test_k3s.yml

# Runs tests referencing the local GitHub Action to verify it works as intended.
---
name: Test

on:
  pull_request:
  push:
    branches-ignore:
      - "dependabot/**"
      - "pre-commit-ci-update-config"
    tags: ["**"]
  workflow_dispatch:

jobs:
  test_install_k3s:
    runs-on: ubuntu-22.04
    name: Test K3s and Helm
    strategy:
      fail-fast: false
      matrix:
        include:
          - k3s-version: ""
            k3s-channel: latest
            helm-version: ""
            metrics-enabled: "true"
            traefik-enabled: "true"
            docker-enabled: "false"
            ip-mode: "default"

          - k3s-version: ""
            k3s-channel: latest
            helm-version: ""
            metrics-enabled: "false"
            traefik-enabled: "false"
            docker-enabled: "true"
            ip-mode: "default"

          - k3s-version: ""
            k3s-channel: latest
            helm-version: ""
            metrics-enabled: "true"
            traefik-enabled: "true"
            docker-enabled: "true"
            ip-mode: "default"

          - k3s-version: ""
            k3s-channel: latest
            helm-version: ""
            metrics-enabled: "false"
            traefik-enabled: "false"
            docker-enabled: "false"
            ip-mode: "default"

          - k3s-version: v1.24.7+k3s1
            k3s-channel: ""
            helm-version: v3.5.0
            metrics-enabled: "true"
            traefik-enabled: "true"
            docker-enabled: "false"
            ip-mode: "default"

          - k3s-version: v1.24.7+k3s1
            k3s-channel: ""
            helm-version: v3.5.0
            metrics-enabled: "false"
            traefik-enabled: "false"
            docker-enabled: "true"
            ip-mode: "default"

          # Test dual stack (IPv6 only doesn't work)

          - k3s-version: ""
            k3s-channel: latest
            helm-version: ""
            metrics-enabled: "false"
            traefik-enabled: "false"
            docker-enabled: "false"
            ip-mode: "dual"

    steps:
      - uses: actions/checkout@v4
      - name: Local action
        id: k3s
        uses: ./
        with:
          k3s-version: ${{ matrix.k3s-version }}
          k3s-channel: ${{ matrix.k3s-channel }}
          helm-version: ${{ matrix.helm-version }}
          metrics-enabled: ${{ matrix.metrics-enabled }}
          traefik-enabled: ${{ matrix.traefik-enabled }}
          docker-enabled: ${{ matrix.docker-enabled }}
          ip-mode: ${{ matrix.ip-mode }}

      - name: Verify action's outputs and env
        run: |
          echo "KUBECONFIG=${KUBECONFIG}"
          echo "kubeconfig=${{ steps.k3s.outputs.kubeconfig }}"
          echo "k3s-version=${{ steps.k3s.outputs.k3s-version }}"
          echo "k8s-version=${{ steps.k3s.outputs.k8s-version }}"
          echo "calico-version=${{ steps.k3s.outputs.calico-version }}"
          echo "helm-version=${{ steps.k3s.outputs.helm-version }}"
          echo "---"

          EXIT=0
          if [[ -z "${KUBECONFIG}" ]]; then
              echo "KUBECONFIG not set as an environment variable"
              EXIT=1
          fi
          if [[ -z "${{ steps.k3s.outputs.kubeconfig }}" ]]; then
              echo "kubeconfig not set as an action output"
              EXIT=1
          fi
          if [[ "${{ steps.k3s.outputs.k3s-version }}" != v* ]]; then
              echo "k3s-version not set correctly as an action output"
              EXIT=1
          fi
          if [[ "${{ steps.k3s.outputs.k8s-version }}" != v* ]]; then
              echo "k8s-version not set correctly as an action output"
              EXIT=1
          fi
          if [[ "${{ steps.k3s.outputs.calico-version }}" != v* ]]; then
              echo "calico-version not set correctly as an action output"
              EXIT=1
          fi
          if [[ "${{ steps.k3s.outputs.helm-version }}" != v* ]]; then
              echo "helm-version not set correctly as an action output"
              EXIT=1
          fi

          exit $EXIT

      - name: Information from kubectl
        run: |
          kubectl version
          kubectl get storageclass
          kubectl get deploy,daemonset,pods --all-namespaces

      - name: Information from docker
        run: |
          docker info
          docker ps

      - name: Information from helm
        run: |
          helm version
          helm list

          if helm version 2>&1 | grep WARNING > /dev/null; then
              echo "helm is expected to run without a WARNING!"
              exit 1
          fi

      - name: Verify deploy/metrics-server based on metrics-enabled input
        run: |
          kubectl get --namespace=kube-system deploy/metrics-server && enabled=true || enabled=false
          if [[ "$enabled" != "${{ matrix.metrics-enabled }}" ]]; then
              echo "ERROR: deploy/metrics-server detected or not, which broke an assumption"
              exit 1
          fi

      - name: Verify deploy/traefik based on traefik-enabled input
        run: |
          kubectl get --namespace=kube-system deploy/traefik && enabled=true || enabled=false
          if [[ "$enabled" != "${{ matrix.traefik-enabled }}" ]]; then
              echo "ERROR: deploy/traefik detected or not, which broke an assumption"
              exit 1
          fi

      # When using `docker-enabled: true` locally built images with docker
      # should be available without loading them for use by the k3s CRI.
      #
      - name: Verify local image is available for the k8s cluster
        if: matrix.docker-enabled == 'true'
        run: |
          docker pull busybox:latest
          docker tag busybox:latest jupyterhub/action-k3s-helm:available-locally

          cat <<EOF | kubectl apply -f -
          apiVersion: v1
          kind: Pod
          metadata:
            name: image-available-locally
          spec:
            containers:
              - name: image-available-locally
                image: jupyterhub/action-k3s-helm:available-locally
                args: ["sleep", "30"]
          EOF

          kubectl wait pod image-available-locally --for condition=Ready --timeout=30s

      - name: Install netpol enforcement test chart
        run: helm install test-netpol-enforcement ./test-netpol-enforcement --wait

      - name: Run netpol enforcement test chart's tests
        run: helm test test-netpol-enforcement --logs

      # https://kubernetes.io/docs/tasks/network/validate-dual-stack/#validate-pod-addressing
      - name: Check pods have an IPv6 address
        if: matrix.ip-mode == 'dual' || matrix.ip-mode == 'ipv6'
        run: |
          echo "::group::pod/check-ipv6"
          kubectl run check-ipv6 --image=nginx
          kubectl wait --for=condition=Ready pod/check-ipv6
          kubectl get pod/check-ipv6 -o yaml
          echo "::endgroup::"

          kubectl get pod/check-ipv6 -o go-template --template='{{range .status.podIPs}}{{printf "%s\n" .ip}}{{end}}' | grep '[0-9a-f]:\S*:[0-9a-f]'

      # ref: https://github.com/jupyterhub/action-k8s-namespace-report
      - name: Kubernetes namespace report (kube-system)
        uses: jupyterhub/action-k8s-namespace-report@v1
        if: always()
        with:
          namespace: kube-system
          important-workloads: >
            ds/calico-node
            deploy/calico-kube-controllers
            deploy/metrics-server
            deploy/traefik

  # Provides a single status_all check that can be used in GitHub branch
  # protection rules instead of having to list each matrix job
  # https://github.community/t/status-check-for-a-matrix-jobs/127354/7
  status_all:
    name: Status matrix Test
    if: always()
    runs-on: ubuntu-latest
    needs: [test_install_k3s]

    steps:
      - name: Check build matrix status
        if: needs.test_install_k3s.result != 'success'
        run: exit 1