conformance-kind.yaml

name: ConformanceKind1.19

# Any change in triggers needs to be reflected in the concurrency group.
on:
  pull_request:
    paths-ignore:
      - 'Documentation/**'
      - 'test/**'
  push:
    branches:
      - master
    paths-ignore:
      - 'Documentation/**'
      - 'test/**'

permissions: read-all

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.after }}
  cancel-in-progress: true

env:
  kind_version: v0.11.1
  kind_config: .github/kind-config.yaml
  cilium_cli_version: v0.8.6

jobs:
  installation-and-connectivity:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Set up job variables
        id: vars
        run: |
          if [ ${{ github.event.pull_request }} ]; then
            SHA=${{ github.event.pull_request.head.sha }}
          else
            SHA=${{ github.sha }}
          fi

          CILIUM_INSTALL_DEFAULTS="--agent-image=quay.io/${{ github.repository_owner }}/cilium-ci \
            --operator-image=quay.io/${{ github.repository_owner }}/operator-generic-ci \
            --version=${SHA} \
            --wait=false \
            --config monitor-aggregation=none"
          HUBBLE_ENABLE_DEFAULTS="--relay-image=quay.io/${{ github.repository_owner }}/hubble-relay-ci \
            --relay-version=${SHA}"
          echo ::set-output name=cilium_install_defaults::${CILIUM_INSTALL_DEFAULTS}
          echo ::set-output name=hubble_enable_defaults::${HUBBLE_ENABLE_DEFAULTS}
          echo ::set-output name=sha::${SHA}

      - name: Install Cilium CLI
        run: |
          curl -sSL --remote-name-all https://github.com/cilium/cilium-cli/releases/download/${{ env.cilium_cli_version }}/cilium-linux-amd64.tar.gz{,.sha256sum}
          sha256sum --check cilium-linux-amd64.tar.gz.sha256sum
          sudo tar xzvfC cilium-linux-amd64.tar.gz /usr/local/bin
          rm cilium-linux-amd64.tar.gz{,.sha256sum}
          cilium version

      - name: Checkout kind config
        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f
        with:
          persist-credentials: false

      - name: Create kind cluster
        uses: helm/kind-action@94729529f85113b88f4f819c17ce61382e6d8478
        with:
          version: ${{ env.kind_version }}
          config: ${{ env.kind_config }}

      - name: Wait for images to be available
        timeout-minutes: 10
        shell: bash
        run: |
          for image in cilium-ci operator-generic-ci hubble-relay-ci ; do
            until curl --silent -f -lSL "https://quay.io/api/v1/repository/${{ github.repository_owner }}/$image/tag/${{ steps.vars.outputs.sha }}/images" &> /dev/null; do sleep 45s; done
          done

      - name: Install Cilium
        run: |
          cilium install ${{ steps.vars.outputs.cilium_install_defaults }}

      - name: Enable Relay
        run: |
          cilium hubble enable ${{ steps.vars.outputs.hubble_enable_defaults }}

      - name: Status
        run: |
          cilium status --wait

      - name: Port forward Relay
        run: |
          cilium hubble port-forward&
          sleep 10s
          [[ $(pgrep -f "cilium.*hubble.*port-forward|kubectl.*port-forward.*hubble-relay" | wc -l) == 2 ]]

      - name: Run connectivity test
        run: |
          cilium connectivity test --flow-validation=disabled

      - name: Clean up Cilium
        run: |
          cilium uninstall --wait
          pkill -f "cilium.*hubble.*port-forward|kubectl.*port-forward.*hubble-relay"

      - name: Install Cilium with encryption
        run: |
          cilium install ${{ steps.vars.outputs.cilium_install_defaults }} \
            --encryption=ipsec

      - name: Enable Relay
        run: |
          cilium hubble enable ${{ steps.vars.outputs.hubble_enable_defaults }}

      - name: Wait for Cilium status to be ready
        run: |
          cilium status --wait

      - name: Port forward Relay
        run: |
          cilium hubble port-forward&
          sleep 10s
          [[ $(pgrep -f "cilium.*hubble.*port-forward|kubectl.*port-forward.*hubble-relay" | wc -l) == 2 ]]

      - name: Run connectivity test
        run: |
          cilium connectivity test --force-deploy --flow-validation=disabled

      - name: Post-test information gathering
        if: ${{ !success() }}
        run: |
          cilium status
          kubectl get pods --all-namespaces -o wide
          curl -sLO https://github.com/cilium/cilium-sysdump/releases/latest/download/cilium-sysdump.zip
          python cilium-sysdump.zip --output cilium-sysdump-out
        shell: bash {0} # Disable default fail-fast behaviour so that all commands run independently

      - name: Upload artifacts
        if: ${{ !success() }}
        uses: actions/upload-artifact@27121b0bdffd731efa15d66772be8dc71245d074
        with:
          name: cilium-sysdump-out.zip
          path: cilium-sysdump-out.zip
          retention-days: 5

      - name: Send slack notification
        if: ${{ !success() && (github.event_name == 'schedule' || github.event_name == 'push') }}
        uses: 8398a7/action-slack@e74cd4e48f4452e8158dc4f8bcfc780ae6203364
        with:
          status: ${{ job.status }}
          fields: repo,message,commit,author,action,eventName,ref,workflow,job,took # selectable (default: repo,message)
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}