Skip to content

Commit b9e2a67

Browse files
teddytpc1teddytpc1
authored
Merge pull request #896 from wazuh/enhancement/878-workflow-test-k8s
New PR Checks
2 parents 6eb022c + 8549926 commit b9e2a67

File tree

2 files changed

+308
-30
lines changed

2 files changed

+308
-30
lines changed

‎.github/workflows/deployment-test.yml‎

Lines changed: 269 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,13 @@ permissions:
1414
id-token: write # This is required for requesting the JWT
1515
contents: read # This is required for actions/checkout
1616

17+
env:
18+
AWS_REGION: us-west-1
19+
CLUSTER_NAMME: test-eks-deploy${{ github.event.number }}
20+
1721
jobs:
1822
EKS_deployment_test:
19-
runs-on: ubuntu-20.04
23+
runs-on: ubuntu-24.04
2024
steps:
2125
- name: Checkout code
2226
uses: actions/checkout@v4
@@ -27,7 +31,7 @@ jobs:
2731
uses: aws-actions/configure-aws-credentials@v4
2832
with:
2933
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
30-
aws-region: "${{ secrets.AWS_REGION }}"
34+
aws-region: "${{ env.AWS_REGION }}"
3135

3236
- name: Install eksctl
3337
run: |
@@ -40,36 +44,36 @@ jobs:
4044
4145
- name: Deploy eks cluster
4246
run: |
43-
eksctl create cluster && \
44-
--name test-eks-deploy-${{ github.event.number }} && \
45-
--with-oidc && \
46-
--region us-east-1 && \
47-
--nodes-min 6 && \
48-
--nodes-max 6 && \
49-
--managed && \
50-
--spot && \
51-
-t t3a.medium && \
47+
eksctl create cluster \
48+
--name ${{ env.CLUSTER_NAMME }} \
49+
--with-oidc \
50+
--region ${{ env.AWS_REGION }} \
51+
--nodes-min 6 \
52+
--nodes-max 6 \
53+
--managed \
54+
--spot \
55+
-t t3a.medium \
5256
--tags "issue=https://github.com/wazuh/wazuh-kubernetes/pull/${{ github.event.number }},team=devops,termination_date=2030-01-01 21:00:00"
5357
5458
- name: Create sa for ebs-csi-controller
5559
run: |
56-
eksctl create iamserviceaccount && \
57-
--name ebs-csi-controller-sa && \
58-
--region us-east-1 && \
59-
--namespace kube-system && \
60-
--cluster test-eks-deploy-${{ github.event.number }} && \
61-
--role-name AmazonEKS_EBS_CSI_DriverRole_test-eks-deploy-${{ github.event.number }} && \
62-
--role-only && \
63-
--attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy && \
60+
eksctl create iamserviceaccount \
61+
--name ebs-csi-controller-sa \
62+
--region ${{ env.AWS_REGION }} \
63+
--namespace kube-system \
64+
--cluster ${{ env.CLUSTER_NAMME }} \
65+
--role-name eksctl-EBS-CSI-DriverRole-${{ env.CLUSTER_NAMME }} \
66+
--role-only \
67+
--attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy \
6468
--approve
6569
6670
- name: Install addon aws-ebs-csi-driver into a eks cluster deployed
6771
run: |
68-
eksctl create addon && \
69-
--name aws-ebs-csi-driver && \
70-
--cluster test-eks-deploy-${{ github.event.number }} && \
71-
--region ${{ secrets.AWS_REGION }} && \
72-
--service-account-role-arn arn:aws:iam::567970947422:role/AmazonEKS_EBS_CSI_DriverRole_test-eks-deploy-${{ github.event.number }} && \
72+
eksctl create addon \
73+
--name aws-ebs-csi-driver \
74+
--cluster ${{ env.CLUSTER_NAMME }} \
75+
--region ${{ env.AWS_REGION }} \
76+
--service-account-role-arn arn:aws:iam::567970947422:role/eksctl-EBS-CSI-DriverRole-${{ env.CLUSTER_NAMME }} \
7377
--force
7478
7579
- name: Create Wazuh indexer certificates
@@ -81,20 +85,150 @@ jobs:
8185
- name: Deploy Wazuh stack
8286
run: kubectl apply -k envs/eks/
8387

