conformance-e2e.yaml

name: Conformance E2E (ci-e2e)

# Any change in triggers needs to be reflected in the concurrency group.
on:
  workflow_dispatch:
    inputs:
      PR-number:
        description: "Pull request number."
        required: true
      context-ref:
        description: "Context in which the workflow runs. If PR is from a fork, will be the PR target branch (general case). If PR is NOT from a fork, will be the PR branch itself (this allows committers to test changes to workflows directly from PRs)."
        required: true
      SHA:
        description: "SHA under test (head of the PR branch)."
        required: true
      extra-args:
        description: "[JSON object] Arbitrary arguments passed from the trigger comment via regex capture group. Parse with 'fromJson(inputs.extra-args).argName' in workflow."
        required: false
        default: '{}'
  # Run every 6 hours
  schedule:
    - cron:  '0 5/6 * * *'

# By specifying the access of one of the scopes, all of those that are not
# specified are set to 'none'.
permissions:
  # To be able to access the repository with actions/checkout
  contents: read
  # To allow retrieving information from the PR API
  pull-requests: read
  # To be able to set commit status
  statuses: write

concurrency:
  # Structure:
  # - Workflow name
  # - Event type
  # - A unique identifier depending on event type:
  #   - schedule: SHA
  #   - workflow_dispatch: PR number
  #
  # This structure ensures a unique concurrency group name is generated for each
  # type of testing, such that re-runs will cancel the previous run.
  group: |
    ${{ github.workflow }}
    ${{ github.event_name }}
    ${{
      (github.event_name == 'schedule' && github.sha) ||
      (github.event_name == 'workflow_dispatch' && github.event.inputs.PR-number)
    }}
  cancel-in-progress: true

env:
  cilium_cli_ci_version:
  check_url: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}

jobs:
  commit-status-start:
    name: Commit Status Start
    runs-on: ubuntu-latest
    steps:
      - name: Set initial commit status
        uses: myrotvorets/set-commit-status-action@38f3f27c7d52fb381273e95542f07f0fba301307 # v2.0.0
        with:
          sha: ${{ inputs.SHA || github.sha }}

  setup-and-test:
    runs-on: ubuntu-latest-4cores-16gb
    name: 'Setup & Test'
    env:
      job_name: 'Setup & Test'
    strategy:
      fail-fast: false
      max-parallel: 16
      matrix:
        include:
          # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
          # ! NOTE: keep tests-e2e-upgrade.yaml config in sync !
          # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

          - name: '1'
            # renovate: datasource=docker depName=quay.io/lvh-images/kind
            kernel: '4.19-20231128.100518'
            kube-proxy: 'iptables'
            kpr: 'false'
            tunnel: 'vxlan'

          - name: '2'
            # renovate: datasource=docker depName=quay.io/lvh-images/kind
            kernel: '5.4-20231128.100518'
            kube-proxy: 'iptables'
            kpr: 'false'
            tunnel: 'disabled'

          - name: '3'
            # renovate: datasource=docker depName=quay.io/lvh-images/kind
            kernel: '5.10-20231128.100518'
            kube-proxy: 'iptables'
            kpr: 'false'
            tunnel: 'disabled'
            endpoint-routes: 'true'

          - name: '4'
            # renovate: datasource=docker depName=quay.io/lvh-images/kind
            kernel: '5.10-20231128.100518'
            kube-proxy: 'iptables'
            kpr: 'true'
            devices: '{eth0,eth1}'
            secondary-network: 'true'
            tunnel: 'vxlan'
            lb-mode: 'snat'
            endpoint-routes: 'true'
            egress-gateway: 'true'

          - name: '5'
            # renovate: datasource=docker depName=quay.io/lvh-images/kind
            kernel: '5.15-20231128.100518'
            kube-proxy: 'iptables'
            kpr: 'true'
            devices: '{eth0,eth1}'
            secondary-network: 'true'
            tunnel: 'disabled'
            lb-mode: 'dsr'
            endpoint-routes: 'true'
            egress-gateway: 'true'
            host-fw: 'true'

          - name: '6'
            # renovate: datasource=docker depName=quay.io/lvh-images/kind
            kernel: '6.1-20231128.100518'
            kube-proxy: 'none'
            kpr: 'true'
            tunnel: 'vxlan'
            lb-mode: 'snat'
            egress-gateway: 'true'
            host-fw: 'true'
            lb-acceleration: 'testing-only'
            ingress-controller: 'true'

          - name: '7'
            # renovate: datasource=docker depName=quay.io/lvh-images/kind
            kernel: 'bpf-next-20231211.012942'
            kube-proxy: 'none'
            kpr: 'true'
            devices: '{eth0,eth1}'
            secondary-network: 'true'
            tunnel: 'disabled'
            lb-mode: 'snat'
            egress-gateway: 'true'
            lb-acceleration: 'testing-only'
            ingress-controller: 'true'

