ovn-kubernetes.yml

name: ovn-kubernetes

on:
  push:
  pull_request:
  workflow_dispatch:
  schedule:
  # Run Sunday at midnight
  - cron: '0 0 * * 0'

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true

env:
  OVNKUBE_COMMIT: "release-1.2"
  KIND_CLUSTER_NAME: ovn
  KIND_INSTALL_INGRESS: true
  KIND_ALLOW_SYSTEM_WRITES: true
  # This skips tests tagged as Serial
  # Current Serial tests are not relevant for OVN
  PARALLEL: true

jobs:
  build:
    name: Build
    if: github.repository_owner == 'ovn-org' || github.event_name != 'schedule'
    runs-on: ubuntu-24.04
    steps:
    - name: Enable Docker experimental features
      run: |
        echo $'{"experimental": true}' | sudo tee /etc/docker/daemon.json
        sudo service docker restart

    - name: Check out ovn
      uses: actions/checkout@v6
      with:
        submodules: recursive

    - name: Fix /etc/hosts file
      run: |
        . .ci/linux-util.sh
        fix_etc_hosts

    - name: Check out ovn-kubernetes
      uses: actions/checkout@v6
      with:
          path: src/github.com/ovn-kubernetes/ovn-kubernetes
          repository: ovn-kubernetes/ovn-kubernetes
          ref: ${{ env.OVNKUBE_COMMIT }}

    - name: Prepare
      run: |
        .ci/ovn-kubernetes/prepare.sh src/github.com/ovn-kubernetes/ovn-kubernetes $GITHUB_ENV

    - name: Build ovn-kubernetes container
      run: |
        make -C src/github.com/ovn-kubernetes/ovn-kubernetes/dist/images \
          IMAGE=ovn-daemonset-f:dev \
          OVN_REPO=https://github.com/${{ github.repository }}.git \
          OVN_GITREF=${{ github.ref_name }} fedora-image
        mkdir /tmp/_output
        docker save ovn-daemonset-f:dev > /tmp/_output/image.tar

    - uses: actions/upload-artifact@v7
      with:
        name: test-image
        path: /tmp/_output/image.tar

  e2e:
    name: e2e
    runs-on: ubuntu-24.04
    timeout-minutes: 220
    strategy:
      fail-fast: false
      matrix:
        # Valid options are:
        # target: ["shard-conformance", "control-plane", "external-gateway" ]
        #         shard-conformance: hybrid-overlay = multicast-enable = emptylb-enable = false
        #         control-plane: hybrid-overlay = multicast-enable = emptylb-enable = true
        # ha: ["HA", "noHA"]
        # gateway-mode: ["local", "shared"]
        # ipfamily: ["ipv4", "ipv6", "dualstack"]
        # disable-snat-multiple-gws: ["noSnatGW", "snatGW"]
        # second-bridge: ["2br", "1br"]
        # ic: ["ic-disabled", "ic-single-node-zones", "ic-multi-node-zones"]
        # forwarding : ["", "disable-forwarding"]
        # network-segmentation : ["", "enable-network-segmentation"]
        include:
          - {"target": "shard-conformance", "ha": "HA",   "gateway-mode": "local",  "ipfamily": "ipv6",      "disable-snat-multiple-gws": "snatGW",   "ic": "ic-disabled"}
          - {"target": "shard-conformance", "ha": "HA",   "gateway-mode": "local",  "ipfamily": "dualstack", "disable-snat-multiple-gws": "snatGW",   "ic": "ic-disabled"}
          - {"target": "shard-conformance", "ha": "HA",   "gateway-mode": "shared", "ipfamily": "ipv4",      "disable-snat-multiple-gws": "snatGW",   "ic": "ic-disabled"}
          - {"target": "shard-conformance", "ha": "HA",   "gateway-mode": "shared", "ipfamily": "ipv6",      "disable-snat-multiple-gws": "snatGW",   "ic": "ic-disabled"}
          - {"target": "control-plane",     "ha": "HA",   "gateway-mode": "shared", "ipfamily": "ipv4",      "disable-snat-multiple-gws": "noSnatGW", "ic": "ic-disabled"}
          - {"target": "control-plane",     "ha": "HA",   "gateway-mode": "shared", "ipfamily": "ipv4",      "disable-snat-multiple-gws": "snatGW",   "ic": "ic-disabled"}
          - {"target": "external-gateway",  "ha": "noHA", "gateway-mode": "shared", "ipfamily": "ipv4",      "disable-snat-multiple-gws": "noSnatGW", "second-bridge": "2br", "ic": "ic-single-node-zones"}
          - {"target": "external-gateway",  "ha": "noHA", "gateway-mode": "local",  "ipfamily": "ipv6",      "disable-snat-multiple-gws": "noSnatGW", "second-bridge": "1br", "ic": "ic-single-node-zones"}
          - {"target": "network-segmentation", "ha": "noHA", "gateway-mode": "shared", "ipfamily": "dualstack", "disable-snat-multiple-gws": "noSnatGW", "second-bridge": "1br", "ic": "ic-single-node-zones", "forwarding": "disable-forwarding"}
          - {"target": "network-segmentation", "ha": "noHA", "gateway-mode": "local", "ipfamily": "dualstack", "disable-snat-multiple-gws": "noSnatGW", "second-bridge": "1br", "ic": "ic-single-node-zones"}
          - {"target": "network-segmentation", "ha": "noHA", "gateway-mode": "shared", "ipfamily": "ipv4", "disable-snat-multiple-gws": "noSnatGW", "second-bridge": "1br", "ic": "ic-single-node-zones", "cni-mode": "unprivileged"}
          - {"target": "network-segmentation", "ha": "noHA", "gateway-mode": "shared", "ipfamily": "ipv6", "disable-snat-multiple-gws": "noSnatGW", "second-bridge": "1br", "ic": "ic-single-node-zones"}

