name: e2e test manual on: workflow_dispatch: inputs: nodeCount: description: "Number of nodes to use in the cluster. Given in format `:`." default: "3:2" type: string attestationVariant: description: "Which attestation variant to use." type: choice options: - "gcp-sev-es" - "gcp-sev-snp" - "azure-sev-snp" - "azure-tdx" - "aws-sev-snp" default: "azure-sev-snp" required: true runner: description: "Architecture of the runner that executes the CLI" type: choice options: - "ubuntu-22.04" - "macos-12" default: "ubuntu-22.04" test: description: "The test to run." type: choice options: - "sonobuoy quick" - "sonobuoy full" - "autoscaling" - "lb" - "perf-bench" - "verify" - "recover" - "malicious join" - "s3proxy" - "nop" required: true kubernetesVersion: description: "Kubernetes version to create the cluster from." default: "1.28" required: true cliVersion: description: "Version of a released CLI to download. Leave empty to build the CLI from the checked out ref." type: string default: "" required: false imageVersion: description: "Full name of OS image (CSP independent image version UID). Leave empty for latest debug image on main." type: string default: "" required: false machineType: description: "Override VM machine type. Leave as 'default' or empty to use the default VM type for the selected cloud provider." type: string default: "default" required: false regionZone: description: "Region or zone to create the cluster in. Leave empty for default region/zone." type: string git-ref: description: "Git ref to checkout." type: string default: "head" required: false workflow_call: inputs: nodeCount: description: "Number of nodes to use in the cluster. Given in format `:`." default: "3:2" type: string attestationVariant: description: "Which attestation variant to use." type: string required: true runner: description: "Architecture of the runner that executes the CLI" type: string required: true test: description: "The test to run." type: string required: true kubernetesVersion: description: "Kubernetes version to create the cluster from." type: string required: true cliVersion: description: "Version of a released CLI to download. Leave empty to build the CLI from the checked out ref." type: string default: "" required: false imageVersion: description: "Full name of OS image (CSP independent image version UID). Leave empty for latest debug image on main." type: string default: "" required: false machineType: description: "Override VM machine type. Leave as 'default' or empty to use the default VM type for the selected cloud provider." type: string required: true regionZone: description: "Region or zone to create the cluster in. Leave empty for default region/zone." type: string git-ref: description: "Git ref to checkout." type: string required: true internalLoadBalancer: description: "Enable internal load balancer for the cluster." type: boolean default: false clusterCreation: description: "How to create infrastructure for the e2e test. One of [cli, terraform]." type: string default: "cli" marketplaceImageVersion: description: "Marketplace image version to use." type: string force: description: "Use the force-flag when applying to ignore version mismatches." type: boolean jobs: generate-input-parameters: name: Generate input parameters runs-on: ubuntu-22.04 permissions: id-token: write contents: read outputs: workerNodes: ${{ steps.split-nodeCount.outputs.workerNodes }} controlPlaneNodes: ${{ steps.split-nodeCount.outputs.controlPlaneNodes }} cloudProvider: ${{ steps.split-attestationVariant.outputs.cloudProvider }} steps: - name: Split nodeCount id: split-nodeCount shell: bash run: | nodeCount="${{ inputs.nodeCount }}" workerNodes="${nodeCount##*:}" controlPlaneNodes="${nodeCount%%:*}" if [[ -z "${workerNodes}" ]] || [[ -z "{controlPlaneNodes}" ]]; then echo "Invalid nodeCount input: '${nodeCount}'." exit 1 fi echo "workerNodes=${workerNodes}" | tee -a "$GITHUB_OUTPUT" echo "controlPlaneNodes=${controlPlaneNodes}" | tee -a "$GITHUB_OUTPUT" - name: Split attestationVariant id: split-attestationVariant shell: bash run: | attestationVariant="${{ inputs.attestationVariant }}" cloudProvider="${attestationVariant%%-*}" echo "cloudProvider=${cloudProvider}" | tee -a "$GITHUB_OUTPUT" find-latest-image: