forked from DefectDojo/django-DefectDojo
-
Notifications
You must be signed in to change notification settings - Fork 0
239 lines (215 loc) · 8.12 KB
/
k8s-testing.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
name: k8s deployment
on:
pull_request:
push:
branches:
- master
- dev
- release/**
- hotfix/**
env:
DD_DOCKER_REPO: defectdojo
DD_HOSTNAME: defectdojo.default.minikube.local
GITHUB_CACHE_REPO: containers.pkg.github.com
HELM_RABBIT_BROKER_SETTINGS: " \
--set redis.enabled=false \
--set rabbitmq.enabled=true \
--set celery.broker=rabbitmq \
--set createRabbitMqSecret=true \
"
HELM_REDIS_BROKER_SETTINGS: " \
--set redis.enabled=false \
--set rabbitmq.enabled=true \
--set celery.broker=rabbitmq \
--set createRabbitMqSecret=true \
"
HELM_MYSQL_DATABASE_SETTINGS: " \
--set database=mysql \
--set postgresql.enabled=false \
--set mysql.enabled=true \
--set createMysqlSecret=true \
"
HELM_PG_DATABASE_SETTINGS: " \
--set database=postgresql \
--set postgresql.enabled=true \
--set mysql.enabled=false \
--set createPostgresqlSecret=true \
"
jobs:
build:
name: Build Image
runs-on: ubuntu-latest
strategy:
matrix:
docker-image: [django, nginx]
steps:
# - name: Login to DockerHub
# uses: docker/login-action@v1
# with:
# username: ${{ secrets.DOCKERHUB_USERNAME }}
# password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Checkout
uses: actions/checkout@v2
- name: Read Docker Image Identifiers
id: read-docker-image-identifiers
run: echo "IMAGE_REPOSITORY=$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v1
- name: Cache Docker layers
uses: actions/cache@v2
env:
docker-image: ${{ matrix.docker-image }}
with:
path: /tmp/.buildx-cache-${{ env.docker-image }}
key: ${{ runner.os }}-buildx-${{ env.docker-image }}-${{ github.workflow }}-${{ github.sha }}-${{ github.run_id }}
restore-keys: |
${{ runner.os }}-buildx-${{ env.docker-image }}-${{ github.workflow }}-${{ github.sha }}
${{ runner.os }}-buildx-${{ env.docker-image }}-${{ github.workflow }}
${{ runner.os }}-buildx-${{ env.docker-image }}
- name: Build
id: docker_build
uses: docker/build-push-action@v2
env:
docker-image: ${{ matrix.docker-image }}
with:
context: .
push: false
tags: |
${{ env.DD_DOCKER_REPO }}/defectdojo-${{ env.docker-image }}:latest
file: Dockerfile.${{ env.docker-image }}
outputs: type=docker,dest=${{ env.docker-image }}_img
cache-from: type=local,src=/tmp/.buildx-cache-${{ env.docker-image }}
cache-to: type=local,dest=/tmp/.buildx-cache-${{ env.docker-image }}
- name: Upload image ${{ env.docker-image }} as artifact
uses: actions/upload-artifact@v2
with:
name: ${{ matrix.docker-image }}
path: ${{ matrix.docker-image }}_img
retention-days: 1
setting_minikube_cluster:
name: Kubernetes Deployment
runs-on: ubuntu-latest
needs: build
strategy:
matrix:
databases: [pgsql, mysql]
brokers: [redis, rabbit]
steps:
# - name: Login to DockerHub
# uses: docker/login-action@v1
# with:
# username: ${{ secrets.DOCKERHUB_USERNAME }}
# password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Checkout
uses: actions/checkout@v2
- name: Setup Minikube
uses: manusa/actions-setup-minikube@v2.3.0
with:
minikube version: 'v1.14.2'
kubernetes version: 'v1.19.2'
driver: docker
start args: '--addons=ingress'
- name: Status of minikube
run: |-
minikube status
- name: Load images from artifacts
uses: actions/download-artifact@v2
- name: Load docker images
run: |-
eval $(minikube docker-env)
docker load -i nginx/nginx_img
docker load -i django/django_img
docker images
- name: Configure HELM repos
run: |-
helm repo add stable https://charts.helm.sh/stable
helm repo add bitnami https://charts.bitnami.com/bitnami
helm dependency list ./helm/defectdojo
helm dependency update ./helm/defectdojo
- name: Set confings into Outputs
id: set
run: |-
echo ::set-output name=pgsql:: "${{ env.HELM_PG_DATABASE_SETTINGS }}"
echo ::set-output name=mysql:: "${{ env.HELM_MYSQL_DATABASE_SETTINGS }}"
echo ::set-output name=redis:: "${{ env.HELM_REDIS_BROKER_SETTINGS }}"
echo ::set-output name=rabbit:: "${{ env.HELM_RABBIT_BROKER_SETTINGS }}"
# - name: Create image pull Secrets
# run: |-
# kubectl create secret docker-registry defectdojoregistrykey --docker-username=${{ secrets.DOCKERHUB_USERNAME }} --docker-password=${{ secrets.DOCKERHUB_TOKEN }}
# kubectl get secrets
- name: Deploying Djano application with ${{ matrix.databases }} ${{ matrix.brokers }}
run: |-
helm install \
defectdojo \
./helm/defectdojo \
--set django.ingress.enabled=false \
--set imagePullPolicy=Never \
${{ steps.set.outputs[matrix.databases] }} \
${{ steps.set.outputs[matrix.brokers] }} \
--set createSecret=true \
# --set imagePullSecrets=defectdojoregistrykey
- name: Check deployment status
run: |-
kubectl get pods
kubectl get ingress
kubectl get services
- name: Check Application
run: |-
to_complete () {
kubectl wait --for=$1 $2 --timeout=500s --selector=$3
if [[ ${?} != 0 ]]; then
echo "ERROR: $2"
echo "INFO: status:"
kubectl get pods
echo "INFO: logs:"
kubectl logs --selector=$3
fi
return ${?}
}
echo "Waiting for init job..."
to_complete "condition=Complete" job "defectdojo.org/component=initializer"
echo "Waiting for celery pods..."
to_complete "condition=ready" pod "defectdojo.org/component=celery"
echo "Waiting for django pod..."
to_complete "condition=ready" pod "defectdojo.org/component=django"
echo "Pods up and ready to rumbole"
kubectl get pods
RETRY=0
while :
do
OUT=$(kubectl run curl --quiet=true --image=curlimages/curl:7.73.0 \
--overrides='{ "apiVersion": "v1" }' \
--restart=Never -i --rm -- -s -m 20 -I --header "Host: $DD_HOSTNAME" http://`kubectl get service defectdojo-django -o json \
| jq -r '.spec.clusterIP'`/login?next=/)
echo $OUT
CR=`echo $OUT | egrep "^HTTP" | cut -d' ' -f2`
echo $CR
if [[ $CR -ne 200 ]]; then
echo $RETRY
if [[ $RETRY -gt 2 ]]; then
kubectl get pods
echo `kubectl logs --tail=30 -l defectdojo.org/component=django -c uwsgi`
echo "ERROR: cannot display login screen; got HTTP code $CR"
exit 1
else
((RETRY++))
echo "Attempt $RETRY to get login page"
sleep 5
fi
else
echo "Result received"
break
fi
done
echo "Final Check of components"
errors=`kubectl get pods | grep Error | awk '{print $1}'`
if [[ ! -z $errors ]]; then
echo "Few pods with errors"
for line in $errors; do
echo "Dumping log from $line"
kubectl logs --tail 50 $line
done
exit 1
else
echo "DD K8S successfully deployed"
fi