Skip to content

Commit 2fa5d4a

Browse files
author
Paul Cruickshank
committed
Add to github workflow
Signed-off-by: Paul Cruickshank <pcruickshank@evroc.com>
1 parent d94361e commit 2fa5d4a

File tree

8 files changed

+157
-17
lines changed

8 files changed

+157
-17
lines changed

‎.github/workflows/build-x86-image.yaml‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3113,6 +3113,142 @@ jobs:
31133113
if: ${{ success() || (failure() && (steps.install.conclusion == 'failure' || steps.kube-ovn-ipsec-e2e.conclusion == 'failure')) }}
31143114
run: make check-kube-ovn-pod-restarts
31153115

3116+
kube-ovn-ipsec-cert-mgr-e2e:
3117+
name: OVN IPSEC E2E CERT MANAGER
3118+
needs:
3119+
- build-kube-ovn
3120+
- build-e2e-binaries
3121+
runs-on: ubuntu-24.04
3122+
timeout-minutes: 15
3123+
steps:
3124+
- uses: jlumbroso/free-disk-space@v1.3.1
3125+
with:
3126+
android: true
3127+
dotnet: true
3128+
haskell: true
3129+
docker-images: false
3130+
large-packages: false
3131+
tool-cache: false
3132+
swap-storage: false
3133+
3134+
- uses: actions/checkout@v4
3135+
3136+
- name: Create the default branch directory
3137+
if: (github.base_ref || github.ref_name) != github.event.repository.default_branch
3138+
run: mkdir -p test/e2e/source
3139+
3140+
- name: Check out the default branch
3141+
if: (github.base_ref || github.ref_name) != github.event.repository.default_branch
3142+
uses: actions/checkout@v4
3143+
with:
3144+
ref: ${{ github.event.repository.default_branch }}
3145+
fetch-depth: 1
3146+
path: test/e2e/source
3147+
3148+
- name: Export E2E directory
3149+
run: |
3150+
if [ '${{ github.base_ref || github.ref_name }}' = '${{ github.event.repository.default_branch }}' ]; then
3151+
echo "E2E_DIR=." >> "$GITHUB_ENV"
3152+
else
3153+
echo "E2E_DIR=test/e2e/source" >> "$GITHUB_ENV"
3154+
fi
3155+
3156+
- uses: actions/setup-go@v5
3157+
id: setup-go
3158+
with:
3159+
go-version-file: ${{ env.E2E_DIR }}/go.mod
3160+
check-latest: true
3161+
cache: false
3162+
3163+
- name: Export Go full version
3164+
run: echo "GO_VERSION=${{ steps.setup-go.outputs.go-version }}" >> "$GITHUB_ENV"
3165+
3166+
- name: Go cache
3167+
uses: actions/cache/restore@v4
3168+
with:
3169+
path: |
3170+
~/.cache/go-build
3171+
~/go/pkg/mod
3172+
key: ${{ runner.os }}-e2e-go-${{ env.GO_VERSION }}-x86-${{ hashFiles(format('{0}/**/go.sum', env.E2E_DIR)) }}
3173+
restore-keys: ${{ runner.os }}-e2e-go-${{ env.GO_VERSION }}-x86-
3174+
3175+
- name: Install kind
3176+
uses: helm/kind-action@v1.12.0
3177+
with:
3178+
version: ${{ env.KIND_VERSION }}
3179+
install_only: true
3180+
3181+
- name: Install ginkgo
3182+
working-directory: ${{ env.E2E_DIR }}
3183+
run: go install -v -mod=mod github.com/onsi/ginkgo/v2/ginkgo
3184+
3185+
- name: Download kube-ovn image
3186+
uses: actions/download-artifact@v4
3187+
with:
3188+
name: kube-ovn
