-
Notifications
You must be signed in to change notification settings - Fork 8
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add composite action for starting a JIMM environment
- Use the composite action as part of a basic integration test
- Loading branch information
Showing
15 changed files
with
265 additions
and
342 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| # test-server | ||
| An action to create a JIMM server with real dependencies for integration test purposes. | ||
|
|
||
| This action requires Docker to be installed to start JIMM and its related services. | ||
|
|
||
| The action performs the following steps: | ||
| - Starts JIMM's docker compose test environment. | ||
| - Uses https://github.com/charmed-kubernetes/actions-operator action to start a Juju controller and connects it to JIMM. | ||
| - Ensures the local Juju CLI is setup to communicate with JIMM authenticating as a test user. | ||
|
|
||
| Use the action by adding the following to a Github workflow: | ||
|
|
||
| ```yaml | ||
| integration-test: | ||
| runs-on: ubuntu-latest | ||
| name: Integration testing with JIMM | ||
| steps: | ||
| - name: Setup JIMM environment | ||
| uses: canonical/[email protected] | ||
| with: | ||
| jimm-version: "v3.1.7" | ||
| juju-channel: "3/stable" | ||
| ghcr-pat: ${{ secrets.GHCR_PAT }} | ||
| ``` | ||
| Note that it's recommended to pin the action version to the same version as `jimm-version` to ensure the action works as expected for that specific version of JIMM. | ||
|
|
||
| The action accepts the following inputs: | ||
| - `jimm-version`: The version of JIMM you want to test against. | ||
| - `juju-channel`: The snap channel to use when installing and bootstrapping Juju. | ||
| - `ghcr-pat`: A PAT token with package:read access that has access to the `canonical/jimm` repo. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| name: JIMM Server Setup | ||
| description: "Create a JIMM environment" | ||
|
|
||
| inputs: | ||
| jimm-version: | ||
| description: 'JIMM version tag to use. This will decide the version of JIMM to start e.g. v3.1.7' | ||
| required: true | ||
| juju-version: | ||
| description: 'Juju snap channel to pass to charmed-kubernetes/actions-operator' | ||
| required: false | ||
| ghcr-pat: | ||
| description: 'PAT Token that has package:read access to canonical/JIMM' | ||
| required: true | ||
|
|
||
| output: | ||
| url: | ||
| description: 'URL where JIMM can be reached.' | ||
| value: "https://jimm.localhost" | ||
| client-id: | ||
| description: 'Test client ID to login to JIMM with a service account.' | ||
| value: "test-client-id" | ||
| client-secret: | ||
| description: 'Test client Secret to login to JIMM with a service account.' | ||
| value: "2M2blFbO4GX4zfggQpivQSxwWX1XGgNf" | ||
|
|
||
| runs: | ||
| using: "composite" | ||
| steps: | ||
| - name: Login to GitHub Container Registry | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ inputs.ghcr-pat }} | ||
| - name: Start server and dependencies | ||
| run: make integration-test-env | ||
| shell: bash | ||
| env: | ||
| JIMM_VERSION: ${{ inputs.jimm-version }} | ||
| - name: Initialise LXD | ||
| run: | | ||
| sudo lxd waitready && \ | ||
| sudo lxd init --auto && \ | ||
