ci: refactor some conformance workflows

Adapted k8s network policies, delegated ipam & kind proxy embedded
to use the wait-for-images action, reducing code duplication burden.

Same on conformance-runtime, using a docker pull/save approach from the
runner instead of curling from the VM. Helps if registry needs auth.

Signed-off-by: Antony Reynaud <antony.reynaud@isovalent.com>

Author: Artyop

.github/workflows/conformance-delegated-ipam.yaml

@@ -296,21 +296,15 @@ jobs:
             --docker-username="${{ vars.DOCKER_READ_USERNAME }}" \
             --docker-password="${{ secrets.DOCKER_READ_PASSWORD }}"
 
-      - name: Login to docker registry for image wait
-        if: ${{ vars.DOCKER_AUTH_REQUIRED == 'true' }}
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
-        with:
-          registry: ${{ vars.DOCKER_READ_HOST}}
-          username: ${{ vars.DOCKER_READ_USERNAME}}
-          password: ${{ secrets.DOCKER_READ_PASSWORD }}
-
       - name: Wait for images to be available
-        timeout-minutes: 30
-        shell: bash
-        run: |
-          for image in cilium-ci operator-generic-ci hubble-relay-ci; do
-            until docker manifest inspect ${{ vars.DOCKER_READ_HOST }}/${{ vars.DOCKER_READ_ORG }}/$image:${{ steps.vars.outputs.sha }} &> /dev/null; do sleep 45s; done
-          done
+        uses: ./.github/actions/wait-for-images
+        with:
+          SHA: ${{ steps.vars.outputs.sha }}
+          images: cilium-ci operator-generic-ci hubble-relay-ci
+          login-host: ${{ vars.DOCKER_READ_HOST }}
+          login-username: ${{ vars.DOCKER_READ_USERNAME }}
+          login-password: ${{ secrets.DOCKER_READ_PASSWORD }}
+          auth-required: ${{ vars.DOCKER_AUTH_REQUIRED }}
 
       - name: Wait for nodes to become ready
         run: |

.github/workflows/conformance-k8s-network-policies.yaml

@@ -79,11 +79,13 @@ jobs:
           fi
 
       - name: Wait for images to be available
-        timeout-minutes: 30
-        shell: bash
-        run: |
-          until docker manifest inspect ${{ env.REGISTRY_DEV }}/${{ env.ORGANIZATION_DEV }}/cilium-ci:${{ steps.vars.outputs.tag }} &> /dev/null; do sleep 45s; done
-          until docker manifest inspect ${{ env.REGISTRY_DEV }}/${{ env.ORGANIZATION_DEV }}/operator-generic-ci:${{ steps.vars.outputs.tag }} &> /dev/null; do sleep 45s; done
+        uses: ./.github/actions/wait-for-images
+        with:
+          SHA: ${{ steps.vars.outputs.tag }}
+          images: cilium-ci operator-generic-ci
+          login-host: ${{ vars.DOCKER_READ_HOST }}
+          login-username: ${{ vars.DOCKER_READ_USERNAME }}
+          login-password: ${{ secrets.DOCKER_READ_PASSWORD }}
 
       - name: Create kind cluster
         uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
@@ -94,6 +96,15 @@ jobs:
           config: ${{ env.KIND_CONFIG }}
           wait: 0 # The control-plane never becomes ready, since no CNI is present
 
+      - name: Create imagePullSecret
+        if: ${{ vars.DOCKER_AUTH_REQUIRED == 'true' }}
+        run: |
+          kubectl create secret docker-registry cilium-registry \
+            --namespace kube-system \
+            --docker-server=${{ vars.DOCKER_READ_HOST }} \
+            --docker-username="${{ vars.DOCKER_READ_USERNAME }}" \
+            --docker-password="${{ secrets.DOCKER_READ_PASSWORD }}"
+
       - name: Install cilium chart
         id: install-cilium
         run: |
@@ -136,6 +147,10 @@ jobs:
             --set hubble.enabled=true \
             --set=hubble.metrics.enabled={dns,drop,tcp,flow,port-distribution,icmp,http}"
 
+          if [ "${{ vars.DOCKER_AUTH_REQUIRED }}" == "true" ]; then
+            HELM_ARGS="$HELM_ARGS --set-string=imagePullSecrets[0].name=cilium-registry"
+          fi
+
           helm install cilium ./install/kubernetes/cilium $HELM_ARGS
 
           kubectl wait -n kube-system --for=condition=Ready -l app.kubernetes.io/part-of=cilium pod --timeout=5m

.github/workflows/conformance-kind-proxy-embedded.yaml

@@ -195,21 +195,15 @@ jobs:
             --docker-username="${{ vars.DOCKER_READ_USERNAME }}" \
             --docker-password="${{ secrets.DOCKER_READ_PASSWORD }}"
 