          - name: '8'
            # renovate: datasource=docker depName=quay.io/lvh-images/kind
            kernel: 'bpf-next-20231211.012942'
            kube-proxy: 'iptables'
            kpr: 'false'
            tunnel: 'geneve'
            endpoint-routes: 'true'

          - name: '9'
            # renovate: datasource=docker depName=quay.io/lvh-images/kind
            kernel: '5.10-20231128.100518'
            kube-proxy: 'iptables'
            kpr: 'true'
            devices: '{eth0,eth1}'
            secondary-network: 'true'
            tunnel: 'vxlan'
            encryption: 'wireguard'
            encryption-node: 'false'
            lb-mode: 'snat'
            endpoint-routes: 'true'
            egress-gateway: 'true'

          - name: '10'
            # renovate: datasource=docker depName=quay.io/lvh-images/kind
            kernel: '5.15-20231128.100518'
            kube-proxy: 'iptables'
            kpr: 'true'
            devices: '{eth0,eth1}'
            secondary-network: 'true'
            tunnel: 'disabled'
            encryption: 'wireguard'
            encryption-node: 'false'
            lb-mode: 'dsr'
            endpoint-routes: 'true'
            egress-gateway: 'true'

          - name: '11'
            # renovate: datasource=docker depName=quay.io/lvh-images/kind
            kernel: '6.1-20231128.100518'
            kube-proxy: 'none'
            kpr: 'true'
            devices: '{eth0,eth1}'
            secondary-network: 'true'
            tunnel: 'vxlan'
            encryption: 'wireguard'
            encryption-node: 'true'
            lb-mode: 'snat'
            egress-gateway: 'true'
            ingress-controller: 'true'

          - name: '12'
            # renovate: datasource=docker depName=quay.io/lvh-images/kind
            kernel: 'bpf-next-20231211.012942'
            kube-proxy: 'none'
            kpr: 'true'
            devices: '{eth0,eth1}'
            secondary-network: 'true'
            tunnel: 'disabled'
            encryption: 'wireguard'
            encryption-node: 'true'
            lb-mode: 'snat'
            egress-gateway: 'true'
            ingress-controller: 'true'

          - name: '13'
            # renovate: datasource=docker depName=quay.io/lvh-images/kind
            kernel: '4.19-20231128.100518'
            kube-proxy: 'iptables'
            kpr: 'false'
            tunnel: 'vxlan'
            misc: 'policyCIDRMatchMode=nodes'

          - name: '14'
            # renovate: datasource=docker depName=quay.io/lvh-images/kind
            kernel: '5.4-20231128.100518'
            kube-proxy: 'iptables'
            kpr: 'true'
            devices: '{eth0,eth1}'
            secondary-network: 'true'
            tunnel: 'vxlan'
            lb-mode: 'snat'
            egress-gateway: 'true'
            lb-acceleration: 'testing-only'


    timeout-minutes: 60
    steps:
      - name: Checkout context ref (trusted)
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          ref: ${{ inputs.context-ref || github.sha }}
          persist-credentials: false

      - name: Set Environment Variables
        uses: ./.github/actions/set-env-variables

      - name: Set up job variables
        id: vars
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            SHA="${{ inputs.SHA }}"
          else
            SHA="${{ github.sha }}"
          fi
          echo sha=${SHA} >> $GITHUB_OUTPUT

      - name: Derive Cilium installation config and junit type
        id: cilium-config
        uses: ./.github/actions/cilium-config
        with:
          image-tag: ${{ steps.vars.outputs.sha }}
          chart-dir: './install/kubernetes/cilium'
          tunnel: ${{ matrix.tunnel }}
          devices: ${{ matrix.devices }}
          endpoint-routes: ${{ matrix.endpoint-routes }}
          ipv6: ${{ matrix.ipv6 }}
          kpr: ${{ matrix.kpr }}
          lb-mode: ${{ matrix.lb-mode }}
          lb-acceleration: ${{ matrix.lb-acceleration }}
          encryption: ${{ matrix.encryption }}
          encryption-node: ${{ matrix.encryption-node }}
          egress-gateway: ${{ matrix.egress-gateway }}
          host-fw: ${{ matrix.host-fw }}
          ingress-controller: ${{ matrix.ingress-controller }}
          misc: ${{ matrix.misc }}

      # Warning: since this is a privileged workflow, subsequent workflow job
      # steps must take care not to execute untrusted code.
      - name: Checkout pull request branch (NOT TRUSTED)
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          ref: ${{ steps.vars.outputs.sha }}
          persist-credentials: false

