Merge sos

.github/workflows/stackhpc-capi-all-in-one.yml

@@ -0,0 +1,374 @@
+---
+# This reusable workflow deploys a VM on a cloud using Terraform, then deploys
+# OpenStack in the VM via Kayobe. Tempest is then used to test the cloud.
+
+name: All in one
+
+on:
+  workflow_call:
+    inputs:
+      kayobe_image:
+        description: Kayobe container image
+        type: string
+        required: true
+      os_distribution:
+        description: Host OS distribution
+        type: string
+        default: centos
+      os_release:
+        description: Host OS release
+        type: string
+        default: 8-stream
+      ssh_username:
+        description: User for terraform to access the all-in-one VM
+        type: string
+        default: cloud-user
+      neutron_plugin:
+        description: Neutron ML2 plugin
+        type: string
+        required: true
+      vm_image:
+        description: Image for the all-in-one VM
+        type: string
+        default: bb8c0a34-533f-42fb-a49b-3461e677f3f6
+      vm_interface:
+        description: Default network interface name
+        type: string
+        default: eth0
+      vm_flavor:
+        description: Flavor for the all-in-one VM
+        type: string
+        default: general.v1.medium
+      vm_network:
+        description: Network for the all-in-one VM
+        type: string
+        default: stackhpc-release
+      vm_subnet:
+        description: Subnet for the all-in-one VM
+        type: string
+        default: stackhpc-release-subnet
+      OS_CLOUD:
+        description: Name of cloud in clouds.yaml
+        type: string
+        required: true
+    secrets:
+      KAYOBE_VAULT_PASSWORD:
+        required: true
+      CLOUDS_YAML:
+        required: true
+      OS_APPLICATION_CREDENTIAL_ID:
+        required: true
+      OS_APPLICATION_CREDENTIAL_SECRET:
+        required: true
+
+jobs:
+  # NOTE: Runner needs unzip and nodejs packages.
+  all-in-one:
+    name: All in one
+    runs-on: [self-hosted, stackhpc-kayobe-config-aio]
+    permissions: {}
+    env:
+      KAYOBE_ENVIRONMENT: ci-capi-aio
+      KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
+      KAYOBE_IMAGE: ${{ inputs.kayobe_image }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+           submodules: true
+
+      - name: Install terraform
+        uses: hashicorp/setup-terraform@v2
+
+      - name: Initialise terraform
+        run: terraform init
+        working-directory: ${{ github.workspace }}/terraform/aio
+
+      - name: Generate SSH keypair
+        run: ssh-keygen -f id_rsa -N ''
+        working-directory: ${{ github.workspace }}/terraform/aio
+
+      - name: Generate clouds.yaml
+        run: |
+          cat << EOF > clouds.yaml
+          ${{ secrets.CLOUDS_YAML }}
+          EOF
+        working-directory: ${{ github.workspace }}/terraform/aio
+
+      - name: Generate terraform.tfvars
+        run: |
+          cat << EOF > terraform.tfvars
+          ssh_public_key = "id_rsa.pub"
+          ssh_username = "${{ env.SSH_USERNAME }}"
+          aio_vm_interface = "${{ env.VM_INTERFACE }}"
+          aio_vm_name = "${{ env.VM_NAME }}"
+          aio_vm_image = "${{ env.VM_IMAGE }}"
+          aio_vm_flavor = "${{ env.VM_FLAVOR }}"
+          aio_vm_network = "${{ env.VM_NETWORK }}"
+          aio_vm_subnet = "${{ env.VM_SUBNET }}"
