Skip to content

Commit 49efe38

Browse files
author
diverdane
committed
Adds GCP-based Jenkins test
This change adds a GCP/GKE based Jenkins test that does the following using Helm v3: - Creates a Kubernetes namespace - Runs a Helm install of a Conjur OSS server - Runs a Helm test that deploys a test container that confirms that the Conjur server's status page is active. - Does a Helm delete of the Conjur OSS release - Deletes the namespace Also fixes an issue with running the 'test.sh' script with Helm v2 in that the 'helm test ...' and 'helm delete ...' commands were incorrectly including a namespace argument (a namespace argument is only used for 'helm install ...' for Helm v2).
1 parent 9074ea8 commit 49efe38

11 files changed

+302
-32
lines changed

‎.github/workflows/ci.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ jobs:
5050
run: ./test-minimal.sh
5151

5252
install-test-helm-v2:
53-
name: Install/test Conjur with Helm V2 on KinD Cluster
53+
name: Install/test Conjur with Helm V2 on KinD Cluster (v1.18.2)
5454
needs:
5555
- linter
5656
- install-test-helm-v3

‎Jenkinsfile

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#!/usr/bin/env groovy
2+
3+
import groovy.transform.Field
4+
5+
@Field
6+
def TAG = ""
7+
8+
pipeline {
9+
agent { label 'executor-v2' }
10+
11+
options {
12+
timestamps()
13+
buildDiscarder(logRotator(numToKeepStr: '30'))
14+
}
15+
16+
triggers {
17+
cron(getDailyCronString())
18+
}
19+
20+
stages {
21+
22+
stage('GKE Build and Test') {
23+
environment {
24+
HELM_VERSION = "3.1.3"
25+
}
26+
steps {
27+
sh 'cd ci && summon ./jenkins_build.sh'
28+
}
29+
}
30+
}
31+
32+
post {
33+
always {
34+
cleanupAndNotify(currentBuild.currentResult)
35+
}
36+
}
37+
}

‎ci/Dockerfile

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
FROM google/cloud-sdk
2+
3+
ARG HELM_VERSION=3.1.3
4+
ARG KUBECTL_VERSION=1.16.9
5+
6+
RUN mkdir -p /src
7+
WORKDIR /src
8+
9+
# Install Docker client
10+
RUN apt-get update && \
11+
apt-get install -y apt-transport-https \
12+
ca-certificates \
13+
curl \
14+
gnupg2 \
15+
software-properties-common \
16+
wget && \
17+
distro="$(. /etc/os-release; echo $ID)" && \
18+
release="$(lsb_release -cs)" && \
19+
curl -fsSL "https://download.docker.com/linux/$distro/gpg" > /tmp/docker_repo_key && \
20+
apt-key add /tmp/docker_repo_key && \
21+
add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/$distro $release stable" && \
22+
apt-get update && \
23+
apt-get install -y docker-ce && \
24+
apt-get clean && \
25+
rm -rf /var/lib/apt/lists/*
26+
27+
# Install Helm client
28+
RUN wget https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz && \
29+
tar xvf helm-v${HELM_VERSION}-linux-amd64.tar.gz && \
30+
mv linux-amd64/helm /usr/local/bin/ && \
31+
rm helm-v${HELM_VERSION}-linux-amd64.tar.gz && \
32+
rm -rf linux-amd64
33+
34+
# Install Kubernetes client
35+
RUN wget -O /usr/local/bin/kubectl https://storage.googleapis.com/kubernetes-release/release/v${KUBECTL_VERSION}/bin/linux/amd64/kubectl && \
36+
chmod +x /usr/local/bin/kubectl

