-
Notifications
You must be signed in to change notification settings - Fork 14
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
`GitHubSecurityLab/actions-permissions/monitor` added a MITM proxy to intercept calls. This proxy signed the GKE API cert which lead to errors: ``` Unable to connect to the server: tls: failed to verify certificate: x509: certificate signed by unknown authority ``` Signed-off-by: Christian Zunker <[email protected]>
- Loading branch information
Showing
6 changed files
with
111 additions
and
102 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -38,102 +38,100 @@ env: | |
| CNSPEC_IMAGE_TAG: ${{ github.event.inputs.cnspecImageTag || 'edge-latest-rootless' }} | ||
|
|
||
| jobs: | ||
| aks-integration-test: | ||
| runs-on: ubuntu-latest | ||
| name: AKS integration tests | ||
|
|
||
| env: | ||
| ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }} | ||
| ARM_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }} | ||
| ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | ||
| ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }} | ||
| KUBECONFIG: ${{ format('{0}/{1}', github.workspace, '.github/terraform/aks/kubeconfig') }} | ||
| # aks-integration-test: | ||
| # runs-on: ubuntu-latest | ||
| # name: AKS integration tests | ||
|
|
||
| # env: | ||
| # ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }} | ||
| # ARM_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }} | ||
| # ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | ||
| # ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }} | ||
| # KUBECONFIG: ${{ format('{0}/{1}', github.workspace, '.github/terraform/aks/kubeconfig') }} | ||
|
|
||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| k8s-version: ["1.25", "1.26", "1.27"] | ||
| # strategy: | ||
| # fail-fast: false | ||
| # matrix: | ||
| # k8s-version: ["1.25", "1.26", "1.27"] | ||
|
|
||
| steps: | ||
| - uses: GitHubSecurityLab/actions-permissions/monitor@v1 | ||
| with: | ||
| config: ${{ vars.PERMISSIONS_CONFIG }} | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 # fetch is needed for "git tag --list" in the Makefile | ||
| # steps: | ||
| # - uses: actions/checkout@v4 | ||
| # with: | ||
| # fetch-depth: 0 # fetch is needed for "git tag --list" in the Makefile | ||
|
|
||
| - name: Import environment variables from file | ||
| run: cat ".github/env" >> $GITHUB_ENV | ||
| # - name: Import environment variables from file | ||
| # run: cat ".github/env" >> $GITHUB_ENV | ||
|
|
||
| - name: Setup Terraform | ||
| uses: hashicorp/setup-terraform@v3 | ||
| # - name: Setup Terraform | ||
| # uses: hashicorp/setup-terraform@v3 | ||
|
|
||
| - name: Terraform init | ||
| run: terraform init | ||
| working-directory: .github/terraform/aks | ||
| # - name: Terraform init | ||
| # run: terraform init | ||
| # working-directory: .github/terraform/aks | ||
|
|
||
| - name: Terraform plan | ||
| run: terraform plan -out aks-${{ matrix.k8s-version }}.json | ||
| env: | ||
| TF_VAR_k8s_version: ${{ matrix.k8s-version }} | ||
| working-directory: .github/terraform/aks | ||
|
|
||
| - name: Terraform apply | ||
| run: terraform apply -auto-approve aks-${{ matrix.k8s-version }}.json | ||
| env: | ||
| TF_VAR_k8s_version: ${{ matrix.k8s-version }} | ||
| working-directory: .github/terraform/aks | ||
|
|
||
| - uses: actions/setup-go@v4 | ||
| with: | ||
| go-version: "${{ env.golang-version }}" | ||
| cache: true | ||
|
|
||
| - name: Get operator version | ||
| run: echo "OPERATOR_VERSION=$(docker run ghcr.io/mondoohq/mondoo-operator:${{ env.MONDOO_OPERATOR_IMAGE_TAG }} version --simple)" >> $GITHUB_ENV | ||
|
|
||
| - name: Wait a bit for the cluster to become more stable | ||