88+
- name: Wait 10 minutes for Wazuh stack startup
89+
run: sleep 10m
90+
91+
- name: View stack status
92+
run: kubectl get all -n wazuh -o wide
93+
94+
- name: View Wazuh dashboard logs
95+
run: kubectl logs $(kubectl get pods -n wazuh | grep wazuh-dashboard | awk '{print $1;}') -n wazuh
96+
97+
- name: View Wazuh indexer 0 logs
98+
run: kubectl logs wazuh-indexer-0 -n wazuh
99+
100+
- name: View Wazuh indexer 1 logs
101+
run: kubectl logs wazuh-indexer-1 -n wazuh
102+
103+
- name: View Wazuh indexer 2 logs
104+
run: kubectl logs wazuh-indexer-2 -n wazuh
105+
106+
- name: View Wazuh manager master logs
107+
run: kubectl logs wazuh-manager-master-0 -n wazuh
108+
109+
- name: View Wazuh manager worker 0 logs
110+
run: kubectl logs wazuh-manager-worker-0 -n wazuh
111+
112+
- name: View Wazuh manager worker 1 logs
113+
run: kubectl logs wazuh-manager-worker-1 -n wazuh
114+
115+
- name: Set Wazuh service URLs
116+
run: |
117+
echo "MANAGER_URL=https://$(kubectl get service wazuh -n wazuh -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'):$(kubectl get service wazuh -n wazuh -o jsonpath='{.spec.ports[?(@.port==55000)].port}')" >> $GITHUB_ENV
118+
echo "INDEXER_URL=https://$(kubectl get service indexer -n wazuh -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'):$(kubectl get service indexer -n wazuh -o jsonpath='{.spec.ports[?(@.port==9200)].port}')" >> $GITHUB_ENV
119+
echo "DASHBOARD_URL=https://$(kubectl get service dashboard -n wazuh -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'):$(kubectl get service dashboard -n wazuh -o jsonpath='{.spec.ports[?(@.port==443)].port}')" >> $GITHUB_ENV
120+
121+
- name: Check Wazuh indexer start
122+
run: |
123+
status_green="`curl -XGET "${{ env.INDEXER_URL }}/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`"
124+
if [[ $status_green -eq 1 ]]; then
125+
curl -XGET "${{ env.INDEXER_URL }}/_cluster/health" -u admin:SecretPassword -k -s
126+
else
127+
curl -XGET "${{ env.INDEXER_URL }}/_cluster/health" -u admin:SecretPassword -k -s
128+
exit 1
129+
fi
130+
status_index="`curl -XGET "${{ env.INDEXER_URL }}/_cat/indices" -u admin:SecretPassword -k -s | wc -l`"
131+
status_index_green="`curl -XGET "${{ env.INDEXER_URL }}/_cat/indices" -u admin:SecretPassword -k -s | grep "green" | wc -l`"
132+
if [[ $status_index_green -eq $status_index ]]; then
133+
curl -XGET "${{ env.INDEXER_URL }}/_cat/indices" -u admin:SecretPassword -k -s
134+
else
135+
curl -XGET "${{ env.INDEXER_URL }}/_cat/indices" -u admin:SecretPassword -k -s
136+
exit 1
137+
fi
138+
139+
- name: Check Wazuh indexer nodes
140+
run: |
141+
nodes="`curl -XGET "${{ env.INDEXER_URL }}/_cat/nodes" -u admin:SecretPassword -k -s | grep -E "indexer" | wc -l`"
