Skip to content

Commit

Permalink
Dbp 1012 setup loadtest env (#8)
Browse files Browse the repository at this point in the history
* worked in qol changes

* changed adding latest tag to true

* added image tag branch condition

* added "" to input tag

* test hardcoded image tag

* test img tag hard coded 2

* typo

* added ticket extraction

* added ticket and branch extraction tasks

* removed sha from extract branch meta

* worked in PR requests

* removed start script cause unused

* removed on push from trigger loadtests

---------

Co-authored-by: M_Westerholz <[email protected]>
  • Loading branch information
MWesterholz and M_Westerholz authored Oct 16, 2024
1 parent e655e04 commit 0b981a8
Show file tree
Hide file tree
Showing 8 changed files with 96 additions and 116 deletions.
53 changes: 0 additions & 53 deletions .github/workflows/install-and-run-spsh-loadtest.yml

This file was deleted.

80 changes: 80 additions & 0 deletions .github/workflows/install-spsh-loadtest.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,80 @@
---
name: Install SPSH Loadtest Action

on:
workflow_call:
inputs:
branch:
type: string
required: false
# default: main
default: DBP-1012-setup-loadtest-env

secrets:
KUBECONFIG:
required: true

permissions:
contents: read

concurrency:
group: schulportal-load-tests-rollout-run
cancel-in-progress: true

jobs:
branch_meta:
runs-on: ubuntu-latest
outputs:
branch: ${{ steps.extract_branch_meta.outputs.branch }}
ticket: ${{ steps.extract_branch_ticket.outputs.ticket }}
steps:
- name: Extract branch meta
shell: bash
id: extract_branch_meta
run: |
if [ "${{ github.event_name }}" == 'pull_request' ]; then
echo "branch=${{ github.event.pull_request.head.ref }}" >> $GITHUB_OUTPUT
else
echo "branch=${GITHUB_REF#refs/heads/}" >> $GITHUB_OUTPUT
fi
- name: Extract project-ticketnumber from branch
id: extract_branch_ticket
run: |
if ${{ github.ref_name == 'main' }}; then
echo "ticket=main" >> $GITHUB_OUTPUT
else
regex='^([[:alpha:]]+?-[[:digit:]]+)'
[[ ${{ steps.extract_branch_meta.outputs.branch }} =~ $regex ]]
echo "ticket=$(echo ${BASH_REMATCH[1]} | tr [A-Z] [a-z])" >> $GITHUB_OUTPUT
fi
rollout:
runs-on: 'ubuntu-latest'
needs: branch_meta
steps:
- name: Checkout repo
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
with:
repository: 'dBildungsplattform/schulportal-load-tests'
# change this ref to a branch to test changes
ref: "${{ inputs.branch }}"

- name: Install kubectl and Helm
uses: azure/setup-kubectl@3e0aec4d80787158d308d7b364cb1b702e7feb7f #v4.0.0

- name: Set kubeconfig
run: |
mkdir /home/runner/.kube/
echo "${{ secrets.KUBECONFIG }}" > /home/runner/.kube/config
chmod 600 /home/runner/.kube/config
- name: Rollout schulportal-load-tests Helm Chart
run: |
helm upgrade --install \
schulportal-load-tests \
./charts/schulportal-load-tests \
--namespace spsh \
--kubeconfig /home/runner/.kube/config \
--set branch="${{ inputs.branch }}" \
${{ inputs.branch != 'main' && format('--set imageTag="{0}"', needs.branch_meta.outputs.ticket ) || '--set imageTag="latest"' }} \
--wait
2 changes: 1 addition & 1 deletion .github/workflows/publish-image-on-push-to-branch.yml
Original file line number Diff line number Diff line change
Expand Up @@ -20,5 +20,5 @@ jobs:
image_name: "schulportal-load-tests"
run_trivy_scan: true
image_tag_generation: "ticket_from_branch"
add_latest_tag: false
add_latest_tag: false
container_registry: "ghcr.io"
12 changes: 7 additions & 5 deletions .github/workflows/trigger-loadtest.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,18 +3,20 @@ name: Trigger Loadtest

on:
workflow_dispatch:
push:
branch: DBP-1012-setup-loadtest-env
inputs:
branch:
description: 'Branch to take tests and helm/cron setup from'
required: false
default: main

