Skip to content
ci

ci|test: wait for pods to be 'Running' #275

Sign in to view logs

ci|test: wait for pods to be 'Running'

ci|test: wait for pods to be 'Running' #275

Workflow file for this run

.github/workflows/ci.yaml at 1b4aa6c
name: ci
on:
push:
pull_request:
env:
ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
PLATFORMS: linux/amd64
permissions:
packages: write
jobs:
check_unit:
strategy:
fail-fast: false
matrix:
combination:
#Debug
- { kernel: 'Linux 6.8', runner: 'ubuntu-24.04', clangs: 'clang-14 clang-15 clang-16 clang-17 clang-18', debug: '1' }
#NDEBUG
- { kernel: 'Linux 6.8', runner: 'ubuntu-24.04', clangs: 'clang-14 clang-15 clang-16 clang-17 clang-18', debug: '0' }
runs-on: ${{ matrix.combination.runner }}
steps:
- name: "Checkout sfunnel"
uses: actions/checkout@v4
with:
path: sfunnel
fetch-depth: 0
fetch-tags: 1
- name: "Install deps..."
run: |
sudo add-apt-repository universe
sudo apt-get update
sudo apt-get install -y ${{matrix.combination.clangs}} make iproute2 \
bridge-utils python3-scapy python3-pip libbpf-dev \
libelf-dev linux-headers-generic \
linux-libc-dev llvm iptables
sudo ln -s /usr/include/x86_64-linux-gnu/asm /usr/include/asm
if [[ "${{ matrix.combination.runner }}" == "ubuntu-24.04" ]]; then
sudo apt-get install python3-pytest
else
sudo pip3 install pytest #pytest binary missing in python3-pytest
fi
- name: "Allow test traffic in iptables/nftables"
run: |
sudo iptables -L -n
sudo iptables -t nat -L -n
sudo iptables -I FORWARD -s 11.1.1.1 -j ACCEPT
- name: "Run Linux NS tests on '${{matrix.combination.clangs}}'..."
run: |
cd sfunnel/test/ns
for clang in ${{matrix.combination.clangs}}; do
echo "[${clang}] Running tests ..."
make VERBOSE=1 CLANG=${clang} DEBUG=${{matrix.combination.debug}} || ( echo "FAILED: test failed with '${clang}' debug='${{matrix.combination.debug}}'" && exit 1 )
make clean 2>&1 > /dev/null
echo "[${clang}]"
done
check_cni_example:
strategy:
fail-fast: false
matrix:
combination:
- { runner: 'ubuntu-24.04', cni: 'cilium', nodes: '1' }
- { runner: 'ubuntu-24.04', cni: 'cilium', nodes: '2' }
- { runner: 'ubuntu-24.04', cni: 'calico', nodes: '2' }
- { runner: 'ubuntu-24.04', cni: 'flannel', nodes: '2' }
- { runner: 'ubuntu-24.04', cni: 'kindnet', nodes: '2' }
runs-on: ${{ matrix.combination.runner }}
steps:
- name: "Checkout sfunnel"
uses: actions/checkout@v4
with:
path: sfunnel
fetch-depth: 0
fetch-tags: 1
- name: "Install deps..."
run: |
sudo add-apt-repository universe
sudo apt-get update
sudo apt-get install -y clang make iproute2 \
bridge-utils python3-scapy python3-pip libbpf-dev \
libelf-dev linux-headers-generic \
linux-libc-dev llvm iptables
sudo ln -s /usr/include/x86_64-linux-gnu/asm /usr/include/asm
if [[ "${{ matrix.combination.runner }}" == "ubuntu-24.04" ]]; then
sudo apt-get install python3-pytest
else
sudo pip3 install pytest #pytest binary missing in python3-pytest
fi
- name: "Run CNI test nodes='${{ matrix.combination.nodes }}' cni='${{ matrix.combination.cni }}'..."
env:
CNI: ${{matrix.combination.cni}}
NODES: ${{matrix.combination.nodes}}
run: |
cd sfunnel/test/cni/
make NODES=${NODES} CNI=${CNI} VERBOSE=1 || ( echo "FAILED: test failed with cni='${CNI}' nodes='${NODES}'" && exit 1 )
echo "Pods (after positive test):"
minikube kubectl -- get pods -o wide
#Remove funneling
make VERBOSE=1 _unload
minikube kubectl -- apply -k ../../.github/workflows/negative/
#This MUST now fail
echo "Pods (before negative test):"
minikube kubectl -- get pods -o wide
( make VERBOSE=1 _check_affinity && ( echo "FAILED: negative test succeeded with cni='${CNI}' nodes='${NODES}' when it should have failed!" && exit 1 ) ) || true
docker_build_test_publish:
needs: [check_unit, check_cni_example]
runs-on: ubuntu-22.04
steps:
- name: "Checkout sfunnel"
uses: actions/checkout@v4
with:
path: sfunnel
fetch-depth: 0
fetch-tags: 1
- name: "Set up Docker buildx"
uses: docker/setup-buildx-action@v3
- name: "Login to GitHub Container Registry (ghcr.io)"
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{github.actor}}
password: ${{secrets.GITHUB_TOKEN}}
- name: "Build container"
run: |
#Cross-build
cd sfunnel
echo "Fix mess with tags in actions/checkout..."