| run: kubectl -n kube-system wait --for=condition=Ready pods --all --timeout=60s | ||
|
|
||
| - name: Run integration tests | ||
| env: | ||
| MONDOO_API_TOKEN: ${{ secrets.MONDOO_TEST_ORG_TOKEN }} | ||
| MONDOO_ORG_MRN: //captain.api.mondoo.app/organizations/serene-lovelace-854342 | ||
| MONDOO_GQL_ENDPOINT: https://api.edge.mondoo.com/query | ||
| run: VERSION=${{ env.OPERATOR_VERSION }} K8S_DISTRO=aks make test/integration/ci | ||
|
|
||
| - name: Clean up AKS terraform | ||
| run: terraform destroy -auto-approve | ||
| if: success() || failure() | ||
| working-directory: .github/terraform/aks | ||
| # - name: Terraform plan | ||
| # run: terraform plan -out aks-${{ matrix.k8s-version }}.json | ||
| # env: | ||
| # TF_VAR_k8s_version: ${{ matrix.k8s-version }} | ||
| # working-directory: .github/terraform/aks | ||
|
|
||
| # - name: Terraform apply | ||
| # run: terraform apply -auto-approve aks-${{ matrix.k8s-version }}.json | ||
| # env: | ||
| # TF_VAR_k8s_version: ${{ matrix.k8s-version }} | ||
| # working-directory: .github/terraform/aks | ||
|
|
||
| # - uses: actions/setup-go@v4 | ||
| # with: | ||
| # go-version: "${{ env.golang-version }}" | ||
| # cache: true | ||
|
|
||
| # - name: Get operator version | ||
| # run: echo "OPERATOR_VERSION=$(docker run ghcr.io/mondoohq/mondoo-operator:${{ env.MONDOO_OPERATOR_IMAGE_TAG }} version --simple)" >> $GITHUB_ENV | ||
|
|
||
| # - name: Wait a bit for the cluster to become more stable | ||
| # run: kubectl -n kube-system wait --for=condition=Ready pods --all --timeout=60s | ||
|
|
||
| # - name: Run integration tests | ||
| # env: | ||
| # MONDOO_API_TOKEN: ${{ secrets.MONDOO_TEST_ORG_TOKEN }} | ||
| # MONDOO_ORG_MRN: //captain.api.mondoo.app/organizations/serene-lovelace-854342 | ||
| # MONDOO_GQL_ENDPOINT: https://api.edge.mondoo.com/query | ||
| # run: VERSION=${{ env.OPERATOR_VERSION }} K8S_DISTRO=aks make test/integration/ci | ||
|
|
||
| # - name: Clean up AKS terraform | ||
| # run: terraform destroy -auto-approve | ||
| # if: success() || failure() | ||
| # working-directory: .github/terraform/aks | ||
|
|
||
| - run: mv integration-tests.xml integration-tests-aks-${{ matrix.k8s-version }}.xml | ||
| if: success() || failure() | ||
|
|
||
| - name: Upload cloud test results | ||
| uses: actions/upload-artifact@v3 # upload test results | ||
| if: success() || failure() # run this step even if previous step failed | ||
| with: # upload a combined archive with unit and integration test results | ||
| name: cloud-test-results | ||
| path: | | ||
| integration-tests-aks-${{ matrix.k8s-version }}.xml | ||
| .github/terraform/aks/aks-${{ matrix.k8s-version }}.json | ||
| - name: Upload test logs artifact | ||
| uses: actions/upload-artifact@v3 | ||
| if: failure() | ||
| with: | ||
| name: test-logs-aks-${{ matrix.k8s-version }} | ||
| path: /home/runner/work/mondoo-operator/mondoo-operator/tests/integration/_output/ | ||
| # - run: mv integration-tests.xml integration-tests-aks-${{ matrix.k8s-version }}.xml | ||
| # if: success() || failure() | ||
|
|
||
| # - name: Upload cloud test results | ||
| # uses: actions/upload-artifact@v3 # upload test results | ||
| # if: success() || failure() # run this step even if previous step failed | ||
| # with: # upload a combined archive with unit and integration test results | ||
| # name: cloud-test-results | ||
| # path: | | ||
| # integration-tests-aks-${{ matrix.k8s-version }}.xml | ||
| # .github/terraform/aks/aks-${{ matrix.k8s-version }}.json | ||
|
|
||
| # - name: Upload test logs artifact | ||
| # uses: actions/upload-artifact@v3 | ||
| # if: failure() | ||
| # with: | ||