jobs:
run_loadtest:
permissions:
packages: write
security-events: write
contents: read
uses: ./.github/workflows/install-and-run-spsh-loadtest.yml
uses: ./.github/workflows/install-spsh-loadtest.yml
with:
branch: DBP-1012-setup-loadtest-env #
branch: ${{ inputs.branch }}
secrets:
# token: ${{ secrets.GITHUB_TOKEN }} # not sure whether this is needed
KUBECONFIG: ${{ secrets.KUBECONFIG }}
9 changes: 4 additions & 5 deletions charts/schulportal-load-tests/templates/cronjob.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ metadata:
name: loadtest-spsh-{{ $job_name }}
namespace: spsh
spec:
schedule: {{ $job_options.schedule }}
schedule: {{ $.Values.schedule }}
startingDeadlineSeconds: 300
suspend: true
jobTemplate:
Expand All @@ -22,7 +22,7 @@ spec:
automountServiceAccountToken: false
containers:
- name: {{ $job_name }}
image: ghcr.io/dbildungsplattform/schulportal-load-tests:{{ $job_options.imageTag }}
image: ghcr.io/dbildungsplattform/schulportal-load-tests:{{ $.Values.imageTag }}
imagePullPolicy: Always
securityContext:
allowPrivilegeEscalation: false
Expand All @@ -42,8 +42,7 @@ spec:
cp /data/json/users.json /home/k6/schulportal-load-tests/loadtest/data/users.json &&
chmod +x run.sh &&
sleep 3600 &&
./run.sh
# k6 run -u 0 ./loadtest/usecases/{{ $job_options.scriptPath }} --compatibility-mode=experimental_enhanced"]
./run.sh"]
volumeMounts:
- name: secret-volume
mountPath: /secrets
Expand All @@ -52,7 +51,7 @@ spec:
mountPath: /data/json
readOnly: true
ports:
- containerPort: {{ $job_options.port }}
- containerPort: {{ $.Values.port }}
name: loadtest-pod

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] CPU Limits Not Set

CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] CPU Requests Not Set

CPU requests should be set to ensure the sum of the resource requests of the scheduled Containers is less than the capacity of the node

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] Container Running As Root

Containers should only run as non-root user. This limits the exploitability of security misconfigurations and restricts an attacker's possibilities in case of compromise

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] Container Running With Low UID

Check if containers are running with low UID, which might cause conflicts with the host's user table.

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] Memory Limits Not Defined

Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than the designated amount of memory

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] Memory Requests Not Defined

Memory requests should be defined for each container. This allows the kubelet to reserve the requested amount of system resources and prevents over-provisioning on individual nodes

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] NET_RAW Capabilities Not Being Dropped

Containers should drop 'ALL' or at least 'NET_RAW' capabilities

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] Seccomp Profile Is Not Configured

Containers should be configured with a secure Seccomp profile to restrict potentially dangerous syscalls

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[LOW] Image Without Digest

Images should be specified together with their digests to ensure integrity

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[LOW] Invalid Image Tag

Image tag must be defined and not be empty or equal to latest.

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] CPU Limits Not Set

CPU limits should be set because if the system has CPU time free, a container is guaranteed to be allocated as much CPU as it requests

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] CPU Requests Not Set

CPU requests should be set to ensure the sum of the resource requests of the scheduled Containers is less than the capacity of the node

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] Container Running As Root

Containers should only run as non-root user. This limits the exploitability of security misconfigurations and restricts an attacker's possibilities in case of compromise

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] Container Running With Low UID

Check if containers are running with low UID, which might cause conflicts with the host's user table.

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] Memory Limits Not Defined

Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than the designated amount of memory

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] Memory Requests Not Defined

Memory requests should be defined for each container. This allows the kubelet to reserve the requested amount of system resources and prevents over-provisioning on individual nodes

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] NET_RAW Capabilities Not Being Dropped

Containers should drop 'ALL' or at least 'NET_RAW' capabilities

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] Seccomp Profile Is Not Configured

Containers should be configured with a secure Seccomp profile to restrict potentially dangerous syscalls

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[LOW] Image Without Digest

Images should be specified together with their digests to ensure integrity

Check warning on line 55 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[LOW] Invalid Image Tag

Image tag must be defined and not be empty or equal to latest.
volumes:
- name: secret-volume
Expand Down
16 changes: 4 additions & 12 deletions charts/schulportal-load-tests/values.yaml
Original file line number Diff line number Diff line change
@@ -1,26 +1,18 @@
branch: "main"
imageTag: latest #default latest, release oder main ?
port: 5656
schedule: 0 8 * * *

cronjobs:
dev-scenario:
scriptPath: 1_goto-sp-oidc.ts # 01, 02, 03 Files
schedule: 0 8 * * *
port: 5656
serviceName: dev-scenario
# image-tag: latest
imageTag: DBP-1012
environment: main.dev.spsh.dbildungsplattform.de
# jobsParallelism: not used yet but available? test it
# staging-scenario:
# scriptPath: test.js
# schedule: 0 8 * * *
# port: 5656
# serviceName: staging-scenario
# image: ghcr.io/dbildungsplattform/schulportal-load-tests:latest
# environment: spsh.staging.dbildungsplattform.de
# prod-scenario:
# scriptPath: test.js
# schedule: 0 8 * * *
# port: 5656
# prod-scenario:
# serviceName: prod-scenario
# image: ghcr.io/dbildungsplattform/schulportal-load-tests:latest
# environment: spsh.dbildungsplattform.de
1 change: 0 additions & 1 deletion loadtest/tests/test.js

This file was deleted.

39 changes: 0 additions & 39 deletions startScript.sh

This file was deleted.

0 comments on commit 0b981a8

Please sign in to comment.