-      - name: Login to docker registry for image wait
-        if: ${{ vars.DOCKER_AUTH_REQUIRED == 'true' }}
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
-        with:
-          registry: ${{ vars.DOCKER_READ_HOST}}
-          username: ${{ vars.DOCKER_READ_USERNAME}}
-          password: ${{ secrets.DOCKER_READ_PASSWORD }}
-
       - name: Wait for images to be available
-        timeout-minutes: 30
-        shell: bash
-        run: |
-          for image in cilium-ci operator-generic-ci hubble-relay-ci ; do
-            until docker manifest inspect ${{ vars.DOCKER_READ_HOST }}/${{ vars.DOCKER_READ_ORG }}/$image:${{ steps.vars.outputs.sha }} &> /dev/null; do sleep 45s; done
-          done
+        uses: ./.github/actions/wait-for-images
+        with:
+          SHA: ${{ steps.vars.outputs.sha }}
+          images: cilium-ci operator-generic-ci hubble-relay-ci
+          login-host: ${{ vars.DOCKER_READ_HOST }}
+          login-username: ${{ vars.DOCKER_READ_USERNAME }}
+          login-password: ${{ secrets.DOCKER_READ_PASSWORD }}
+          auth-required: ${{ vars.DOCKER_AUTH_REQUIRED }}
 
       # Warning: since this is a privileged workflow, subsequent workflow job
       # steps must take care not to execute untrusted code.

.github/workflows/conformance-runtime.yaml

@@ -89,32 +89,23 @@ jobs:
   wait-for-images:
     runs-on: ubuntu-24.04
     name: Wait for images
+    timeout-minutes: 30
     steps:
       - name: Checkout context ref (trusted)
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ inputs.context-ref || github.sha }}
           persist-credentials: false
 
-      - name: Set Environment Variables
-        uses: ./.github/actions/set-env-variables
-
-      - name: Set up job variables
-        id: vars
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            SHA="${{ inputs.SHA }}"
-          else
-            SHA="${{ github.sha }}"
-          fi
-
-          echo "sha=${SHA}" >> $GITHUB_OUTPUT
-
-      - name: Waiting for images
-        timeout-minutes: 20
-        shell: bash
-        run: |
-          until docker manifest inspect ${{ env.REGISTRY_DEV }}/${{ env.ORGANIZATION_DEV }}/cilium-ci:${{ steps.vars.outputs.sha }} &> /dev/null; do sleep 45s; done
+      - name: Wait for images
+        uses: ./.github/actions/wait-for-images
+        with:
+          SHA: ${{ inputs.SHA || github.sha }}
+          images: cilium-ci
+          login-host: ${{ vars.DOCKER_READ_HOST }}
+          login-username: ${{ vars.DOCKER_READ_USERNAME }}
+          login-password: ${{ secrets.DOCKER_READ_PASSWORD }}
+          auth-required: ${{ vars.DOCKER_AUTH_REQUIRED }}
 
   setup-and-test:
     needs: wait-for-images
@@ -193,7 +184,6 @@ jobs:
           lvh-version: "v0.0.30"
           mem: 14G
 
-
       # Load Golang cache build from GitHub
       - name: Load Golang cache build from GitHub
         if: ${{ matrix.focus == 'privileged' }}
@@ -221,6 +211,20 @@ jobs:
           mv "${GOCACHE}/go-build-cache.tar.zst" ./go-build-cache.tar.zst || true
           mv "${GOMODCACHE}/go-mod-cache.tar.zst" ./go-mod-cache.tar.zst || true
 
+      - name: Login to docker registry for CI image pull
+        if: ${{ vars.DOCKER_AUTH_REQUIRED == 'true' }}
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          registry: ${{ vars.DOCKER_READ_HOST }}
+          username: ${{ vars.DOCKER_READ_USERNAME }}
+          password: ${{ secrets.DOCKER_READ_PASSWORD }}
+
+      - name: Export Cilium toolchain image for the VM
+        shell: bash
+        run: |
+          docker pull ${{ env.REGISTRY_DEV }}/${{ env.ORGANIZATION_DEV }}/cilium-ci:${{ steps.vars.outputs.sha }}
+          docker save ${{ env.REGISTRY_DEV }}/${{ env.ORGANIZATION_DEV }}/cilium-ci:${{ steps.vars.outputs.sha }} -o ./cilium-toolchain-image.tar
+
       - name: Setup runtime
         timeout-minutes: 10
         uses: cilium/little-vm-helper@5ae749011735fd77f30f38add52f1a53a5568671 # v0.0.30
@@ -240,9 +244,7 @@ jobs:
             # These programs are not statically linked so they might break in
             # the case of GHA runners being upgraded.
             if ! command -v clang >/dev/null 2>&1; then
-              # Wait for systemd-resolved to be ready so that the image pull
-              # below can resolve the registry hostname.
-              for i in {1..5}; do curl "https://${{ env.REGISTRY_DEV }}" > /dev/null 2>&1 && break || sleep 5; echo "Waiting for systemd-resolved to be ready..."; done
+              docker load -i /host/cilium-toolchain-image.tar
               docker create --name cilium-toolchain ${{ env.REGISTRY_DEV }}/${{ env.ORGANIZATION_DEV }}/cilium-ci:${{ steps.vars.outputs.sha }}
               docker cp cilium-toolchain:/usr/local/bin/clang /usr/bin/
               docker cp cilium-toolchain:/usr/local/bin/llc /usr/bin/