‎ci/jenkins_build.sh

+137
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
#!/bin/bash
2+
set -euo pipefail
3+
4+
source ../utils.sh
5+
6+
# This script does the following in sequence:
7+
# - Runs a Helm install of a Conjur OSS server
8+
# - Runs a Helm test that deploys a test container that runs a
9+
# Bash Automated Test System (a.k.a. "Bats") test script that
10+
# confirms that the Conjur server's status page is active.
11+
#
12+
# Optional Environment Variables:
13+
# CONJUR_NAMESPACE: Namespace to use for Conjur deployment. The
14+
# namespace is created if it doesn't exist.
15+
# HELM_INSTALL_TIMEOUT: Helm install timeout in seconds.
16+
# Defaults to `180`.
17+
# HELM_TEST_LOGGING: Set to true to enable Helm test log collection.
18+
# Defaults to false.
19+
# HELM_VERSION: Helm client version to use for the test.
20+
# Defaults to '3.1.3'.
21+
# KUBECTL_VERSION: Kubectl client version to use for the test.
22+
# Defaults to '1.16.9'.
23+
# SKIP_GCLOUD_LOGIN: If set to 'true', then skip Gcloud authentication.
24+
# This is useful for local testing whereby you've
25+
# already authenticated with GCP and/or have 'kubectl'
26+
# access to a cluster. Defaults to 'false'.
27+
28+
test_id="$(random_string)"
29+
30+
export CONJUR_NAMESPACE="${CONJUR_NAMESPACE:-conjur-oss-test-$test_id}"
31+
export HELM_INSTALL_TIMEOUT="${HELM_INSTALL_TIMEOUT:-180}"
32+
export HELM_TEST_LOGGING="${HELM_TEST_LOGGING:-true}"
33+
export HELM_VERSION="${HELM_VERSION:-3.1.3}"
34+
export KUBECTL_VERSION="${KUBECTL_VERSION:-1.16.9}"
35+
export RELEASE_NAME="$CONJUR_NAMESPACE"
36+
export SKIP_GCLOUD_LOGIN="${SKIP_GCLOUD_LOGIN:-false}"
37+
38+
announce "Building gcloud/kubectl/helm client image..."
39+
# Build the gcloud/kubectl/helm client container image
40+
tools_image_name="conjur-oss-helm-kubectl"
41+
docker build -t "${tools_image_name}" \
42+
--quiet \
43+
--build-arg HELM_VERSION="$HELM_VERSION" \
44+
--build-arg KUBECTL_VERSION="$KUBECTL_VERSION" \
45+
-f Dockerfile \
46+
.
47+
48+
tmp_dir="$(pwd)/.tmp"
49+
tmp_bin_dir="${tmp_dir}/bin"
50+
mkdir -p "${tmp_bin_dir}" \
51+
"${tmp_dir}/.kube" \
52+
"${tmp_dir}/.config"
53+
export PATH="${tmp_bin_dir}:${PATH}"
54+
55+
# Create a local alias for running 'gcloud' in client container
56+
cat > "${tmp_bin_dir}/gcloud" <<EOF
57+
docker run --rm \
58+
--ipc="host" \
59+
-v "${tmp_dir}/.kube:/root/.kube" \
60+
-v "${tmp_dir}/.config:/root/.config" \
61+
--entrypoint /usr/bin/gcloud \
62+
"${tools_image_name}" \
63+
"\$@"
64+
EOF
65+
chmod +x "${tmp_bin_dir}/gcloud"
66+
67+
# Create a local alias for running 'helm' in client container
68+
cat > "${tmp_bin_dir}/helm" <<EOF
69+
docker run --rm \
70+
-v "${tmp_dir}/.kube:/root/.kube" \
71+
-v "${tmp_dir}/.config:/root/.config" \
72+
-v "$(cd ../conjur-oss; pwd):/src/conjur-oss:ro" \
73+
--entrypoint /usr/local/bin/helm \
74+
"${tools_image_name}" \
75+
"\$@"
76+
EOF
77+
chmod +x "${tmp_bin_dir}/helm"
78+
79+
# Create a local alias for running 'kubectl' in client container
80+
cat > "${tmp_bin_dir}/kubectl" <<EOF
81+
docker run --rm \
82+
-v "${tmp_dir}/.kube:/root/.kube" \
83+
-v "${tmp_dir}/.config:/root/.config" \
84+
--entrypoint /usr/local/bin/kubectl \
85+
"${tools_image_name}" \
86+
"\$@"
87+
EOF
88+
chmod +x "${tmp_bin_dir}/kubectl"
89+
90+
if [ "$SKIP_GCLOUD_LOGIN" = true ]; then
91+
cp "$HOME/.kube/config" "$tmp_dir/.kube/config"
92+
cp -r "$HOME/.config/gcloud" "$tmp_dir/.config/gcloud"
93+
else
94+
announce "Logging in to GCP..."
95+
# It is assumed that the environment variables below are set by summon.
96+
docker run --rm \
97+
-e GCLOUD_CLUSTER_NAME \
98+
-e GCLOUD_PROJECT_NAME \
99+
-e GCLOUD_SERVICE_KEY="/tmp${GCLOUD_SERVICE_KEY}" \
100+
-e GCLOUD_ZONE \
101+
-e DOCKER_REGISTRY_URL \
102+
-e DOCKER_REGISTRY_PATH \
103+
-v "${tmp_dir}/.kube:/root/.kube" \
104+
-v "${tmp_dir}/.config:/root/.config" \
105+
-v "${GCLOUD_SERVICE_KEY}:/tmp${GCLOUD_SERVICE_KEY}" \
106+
-v "$(pwd):/src:ro" \
107+
"${tools_image_name}" \
108+
bash -c "./platform_login.sh"
109+
fi
110+
111+
# Fix permissions on files created within Docker
112+
docker run --rm \
113+
-v "${tmp_dir}/.kube:/root/.kube" \
114+
-v "${tmp_dir}/.config:/root/.config" \
115+
"${tools_image_name}" \
116+
bash -c "chown ${UID} -R /root/.kube/config /root/.config/*"
117+
118+
function delete_namespace {
119+
announce "Deleting namespace $CONJUR_NAMESPACE"
120+
kubectl delete namespace --ignore-not-found=true "$CONJUR_NAMESPACE"
121+
}
122+
123+
if ! is_helm_v2; then
124+
# Helm v3 requires units for timeout values
125+
HELM_INSTALL_TIMEOUT+="s"
126+
else
127+
helm init --upgrade
128+
fi
129+
130+
announce "Deploying and testing Conjur OSS"
131+
cd ..
132+
trap delete_namespace EXIT
133+
if ! ./test.sh; then
134+
announce " FAILED"
135+
exit 1
136+
fi
137+
announce " SUCCESS"