+          EOF
+        working-directory: ${{ github.workspace }}/terraform/aio
+        env:
+          SSH_USERNAME: "${{ inputs.ssh_username }}"
+          VM_NAME: "skc-ci-aio-${{ inputs.neutron_plugin }}-${{ github.run_id }}"
+          VM_IMAGE: ${{ inputs.vm_image }}
+          VM_FLAVOR: ${{ inputs.vm_flavor }}
+          VM_NETWORK: ${{ inputs.vm_network }}
+          VM_SUBNET: ${{ inputs.vm_subnet }}
+          VM_INTERFACE: ${{ inputs.vm_interface }}
+
+      - name: Terraform Plan
+        run: terraform plan
+        working-directory: ${{ github.workspace }}/terraform/aio
+        env:
+          OS_CLOUD: ${{ inputs.OS_CLOUD }}
+          OS_APPLICATION_CREDENTIAL_ID: ${{ secrets.OS_APPLICATION_CREDENTIAL_ID }}
+          OS_APPLICATION_CREDENTIAL_SECRET: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
+
+      - name: Terraform Apply
+        run: terraform apply -auto-approve
+        working-directory: ${{ github.workspace }}/terraform/aio
+        env:
+          OS_CLOUD: ${{ inputs.OS_CLOUD }}
+          OS_APPLICATION_CREDENTIAL_ID: ${{ secrets.OS_APPLICATION_CREDENTIAL_ID }}
+          OS_APPLICATION_CREDENTIAL_SECRET: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
+
+      - name: Get Terraform outputs
+        id: tf_outputs
+        run: |
+          terraform output -json
+        working-directory: ${{ github.workspace }}/terraform/aio
+
+      - name: Write Terraform outputs
+        run: |
+          cat << EOF > etc/kayobe/environments/$KAYOBE_ENVIRONMENT/tf-outputs.yml
+          ${{ steps.tf_outputs.outputs.stdout }}
+          EOF
+
+      - name: Write Terraform network config
+        run: |
+          cat << EOF > etc/kayobe/environments/$KAYOBE_ENVIRONMENT/tf-networks.yml
+
+          admin_oc_net_name: admin
+          admin_cidr: "{{ access_cidr.value }}"
+          admin_allocation_pool_start: 0.0.0.0
+          admin_allocation_pool_end: 0.0.0.0
+          admin_gateway: "{{ access_gw.value }}"
+          admin_bootproto: dhcp
+          admin_ips:
+            controller0: "{{ access_ip_v4.value }}"
+          EOF
+
+      - name: Write Terraform network interface config
+        run: |
+          cat << EOF > etc/kayobe/environments/$KAYOBE_ENVIRONMENT/inventory/group_vars/controllers/tf-network-interfaces
+          admin_interface: "{{ access_interface.value }}"
+          EOF
+
+      - name: Write all-in-one scenario config
+        run: |
+          cat << EOF > etc/kayobe/environments/$KAYOBE_ENVIRONMENT/zz-aio-scenario.yml
+          ---
+          os_distribution: ${{ env.OS_DISTRIBUTION }}
+          os_release: "${{ env.OS_RELEASE }}"
+          kolla_enable_ovn: ${{ env.ENABLE_OVN }}
+          EOF
+        env:
+          ENABLE_OVN: ${{ inputs.neutron_plugin == 'ovn' }}
+          OS_DISTRIBUTION: ${{ inputs.os_distribution }}
+          OS_RELEASE: ${{ inputs.os_release }}
+
+      # Use a heredoc to define a multiline string output
+      # https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#multiline-strings
+      - name: Set SSH key output
+        id: ssh_key
+        run: |
+          echo "ssh_key<<EOF" >> $GITHUB_OUTPUT
+          cat terraform/aio/id_rsa >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
+      # The same tag may be reused (e.g. pr-123), so ensure we have the latest image.
