From 0bf161dffb8c7805c44a4fb2c3db191dfa901b88 Mon Sep 17 00:00:00 2001 From: Andrey Smirnov Date: Wed, 26 Jan 2022 23:26:34 +0300 Subject: [PATCH] test: add integration test for system extensions This verifies system extensions via the gVisor system extension. Signed-off-by: Andrey Smirnov --- .drone.jsonnet | 12 +++++++++--- hack/test/e2e-qemu.sh | 4 ++++ hack/test/e2e.sh | 6 ++++++ hack/test/gvisor/manifest.yaml | 15 +++++++++++++++ 4 files changed, 34 insertions(+), 3 deletions(-) create mode 100644 hack/test/gvisor/manifest.yaml diff --git a/.drone.jsonnet b/.drone.jsonnet index be2a778f7..f7f08d302 100644 --- a/.drone.jsonnet +++ b/.drone.jsonnet @@ -358,7 +358,13 @@ local integration_provision_tests_track_0 = Step("provision-tests-track-0", priv local integration_provision_tests_track_1 = Step("provision-tests-track-1", privileged=true, depends_on=[integration_provision_tests_prepare], environment={"IMAGE_REGISTRY": local_registry}); local integration_provision_tests_track_2 = Step("provision-tests-track-2", privileged=true, depends_on=[integration_provision_tests_prepare], environment={"IMAGE_REGISTRY": local_registry}); -local integration_cilium = Step("e2e-cilium-1.9.10", target="e2e-qemu", privileged=true, depends_on=[load_artifacts], environment={ +local integration_gvisor = Step("e2e-gvisor", target="e2e-qemu", privileged=true, depends_on=[load_artifacts], environment={ + "SHORT_INTEGRATION_TEST": "yes", + "WITH_CONFIG_PATCH": '[{"op":"add","path":"/machine/install/extensions","value":[{"image":"ghcr.io/talos-systems/gvisor:933cdb8"}]},{"op":"add","path":"/machine/sysctls","value":{"user.max_user_namespaces": "11255"}}]', + "WITH_TEST": "run_gvisor_test", + "IMAGE_REGISTRY": local_registry, +}); +local integration_cilium = Step("e2e-cilium-1.9.10", target="e2e-qemu", privileged=true, depends_on=[integration_gvisor], environment={ "SHORT_INTEGRATION_TEST": "yes", "CUSTOM_CNI_URL": "https://raw.githubusercontent.com/cilium/cilium/v1.9.10/install/kubernetes/quick-install.yaml", "WITH_CONFIG_PATCH": '[{"op": "replace", "path": "/cluster/network/podSubnets", "value": ["10.0.0.0/8"]}]', # use Pod CIDRs as hardcoded in Cilium's quick-install @@ -434,7 +440,7 @@ local integration_pipelines = [ Pipeline('integration-provision-0', default_pipeline_steps + [integration_provision_tests_prepare, integration_provision_tests_track_0]) + integration_trigger(['integration-provision', 'integration-provision-0']), Pipeline('integration-provision-1', default_pipeline_steps + [integration_provision_tests_prepare, integration_provision_tests_track_1]) + integration_trigger(['integration-provision', 'integration-provision-1']), Pipeline('integration-provision-2', default_pipeline_steps + [integration_provision_tests_prepare, integration_provision_tests_track_2]) + integration_trigger(['integration-provision', 'integration-provision-2']), - Pipeline('integration-misc', default_pipeline_steps + [integration_cilium, integration_uefi, integration_disk_image, integration_canal_reset, integration_no_cluster_discovery, integration_kubespan]) + integration_trigger(['integration-misc']), + Pipeline('integration-misc', default_pipeline_steps + [integration_gvisor, integration_cilium, integration_uefi, integration_disk_image, integration_canal_reset, integration_no_cluster_discovery, integration_kubespan]) + integration_trigger(['integration-misc']), Pipeline('integration-qemu-encrypted-vip', default_pipeline_steps + [integration_qemu_encrypted_vip]) + integration_trigger(['integration-qemu-encrypted-vip']), Pipeline('integration-qemu-race', default_pipeline_steps + [build_race, integration_qemu_race]) + integration_trigger(['integration-qemu-race']), Pipeline('integration-images', default_pipeline_steps + [integration_images, integration_sbcs]) + integration_trigger(['integration-images']), @@ -444,7 +450,7 @@ local integration_pipelines = [ Pipeline('cron-integration-provision-0', default_pipeline_steps + [integration_provision_tests_prepare, integration_provision_tests_track_0], [default_cron_pipeline]) + cron_trigger(['thrice-daily', 'nightly']), Pipeline('cron-integration-provision-1', default_pipeline_steps + [integration_provision_tests_prepare, integration_provision_tests_track_1], [default_cron_pipeline]) + cron_trigger(['thrice-daily', 'nightly']), Pipeline('cron-integration-provision-2', default_pipeline_steps + [integration_provision_tests_prepare, integration_provision_tests_track_2], [default_cron_pipeline]) + cron_trigger(['thrice-daily', 'nightly']), - Pipeline('cron-integration-misc', default_pipeline_steps + [integration_cilium, integration_uefi, integration_disk_image, integration_canal_reset, integration_no_cluster_discovery, integration_kubespan], [default_cron_pipeline]) + cron_trigger(['thrice-daily', 'nightly']), + Pipeline('cron-integration-misc', default_pipeline_steps + [integration_gvisor, integration_cilium, integration_uefi, integration_disk_image, integration_canal_reset, integration_no_cluster_discovery, integration_kubespan], [default_cron_pipeline]) + cron_trigger(['thrice-daily', 'nightly']), Pipeline('cron-integration-qemu-encrypted-vip', default_pipeline_steps + [integration_qemu_encrypted_vip], [default_cron_pipeline]) + cron_trigger(['thrice-daily', 'nightly']), Pipeline('cron-integration-qemu-race', default_pipeline_steps + [build_race, integration_qemu_race], [default_cron_pipeline]) + cron_trigger(['nightly']), Pipeline('cron-integration-images', default_pipeline_steps + [integration_images, integration_sbcs], [default_cron_pipeline]) + cron_trigger(['nightly']), diff --git a/hack/test/e2e-qemu.sh b/hack/test/e2e-qemu.sh index 38cb4e9cf..80db92fc8 100755 --- a/hack/test/e2e-qemu.sh +++ b/hack/test/e2e-qemu.sh @@ -125,6 +125,10 @@ case "${TEST_MODE:-default}" in get_kubeconfig run_talos_integration_test run_kubernetes_integration_test + + if [ "${WITH_TEST:-none}" != "none" ]; then + "${WITH_TEST}" + fi ;; esac diff --git a/hack/test/e2e.sh b/hack/test/e2e.sh index e40c838bd..ac04c94e2 100755 --- a/hack/test/e2e.sh +++ b/hack/test/e2e.sh @@ -211,3 +211,9 @@ function build_registry_mirrors { REGISTRY_MIRROR_FLAGS=${REGISTRY_MIRROR_FLAGS:-} fi } + +function run_gvisor_test { + ${KUBECTL} apply -f ${PWD}/hack/test/gvisor/manifest.yaml + sleep 10 + ${KUBECTL} wait --for=condition=ready pod nginx-gvisor --timeout=1m +} diff --git a/hack/test/gvisor/manifest.yaml b/hack/test/gvisor/manifest.yaml new file mode 100644 index 000000000..17e776abc --- /dev/null +++ b/hack/test/gvisor/manifest.yaml @@ -0,0 +1,15 @@ +apiVersion: node.k8s.io/v1 +kind: RuntimeClass +metadata: + name: gvisor +handler: runsc +--- +apiVersion: v1 +kind: Pod +metadata: + name: nginx-gvisor +spec: + runtimeClassName: gvisor + containers: + - name: nginx + image: nginx