3189+
3190+
- name: Load images
3191+
run: docker load -i kube-ovn.tar
3192+
3193+
- name: Create kind cluster
3194+
run: |
3195+
pipx install jinjanator
3196+
make kind-init
3197+
3198+
- name: Install Kube-OVN
3199+
id: install
3200+
run: make kind-install-ovn-ipsec-cert-manager
3201+
3202+
- name: Run Ovn IPSEC cert-manager E2E
3203+
id: kube-ovn-ipsec-cert-mgr-e2e
3204+
working-directory: ${{ env.E2E_DIR }}
3205+
env:
3206+
E2E_BRANCH: ${{ github.base_ref || github.ref_name }}
3207+
run: make kube-ovn-ipsec-cert-mgr-e2e
3208+
3209+
- name: Collect k8s events
3210+
if: failure() && ( steps.ovn-ipsec-cert-mgr-e2e.conclusion == 'failure')
3211+
run: |
3212+
kubectl get events -A -o yaml > kube-ovn-ipsec-cert-mgr-e2e-events.yaml
3213+
tar zcf kube-ovn-ipsec-cert-mgr-e2e-events.tar.gz kube-ovn-ipsec-cert-mgr-e2e-events.yaml
3214+
3215+
- name: Upload k8s events
3216+
uses: actions/upload-artifact@v4
3217+
if: failure() && (steps.kube-ovn-ipsec-cert-mgr-e2e.conclusion == 'failure')
3218+
with:
3219+
name: kube-ovn-ipsec-cert-mgr-e2e-events
3220+
path: kube-ovn-ipsec-cert-mgr-e2e-events.tar.gz
3221+
3222+
- name: Collect apiserver audit logs
3223+
if: failure() && (steps.kube-ovn-ipsec-cert-mgr-e2e.conclusion == 'failure')
3224+
run: |
3225+
docker cp kube-ovn-control-plane:/var/log/kubernetes/kube-apiserver-audit.log .
3226+
tar zcf kube-ovn-ipsec-cert-mgr-e2e-audit-log.tar.gz kube-apiserver-audit.log
3227+
3228+
- name: Upload apiserver audit logs
3229+
uses: actions/upload-artifact@v4
3230+
if: failure() && (steps.kube-ovn-ipse-cert-mgrc-e2e.conclusion == 'failure')
3231+
with:
3232+
name: kube-ovn-ipsec-cert-mgr-e2e-audit-log
3233+
path: kube-ovn-ipsec-cert-mgr-e2e-audit-log.tar.gz
3234+
3235+
- name: kubectl ko log
3236+
if: failure() && (steps.kube-ovn-ipsec-cert-mgr-e2e.conclusion == 'failure')
3237+
run: |
3238+
make kubectl-ko-log
3239+
mv kubectl-ko-log.tar.gz kube-ovn-ipsec-cert-mgr-e2e-ko-log.tar.gz
3240+
3241+
- name: upload kubectl ko log
3242+
uses: actions/upload-artifact@v4
3243+
if: failure() && (steps.kube-ovn-ipsec-cert-mgr-e2e.conclusion == 'failure')
3244+
with:
3245+
name: kube-ovn-ipsec-cert-mgr-e2e-ko-log
3246+
path: kube-ovn-ipsec-cert-mgr-e2e-ko-log.tar.gz
3247+
3248+
- name: Check kube ovn pod restarts
3249+
if: ${{ success() || (failure() && (steps.install.conclusion == 'failure' || steps.kube-ovn-ipsec-cert-mgr-e2e.conclusion == 'failure')) }}
3250+
run: make check-kube-ovn-pod-restarts
3251+
31163252
kube-ovn-connectivity-test:
31173253
name: Kube-OVN Connectivity E2E
31183254
needs:
@@ -3379,6 +3515,7 @@ jobs:
33793515
- kube-ovn-conformance-e2e
33803516
- kube-ovn-ic-conformance-e2e
33813517
- kube-ovn-ipsec-e2e
3518+
- kube-ovn-ipsec-cert-mgr-e2e
33823519
- kube-ovn-underlay-metallb-e2e
33833520
- multus-conformance-e2e
33843521
- vpc-egress-gateway-e2e