| # name: test-logs-aks-${{ matrix.k8s-version }} | ||
| # path: /home/runner/work/mondoo-operator/mondoo-operator/tests/integration/_output/ | ||
|
|
||
| eks-integration-test: | ||
| runs-on: ubuntu-latest | ||
| name: EKS integration tests | ||
|
|
||
| strategy: | ||
| fail-fast: false | ||
| max-parallel: 3 # Otherwise we will hit AWS VPC quota limits | ||
| matrix: | ||
| k8s-version: ["1.24", "1.25", "1.26", "1.27", "1.28"] | ||
| k8s-version: ["1.25"] #, "1.25", "1.26", "1.27", "1.28"] | ||
|
|
||
| env: | ||
| TF_VAR_test_name: ${{ github.event.inputs.mondooOperatorImageTag }} | ||
|
|
@@ -142,9 +140,6 @@ jobs: | |
| AWS_REGION: us-east-2 | ||
|
|
||
| steps: | ||
| - uses: GitHubSecurityLab/actions-permissions/monitor@v1 | ||
| with: | ||
| config: ${{ vars.PERMISSIONS_CONFIG }} | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 # fetch is needed for "git tag --list" in the Makefile | ||
|
|
@@ -217,16 +212,13 @@ jobs: | |
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| k8s-version: ["1.25", "1.26", "1.27"] | ||
| k8s-version: ["1.25"] #, "1.26", "1.27"] | ||
|
|
||
| env: | ||
| GOOGLE_APPLICATION_CREDENTIALS: ${{ format('{0}/{1}', github.workspace, 'gcp_sa.json') }} | ||
| KUBECONFIG: ${{ format('{0}/{1}', github.workspace, '.github/terraform/gke/kubeconfig') }} | ||
|
|
||
| steps: | ||
| - uses: GitHubSecurityLab/actions-permissions/monitor@v1 | ||
| with: | ||
| config: ${{ vars.PERMISSIONS_CONFIG }} | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 # fetch is needed for "git tag --list" in the Makefile | ||
|
|
@@ -260,11 +252,14 @@ jobs: | |
| go-version: "${{ env.golang-version }}" | ||
| cache: true | ||
|
|
||
| - name: Manually install dep | ||
| run: go get github.com/GoogleCloudPlatform/cloud-foundation-toolkit/infra/[email protected] | ||
|
|
||
| - name: Get operator version | ||
| run: echo "OPERATOR_VERSION=$(docker run ghcr.io/mondoohq/mondoo-operator:${{ env.MONDOO_OPERATOR_IMAGE_TAG }} version --simple)" >> $GITHUB_ENV | ||
|
|
||
| - name: Wait a bit for the cluster to become more stable | ||
| run: kubectl -n kube-system wait --for=condition=Ready pods --all --timeout=60s | ||
| run: kubectl -n kube-system wait --for=condition=Ready pods --all --timeout=300s | ||
|
|
||
| - name: Run integration tests | ||
| env: | ||
|
|
@@ -302,12 +297,10 @@ jobs: | |
| test-report: | ||
| name: Report test results | ||
| runs-on: ubuntu-latest | ||
| needs: [eks-integration-test,aks-integration-test,gke-integration-test] | ||
| #needs: [eks-integration-test,aks-integration-test,gke-integration-test] | ||
| needs: [gke-integration-test] | ||
| if: always() | ||
| steps: | ||
| - uses: GitHubSecurityLab/actions-permissions/monitor@v1 | ||
| with: | ||
| config: ${{ vars.PERMISSIONS_CONFIG }} | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 # fetch is needed for "git tag --list" in the Makefile | ||
|
|
@@ -327,13 +320,11 @@ jobs: | |
| discord-notification: | ||
| runs-on: ubuntu-latest | ||
| name: Send Discord notification | ||
| needs: [eks-integration-test,aks-integration-test,gke-integration-test] | ||
| #needs: [eks-integration-test,aks-integration-test,gke-integration-test] | ||
| needs: [gke-integration-test] | ||
| # Run only if the previous job has failed and only if it's running against the main branch | ||
| if: ${{ always() && contains(join(needs.*.result, ','), 'fail') && github.ref_name == 'main' }} | ||
| steps: | ||
| - uses: GitHubSecurityLab/actions-permissions/monitor@v1 | ||
| with: | ||
| config: ${{ vars.PERMISSIONS_CONFIG }} | ||
| - uses: sarisia/actions-status-discord@v1 | ||
| with: | ||
| webhook: ${{ secrets.DISCORD_WEBHOOK }} | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.