      - name: Install Cilium CLI-cli
        uses: cilium/cilium-cli@c1fa8afda634f0457e9905d4f638e5164c4e0fc8 # v0.15.17
        with:
          repository: ${{ env.CILIUM_CLI_RELEASE_REPO }}
          release-version: ${{ env.CILIUM_CLI_VERSION }}
          ci-version: ${{ env.cilium_cli_ci_version }}
          binary-name: cilium-cli
          binary-dir: ./

      - name: Set Kind params
        id: kind-params
        shell: bash
        run: |
          IP_FAM="dual"
          if [ "${{ matrix.ipv6 }}" == "false" ]; then
            IP_FAM="ipv4"
          fi
          echo params="--xdp --secondary-network \"\" 3 \"\" \"\" ${{ matrix.kube-proxy }} $IP_FAM" >> $GITHUB_OUTPUT

      - name: Provision K8s on LVH VM
        uses: cilium/cilium/.github/actions/lvh-kind@main
        with:
          test-name: e2e-conformance
          kernel: ${{ matrix.kernel }}
          kind-params: "${{ steps.kind-params.outputs.params }}"

      - name: Wait for images to be available
        timeout-minutes: 30
        shell: bash
        run: |
          for image in cilium-ci operator-generic-ci hubble-relay-ci ; do
            until docker manifest inspect quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/$image:${{ steps.vars.outputs.sha }} &> /dev/null; do sleep 45s; done
          done

      - name: Install Cilium
        shell: bash
        run: |
          kubectl patch node kind-worker3 --type=json -p='[{"op":"add","path":"/metadata/labels/cilium.io~1no-schedule","value":"true"}]'

          export CILIUM_CLI_MODE=helm
          ./cilium-cli install ${{ steps.cilium-config.outputs.config }}
          kubectl -n cilium-spire wait --for=condition=Ready pod -l app=spire-server --timeout=300s
          kubectl -n cilium-spire wait --for=condition=Ready pod -l app=spire-agent --timeout=300s

          ./cilium-cli status --wait
          kubectl get pods --all-namespaces -o wide
          kubectl -n kube-system exec daemonset/cilium -- cilium-dbg status

          mkdir -p cilium-junits

      - name: Run tests
        shell: bash
        run: |
          EXTRA=()
          if [ "${{ matrix.secondary-network }}" = "true" ]; then
            EXTRA+=("--secondary-network-iface=eth1")
          fi

          if [ "${{ matrix.host-fw }}" == "true" ]; then
            # Until https://github.com/cilium/cilium/issues/28088 is fixed
            EXTRA+=("--expected-drop-reasons=+Missed tail call")
          fi

          ./cilium-cli connectivity test --include-unsafe-tests --collect-sysdump-on-failure \
            "${EXTRA[@]}" \
            --sysdump-hubble-flows-count=1000000 --sysdump-hubble-flows-timeout=5m \
            --sysdump-output-filename "cilium-sysdump-${{ matrix.name }}-<ts>" \
            --junit-file "cilium-junits/${{ env.job_name }} (${{ matrix.name }}).xml" \
            --junit-property github_job_step="Run tests (${{ matrix.name }})" \

      - name: Fetch artifacts
        if: ${{ !success() && steps.run-tests.outcome != 'skipped' }}
        shell: bash
        run: |
          kubectl get pods --all-namespaces -o wide
          ./cilium-cli status
          mkdir -p cilium-sysdumps
          ./cilium-cli sysdump --output-filename cilium-sysdump-${{ matrix.name }}-final

      - name: Upload artifacts
        if: ${{ !success() }}
        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
        with:
          name: cilium-sysdumps
          path: cilium-sysdump-*.zip
          retention-days: 5

      - name: Upload JUnits [junit]
        if: ${{ always() }}
        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
        with:
          name: cilium-junits
          path: cilium-junits/*.xml
          retention-days: 5

      - name: Publish Test Results As GitHub Summary
        if: ${{ always() }}
        uses: aanm/junit2md@332ebf0fddd34e91b03a832cfafaa826306558f9 # v0.0.3
        with:
          junit-directory: "cilium-junits"

  commit-status-final:
    if: ${{ always() }}
    name: Commit Status Final
    needs: setup-and-test
    runs-on: ubuntu-latest
    steps:
      - name: Set final commit status
        uses: myrotvorets/set-commit-status-action@38f3f27c7d52fb381273e95542f07f0fba301307 # v2.0.0
        with:
          sha: ${{ inputs.SHA || github.sha }}
          status: ${{ needs.setup-and-test.result }}