‎e2e.mk‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -248,8 +248,8 @@ kube-ovn-ipsec-e2e:
248248
ginkgo $(GINKGO_OUTPUT_OPT) $(GINKGO_PARALLEL_OPT) --randomize-all -v \
249249
--focus=CNI:Kube-OVN ./test/e2e/ipsec/ipsec.test -- $(TEST_BIN_ARGS)
250250

251-
.PHONY: kube-ovn-ipsec-e2e-cert-mgr
252-
kube-ovn-ipsec-e2e-cert-mgr:
251+
.PHONY: kube-ovn-ipsec-cert-mgr-e2e
252+
kube-ovn-ipsec-cert-mgr-e2e:
253253
ginkgo build $(E2E_BUILD_FLAGS) ./test/e2e/ipsec-cert-mgr
254254
E2E_BRANCH=$(E2E_BRANCH) \
255255
E2E_IP_FAMILY=$(E2E_IP_FAMILY) \

‎go.mod‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ require (
88
github.com/bhendo/go-powershell v0.0.0-20190719160123-219e7fb4e41e
99
github.com/brianvoe/gofakeit/v7 v7.2.1
1010
github.com/cenkalti/backoff/v5 v5.0.2
11+
github.com/cert-manager/cert-manager v1.17.1
1112
github.com/cnf/structhash v0.0.0-20201127153200-e1b16c1ebc08
1213
github.com/containerd/containerd/v2 v2.1.3
1314
github.com/containernetworking/cni v1.3.0
@@ -75,8 +76,6 @@ require (
7576
sigs.k8s.io/network-policy-api v0.1.5
7677
)
7778

78-
require sigs.k8s.io/gateway-api v1.1.0 // indirect
79-
8079
require (
8180
cel.dev/expr v0.24.0 // indirect
8281
cloud.google.com/go/compute/metadata v0.7.0 // indirect
@@ -95,7 +94,6 @@ require (
9594
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
9695
github.com/cenkalti/hub v1.0.2 // indirect
9796
github.com/cenkalti/rpc2 v1.0.4 // indirect
98-
github.com/cert-manager/cert-manager v1.17.1
9997
github.com/cespare/xxhash/v2 v2.3.0 // indirect
10098
github.com/chai2010/gettext-go v1.0.3 // indirect
10199
github.com/container-storage-interface/spec v1.11.0 // indirect
@@ -296,6 +294,7 @@ require (
296294
kubevirt.io/containerized-data-importer-api v1.62.0 // indirect
297295
kubevirt.io/controller-lifecycle-operator-sdk/api v0.2.4 // indirect
298296
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.32.1 // indirect
297+
sigs.k8s.io/gateway-api v1.1.0 // indirect
299298
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
300299
sigs.k8s.io/kustomize/api v0.19.0 // indirect
301300
sigs.k8s.io/kustomize/kyaml v0.19.0 // indirect

‎kind.mk‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -654,16 +654,20 @@ kind-install-ovn-ipsec:
654654
.PHONY: kind-install-cert-manager
655655
kind-install-cert-manager:
656656
$(call kind_load_image,kube-ovn,$(CERT_MANAGER_CONTROLLER),1)
657+
$(call kind_load_image,kube-ovn,$(CERT_MANAGER_CAINJECTOR),1)
658+
$(call kind_load_image,kube-ovn,$(CERT_MANAGER_WEBHOOK),1)
659+
657660
kubectl apply -f "$(CERT_MANAGER_YAML)"
661+
658662
kubectl rollout status deployment/cert-manager -n cert-manager --timeout 120s
663+
kubectl rollout status deployment/cert-manager-cainjector -n cert-manager --timeout 120s
664+
kubectl rollout status deployment/cert-manager-webhook -n cert-manager --timeout 120s
659665

660666
.PHONY: kind-install-ovn-ipsec-cert-manager
661667
kind-install-ovn-ipsec-cert-manager:
662668
@$(MAKE) ENABLE_OVN_IPSEC=true CERT_MANAGER_IPSEC_CERT=true kind-install
663669
@$(MAKE) kind-install-cert-manager
664-
665-
kubectl rollout status deployment/cert-manager-webhook -n cert-manager --timeout 120s
666-
670+
667671
$(eval CA_KEY = $(shell mktemp))
668672
$(shell openssl genrsa -out $(CA_KEY) 2048)
669673
$(eval CA_CERT = $(shell openssl req -x509 -new -nodes \

‎pkg/controller/config.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ type Configuration struct {
9797
EnableMetrics bool
9898
EnableANP bool
9999
EnableOVNIPSec bool
100-
CertManagerIPSECCert bool
100+
CertManagerIPSecCert bool
101101
EnableLiveMigrationOptimize bool
102102

103103
ExternalGatewaySwitch string
@@ -189,7 +189,7 @@ func ParseFlags() (*Configuration, error) {
189189
argEnableMetrics = pflag.Bool("enable-metrics", true, "Whether to support metrics query")
190190
argEnableANP = pflag.Bool("enable-anp", false, "Enable support for admin network policy and baseline admin network policy")
191191
argEnableOVNIPSec = pflag.Bool("enable-ovn-ipsec", false, "Whether to enable ovn ipsec")
192-
argCertManagerIPSECCert = pflag.Bool("cert-manager-ipsec-cert", false, "Whether to use cert-manager for signing IPSec certificates")
192+
argCertManagerIPSecCert = pflag.Bool("cert-manager-ipsec-cert", false, "Whether to use cert-manager for signing IPSec certificates")
193193
argEnableLiveMigrationOptimize = pflag.Bool("enable-live-migration-optimize", true, "Whether to enable kubevirt live migration optimize")
194194