‎ci/platform_login.sh

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
#!/bin/bash
2+
3+
set -euo pipefail
4+
5+
function log_in() {
6+
gcloud auth activate-service-account \
7+
--key-file "${GCLOUD_SERVICE_KEY}"
8+
gcloud container clusters get-credentials \
9+
"${GCLOUD_CLUSTER_NAME}" \
10+
--zone "${GCLOUD_ZONE}" \
11+
--project "${GCLOUD_PROJECT_NAME}"
12+
docker login "${DOCKER_REGISTRY_URL}" \
13+
-u oauth2accesstoken \
14+
-p "$(gcloud auth print-access-token)"
15+
}
16+
17+
echo "Logging into GKE and Docker registry..."
18+
19+
attempt=0
20+
21+
log_in
22+
until [[ "$(gcloud auth list --filter=status:ACTIVE --format='value(account)' 2>/dev/null)" != "" ]]; do
23+
echo -n '.'
24+
sleep 2
25+
26+
attempt=$(( attempt + 1 ))
27+
if [ $attempt -gt 10 ]; then
28+
echo
29+
echo "ERROR: Could not log into Gcloud!"
30+
exit 1
31+
fi
32+
33+
log_in
34+
done
35+
36+
echo "Logged into remote resources."

‎ci/secrets.yml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
GCLOUD_CLUSTER_NAME: !var ci/google-container-engine-testbed/gcloud-cluster-name
2+
GCLOUD_PROJECT_NAME: !var ci/google-container-engine-testbed/gcloud-project-name
3+
GCLOUD_SERVICE_KEY: !var:file ci/google-container-engine-testbed/gcloud-service-key
4+
GCLOUD_ZONE: !var ci/google-container-engine-testbed/gcloud-zone
5+
6+
DOCKER_REGISTRY_URL: us.gcr.io
7+
DOCKER_REGISTRY_PATH: us.gcr.io/conjur-gke-dev

‎is-helm-v2.sh

-7
This file was deleted.

‎run.sh

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
set -eo pipefail
44

5-
source ./is-helm-v2.sh
5+
source ./utils.sh
66

77
HELM_RELEASE=${HELM_RELEASE:-conjur-oss}
88

@@ -24,7 +24,7 @@ if [ ! -z "$CONJUR_NAMESPACE" ]; then
2424
if ! kubectl get namespace "$CONJUR_NAMESPACE" 2>/dev/null; then
2525
kubectl create namespace "$CONJUR_NAMESPACE"
2626
fi
27-
HELM_ARGS="$HELM_ARGS -n $CONJUR_NAMESPACE"
27+
HELM_ARGS="$HELM_ARGS --namespace $CONJUR_NAMESPACE"
2828
fi
2929

3030
helm install $HELM_ARGS ./conjur-oss

‎test-minimal.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash -e
22

3-
source ./is-helm-v2.sh
3+
source ./utils.sh
44

55
# This script runs the minimal helm test, without relies on external load
66
# balancers or persistent volumes. This is suitable for environment where

0 commit comments

Comments
 (0)