    needs: [build]
    env:
      JOB_NAME: "${{ matrix.target }}-${{ matrix.ha }}-${{ matrix.gateway-mode }}-${{ matrix.ipfamily }}-${{ matrix.disable-snat-multiple-gws }}-${{ matrix.second-bridge }}"
      OVN_HYBRID_OVERLAY_ENABLE: "${{ matrix.target == 'control-plane' }}"
      KIND_INSTALL_METALLB: "${{ matrix.target == 'control-plane' || matrix.target == 'network-segmentation' }}"
      OVN_MULTICAST_ENABLE:  "${{ matrix.target == 'control-plane' || matrix.target == 'network-segmentation'}}"
      OVN_EMPTY_LB_EVENTS: "${{ matrix.target == 'control-plane' }}"
      # TODO: We have been testing only non-interconnect ovn-k8s jobs until
      # now.  We only enable interconnect mode for the external-gateway and
      # network-segmentation jobs.  However, both modes should be tested in
      # the future, similar to what upstream ovn-k8s does.
      OVN_ENABLE_INTERCONNECT: "${{ matrix.ic == 'ic-single-node-zones' ||  matrix.ic == 'ic-multi-node-zones'}}"
      ENABLE_NETWORK_SEGMENTATION: "${{ matrix.target == 'network-segmentation' || matrix.network-segmentation == 'enable-network-segmentation' }}"
      OVN_HA: "${{ matrix.ha == 'HA' }}"
      OVN_DISABLE_SNAT_MULTIPLE_GWS: "${{ matrix.disable-snat-multiple-gws == 'noSnatGW' }}"
      OVN_GATEWAY_MODE: "${{ matrix.gateway-mode }}"
      OVN_SECOND_BRIDGE: "${{ matrix.second-bridge == '2br' }}"
      ENABLE_MULTI_NET: "${{ matrix.target == 'network-segmentation' }}"
      OVN_DISABLE_FORWARDING: "${{ matrix.forwarding == 'disable-forwarding' }}"
      PLATFORM_IPV4_SUPPORT: "${{ matrix.ipfamily == 'IPv4' || matrix.ipfamily == 'dualstack' }}"
      PLATFORM_IPV6_SUPPORT: "${{ matrix.ipfamily == 'IPv6' || matrix.ipfamily == 'dualstack' }}"
      ENABLE_PRE_CONF_UDN_ADDR: "${{ matrix.ic == 'ic-single-node-zones' && (matrix.target == 'network-segmentation' || matrix.network-segmentation == 'enable-network-segmentation') }}"
      ENABLE_NETWORK_CONNECT: "${{ matrix.target == 'network-segmentation' }}"
      OVN_UNPRIVILEGED_MODE: "${{ matrix.cni-mode == 'unprivileged' }}"
      MULTI_POD_SUBNET: true
    steps:

