2022-07-13 08:04:46 -04:00
|
|
|
name: Constellation create
|
2022-10-24 12:47:03 -04:00
|
|
|
description: Create a new Constellation cluster using latest OS image.
|
|
|
|
|
2022-05-03 05:15:53 -04:00
|
|
|
inputs:
|
|
|
|
workerNodesCount:
|
|
|
|
description: "Number of worker nodes to spawn."
|
|
|
|
required: true
|
|
|
|
controlNodesCount:
|
|
|
|
description: "Number of control-plane nodes to spawn."
|
|
|
|
required: true
|
|
|
|
cloudProvider:
|
2023-08-08 06:02:43 -04:00
|
|
|
description: "Either 'gcp', 'aws' or 'azure'."
|
2022-05-03 05:15:53 -04:00
|
|
|
required: true
|
|
|
|
machineType:
|
|
|
|
description: "Machine type of VM to spawn."
|
2022-09-02 06:09:45 -04:00
|
|
|
required: false
|
2023-08-07 05:02:00 -04:00
|
|
|
cliVersion:
|
|
|
|
description: "Version of the CLI"
|
|
|
|
required: true
|
2022-10-21 04:16:44 -04:00
|
|
|
osImage:
|
2022-11-23 03:41:42 -05:00
|
|
|
description: "OS image to use."
|
2022-08-09 09:29:39 -04:00
|
|
|
required: true
|
|
|
|
isDebugImage:
|
2022-10-21 04:16:44 -04:00
|
|
|
description: "Is OS img a debug img?"
|
2022-08-09 09:29:39 -04:00
|
|
|
required: true
|
2022-08-09 04:02:15 -04:00
|
|
|
kubernetesVersion:
|
|
|
|
description: "Kubernetes version to create the cluster from."
|
|
|
|
required: false
|
2023-04-13 06:02:19 -04:00
|
|
|
artifactNameSuffix:
|
|
|
|
description: "Suffix for artifact naming."
|
|
|
|
required: true
|
2023-08-04 03:43:32 -04:00
|
|
|
fetchMeasurements:
|
|
|
|
default: "false"
|
|
|
|
description: "Update measurements via the 'constellation config fetch-measurements' command."
|
2023-08-08 06:02:43 -04:00
|
|
|
azureSNPEnforcementPolicy:
|
|
|
|
required: false
|
|
|
|
description: "Azure SNP enforcement policy."
|
2023-08-21 02:01:33 -04:00
|
|
|
test:
|
|
|
|
description: "The e2e test payload."
|
|
|
|
required: true
|
2023-09-27 10:17:31 -04:00
|
|
|
azureClusterCreateCredentials:
|
|
|
|
description: "Azure credentials authorized to create a Constellation cluster."
|
|
|
|
required: true
|
|
|
|
azureIAMCreateCredentials:
|
|
|
|
description: "Azure credentials authorized to create an IAM configuration."
|
|
|
|
required: true
|
|
|
|
refStream:
|
|
|
|
description: "Reference and stream of the image in use"
|
|
|
|
required: false
|
2023-10-17 09:46:15 -04:00
|
|
|
internalLoadBalancer:
|
|
|
|
description: "Whether to use an internal load balancer for the control plane"
|
|
|
|
required: false
|
2022-10-24 12:47:03 -04:00
|
|
|
|
|
|
|
outputs:
|
|
|
|
kubeconfig:
|
|
|
|
description: "The kubeconfig for the cluster."
|
|
|
|
value: ${{ steps.constellation-init.outputs.KUBECONFIG }}
|
2023-04-04 04:47:26 -04:00
|
|
|
osImageUsed:
|
|
|
|
description: "The OS image used in the cluster."