+      - name: Pull latest Kayobe image
+        run: |
+          sudo docker image pull $KAYOBE_IMAGE
+
+      - name: Host configure
+        run: |
+          sudo -E docker run -t --rm \
+            -v $(pwd):/stack/kayobe-automation-env/src/kayobe-config \
+            -e KAYOBE_ENVIRONMENT -e KAYOBE_VAULT_PASSWORD -e KAYOBE_AUTOMATION_SSH_PRIVATE_KEY \
+            $KAYOBE_IMAGE \
+            /stack/kayobe-automation-env/src/kayobe-config/.automation/pipeline/overcloud-host-configure.sh
+        env:
+          KAYOBE_AUTOMATION_SSH_PRIVATE_KEY: ${{ steps.ssh_key.outputs.ssh_key }}
+
+      - name: Magnum container build
+        run: |
+          sudo -E docker run -it --rm \
+            -v $(pwd):/stack/kayobe-automation-env/src/kayobe-config \
+            -e KAYOBE_ENVIRONMENT -e KAYOBE_VAULT_PASSWORD -e KAYOBE_AUTOMATION_SSH_PRIVATE_KEY \
+            $KAYOBE_IMAGE \
+            /stack/kayobe-automation-env/src/kayobe-config/.automation/pipeline/overcloud-container-image-build.sh magnum
+        env:
+          KAYOBE_AUTOMATION_SSH_PRIVATE_KEY: ${{ steps.ssh_key.outputs.ssh_key }}
+
+      - name: Install management cluster
+        run: |
+          sudo -E docker run -t --rm \
+            -v $(pwd):/stack/kayobe-automation-env/src/kayobe-config \
+            -e KAYOBE_ENVIRONMENT -e KAYOBE_VAULT_PASSWORD -e KAYOBE_AUTOMATION_SSH_PRIVATE_KEY \
+            $KAYOBE_IMAGE \
+            /stack/kayobe-automation-env/src/kayobe-config/.automation/pipeline/overcloud-host-command-run.sh --command $MGMT_SCRIPT -l controllers
+        env:
+          KAYOBE_AUTOMATION_SSH_PRIVATE_KEY: ${{ steps.ssh_key.outputs.ssh_key }}
+          MGMT_SCRIPT: |
+            # # Install `kubectl` CLI
+            curl -fsLo /tmp/kubectl "https://dl.k8s.io/release/$(curl -fsL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
+            sudo install -o root -g root -m 0755 /tmp/kubectl /usr/local/bin/kubectl
+
+            # Install k3s
+            curl -fsL https://get.k3s.io | sudo bash -s - --disable traefik
+
+            # copy kubeconfig file into standard location
+            mkdir -p $HOME/.kube
+            sudo cp /etc/rancher/k3s/k3s.yaml $HOME/.kube/config
+            sudo chown $USER $HOME/.kube/config
+
+            # Install helm
+            curl -fsL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+
+            # Install cert manager
+            helm upgrade cert-manager cert-manager \
+              --install \
+              --namespace cert-manager \
+              --create-namespace \
+              --repo https://charts.jetstack.io \
+              --version v1.11.1 \
+              --set installCRDs=true \
+              --wait
+
+            # Install Cluster API resources
+            mkdir -p capi
+            cat <<EOF > capi/kustomization.yaml
+            ---
+            resources:
+              - https://github.com/kubernetes-sigs/cluster-api/releases/download/v1.3.3/cluster-api-components.yaml
+              - https://github.com/kubernetes-sigs/cluster-api-provider-openstack/releases/download/v0.7.1/infrastructure-components.yaml
+            patches:
+              - patch: |-
+                  - op: replace
+                    path: /spec/template/spec/containers/0/args
+                    value:
+                      - --leader-elect
+                      - --metrics-bind-addr=localhost:8080
+                target:
+                  kind: Deployment
+                  namespace: capi-system
+                  name: capi-controller-manager
+              - patch: |-
+                  - op: replace
+                    path: /spec/template/spec/containers/0/args
+                    value:
+                      - --leader-elect
+                      - --metrics-bind-addr=localhost:8080
+                target:
+                  kind: Deployment
+                  namespace: capi-kubeadm-bootstrap-system
+                  name: capi-kubeadm-bootstrap-controller-manager
+              - patch: |-
+                  - op: replace
+                    path: /spec/template/spec/containers/0/args
+                    value:
+                      - --leader-elect
