
              region: ${{ env.region }}
              tags:
               usage: "${{ github.repository_owner }}-${{ github.event.repository.name }}"
               owner: "${{ steps.vars.outputs.owner }}"

            managedNodeGroups:
            - name: ng-1
              instanceTypes:
               - t3.medium
               - t3a.medium
              desiredCapacity: 2
              spot: true
              privateNetworking: true
              volumeType: "gp3"
              volumeSize: 10
              taints:
               - key: "node.cilium.io/agent-not-ready"
                 value: "true"
                 effect: "NoExecute"
          EOF

          eksctl create cluster -f ./eks-config.yaml

      - name: Create kubeconfig and load it in configmap
        run: |
          .github/get-kubeconfig.sh
          kubectl create configmap cilium-cli-kubeconfig -n kube-system --from-file kubeconfig

      - name: Load cilium cli script in configmap
        run: |
          kubectl create configmap cilium-cli-test-script -n kube-system --from-file=in-cluster-test-script.sh=.github/in-cluster-test-scripts/eks-tunnel.sh

      - name: Create cilium-cli test job
        run: |
          helm install .github/cilium-cli-test-job-chart \
            --generate-name \
            --set tag=${{ steps.vars.outputs.sha }} \
            --set cilium_version=${{ env.cilium_version }} \
            --set cluster_name=${{ env.clusterName }}

      - name: Wait for job
        env:
          timeout: 30m
        run: |
          # Background wait for job to complete or timeout
          kubectl -n kube-system wait job/cilium-cli --for=condition=complete --timeout=${{ env.timeout }} &
          complete_pid=$!

          # Background wait for job to fail
          (kubectl -n kube-system wait job/cilium-cli --for=condition=failed --timeout=${{ env.timeout }} && exit 1) &
          failed_pid=$!

          # Active wait for whichever background process ends first
          wait -n $complete_pid $failed_pid
          EXIT_CODE=$?

          # Retrieve job logs
          kubectl logs --timestamps -n kube-system job/cilium-cli
          exit ${EXIT_CODE}
        shell: bash {0} # Disable default fail-fast behaviour so that all commands run independently

      - name: Post-test information gathering
        if: ${{ !success() }}
        run: |
          echo "=== Install latest stable CLI ==="
          curl -sSL --remote-name-all https://github.com/cilium/cilium-cli/releases/latest/download/cilium-linux-amd64.tar.gz{,.sha256sum}
          sha256sum --check cilium-linux-amd64.tar.gz.sha256sum
          sudo tar xzvfC cilium-linux-amd64.tar.gz /usr/bin
          rm cilium-linux-amd64.tar.gz{,.sha256sum}
          cilium version

          echo "=== Retrieve cluster state ==="
          kubectl get pods --all-namespaces -o wide
          cilium status
          cilium sysdump --output-filename cilium-sysdump-out
        shell: bash {0} # Disable default fail-fast behaviour so that all commands run independently

      - name: Uninstall and make sure the 'aws-node' DaemonSet blocking nodeSelector was removed
        if: ${{ success() }}
        env:
          timeout: 5m
        run: |
          kubectl create configmap cilium-cli-test-script-uninstall -n kube-system --from-file=in-cluster-test-script.sh=.github/in-cluster-test-scripts/eks-uninstall.sh
          helm install .github/cilium-cli-test-job-chart \
            --generate-name \
            --set tag=${{ steps.vars.outputs.sha }} \
            --set cluster_name=${{ env.clusterName }} \
            --set job_name=cilium-cli-uninstall \
            --set test_script_cm=cilium-cli-test-script-uninstall

          # Background wait for job to complete or timeout
          kubectl -n kube-system wait job/cilium-cli-uninstall --for=condition=complete --timeout=${{ env.timeout }} &
          complete_pid=$!

          # Background wait for job to fail
          (kubectl -n kube-system wait job/cilium-cli-uninstall --for=condition=failed --timeout=${{ env.timeout }} && exit 1) &
          failed_pid=$!

          # Active wait for whichever background process ends first
          wait -n $complete_pid $failed_pid
          EXIT_CODE=$?

          # Retrieve job logs
          kubectl logs --timestamps -n kube-system job/cilium-cli-uninstall
          exit ${EXIT_CODE}
        shell: bash {0} # Disable default fail-fast behaviour so that all commands run independently

      - name: Clean up EKS
        if: ${{ always() }}
        run: |
          eksctl delete cluster --name ${{ env.clusterName }}
        shell: bash {0} # Disable default fail-fast behaviour so that all commands run independently

      - name: Upload artifacts
        if: ${{ !success() }}
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
        with:
          name: cilium-sysdump-out.zip
          path: cilium-sysdump-out.zip
          retention-days: 5