195195
argExternalGatewayConfigNS = pflag.String("external-gateway-config-ns", "kube-system", "The namespace of configmap external-gateway-config, default: kube-system")
@@ -292,7 +292,7 @@ func ParseFlags() (*Configuration, error) {
292292
EnableOVNLBPreferLocal: *argEnableOVNLBPreferLocal,
293293
EnableMetrics: *argEnableMetrics,
294294
EnableOVNIPSec: *argEnableOVNIPSec,
295-
CertManagerIPSECCert: *argCertManagerIPSECCert,
295+
CertManagerIPSecCert: *argCertManagerIPSecCert,
296296
EnableLiveMigrationOptimize: *argEnableLiveMigrationOptimize,
297297
BfdMinTx: *argBfdMinTx,
298298
BfdMinRx: *argBfdMinRx,

‎pkg/controller/controller.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -982,7 +982,7 @@ func (c *Controller) Run(ctx context.Context) {
982982
util.LogFatalAndExit(err, "failed to sync crd vlans")
983983
}
984984

985-
if c.config.EnableOVNIPSec && !c.config.CertManagerIPSECCert {
985+
if c.config.EnableOVNIPSec && !c.config.CertManagerIPSecCert {
986986
if err := c.InitDefaultOVNIPsecCA(); err != nil {
987987
util.LogFatalAndExit(err, "failed to init ovn ipsec CA")
988988
}

‎pkg/daemon/config.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ type Configuration struct {
6969
ExternalGatewaySwitch string // provider network underlay vlan subnet
7070
EnableMetrics bool
7171
EnableOVNIPSec bool
72-
CertManagerIPSECCert bool
72+
CertManagerIPSecCert bool
7373
CertManagerIssuerName string
7474
IPSecCertDuration int
7575
EnableArpDetectIPConflict bool
@@ -130,7 +130,7 @@ func ParseFlags() *Configuration {
130130
argEnableTProxy = pflag.Bool("enable-tproxy", false, "enable tproxy for vpc pod liveness or readiness probe")
131131
argOVSVsctlConcurrency = pflag.Int32("ovs-vsctl-concurrency", 100, "concurrency limit of ovs-vsctl")
132132
argEnableOVNIPSec = pflag.Bool("enable-ovn-ipsec", false, "Whether to enable ovn ipsec")
133-
argCertManagerIPSECCert = pflag.Bool("cert-manager-ipsec-cert", false, "Whether to use cert-manager for signing IPSec certificates")
133+
argCertManagerIPSecCert = pflag.Bool("cert-manager-ipsec-cert", false, "Whether to use cert-manager for signing IPSec certificates")
134134
argCertManagerIssuerName = pflag.String("cert-manager-issuer-name", "kube-ovn", "The cert-manager issuer name to request certificates from")
135135
argOVNIPSecCertDuration = pflag.Int("ovn-ipsec-cert-duration", 2*365*24*60*60, "The duration requested for IPSec certificates (seconds)")
136136
argSetVxlanTxOff = pflag.Bool("set-vxlan-tx-off", false, "Whether to set vxlan_sys_4789 tx off")
@@ -204,7 +204,7 @@ func ParseFlags() *Configuration {
204204
TLSMinVersion: *argTLSMinVersion,
205205
TLSMaxVersion: *argTLSMaxVersion,
206206
TLSCipherSuites: *argTLSCipherSuites,
207-
CertManagerIPSECCert: *argCertManagerIPSECCert,
207+
CertManagerIPSecCert: *argCertManagerIPSecCert,
208208
CertManagerIssuerName: *argCertManagerIssuerName,
209209
IPSecCertDuration: *argOVNIPSecCertDuration,
210210
}
@@ -434,7 +434,7 @@ func (config *Configuration) initKubeClient() error {
434434
}
435435
config.KubeClient = kubeClient
436436

437-
if config.CertManagerIPSECCert {
437+
if config.CertManagerIPSecCert {
438438
cfg.ContentType = "application/json"
439439
cmClient, err := certmanagerclientset.NewForConfig(cfg)
440440
if err != nil {

‎pkg/daemon/ipsec.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -660,7 +660,7 @@ func (c *Controller) CreateIPSecKeys(p pkiFiles) error {
660660
defer cancel()
661661

662662
var cert []byte
663-
if c.config.CertManagerIPSECCert {
663+
if c.config.CertManagerIPSecCert {
664664
cert, err = c.getCertManagerSignedCert(ctx, csr64)
665665
if err != nil {
666666
err := fmt.Errorf("create cr error: %w", err)

0 commit comments

Comments
 (0)