+                      - --metrics-bind-addr=localhost:8080
+                target:
+                  kind: Deployment
+                  namespace: capi-kubeadm-control-plane-system
+                  name: capi-kubeadm-control-plane-controller-manager
+            EOF
+            kubectl apply -k capi
+
+            # Install addon manager
+            helm upgrade cluster-api-addon-provider cluster-api-addon-provider \
+              --install \
+              --repo https://stackhpc.github.io/cluster-api-addon-provider \
+              --version 0.1.0-dev.0.main.26 \
+              --namespace capi-addon-system \
+              --create-namespace \
+              --wait \
+              --timeout 30m
+
+              sudo dnf install -y python3-pip
+
+              sudo pip3 install python-magnumclient kubernetes
+
+      - name: Get kubeconfig
+        run: |
+          echo "kubeconfig<<EOF" >> $GITHUB_OUTPUT
+          sudo -E docker run -t --rm \
+            -v $(pwd):/stack/kayobe-automation-env/src/kayobe-config \
+            -e KAYOBE_ENVIRONMENT -e KAYOBE_VAULT_PASSWORD -e KAYOBE_AUTOMATION_SSH_PRIVATE_KEY \
+            $KAYOBE_IMAGE \
+            /stack/kayobe-automation-env/src/kayobe-config/.automation/pipeline/overcloud-host-command-run.sh --command "cat ~/.kube/config" -l controllers >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+        env:
+          KAYOBE_AUTOMATION_SSH_PRIVATE_KEY: ${{ steps.ssh_key.outputs.ssh_key }}
+
+      - name: Set kubeconfig
+        run: |
+          echo $KUBECONFIG > etc/kayobe/environments/$KAYOBE_ENVIRONMENT/kolla/config/magnum/kubeconfig
+
+      - name: Service deploy
+        run: |
+          sudo -E docker run -t --rm \
+            -v $(pwd):/stack/kayobe-automation-env/src/kayobe-config \
+            -e KAYOBE_ENVIRONMENT -e KAYOBE_VAULT_PASSWORD -e KAYOBE_AUTOMATION_SSH_PRIVATE_KEY \
+            $KAYOBE_IMAGE \
+            /stack/kayobe-automation-env/src/kayobe-config/.automation/pipeline/overcloud-service-deploy.sh
+        env:
+          KAYOBE_AUTOMATION_SSH_PRIVATE_KEY: ${{ steps.ssh_key.outputs.ssh_key }}
+
+      - name: Configure aio resources
+        run: |
+          sudo -E docker run -t --rm \
+            -v $(pwd):/stack/kayobe-automation-env/src/kayobe-config \
+            -e KAYOBE_ENVIRONMENT -e KAYOBE_VAULT_PASSWORD -e KAYOBE_AUTOMATION_SSH_PRIVATE_KEY \
+            $KAYOBE_IMAGE \
+            /stack/kayobe-automation-env/src/kayobe-config/.automation/pipeline/playbook-run.sh etc/kayobe/ansible/configure-aio-resources.yml
+        env:
+          KAYOBE_AUTOMATION_SSH_PRIVATE_KEY: ${{ steps.ssh_key.outputs.ssh_key }}
+
+      - name: Tempest tests
+        run: |
+          mkdir -p tempest-artifacts
+          sudo -E docker run -t --rm \
+            -v $(pwd):/stack/kayobe-automation-env/src/kayobe-config \
+            -v $(pwd)/tempest-artifacts:/stack/tempest-artifacts \
+            -e KAYOBE_ENVIRONMENT -e KAYOBE_VAULT_PASSWORD -e KAYOBE_AUTOMATION_SSH_PRIVATE_KEY \
+            $KAYOBE_IMAGE \
+            /stack/kayobe-automation-env/src/kayobe-config/.automation/pipeline/tempest.sh -e ansible_user=stack
+        env:
+          KAYOBE_AUTOMATION_SSH_PRIVATE_KEY: ${{ steps.ssh_key.outputs.ssh_key }}
+
+      - name: Upload test result artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: tempest-results-${{ inputs.os_distribution }}-${{ inputs.os_release }}-${{ inputs.neutron_plugin }}
+          path: tempest-artifacts/*
+
+      - name: Fail if any Tempest tests failed
+        run: |
+          test $(wc -l < tempest-artifacts/failed-tests) -lt 1
+
+      - name: Destroy
+        run: terraform destroy -auto-approve
+        working-directory: ${{ github.workspace }}/terraform/aio
+        env:
+          OS_CLOUD: ${{ inputs.OS_CLOUD }}
+          OS_APPLICATION_CREDENTIAL_ID: ${{ secrets.OS_APPLICATION_CREDENTIAL_ID }}
+          OS_APPLICATION_CREDENTIAL_SECRET: ${{ secrets.OS_APPLICATION_CREDENTIAL_SECRET }}
+        if: always()
+
+      - name: Prune Docker images over 1 week old
+        # May fail if another prune is running
+        run: sudo docker image prune --all --force --filter until=168h || true
+        if: always()