ci.yml

name: CI

on:
  push:
    branches: [ main ]
    tags:
      - "*"
  pull_request:
    branches: [ main ]
  schedule:
  - cron:  '0 0 * * *'
  workflow_dispatch:

jobs:

  container:
    runs-on: ubuntu-latest
    steps:
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
    - name: Build container
      uses: docker/build-push-action@v5

  e2e:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
    - name: Build container
      uses: docker/build-push-action@v5
      with:
        context: .
        load: true
        tags: quay.io/observatorium/namespace-provisioner:test
    - name: Setup Kubernetes
      uses: helm/kind-action@v1.8.0
      with:
        cluster_name: e2e
    - name: Install namespace-provisioner
      run: |
        SERVER="$(kubectl config view -o jsonpath='{.clusters[?(@.name == "kind-e2e")].cluster.server}')"
        kind load docker-image --name e2e quay.io/observatorium/namespace-provisioner:test
        kubectl apply -f manifests/namespace-provisioner.yaml
        cat <<EOF | kubectl apply -f -
        apiVersion: v1
        kind: ConfigMap
        metadata:
          name: namespace-provisioner
          namespace: namespace-provisioner
        data:
          server: "$SERVER"
          ttl: 1h
        EOF
        kubectl apply -f manifests/example-grants/pods.yaml
        kubectl -n namespace-provisioner set image deployment namespace-provisioner namespace-provisioner=quay.io/observatorium/namespace-provisioner:test
        kubectl -n namespace-provisioner rollout status deployment namespace-provisioner --timeout 1m
    - name: Test namespace-provisioner
      run: |
        kubectl -n namespace-provisioner port-forward service/namespace-provisioner 8080 &
        until lsof -nP -iTCP:8080 -sTCP:LISTEN >/dev/null; do sleep 1; done
        curl localhost:8080/api/v1/namespace?ttl=1s -X POST -H "Authorization: bearer PASSWORD" > kubeconfig
        kubectl --kubeconfig kubeconfig get pods
        sleep 5
        [ $(kubectl get ns | grep np- | wc -l) -eq 0 ]
        ! curl localhost:8080/api/v1/namespace?server=foo -X POST -H "Authorization: bearer PASSWORD" --fail
        curl localhost:8080/api/v1/namespace?server=https://example.com -X POST -H "Authorization: bearer PASSWORD" | grep --fixed-strings "server: https://example.com"
    - name: Debug failure
      if: failure()
      run: |
        kubectl get -A all
        kubectl -n namespace-provisioner logs deploy/namespace-provisioner

  push:
    if: github.event_name != 'pull_request'
    needs:
    - container
    - e2e
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3
    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3
    - name: Login to GitHub Container Registry
      uses: docker/login-action@v3
      with:
        registry: quay.io
        username: ${{ secrets.QUAY_USERNAME }}
        password: ${{ secrets.QUAY_PASSWORD }}
    - name: Determine SHA
      id: sha
      run: echo "::set-output name=sha::$(git describe --always --tags --dirty)"
    - name: Build and push
      id: push
      uses: docker/build-push-action@v5
      with:
        push: true
        platforms: linux/arm64, linux/amd64
        tags: quay.io/observatorium/namespace-provisioner:latest, quay.io/observatorium/namespace-provisioner:${{ steps.sha.outputs.sha }}
    - name: Determine digest
      run: echo ${{ steps.push.outputs.digest }}