142+
if [[ $nodes -eq 3 ]]; then
143+
echo "Wazuh indexer nodes: ${nodes}"
144+
else
145+
echo "Wazuh indexer nodes: ${nodes}"
146+
exit 1
147+
fi
148+
149+
- name: Check documents into wazuh-alerts index
150+
run: |
151+
docs="`curl -XGET "${{ env.INDEXER_URL }}/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`"
152+
if [[ $docs -gt 0 ]]; then
153+
echo "wazuh-alerts index documents: ${docs}"
154+
else
155+
echo "wazuh-alerts index documents: ${docs}"
156+
exit 1
157+
fi
158+
159+
- name: Check Wazuh templates
160+
run: |
161+
qty_templates="`curl -XGET "${{ env.INDEXER_URL }}/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`"
162+
templates="`curl -XGET "${{ env.INDEXER_URL }}/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`"
163+
if [[ $qty_templates -gt 3 ]]; then
164+
echo "wazuh templates:"
165+
echo "${templates}"
166+
else
167+
echo "wazuh templates:"
168+
echo "${templates}"
169+
exit 1
170+
fi
171+
172+
- name: Check Wazuh manager start
173+
run: |
174+
services="`curl -k -s -X GET "${{ env.MANAGER_URL }}/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`"
175+
if [[ $services -gt 9 ]]; then
176+
echo "Wazuh Manager Services: ${services}"
177+
echo "OK"
178+
else
179+
echo "Wazuh indexer nodes: ${nodes}"
180+
curl -k -X GET "${{ env.MANAGER_URL }}/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items
181+
exit 1
182+
fi
183+
env:
184+
TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "${{ env.MANAGER_URL }}/security/user/authenticate?raw=true")
185+
186+
- name: Check Wazuh dashboard service URL
187+
run: |
188+
status=$(curl -XGET --silent ${{ env.DASHBOARD_URL }}/app/status -k -u admin:SecretPassword -I -s | grep -E "^HTTP" | awk '{print $2}')
189+
if [[ $status -eq 200 ]]; then
190+
echo "Wazuh dashboard status: ${status}"
191+
else
192+
echo "Wazuh dashboard status: ${status}"
193+
exit 1
194+
fi
195+
196+
- name: Delete eks cluster
197+
if: always()
198+
run: |
199+
eksctl delete cluster \
200+
--name ${{ env.CLUSTER_NAMME }} \
201+
--region ${{ env.AWS_REGION }}
202+
203+
- name: Delete EBS dynamic volumes
204+
if: always()
205+
run: |
206+
for volume_id in $(aws ec2 describe-volumes \
207+
--region ${{ env.AWS_REGION }} \
208+
--filters Name=tag:KubernetesCluster,Values="${{ env.CLUSTER_NAMME }}" \
209+
--query "Volumes[].VolumeId" \
210+
--output text); do
211+
echo "Eliminando volumen con ID: $volume_id"
212+
aws ec2 delete-volume --region ${{ env.AWS_REGION }} --volume-id $volume_id
213+
done
214+
84215
Local_deployment_test:
85-
runs-on: ubuntu-20.04
216+
runs-on: ubuntu-24.04
86217
steps:
87218
- name: Checkout code
88219
uses: actions/checkout@v4
89220
with:
90221
ref: ${{ inputs.BRANCH_VERSION }}
91222

