constellation/.github/workflows/e2e-test.yml

name: e2e test manual

on:
  workflow_dispatch:
    inputs:
      nodeCount:
        description: "Number of nodes to use in the cluster. Given in format `<control-plane nodes>:<worker nodes>`."
        default: "3:2"
        type: string
      attestationVariant:
        description: "Which attestation variant to use."
        type: choice
        options:
          - "gcp-sev-es"
          - "gcp-sev-snp"
          - "azure-sev-snp"
          - "azure-tdx"
          - "aws-sev-snp"
        default: "azure-sev-snp"
        required: true
      runner:
        description: "Architecture of the runner that executes the CLI"
        type: choice
        options:
          - "ubuntu-22.04"
          - "macos-12"
        default: "ubuntu-22.04"
      test:
        description: "The test to run."
        type: choice
        options:
          - "sonobuoy quick"
          - "sonobuoy full"
          - "autoscaling"
          - "lb"
          - "perf-bench"
          - "verify"
          - "recover"
          - "malicious join"
          - "s3proxy"
          - "nop"
        required: true
      kubernetesVersion:
        description: "Kubernetes version to create the cluster from."
        default: "1.29"
        required: true
      cliVersion:
        description: "Version of a released CLI to download. Leave empty to build the CLI from the checked out ref."
        type: string
        default: ""
        required: false
      imageVersion:
        description: "Full name of OS image (CSP independent image version UID). Leave empty for latest debug image on main."
        type: string
        default: ""
        required: false
      machineType:
        description: "Override VM machine type. Leave as 'default' or empty to use the default VM type for the selected cloud provider."
        type: string
        default: "default"
        required: false
      regionZone:
        description: "Region or zone to create the cluster in. Leave empty for default region/zone."
        type: string
      git-ref:
        description: "Git ref to checkout."
        type: string
        default: "head"
        required: false
  workflow_call:
    inputs:
      nodeCount:
        description: "Number of nodes to use in the cluster. Given in format `<control-plane nodes>:<worker nodes>`."
        default: "3:2"
        type: string
      attestationVariant:
        description: "Which attestation variant to use."
        type: string
        required: true
      runner:
        description: "Architecture of the runner that executes the CLI"
        type: string
        required: true
      test:
        description: "The test to run."
        type: string
        required: true
      kubernetesVersion:
        description: "Kubernetes version to create the cluster from."
        type: string
        required: true
      cliVersion:
        description: "Version of a released CLI to download. Leave empty to build the CLI from the checked out ref."
        type: string
        default: ""
        required: false
      imageVersion:
        description: "Full name of OS image (CSP independent image version UID). Leave empty for latest debug image on main."
        type: string
        default: ""
        required: false
      machineType:
        description: "Override VM machine type. Leave as 'default' or empty to use the default VM type for the selected cloud provider."
        type: string
        required: true
      regionZone:
        description: "Region or zone to create the cluster in. Leave empty for default region/zone."
        type: string
      git-ref:
        description: "Git ref to checkout."
        type: string
        required: true
      internalLoadBalancer:
        description: "Enable internal load balancer for the cluster."
        type: boolean
        default: false
      clusterCreation:
        description: "How to create infrastructure for the e2e test. One of [cli, terraform]."
        type: string
        default: "cli"
      marketplaceImageVersion:
        description: "Marketplace image version to use."
        type: string
      force:
        description: "Use the force-flag when applying to ignore version mismatches."
        type: boolean

jobs:
  generate-input-parameters:
    name: Generate input parameters
    runs-on: ubuntu-22.04
    permissions:
      id-token: write
      contents: read
    outputs:
      workerNodes: ${{ steps.split-nodeCount.outputs.workerNodes }}
      controlPlaneNodes: ${{ steps.split-nodeCount.outputs.controlPlaneNodes }}
      cloudProvider: ${{ steps.split-attestationVariant.outputs.cloudProvider }}
    steps:
      - name: Split nodeCount
        id: split-nodeCount
        shell: bash
        run: |
          nodeCount="${{ inputs.nodeCount }}"
          workerNodes="${nodeCount##*:}"
          controlPlaneNodes="${nodeCount%%:*}"

          if [[ -z "${workerNodes}" ]] || [[ -z "{controlPlaneNodes}" ]]; then
            echo "Invalid nodeCount input: '${nodeCount}'."
            exit 1
          fi

          echo "workerNodes=${workerNodes}" | tee -a "$GITHUB_OUTPUT"
          echo "controlPlaneNodes=${controlPlaneNodes}" | tee -a "$GITHUB_OUTPUT"

      - name: Split attestationVariant
        id: split-attestationVariant
        shell: bash
        run: |
          attestationVariant="${{ inputs.attestationVariant }}"
          cloudProvider="${attestationVariant%%-*}"

          echo "cloudProvider=${cloudProvider}" | tee -a "$GITHUB_OUTPUT"

  find-latest-image:
    name: Select image
    runs-on: ubuntu-22.04
    permissions:
      id-token: write
      contents: read
    outputs:
      image: ${{ steps.find-latest-image.outputs.image }}
      isDebugImage: ${{ steps.find-latest-image.outputs.isDebugImage }}
    steps:
      - name: Checkout head
        if: inputs.git-ref == 'head'
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          ref: ${{ !github.event.pull_request.head.repo.fork && github.head_ref || '' }}

