Skip to content

unit tests use tas pipeline #284

unit tests use tas pipeline

unit tests use tas pipeline #284

# Copyright 2021 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: Insecure Registry KinD E2E
on:
pull_request:
branches: [ 'main', 'release-*' ]
permissions: read-all
jobs:
e2e-tests:
name: e2e tests
runs-on: ubuntu-latest
strategy:
fail-fast: false # Keep running if one leg fails.
matrix:
k8s-version:
- v1.25.x
- v1.26.x
- v1.27.x
env:
# https://github.com/google/go-containerregistry/pull/125 allows insecure registry for
# '*.local' hostnames.
REGISTRY_NAME: registry.local
REGISTRY_PORT: 5000
INSECURE_REGISTRY_NAME: insecure-registry.notlocal
INSECURE_REGISTRY_PORT: 5001
INSECURE_OCI_REGISTRY_NAME: insecure-oci-registry.notlocal
INSECURE_OCI_REGISTRY_PORT: 5002
KO_DOCKER_REPO: registry.local:5000/policy-controller
steps:
- uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
with:
go-version: '1.21'
check-latest: true
- uses: imjasonh/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa # v0.6
- uses: imranismail/setup-kustomize@2ba527d4d055ab63514ba50a99456fc35684947f # v2.1.0
- name: Install yq
uses: mikefarah/yq@c35ec752e38ea0c096d3c44e13cfc0797ac394d8 # v4.43.1
- name: Install Cosign
run: |
go install ./cmd/cosign
- name: Setup mirror
uses: chainguard-dev/actions/setup-mirror@main
with:
mirror: mirror.gcr.io
- name: Setup kind cluster
uses: chainguard-dev/actions/setup-kind@main
with:
k8s-version: ${{ matrix.k8s-version }}
cluster-suffix: c${{ github.run_id }}.local
- name: Setup local insecure registry
run: |
# Create a self-signed SSL cert
mkdir -p insecure-certs
openssl req \
-subj "/C=US/ST=WA/L=Flavorton/O=Tests-R-Us/OU=Dept. of Insecurity/CN=example.com/[email protected]" \
-newkey rsa:4096 -nodes -sha256 -keyout insecure-certs/domain.key \
-x509 -days 365 -out insecure-certs/domain.crt
# Run a registry.
docker run -d --restart=always \
--name $INSECURE_REGISTRY_NAME \
-v "$(pwd)"/insecure-certs:/insecure-certs \
-e REGISTRY_HTTP_ADDR=0.0.0.0:$INSECURE_REGISTRY_PORT \
-e REGISTRY_HTTP_TLS_CERTIFICATE=/insecure-certs/domain.crt \
-e REGISTRY_HTTP_TLS_KEY=/insecure-certs/domain.key \
-p $INSECURE_REGISTRY_PORT:$INSECURE_REGISTRY_PORT \
registry:2
# Connect the registry to the KinD network.
docker network connect "kind" $INSECURE_REGISTRY_NAME
# Make the $INSECURE_REGISTRY_NAME -> 127.0.0.1, to tell `ko` to publish to
# local registry, even when pushing $INSECURE_REGISTRY_NAME:$INSECURE_REGISTRY_NAME/some/image
sudo echo "127.0.0.1 $INSECURE_REGISTRY_NAME" | sudo tee -a /etc/hosts
- name: Run Insecure Registry Tests
run: |
go install github.com/google/go-containerregistry/cmd/crane
./test/e2e_test_insecure_registry.sh
- name: Setup local insecure OCI registry
run: |
# Create a self-signed SSL cert
mkdir -p insecure-certs
openssl req \
-subj "/C=US/ST=WA/L=Flavorton/O=Tests-R-Us/OU=Dept. of Insecurity/CN=example.com/[email protected]" \
-newkey rsa:4096 -nodes -sha256 -keyout insecure-certs/domain.key \
-x509 -days 365 -out insecure-certs/domain.crt
cat > config.json << EOF
{
"distSpecVersion": "1.1.0-dev",
"storage": {
"rootDirectory": "/tmp/zot"
},
"http": {
"address": "0.0.0.0",
"port": "5000",
"realm": "zot",
"tls": {
"cert": "/insecure-certs/domain.crt",
"key": "/insecure-certs/domain.key"
}
},
"log": {
"level": "debug"
}
}
EOF
# Run a registry.
docker run -d --restart=always \
--name $INSECURE_OCI_REGISTRY_NAME \
-v "$(pwd)"/insecure-certs:/insecure-certs \
-v "$(pwd)"/config.json:/etc/zot/config.json \
-p $INSECURE_OCI_REGISTRY_PORT:$REGISTRY_PORT \
ghcr.io/project-zot/zot-minimal-linux-amd64:$ZOT_VERSION
# Connect the registry to the KinD network.
docker network connect "kind" $INSECURE_OCI_REGISTRY_NAME
# Make the $INSECURE_REGISTRY_NAME -> 127.0.0.1, to tell `ko` to publish to
# local registry, even when pushing $INSECURE_REGISTRY_NAME:$INSECURE_REGISTRY_NAME/some/image
sudo echo "127.0.0.1 $INSECURE_OCI_REGISTRY_NAME" | sudo tee -a /etc/hosts
env:
ZOT_VERSION: v2.0.0-rc6
- name: Run Insecure OCI Registry Tests
run: |
go install github.com/google/go-containerregistry/cmd/crane
./test/e2e_test_insecure_oci_registry.sh
- name: Collect diagnostics
if: ${{ failure() }}
uses: chainguard-dev/actions/kind-diag@84c993eaf02da1c325854fb272a4df9184bd80fc # main