223+
- name: Free Disk Space (Ubuntu)
224+
uses: jlumbroso/free-disk-space@main
225+
92226
- name: free disk space
93227
run: |
94228
sudo swapoff -a
95229
sudo rm -f /swapfile
230+
sudo apt update -y && sudo apt upgrade -y
96231
sudo apt clean
97-
docker rmi $(docker image ls -aq)
98232
df -h
99233
100234
- name: Install Minikube cluster
@@ -111,5 +245,113 @@ jobs:
111245
- name: Create Wazuh dashboard certificates
112246
run: wazuh/certs/dashboard_http/generate_certs.sh
113247

248+
- name: Change provisioner for minikube
249+
run: |
250+
sed -i 's/provisioner: microk8s.io\/hostpath/# provisioner: microk8s.io\/hostpath/; s/# provisioner: k8s.io\/minikube-hostpath/provisioner: k8s.io\/minikube-hostpath/' envs/local-env/storage-class.yaml
251+
114252
- name: Deploy Wazuh stack
115-
run: minikube kubectl apply -k envs/local/
253+
run: kubectl apply -k envs/local-env/
254+
255+
- name: Wait 10 minutes for Wazuh stack startup
256+
run: sleep 10m
257+
258+
- name: Start minikube tunnel
259+
run: |
260+
minikube tunnel &> /dev/null &
261+
sleep 30
262+
263+
- name: View stack status
264+
run: kubectl get all -n wazuh -o wide
265+
266+
- name: View Wazuh dashboard logs
267+
run: kubectl logs $(kubectl get pods -n wazuh | grep wazuh-dashboard | awk '{print $1;}') -n wazuh
268+
269+
- name: View Wazuh indexer 0 logs
270+
run: kubectl logs wazuh-indexer-0 -n wazuh
271+
272+
- name: View Wazuh manager master logs
273+
run: kubectl logs wazuh-manager-master-0 -n wazuh
274+
275+
- name: View Wazuh manager worker 0 logs
276+
run: kubectl logs wazuh-manager-worker-0 -n wazuh
277+
278+
- name: Set Wazuh service URLs
279+
run: |
280+
echo "MANAGER_URL=https://$(kubectl get service wazuh -n wazuh -o jsonpath='{.status.loadBalancer.ingress[0].ip}'):$(kubectl get service wazuh -n wazuh -o jsonpath='{.spec.ports[?(@.port==55000)].port}')" >> $GITHUB_ENV
281+
echo "INDEXER_URL=https://$(kubectl get service indexer -n wazuh -o jsonpath='{.status.loadBalancer.ingress[0].ip}'):$(kubectl get service indexer -n wazuh -o jsonpath='{.spec.ports[?(@.port==9200)].port}')" >> $GITHUB_ENV
282+
echo "DASHBOARD_URL=https://$(kubectl get service dashboard -n wazuh -o jsonpath='{.status.loadBalancer.ingress[0].ip}'):$(kubectl get service dashboard -n wazuh -o jsonpath='{.spec.ports[?(@.port==443)].port}')" >> $GITHUB_ENV
283+
284+
- name: Check Wazuh indexer start
285+
run: |
286+
status_green="`curl -XGET "${{ env.INDEXER_URL }}/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`"
287+
if [[ $status_green -eq 1 ]]; then
288+
curl -XGET "${{ env.INDEXER_URL }}/_cluster/health" -u admin:SecretPassword -k -s
289+
else
290+
curl -XGET "${{ env.INDEXER_URL }}/_cluster/health" -u admin:SecretPassword -k -s
291+
exit 1
292+
fi
293+
status_index="`curl -XGET "${{ env.INDEXER_URL }}/_cat/indices" -u admin:SecretPassword -k -s | wc -l`"
294+
status_index_green="`curl -XGET "${{ env.INDEXER_URL }}/_cat/indices" -u admin:SecretPassword -k -s | grep "green" | wc -l`"
295+
if [[ $status_index_green -eq $status_index ]]; then
296+
curl -XGET "${{ env.INDEXER_URL }}/_cat/indices" -u admin:SecretPassword -k -s
297+
else
298+
curl -XGET "${{ env.INDEXER_URL }}/_cat/indices" -u admin:SecretPassword -k -s
299+
exit 1
300+
fi
301+
302+
- name: Check Wazuh indexer nodes
303+
run: |
304+
nodes="`curl -XGET "${{ env.INDEXER_URL }}/_cat/nodes" -u admin:SecretPassword -k -s | grep -E "indexer" | wc -l`"
305+
if [[ $nodes -eq 1 ]]; then
306+
echo "Wazuh indexer nodes: ${nodes}"
307+
else
308+
echo "Wazuh indexer nodes: ${nodes}"
309+
exit 1
310+
fi
311+
312+
- name: Check documents into wazuh-alerts index
313+
run: |
314+
docs="`curl -XGET "${{ env.INDEXER_URL }}/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`"
315+
if [[ $docs -gt 0 ]]; then
316+
echo "wazuh-alerts index documents: ${docs}"
317+
else
318+
echo "wazuh-alerts index documents: ${docs}"
319+
exit 1
320+
fi
321+
322+
- name: Check Wazuh templates
323+
run: |
324+
qty_templates="`curl -XGET "${{ env.INDEXER_URL }}/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`"
325+
templates="`curl -XGET "${{ env.INDEXER_URL }}/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`"
326+
if [[ $qty_templates -gt 3 ]]; then
327+
echo "wazuh templates:"
328+
echo "${templates}"
329+
else
330+
echo "wazuh templates:"
331+
echo "${templates}"
332+
exit 1
333+
fi
334+
335+
- name: Check Wazuh manager start
336+
run: |
337+
services="`curl -k -s -X GET "${{ env.MANAGER_URL }}/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`"
338+
if [[ $services -gt 9 ]]; then
339+
echo "Wazuh Manager Services: ${services}"
340+
echo "OK"
341+
else
342+
echo "Wazuh indexer nodes: ${nodes}"
343+
curl -k -X GET "${{ env.MANAGER_URL }}/manager/status?pretty=true" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items
344+
exit 1
345+
fi
346+
env:
347+
TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "${{ env.MANAGER_URL }}/security/user/authenticate?raw=true")
348+
349+
- name: Check Wazuh dashboard service URL
350+
run: |
351+
status=$(curl -XGET --silent ${{ env.DASHBOARD_URL }}/app/status -k -u admin:SecretPassword -I -s | grep -E "^HTTP" | awk '{print $2}')
352+
if [[ $status -eq 200 ]]; then
353+
echo "Wazuh dashboard status: ${status}"
354+
else
355+
echo "Wazuh dashboard status: ${status}"
356+
exit 1
357+
fi

0 commit comments

Comments
 (0)