      - name: Checkout ref
        if: inputs.git-ref != 'head'
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          ref: ${{ inputs.git-ref }}

      - name: Get Latest Image
        id: find-latest-image
        uses: ./.github/actions/find_latest_image
        with:
          git-ref: ${{ inputs.git-ref }}
          imageVersion: ${{ inputs.imageVersion }}
          ref: main
          stream: debug

  e2e-test-manual:
    runs-on: ${{ inputs.runner }}
    permissions:
      id-token: write
      checks: write
      contents: read
      packages: write
      actions: write
    needs: [find-latest-image, generate-input-parameters]
    if: always() && !cancelled()
    steps:
      - name: Install basic tools (macOS)
        if: runner.os == 'macOS'
        shell: bash
        run: brew install coreutils kubectl bash terraform

      - name: Checkout head
        if: inputs.git-ref == 'head'
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          ref: ${{ !github.event.pull_request.head.repo.fork && github.head_ref || '' }}

      - name: Checkout ref
        if: inputs.git-ref != 'head'
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          ref: ${{ inputs.git-ref }}

      - name: Set up gcloud CLI (macOS)
        if: needs.generate-input-parameters.outputs.cloudProvider == 'gcp' && runner.os == 'macOS'
        uses: google-github-actions/setup-gcloud@98ddc00a17442e89a24bbf282954a3b65ce6d200 # v2.1.0

      - name: Run manual E2E test
        id: e2e_test
        uses: ./.github/actions/e2e_test
        with:
          workerNodesCount: ${{ needs.generate-input-parameters.outputs.workerNodes }}
          controlNodesCount: ${{ needs.generate-input-parameters.outputs.controlPlaneNodes }}
          cloudProvider: ${{ needs.generate-input-parameters.outputs.cloudProvider }}
          attestationVariant: ${{ inputs.attestationVariant }}
          machineType: ${{ inputs.machineType }}
          regionZone: ${{ inputs.regionZone }}
          gcpProject: constellation-e2e
          gcpClusterCreateServiceAccount: "infrastructure-e2e@constellation-e2e.iam.gserviceaccount.com"
          gcpIAMCreateServiceAccount: "iam-e2e@constellation-e2e.iam.gserviceaccount.com"
          test: ${{ inputs.test }}
          kubernetesVersion: ${{ inputs.kubernetesVersion }}
          awsOpenSearchDomain: ${{ secrets.AWS_OPENSEARCH_DOMAIN }}
          awsOpenSearchUsers: ${{ secrets.AWS_OPENSEARCH_USER }}
          awsOpenSearchPwd: ${{ secrets.AWS_OPENSEARCH_PWD }}
          osImage: ${{ needs.find-latest-image.outputs.image }}
          cliVersion: ${{ inputs.cliVersion }}
          isDebugImage: ${{ needs.find-latest-image.outputs.isDebugImage }}
          azureClusterCreateCredentials: ${{ secrets.AZURE_E2E_CLUSTER_CREDENTIALS }}
          azureIAMCreateCredentials: ${{ secrets.AZURE_E2E_IAM_CREDENTIALS }}
          registry: ghcr.io
          githubToken: ${{ secrets.GITHUB_TOKEN }}
          cosignPassword: ${{ secrets.COSIGN_PASSWORD }}
          cosignPrivateKey: ${{ secrets.COSIGN_PRIVATE_KEY }}
          fetchMeasurements: ${{ contains(needs.find-latest-image.outputs.image, '/stream/stable/') }}
          internalLoadBalancer: ${{ inputs.internalLoadBalancer }}
          clusterCreation: ${{ inputs.clusterCreation }}
          s3AccessKey: ${{ secrets.AWS_ACCESS_KEY_ID_S3PROXY }}
          s3SecretKey: ${{ secrets.AWS_SECRET_ACCESS_KEY_S3PROXY }}
          marketplaceImageVersion: ${{ inputs.marketplaceImageVersion }}
          force: ${{ inputs.force }}
          encryptionSecret: ${{ secrets.ARTIFACT_ENCRYPT_PASSWD }}

      - name: Always terminate cluster
        if: always()
        uses: ./.github/actions/constellation_destroy
        with:
          kubeconfig: ${{ steps.e2e_test.outputs.kubeconfig }}
          clusterCreation: ${{ inputs.clusterCreation }}
          cloudProvider: ${{ needs.generate-input-parameters.outputs.cloudProvider }}
          azureClusterDeleteCredentials: ${{ secrets.AZURE_E2E_CLUSTER_CREDENTIALS }}
          gcpClusterDeleteServiceAccount: "infrastructure-e2e@constellation-e2e.iam.gserviceaccount.com"

      - name: Always delete IAM configuration
        if: always()
        uses: ./.github/actions/constellation_iam_destroy
        with:
          cloudProvider: ${{ needs.generate-input-parameters.outputs.cloudProvider }}
          azureCredentials: ${{ secrets.AZURE_E2E_IAM_CREDENTIALS }}
          gcpServiceAccount: "iam-e2e@constellation-e2e.iam.gserviceaccount.com"

      - name: Update tfstate
        if: always()
        env:
          GH_TOKEN: ${{ github.token }}
        uses: ./.github/actions/update_tfstate
        with:
          name: terraform-state-${{ steps.e2e_test.outputs.namePrefix }}
          runID: ${{ github.run_id }}
          encryptionSecret: ${{ secrets.ARTIFACT_ENCRYPT_PASSWD }}