|
|
|
|
value: ${{ steps.setImage.outputs.image }}
|
2022-10-24 12:47:03 -04:00
|
|
|
|
2022-05-03 05:15:53 -04:00
|
|
|
runs:
|
2022-08-09 04:02:15 -04:00
|
|
|
using: "composite"
|
2022-05-03 05:15:53 -04:00
|
|
|
steps:
|
2023-08-09 02:39:22 -04:00
|
|
|
- name: Set constellation name
|
2022-10-24 12:47:03 -04:00
|
|
|
shell: bash
|
2022-08-09 04:02:15 -04:00
|
|
|
run: |
|
2023-02-10 07:27:22 -05:00
|
|
|
yq eval -i "(.name) = \"e2e-test\"" constellation-conf.yaml
|
|
|
|
|
2023-08-08 06:02:43 -04:00
|
|
|
- name: Set Azure SNP enforcement policy
|
|
|
|
if: inputs.azureSNPEnforcementPolicy != ''
|
|
|
|
shell: bash
|
|
|
|
run: |
|
|
|
|
if [[ ${{ inputs.cloudProvider }} != 'azure' ]]; then
|
|
|
|
echo "SNP enforcement policy is only supported for Azure"
|
|
|
|
exit 1
|
|
|
|
fi
|
|
|
|
yq eval -i "(.attestation.azureSEVSNP.firmwareSignerConfig.enforcementPolicy) \
|
|
|
|
= \"${{ inputs.azureSNPEnforcementPolicy }}\"" constellation-conf.yaml
|
|
|
|
|
2022-08-09 09:29:39 -04:00
|
|
|
- name: Set image
|
2023-04-04 04:47:26 -04:00
|
|
|
id: setImage
|
2022-10-24 12:47:03 -04:00
|
|
|
shell: bash
|
|
|
|
env:
|
2023-04-04 04:47:26 -04:00
|
|
|
imageInput: ${{ inputs.osImage }}
|
|
|
|
run: |
|
|
|
|
if [[ -z "${imageInput}" ]]; then
|
|
|
|
echo "No image specified. Using default image from config."
|
|
|
|
image=$(yq eval ".image" constellation-conf.yaml)
|
|
|
|
echo "image=${image}" | tee -a "$GITHUB_OUTPUT"
|
|
|
|
exit 0
|
|
|
|
fi
|
|
|
|
|
|
|
|
yq eval -i "(.image) = \"${imageInput}\"" constellation-conf.yaml
|
|
|
|
echo "image=${imageInput}" | tee -a "$GITHUB_OUTPUT"
|
2022-08-09 09:29:39 -04:00
|
|
|
|
2023-08-04 03:43:32 -04:00
|
|
|
- name: Update measurements for non-stable images
|
|
|
|
if: inputs.fetchMeasurements
|
|
|
|
shell: bash
|
|
|
|
run: |
|
|
|
|
constellation config fetch-measurements --debug --insecure
|
|
|
|
|
2022-09-02 06:09:45 -04:00
|
|
|
- name: Set instanceType
|
2023-01-17 12:49:00 -05:00
|
|
|
if: inputs.machineType && inputs.machineType != 'default'
|
2022-09-02 06:09:45 -04:00
|
|
|
shell: bash
|
|
|
|
run: |
|
2023-08-02 04:45:32 -04:00
|
|
|
yq eval -i "(.nodeGroups[] | .instanceType) = \"${{ inputs.machineType }}\"" constellation-conf.yaml
|
|
|
|
|
|
|
|
- name: Set node count
|
|
|
|
shell: bash
|
|
|
|
run: |
|
|
|
|
yq eval -i "(.nodeGroups[] | select(.role == \"control-plane\") | .initialCount) = ${{ inputs.controlNodesCount }}" constellation-conf.yaml
|
|
|
|
yq eval -i "(.nodeGroups[] | select(.role == \"worker\") | .initialCount) = ${{ inputs.workerNodesCount }}" constellation-conf.yaml
|
2022-09-02 06:09:45 -04:00
|
|
|
|
2022-09-06 04:38:14 -04:00
|
|
|
- name: Enable debugCluster flag
|
2023-01-17 12:49:00 -05:00
|
|
|