git fetch -f && git fetch -f --tags
docker buildx build --platform ${PLATFORMS} -t sfunnel --build-arg VERSION="$(git describe)" --build-arg COMMIT="${GITHUB_SHA}" --load -f docker/Dockerfile .
- name: "[TEST] Run container without env. nor file. Should fail..."
run: |
set -o pipefail
set +e
docker run --privileged --network=host -v /var/run/netns:/var/run/netns -e DEBUG=1 -e IFACES=lo sfunnel:latest 2>&1 | tee output
if [ ${PIPESTATUS[0]} -eq 0 ]; then
echo "ERROR: container succeded when it should have FAILED!"
exit 1
fi
set -e
grep "\[ERROR\] Neither '" output || (echo "ERROR: unable to validate it raises the correct ruleset error" && exit 1)
- name: "[TEST] Run container with ruleset file..."
run: |
RULE="ip saddr 127.0.0.1 udp dport 80 actions unfunnel udp"
echo "$RULE" > ruleset
set -o pipefail
docker run --privileged -v `pwd`/ruleset:/etc/sfunnel/ruleset 2>&1 sfunnel:latest | tee output
if [ ${PIPESTATUS[0]} -ne 0 ]; then
echo "ERROR: container execution FAILED!"
exit 1
fi
grep "Recompiling sfunnel BPF program" output || (echo "ERROR: unable to validate it loads the rulset file" && exit 1)
grep "$RULE" output || (echo "ERROR: unable to validate it loads the ruleset file" && exit 1)
- name: "[TEST] Run container with invalid SFUNNEL_RULESET. Should fail..."
run: |
set -o pipefail
set +e
docker run --privileged --network=host -e SFUNNEL_RULESET="XXX" -e DEBUG=1 -e IFACES=lo sfunnel:latest 2>&1 | tee output
if [ ${PIPESTATUS[0]} -eq 0 ]; then
echo "ERROR: container succeded when it should have FAILED!"
exit 1
fi
set -e
- name: "[TEST] Run container with ruleset via SFUNNEL_RULESET (no override)..."
run: |
RULE="ip saddr 127.0.0.2 udp dport 80 actions unfunnel udp"
set -o pipefail
docker run -e SFUNNEL_RULESET="$RULE" --privileged sfunnel:latest 2>&1 | tee output
if [ ${PIPESTATUS[0]} -ne 0 ]; then
echo "ERROR: container execution FAILED!"
exit 1
fi
grep "SFUNNEL_RULESET='$RULE'" output || (echo "ERROR: unable to validate it loads ruleset via SFUNNEL_RULESET" && exit 1)
grep "Recompiling sfunnel BPF program" output || (echo "ERROR: unable to validate it loads ruleset via SFUNNEL_RULESET" && exit 1)
grep "$RULE" output || (echo "ERROR: unable to validate it loads custom ruleset via SFUNNEL_RULESET" && exit 1)
- name: "[TEST] Run container with ruleset via SFUNNEL_RULESET (override)..."
run: |
RULE="ip saddr 127.0.0.2 udp dport 80 actions unfunnel udp" #Should override ruleset file with 127.0.0.1
set -o pipefail
docker run -e SFUNNEL_RULESET="$RULE" --privileged -v `pwd`/ruleset:/etc/sfunnel/ruleset sfunnel:latest 2>&1 | tee output
if [ ${PIPESTATUS[0]} -ne 0 ]; then
echo "ERROR: container execution FAILED!"
exit 1
fi
grep "SFUNNEL_RULESET='$RULE'" output || (echo "ERROR: unable to validate it loads ruleset via SFUNNEL_RULESET" && exit 1)
grep "Recompiling sfunnel BPF program" output || (echo "ERROR: unable to validate it loads ruleset via SFUNNEL_RULESET" && exit 1)
grep "$RULE" output || (echo "ERROR: unable to validate it loads custom ruleset via SFUNNEL_RULESET" && exit 1)
- name: "[TEST] Run container with custom params ..."
run: |
set -o pipefail
docker run -e N_ATTEMPTS=7 -e RETRY_DELAY=3 -e IFACES="lo" -e DEBUG=1 -v `pwd`/ruleset:/etc/sfunnel/ruleset --privileged sfunnel:latest 2>&1 | tee output
if [ ${PIPESTATUS[0]} -ne 0 ]; then
echo "ERROR: container execution FAILED!"