name: Select image runs-on: ubuntu-22.04 permissions: id-token: write contents: read outputs: image: ${{ steps.find-latest-image.outputs.image }} isDebugImage: ${{ steps.find-latest-image.outputs.isDebugImage }} steps: - name: Checkout head if: inputs.git-ref == 'head' uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 with: ref: ${{ !github.event.pull_request.head.repo.fork && github.head_ref || '' }} - name: Checkout ref if: inputs.git-ref != 'head' uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 with: ref: ${{ inputs.git-ref }} - name: Get Latest Image id: find-latest-image uses: ./.github/actions/find_latest_image with: git-ref: ${{ inputs.git-ref }} imageVersion: ${{ inputs.imageVersion }} ref: main stream: debug e2e-test-manual: runs-on: ${{ inputs.runner }} permissions: id-token: write checks: write contents: read packages: write needs: [find-latest-image, generate-input-parameters] if: always() && !cancelled() steps: - name: Install basic tools (macOS) if: runner.os == 'macOS' shell: bash run: brew install coreutils kubectl bash terraform - name: Checkout head if: inputs.git-ref == 'head' uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 with: ref: ${{ !github.event.pull_request.head.repo.fork && github.head_ref || '' }} - name: Checkout ref if: inputs.git-ref != 'head' uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 with: ref: ${{ inputs.git-ref }} - name: Set up gcloud CLI (macOS) if: needs.generate-input-parameters.outputs.cloudProvider == 'gcp' && runner.os == 'macOS' uses: google-github-actions/setup-gcloud@98ddc00a17442e89a24bbf282954a3b65ce6d200 # v2.1.0 - name: Run manual E2E test id: e2e_test uses: ./.github/actions/e2e_test with: workerNodesCount: ${{ needs.generate-input-parameters.outputs.workerNodes }} controlNodesCount: ${{ needs.generate-input-parameters.outputs.controlPlaneNodes }} cloudProvider: ${{ needs.generate-input-parameters.outputs.cloudProvider }} attestationVariant: ${{ inputs.attestationVariant }} machineType: ${{ inputs.machineType }} regionZone: ${{ inputs.regionZone }} gcpProject: constellation-e2e gcpClusterCreateServiceAccount: "infrastructure-e2e@constellation-e2e.iam.gserviceaccount.com" gcpIAMCreateServiceAccount: "iam-e2e@constellation-e2e.iam.gserviceaccount.com" test: ${{ inputs.test }} kubernetesVersion: ${{ inputs.kubernetesVersion }} awsOpenSearchDomain: ${{ secrets.AWS_OPENSEARCH_DOMAIN }} awsOpenSearchUsers: ${{ secrets.AWS_OPENSEARCH_USER }} awsOpenSearchPwd: ${{ secrets.AWS_OPENSEARCH_PWD }} osImage: ${{ needs.find-latest-image.outputs.image }} cliVersion: ${{ inputs.cliVersion }} isDebugImage: ${{ needs.find-latest-image.outputs.isDebugImage }} buildBuddyApiKey: ${{ secrets.BUILDBUDDY_ORG_API_KEY }} azureClusterCreateCredentials: ${{ secrets.AZURE_E2E_CLUSTER_CREDENTIALS }} azureIAMCreateCredentials: ${{ secrets.AZURE_E2E_IAM_CREDENTIALS }} registry: ghcr.io githubToken: ${{ secrets.GITHUB_TOKEN }} cosignPassword: ${{ secrets.COSIGN_PASSWORD }} cosignPrivateKey: ${{ secrets.COSIGN_PRIVATE_KEY }} fetchMeasurements: ${{ contains(needs.find-latest-image.outputs.image, '/stream/stable/') }} internalLoadBalancer: ${{ inputs.internalLoadBalancer }} clusterCreation: ${{ inputs.clusterCreation }} s3AccessKey: ${{ secrets.AWS_ACCESS_KEY_ID_S3PROXY }} s3SecretKey: ${{ secrets.AWS_SECRET_ACCESS_KEY_S3PROXY }} marketplaceImageVersion: ${{ inputs.marketplaceImageVersion }} force: ${{ inputs.force }} encryptionSecret: ${{ secrets.ARTIFACT_ENCRYPT_PASSWD }} - name: Always terminate cluster if: always() uses: ./.github/actions/constellation_destroy with: kubeconfig: ${{ steps.e2e_test.outputs.kubeconfig }} clusterCreation: ${{ inputs.clusterCreation }} cloudProvider: ${{ needs.generate-input-parameters.outputs.cloudProvider }} azureClusterDeleteCredentials: ${{ secrets.AZURE_E2E_CLUSTER_CREDENTIALS }} gcpClusterDeleteServiceAccount: "infrastructure-e2e@constellation-e2e.iam.gserviceaccount.com" - name: Always delete IAM configuration if: always() uses: ./.github/actions/constellation_iam_destroy with: cloudProvider: ${{ needs.generate-input-parameters.outputs.cloudProvider }} azureCredentials: ${{ secrets.AZURE_E2E_IAM_CREDENTIALS }} gcpServiceAccount: "iam-e2e@constellation-e2e.iam.gserviceaccount.com"