| sudo chmod a+wr /var/snap/lxd/common/lxd/unix.socket && \ | ||
| lxc network set lxdbr0 ipv6.address none && \ | ||
| sudo usermod -a -G lxd $USER | ||
| shell: bash | ||
| - name: Setup cloud-init script for bootstraping Juju controllers | ||
| run: ./local/jimm/setup-controller.sh | ||
| shell: bash | ||
| env: | ||
| SKIP_BOOTSTRAP: true | ||
| CLOUDINIT_FILE: "cloudinit.temp.yaml" | ||
| - name: Setup Juju Controller | ||
| uses: charmed-kubernetes/actions-operator@main | ||
| with: | ||
| provider: "lxd" | ||
| channel: "5.19/stable" | ||
| juju-channel: ${{ inputs.juju-channel }} | ||
| bootstrap-options: "--config cloudinit.temp.yaml --config login-token-refresh-url=https://jimm.localhost/.well-known/jwks.json" | ||
| - name: Save LXD controller name | ||
| id: lxd-controller | ||
| run: echo "name=$CONTROLLER_NAME" >> $GITHUB_OUTPUT | ||
| shell: bash | ||
| - name: Install jimmctl and yq | ||
| run: sudo snap install jimmctl --channel=3/stable && sudo snap install yq | ||
| shell: bash | ||
| - name: Authenticate Juju CLI | ||
| run: chmod -R 666 ~/.local/share/juju/*.yaml && ./local/jimm/setup-cli-auth.sh | ||
| shell: bash | ||
| # Below is a hardcoded JWT using the same test-secret used in JIMM's docker compose and allows the CLI to authenticate as the [email protected] user. | ||
| env: | ||
| JWT: ZXlKMGVYQWlPaUpLVjFRaUxDSmhiR2NpT2lKSVV6STFOaUo5LmV5SnBjM01pT2lKUGJteHBibVVnU2xkVUlFSjFhV3hrWlhJaUxDSnBZWFFpT2pFM01qUXlNamcyTmpBc0ltVjRjQ0k2TXprMk5EYzFNelEyTUN3aVlYVmtJam9pYW1sdGJTSXNJbk4xWWlJNkltcHBiVzB0ZEdWemRFQmpZVzV2Ym1sallXd3VZMjl0SW4wLkpTWVhXcGF6T0FnX1VFZ2hkbjlOZkVQdWxhWWlJQVdaX3BuSmRDbnJvWEk= | ||
| - name: Add LXD Juju controller to JIMM | ||
| run: ./local/jimm/add-controller.sh | ||
| shell: bash | ||
| env: | ||
| JIMM_CONTROLLER_NAME: "jimm" | ||
| CONTROLLER_NAME: ${{ steps.lxd-controller.outputs.name }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| name: Integration Test | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| jimm-version: | ||
| description: > | ||
| JIMM version tag to use. This will decide the version of JIMM to start e.g. v3.1.7. | ||
| View all available versions at https://github.com/canonical/jimm/pkgs/container/jimm. | ||
| required: true | ||
|
|
||
| jobs: | ||
| startjimm: | ||
| name: Start JIMM | ||
| runs-on: ubuntu-22.04 | ||
| steps: | ||
| - name: Checkout JIMM repo | ||
| uses: actions/checkout@v4 | ||
| - name: Start JIMM | ||
| uses: ./.github/actions/test-server | ||
| with: | ||
| jimm-version: ${{ inputs.jimm-version }} | ||
| juju-channel: "3/stable" | ||
| ghcr-pat: ${{ secrets.GITHUB_TOKEN }} | ||
| - name: Create a model, deploy an application and run juju status | ||
| run: | | ||
| juju add-model foo && \ | ||
| juju deploy haproxy && \ | ||
| sleep 5 && \ | ||
| juju status |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,7 +2,7 @@ services: | |
| traefik: | ||
| image: "traefik:2.9" | ||
| container_name: traefik | ||
| profiles: ["dev"] | ||
| profiles: ["dev", "test"] | ||
| ports: | ||
| - "80:80" | ||
| - "443:443" | ||
|
|
@@ -19,7 +19,46 @@ services: | |
| interval: 10s | ||
| timeout: 5s | ||
| retries: 3 | ||
|
|
||
| # An instance of JIMM used in integration tests, pulled from a tag. | ||
| jimm-test: | ||
