test-rke2.yaml

# Copyright 2024 Defense Unicorns
# SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial

name: RKE2 Nightly Test

on:
  schedule:
    - cron: '0 6 * * *' # Runs at midnight Mountain every day
  pull_request:
    paths:
      - tasks/iac.yaml
      - .github/bundles/rke2/*
      - .github/test-infra/aws/rke2/*

permissions:
  id-token: write
  contents: read

jobs:
  test-rke2-install:
    strategy:
      matrix:
        flavor: [upstream, registry1, unicorn]
    runs-on: ubuntu-latest
    env:
      SHA: ${{ github.sha }}
      UDS_REGION: us-west-2
      UDS_PERMISSIONS_BOUNDARY_ARN: ${{ secrets.PERMISSIONS_BOUNDARY_ARN }}
      UDS_PERMISSIONS_BOUNDARY_NAME: ${{ secrets.PERMISSIONS_BOUNDARY_NAME }}
      UDS_STATE_BUCKET_NAME: uds-aws-ci-commercial-us-west-2-5246-tfstate
      UDS_STATE_DYNAMODB_TABLE_NAME: uds-aws-ci-commercial-org-us-west-2-5246-tfstate-lock
    steps:
      - name: Set ENV
        run: |
          echo "UDS_CLUSTER_NAME=uds-ci-${{ matrix.flavor }}-${SHA:0:7}" >> $GITHUB_ENV
          echo "UDS_STATE_KEY="tfstate/ci/install/${SHA:0:7}-rke2-core-${{ matrix.flavor }}-aws.tfstate >> $GITHUB_ENV
          echo "TF_VAR_region=${UDS_REGION}" >> $GITHUB_ENV
          echo "TF_VAR_run_id=$GITHUB_RUN_ID" >> $GITHUB_ENV
          echo "TF_VAR_use_permissions_boundary=true" >> $GITHUB_ENV
          echo "TF_VAR_permissions_boundary_name=${UDS_PERMISSIONS_BOUNDARY_NAME}" >> $GITHUB_ENV

      - name: Checkout repository
        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4

      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4
        with:
          role-to-assume: ${{ secrets.AWS_COMMERCIAL_ROLE_TO_ASSUME }}
          role-session-name: ${{ github.job || github.event.client_payload.pull_request.head.sha || github.sha }}
          aws-region: ${{ env.UDS_REGION }}
          role-duration-seconds: 21600

      - name: Environment setup
        uses: ./.github/actions/setup
        with:
          registry1Username: ${{ secrets.IRON_BANK_ROBOT_USERNAME }}
          registry1Password: ${{ secrets.IRON_BANK_ROBOT_PASSWORD }}
          ghToken: ${{ secrets.GITHUB_TOKEN }}
          chainguardIdentity: ${{ secrets.CHAINGUARD_IDENTITY }}

      # - name: Install eksctl
      #   run: uds run -f tasks/iac.yaml install-eksctl --no-progress

      - name: Setup Tofu
        uses: opentofu/setup-opentofu@12f4debbf681675350b6cd1f0ff8ecfbda62027b # v1.0.4
        with:
          tofu_version: 1.8.2
          tofu_wrapper: false

      - name: Create UDS Core Package
        run: ZARF_ARCHITECTURE=amd64 uds run -f tasks/create.yaml standard-package --no-progress --set FLAVOR=${{ matrix.flavor }}

      - name: Create Core Bundle
        run: uds create .github/bundles/rke2 --confirm

      - name: Create IAC
        run: uds run -f tasks/iac.yaml create-iac --no-progress --set K8S_DISTRO=rke2 --set CLOUD=aws
        timeout-minutes: 20

      - name: Get Kubeconfig
        run: uds run -f tasks/iac.yaml rke2-get-kubeconfig --no-progress
        timeout-minutes: 20

      - name: Wait for RKE2 Cluster
        run: uds run -f tasks/iac.yaml rke2-cluster-ready --no-progress
        timeout-minutes: 20

      - name: Deploy Core Bundle
        env:
          UDS_CONFIG: .github/bundles/rke2/uds-config.yaml
        run: uds deploy .github/bundles/rke2/uds-bundle-uds-core-rke2-nightly-*.tar.zst --confirm
        timeout-minutes: 60

      - name: Debug Output
        if: ${{ always() }}
        uses: ./.github/actions/debug-output

      - name: Remove UDS Core
        if: always()
        run: uds remove .github/bundles/rke2/uds-bundle-uds-core-rke2-*.tar.zst --confirm
        env:
          KUBECONFIG: ".github/test-infra/aws/rke2/rke2-config"
        timeout-minutes: 20
        continue-on-error: true

      - name: Remove IAC
        if: always()
        run: uds run -f tasks/iac.yaml destroy-iac --no-progress --set K8S_DISTRO=rke2 --set CLOUD=aws
        timeout-minutes: 10
        continue-on-error: true