if: inputs.isDebugImage == 'true'
|
2022-10-24 12:47:03 -04:00
|
|
|
shell: bash
|
2022-08-09 09:29:39 -04:00
|
|
|
run: |
|
2022-09-06 04:38:14 -04:00
|
|
|
yq eval -i '(.debugCluster) = true' constellation-conf.yaml
|
2022-08-09 09:29:39 -04:00
|
|
|
|
2023-10-17 09:46:15 -04:00
|
|
|
- name: Enable internalLoadBalancer flag
|
|
|
|
if: inputs.internalLoadBalancer == 'true'
|
|
|
|
shell: bash
|
|
|
|
run: |
|
|
|
|
yq eval -i '(.internalLoadBalancer) = true' constellation-conf.yaml
|
|
|
|
|
2022-08-09 04:02:15 -04:00
|
|
|
- name: Constellation create
|
2022-10-24 12:47:03 -04:00
|
|
|
shell: bash
|
2022-08-09 04:02:15 -04:00
|
|
|
run: |
|
|
|
|
echo "Creating cluster using config:"
|
|
|
|
cat constellation-conf.yaml
|
2022-12-13 04:07:09 -05:00
|
|
|
sudo sh -c 'echo "127.0.0.1 license.confidential.cloud" >> /etc/hosts' || true
|
2023-10-20 02:10:26 -04:00
|
|
|
constellation create -y --debug --tf-log=DEBUG
|
2022-08-09 04:02:15 -04:00
|
|
|
|
2022-08-09 09:29:39 -04:00
|
|
|
- name: Cdbg deploy
|
2023-01-17 12:49:00 -05:00
|
|
|
if: inputs.isDebugImage == 'true'
|
2023-09-27 10:17:31 -04:00
|
|
|
uses: ./.github/actions/cdbg_deploy
|
|
|
|
with:
|
|
|
|
cloudProvider: ${{ inputs.cloudProvider }}
|
|
|
|
test: ${{ inputs.test }}
|
|
|
|
azureClusterCreateCredentials: ${{ inputs.azureClusterCreateCredentials }}
|
|
|
|
azureIAMCreateCredentials: ${{ inputs.azureIAMCreateCredentials }}
|
|
|
|
refStream: ${{ inputs.refStream }}
|
|
|
|
kubernetesVersion: ${{ inputs.kubernetesVersion }}
|
2022-08-09 09:29:39 -04:00
|
|
|
|
2022-08-09 04:02:15 -04:00
|
|
|
- name: Constellation init
|
2022-09-09 07:28:53 -04:00
|
|
|
id: constellation-init
|
2022-10-24 12:47:03 -04:00
|
|
|
shell: bash
|
2022-08-09 04:02:15 -04:00
|
|
|
run: |
|
2023-10-20 02:10:26 -04:00
|
|
|
constellation init --debug
|
2023-08-09 07:00:27 -04:00
|
|
|
echo "KUBECONFIG=$(pwd)/constellation-admin.conf" | tee -a $GITHUB_OUTPUT
|
2022-09-05 12:12:46 -04:00
|
|
|
|
2022-09-09 07:28:53 -04:00
|
|
|
- name: Wait for nodes to join and become ready
|
2022-10-24 12:47:03 -04:00
|
|
|
shell: bash
|
|
|
|
env:
|
|
|
|
KUBECONFIG: "${{ steps.constellation-init.outputs.KUBECONFIG }}"
|
|
|
|
JOINTIMEOUT: "1200" # 20 minutes timeout for all nodes to join
|
2022-09-09 07:28:53 -04:00
|
|
|
run: |
|
|
|
|
echo "::group::Wait for nodes"
|
|
|
|
NODES_COUNT=$((${{ inputs.controlNodesCount }} + ${{ inputs.workerNodesCount }}))
|
|
|
|
JOINWAIT=0
|
2022-12-09 05:51:38 -05:00
|
|
|
until [[ "$(kubectl get nodes -o json | jq '.items | length')" == "${NODES_COUNT}" ]] || [[ $JOINWAIT -gt $JOINTIMEOUT ]];
|
2022-09-09 07:28:53 -04:00
|
|
|
do
|
|
|
|
echo "$(kubectl get nodes -o json | jq '.items | length')/"${NODES_COUNT}" nodes have joined.. waiting.."