exit 1
fi
grep "\$DEBUG='1'" output || (echo "ERROR: unable to validate it loads params (DEBUG)" && exit 1)
grep "\-DDEBUG=1" output || (echo "ERROR: unable to validate it loads params (DEBUG), CFLAGS" && exit 1)
grep "\$N_ATTEMPTS='7'" output || (echo "ERROR: unable to validate it loads params (N_ATTEMPTS)" && exit 1)
grep "\$RETRY_DELAY='3'" output || (echo "ERROR: unable to validate it loads params (RETRY_DELAY)" && exit 1)
grep "\$IFACES='lo'" output || (echo "ERROR: unable to validate it loads params (IFACES)" && exit 1)
#Must recompile due to DEBUG=1
grep "Recompiling sfunnel BPF program" output || (echo "ERROR: unable to validate it loads params (DEBUG)" && exit 1)
grep "\-DDEBUG=1" output || (echo "ERROR: unable to validate it loads params (DEBUG, CFLAGS)" && exit 1)
- name: "[TEST] Run container with DEBUG=1 ..."
run: |
RULE="ip saddr 127.0.0.1 udp dport 80 actions unfunnel udp"
echo "$RULE" > ruleset
set -o pipefail
docker run --privileged -e DEBUG=1 -v `pwd`/ruleset:/etc/sfunnel/ruleset sfunnel:latest 2>&1 | tee output
if [ ${PIPESTATUS[0]} -ne 0 ]; then
echo "ERROR: container execution FAILED!"
exit 1
fi
grep "\$DEBUG='1'" output || (echo "ERROR: unable to validate it loads custom file ruleset DEBUG=1" && exit 1)
grep "\-DDEBUG=1" output || (echo "ERROR: unable to validate it loads custom file ruleset DEBUG=1, CFLAGS" && exit 1)
grep "Recompiling sfunnel BPF program" output || (echo "ERROR: unable to validate it loads custom file ruleset DEBUG=1" && exit 1)
grep "$RULE" output || (echo "ERROR: unable to validate it loads custom file ruleset DEBUG=1" && exit 1)
- name: "[TEST] Run container with IFACES=invalid ..."
run: |
set -o pipefail
set +e
docker run --privileged -e DEBUG=1 -e IFACES=invalid -v `pwd`/ruleset:/etc/sfunnel/ruleset sfunnel:latest 2>&1 | tee output
if [ ${PIPESTATUS[0]} -eq 0 ]; then
echo "ERROR: container succeded when it should have FAILED!"
exit 1
fi
set -e
- name: "[TEST] Run container with DIRECTION=invalid ..."
run: |
set -o pipefail
set +e
docker run --privileged -e DEBUG=1 -e DIRECTION=invalid -v `pwd`/ruleset:/etc/sfunnel/ruleset sfunnel:latest 2>&1 | tee output
if [ ${PIPESTATUS[0]} -eq 0 ]; then
echo "ERROR: container succeded when it should have FAILED!"
exit 1
fi
set -e
grep "FATAL: Invalid traffic direction" output || (echo "ERROR: unable to validate container correctly fails when DIRECTION is invalid" && exit 1)
- name: "[TEST] Run container with DIRECTION=ingress ..."
run: |
set -o pipefail
docker run --privileged -e DEBUG=1 -e DIRECTION=ingress -v `pwd`/ruleset:/etc/sfunnel/ruleset sfunnel:latest 2>&1 | tee output
if [ ${PIPESTATUS[0]} -ne 0 ]; then
echo "ERROR: container execution FAILED!"
exit 1
fi
(grep "Attaching BPF program" output | grep "direction 'ingress'") || (echo "ERROR: unable to validate container attaches to DIRECTION=ingress" && exit 1)
- name: "[TEST] Run container with DIRECTION=egress ..."
run: |
set -o pipefail
docker run --privileged -e DEBUG=1 -e DIRECTION=egress -v `pwd`/ruleset:/etc/sfunnel/ruleset sfunnel:latest 2>&1 | tee output
if [ ${PIPESTATUS[0]} -ne 0 ]; then
echo "ERROR: container execution FAILED!"
exit 1
fi
(grep "Attaching BPF program" output | grep "direction 'egress'") || (echo "ERROR: unable to validate container attaches to DIRECTION=egress" && exit 1)
- name: "[TEST] Run container with DIRECTION=both ..."
run: |
set -o pipefail
docker run --privileged -e DEBUG=1 -e DIRECTION=both -v `pwd`/ruleset:/etc/sfunnel/ruleset sfunnel:latest 2>&1 | tee output
if [ ${PIPESTATUS[0]} -ne 0 ]; then
echo "ERROR: container execution FAILED!"