    - name: Check out ovn
      uses: actions/checkout@v6

    - name: Fix /etc/hosts file
      run: |
        . .ci/linux-util.sh
        fix_etc_hosts

    - name: Install VRF kernel module
      run: |
        set -x
        sudo apt update
        sudo apt-get install linux-modules-extra-$(uname -r) -y
        sudo modprobe vrf

    - name: Free up disk space
      run: |
        . .ci/linux-util.sh
        free_up_disk_space_ubuntu

    - name: Check out ovn-kubernetes
      uses: actions/checkout@v6
      with:
          path: src/github.com/ovn-kubernetes/ovn-kubernetes
          repository: ovn-kubernetes/ovn-kubernetes
          ref: ${{ env.OVNKUBE_COMMIT }}

    - name: Prepare
      run: |
        .ci/ovn-kubernetes/prepare.sh src/github.com/ovn-kubernetes/ovn-kubernetes $GITHUB_ENV

    - name: Set up Go
      uses: actions/setup-go@v6
      with:
        go-version: ${{ env.GO_VERSION }}
        cache-dependency-path: "**/*.sum"
      id: go

    - name: Set up GOPATH
      run: |
        export GOPATH=$(go env GOPATH)
        echo "GOPATH=$GOPATH" >> $GITHUB_ENV
        echo "$GOPATH/bin" >> $GITHUB_PATH

    - name: Disable ufw
      # For IPv6 and Dualstack, ufw (Uncomplicated Firewall) should be disabled.
      # Not needed for KIND deployments, so just disable all the time.
      run: |
        sudo ufw disable

    - uses: actions/download-artifact@v8
      with:
        name: test-image

    - name: Load docker image
      run: |
        docker load --input image.tar && rm -rf image.tar

    - name: kind setup
      run: |
        export OVN_IMAGE="ovn-daemonset-f:dev"
        make -C test install-kind
      working-directory: src/github.com/ovn-kubernetes/ovn-kubernetes

    - name: Run Tests
      # e2e tests take ~60 minutes normally, 120 should be more than enough
      # set 3 hours for control-plane tests as these might take a while
      # give 10m extra to give ginkgo chance to timeout before github so that
      # we get its output.
      timeout-minutes: ${{ matrix.target == 'control-plane' && 190 || 130 }}
      run: |
        if [ "${{ matrix.target }}" == "external-gateway" ]; then
            make -C test control-plane WHAT="External Gateway"
        elif [ "${{ matrix.target }}" == "network-segmentation" ]; then
          make -C test control-plane WHAT="Network Segmentation"
        else
            make -C test ${{ matrix.target }}
        fi
      working-directory: src/github.com/ovn-kubernetes/ovn-kubernetes

    - name: Upload Junit Reports
      if: always()
      uses: actions/upload-artifact@v7
      with:
        name: kind-junit-${{ env.JOB_NAME }}-${{ github.run_id }}
        path: 'src/github.com/ovn-kubernetes/ovn-kubernetes/test/_artifacts/*.xml'

    - name: Export logs
      if: always()
      run: |
        mkdir -p /tmp/kind/logs
        kind export logs --name ${KIND_CLUSTER_NAME} --verbosity 4 /tmp/kind/logs
      working-directory: src/github.com/ovn-kubernetes/ovn-kubernetes

    - name: Upload logs
      if: always()
      uses: actions/upload-artifact@v7
      with:
        name: kind-logs-${{ env.JOB_NAME }}-${{ github.run_id }}
        path: /tmp/kind/logs