|
|
|
|
JOINWAIT=$((JOINWAIT+30))
|
|
|
|
sleep 30
|
|
|
|
done
|
2022-12-09 05:51:38 -05:00
|
|
|
if [[ $JOINWAIT -gt $JOINTIMEOUT ]]; then
|
2022-09-09 07:28:53 -04:00
|
|
|
echo "Timed out waiting for nodes to join"
|
|
|
|
exit 1
|
|
|
|
fi
|
|
|
|
echo "$(kubectl get nodes -o json | jq '.items | length')/"${NODES_COUNT}" nodes have joined"
|
2023-03-13 11:12:10 -04:00
|
|
|
if ! kubectl wait --for=condition=ready --all nodes --timeout=20m; then
|
2023-03-11 02:15:31 -05:00
|
|
|
kubectl get pods -n kube-system
|
|
|
|
kubectl get events -n kube-system
|
2023-03-13 11:12:10 -04:00
|
|
|
echo "::error::kubectl wait timed out before all nodes became ready"
|
|
|
|
echo "::endgroup::"
|
|
|
|
exit 1
|
2023-03-11 02:15:31 -05:00
|
|
|
fi
|
2022-09-09 07:28:53 -04:00
|
|
|
echo "::endgroup::"
|
|
|
|
|
2022-09-05 12:12:46 -04:00
|
|
|
- name: Download boot logs
|
2023-01-17 12:49:00 -05:00
|
|
|
if: always()
|
2022-10-24 12:47:03 -04:00
|
|
|
continue-on-error: true
|
|
|
|
shell: bash
|
|
|
|
env:
|
|
|
|
CSP: ${{ inputs.cloudProvider }}
|
2022-09-05 12:12:46 -04:00
|
|
|
run: |
|
|
|
|
echo "::group::Download boot logs"
|
2023-10-09 07:04:29 -04:00
|
|
|
CONSTELL_UID=$(yq '.infrastructure.uid' constellation-state.yaml)
|
2022-09-05 12:12:46 -04:00
|
|
|
case $CSP in
|
|
|
|
azure)
|
|
|
|
AZURE_RESOURCE_GROUP=$(yq eval ".provider.azure.resourceGroup" constellation-conf.yaml)
|
|
|
|
./.github/actions/constellation_create/az-logs.sh ${AZURE_RESOURCE_GROUP}
|
|
|
|
;;
|
|
|
|
gcp)
|
2023-07-13 10:28:33 -04:00
|
|
|
GCP_ZONE=$(yq eval ".provider.gcp.zone" constellation-conf.yaml)
|
|
|
|
./.github/actions/constellation_create/gcp-logs.sh ${GCP_ZONE} ${CONSTELL_UID}
|
2022-09-05 12:12:46 -04:00
|
|
|
;;
|
2022-11-08 10:43:17 -05:00
|
|
|
aws)
|
2023-07-13 10:28:33 -04:00
|
|
|
./.github/actions/constellation_create/aws-logs.sh us-east-2 ${CONSTELL_UID}
|
2022-11-08 10:43:17 -05:00
|
|
|
;;
|
2022-09-05 12:12:46 -04:00
|
|
|
esac
|
|
|
|
echo "::endgroup::"
|
2022-10-24 12:47:03 -04:00
|
|
|
|
2022-09-05 12:12:46 -04:00
|
|
|
- name: Upload boot logs
|
2023-01-17 12:49:00 -05:00
|
|
|
if: always() && !env.ACT
|
2023-04-14 12:50:58 -04:00
|
|
|
continue-on-error: true
|
2023-10-11 07:49:50 -04:00
|
|
|
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
|
2022-09-05 12:12:46 -04:00
|
|
|
with:
|
2023-04-13 06:02:19 -04:00
|
|
|
name: serial-logs-${{ inputs.artifactNameSuffix }}
|
2023-07-13 10:28:33 -04:00
|
|
|
path: |
|
|
|
|
*.log
|
|
|
|
!terraform.log
|