exit 1
fi
(grep "Attaching BPF program" output | grep "direction 'ingress'") || (echo "ERROR: unable to validate container attaches to DIRECTION=both" && exit 1)
(grep "Attaching BPF program" output | grep "direction 'egress'") || (echo "ERROR: unable to validate container attaches to DIRECTION=both" && exit 1)
- name: "[TEST] Run container with CLEAN=1 ..."
run: |
set -o pipefail
#Create a pair of veths
sudo ip link add type veth
sudo ip link set up dev veth0
sudo ip link set up dev veth1
#First attach to veth
docker run --privileged --network=host -e DEBUG=1 -e DIRECTION=both -e IFACES=veth0 -v `pwd`/ruleset:/etc/sfunnel/ruleset sfunnel:latest 2>&1 | tee output
if [ ${PIPESTATUS[0]} -ne 0 ]; then
echo "ERROR: container execution FAILED!"
exit 1
fi
(tc filter show dev veth0 ingress | grep sfunnel) || (echo "ERROR: unable to validate container attaches to ingress" && exit 1)
(tc filter show dev veth0 egress | grep sfunnel) || (echo "ERROR: unable to validate container attaches to egress" && exit 1)
#Run CLEAN=1
docker run --privileged --network=host -e DEBUG=1 -e CLEAN=1 -e DIRECTION=both -e IFACES=veth0 sfunnel:latest 2>&1 | tee output
[[ "$(tc filter show dev veth0 ingress)" == "" ]] || (echo "ERROR: unable to validate container removes BPF programs from ingress" && exit 1)
[[ "$(tc filter show dev veth0 egress)" == "" ]] || (echo "ERROR: unable to validate container removes BPF programs from egress" && exit 1)
- name: "[TEST] Run container with NETNS=test_ns ..."
run: |
set -o pipefail
#Create a pair of veths
sudo ip netns add test_ns
sudo ip netns exec test_ns ip link set up dev lo
#First run with an invalid netns, make sure it fails
set +e
docker run --privileged --network=host -v /var/run/netns:/var/run/netns -v `pwd`/ruleset:/etc/sfunnel/ruleset -e NETNS=test_ns_invalid -e DEBUG=1 -e IFACES=lo sfunnel:latest 2>&1 | tee output
if [ ${PIPESTATUS[0]} -eq 0 ]; then
echo "ERROR: container succeded when it should have FAILED!"
exit 1
fi
#Then run it with a valid netns but invalid IFACE, and make sure it propagates the error code
docker run --privileged --network=host -v /var/run/netns:/var/run/netns -e NETNS=test_ns -e DEBUG=1 -e IFACES=lo2 sfunnel:latest 2>&1 | tee output
if [ ${PIPESTATUS[0]} -eq 0 ]; then
echo "ERROR: container succeded when it should have FAILED!"
exit 1
fi
set -e
#Successful run
docker run --privileged --network=host -v /var/run/netns:/var/run/netns -v `pwd`/ruleset:/etc/sfunnel/ruleset -e NETNS=test_ns -e DEBUG=1 -e IFACES=lo sfunnel:latest 2>&1 | tee output
if [ ${PIPESTATUS[0]} -ne 0 ]; then
echo "ERROR: container execution FAILED!"
exit 1
fi
[[ "$(sudo ip netns exec test_ns tc filter show dev lo ingress | grep sfunnel)" != "" ]] || (echo "ERROR: unable to validate container attaches to ingress when NETNS is set" && exit 1)
(grep "\$DEBUG='1'" output) || (echo "ERROR: unable to validate env. variables are passed to the NETNS execution" && exit 1)
#Successful run with SFUNNEL_RULESET
RULE="ip saddr 127.0.0.2 udp dport 80 actions unfunnel udp"
docker run --privileged --network=host -v /var/run/netns:/var/run/netns -e NETNS=test_ns -e DEBUG=1 -e SFUNNEL_RULESET="$RULE" -e IFACES=lo sfunnel:latest 2>&1 | tee output
if [ ${PIPESTATUS[0]} -ne 0 ]; then
echo "ERROR: container execution FAILED!"
exit 1
fi
- name: "Push to ghcr"
run: |
cd sfunnel
export TAG=$(git describe HEAD | sed 's/-.*$//g' | tr -d "v")
export EXACT_TAG=$(git describe --exact-match --match "v*" || echo "")
echo "TAG=${TAG}, EXACT_TAG=${EXACT_TAG}"
if [[ "${EXACT_TAG}" != "" ]]; then
echo "Pushing to ghcr.io..."
docker buildx build --platform ${PLATFORMS} --build-arg VERSION="$(git describe)" --build-arg COMMIT="${GITHUB_SHA}" --push -f docker/Dockerfile . --tag ghcr.io/${GITHUB_REPOSITORY}:${TAG}
fi