| image: ghcr.io/canonical/jimm:${JIMM_VERSION} | ||
| profiles: ["test"] | ||
| container_name: jimm-test | ||
| ports: | ||
| - 17070:80 | ||
| entrypoint: | ||
| - bash | ||
| - -c | ||
| - >- | ||
| apt update && apt install curl -y | ||
| && set -a && . /test.env && . /vault/vault.env && set +a && /usr/local/bin/jimmsrv | ||
| volumes: | ||
| - ./local/vault/vault.env:/vault/vault.env:rw | ||
| - ./test.env:/test.env | ||
| healthcheck: | ||
| test: [ "CMD", "curl", "http://jimm.localhost:80" ] | ||
| interval: 5s | ||
| timeout: 5s | ||
| retries: 5 # Should fail after approximately (interval*retry) seconds | ||
| depends_on: | ||
| db: | ||
| condition: service_healthy | ||
| openfga: | ||
| condition: service_healthy | ||
| traefik: | ||
| condition: service_healthy | ||
| insert-hardcoded-auth-model: | ||
| condition: service_completed_successfully | ||
| keycloak: | ||
| condition: service_healthy | ||
| labels: | ||
| traefik.enable: true | ||
| traefik.http.routers.jimm.rule: Host(`jimm.localhost`) | ||
| traefik.http.routers.jimm.entrypoints: websecure | ||
| traefik.http.routers.jimm.tls: true | ||
|
|
||
| # An instance of JIMM used for dev, built from source. | ||
| jimm: | ||
| image: cosmtrek/air:latest | ||
| profiles: ["dev"] | ||
|
|
@@ -36,47 +75,8 @@ services: | |
| ports: | ||
| - 17070:80 | ||
| - 2345:2345 | ||
| environment: | ||
| JIMM_LOG_LEVEL: "debug" | ||
| JIMM_UUID: "3217dbc9-8ea9-4381-9e97-01eab0b3f6bb" | ||
| JIMM_DSN: "postgresql://jimm:jimm@db/jimm" | ||
| # Not needed for local test (yet). | ||
| # BAKERY_AGENT_FILE: "" | ||
| JIMM_ADMINS: "[email protected]" | ||
| # Note: You can comment out the Vault ENV vars below and instead use INSECURE_SECRET_STORAGE to place secrets in Postgres. | ||
| VAULT_ADDR: "http://vault:8200" | ||
| VAULT_PATH: "/jimm-kv/" | ||
| # Note: By default we should use Vault as that is the primary means of secret storage. | ||
| # INSECURE_SECRET_STORAGE: "enabled" | ||
| # JIMM_DASHBOARD_LOCATION: "" | ||
| JIMM_DNS_NAME: "jimm.localhost" | ||
| JIMM_LISTEN_ADDR: "0.0.0.0:80" | ||
| JIMM_TEST_PGXDSN: "postgresql://jimm:jimm@db/jimm" | ||
| JIMM_JWT_EXPIRY: 30s | ||
| JIMM_AUDIT_LOG_RETENTION_PERIOD_IN_DAYS: "1" | ||
| TEST_LOGGING_CONFIG: "" | ||
| BAKERY_PUBLIC_KEY: "izcYsQy3TePp6bLjqOo3IRPFvkQd2IKtyODGqC6SdFk=" | ||
| BAKERY_PRIVATE_KEY: "ly/dzsI9Nt/4JxUILQeAX79qZ4mygDiuYGqc2ZEiDEc=" | ||
| OPENFGA_SCHEME: "http" | ||
| OPENFGA_HOST: "openfga" | ||
| OPENFGA_PORT: 8080 | ||
| OPENFGA_STORE: "01GP1254CHWJC1MNGVB0WDG1T0" | ||
| OPENFGA_AUTH_MODEL: "01GP1EC038KHGB6JJ2XXXXCXKB" | ||
| OPENFGA_TOKEN: "jimm" | ||
| JIMM_IS_LEADER: true | ||
| JIMM_OAUTH_ISSUER_URL: "http://keycloak.localhost:8082/realms/jimm" # Scheme required | ||
| JIMM_OAUTH_CLIENT_ID: "jimm-device" | ||
| JIMM_OAUTH_CLIENT_SECRET: "SwjDofnbDzJDm9iyfUhEp67FfUFMY8L4" | ||
| JIMM_OAUTH_SCOPES: "openid profile email" # Space separated list of scopes | ||
| JIMM_DASHBOARD_FINAL_REDIRECT_URL: "https://jaas.ai" # Example URL | ||
| JIMM_ACCESS_TOKEN_EXPIRY_DURATION: 1h | ||
| JIMM_SECURE_SESSION_COOKIES: false | ||
| JIMM_SESSION_COOKIE_MAX_AGE: 86400 | ||
| JIMM_SESSION_SECRET_KEY: Xz2RkR9g87M75xfoumhEs5OmGziIX8D88Rk5YW8FSvkBPSgeK9t5AS9IvPDJ3NnB | ||
| volumes: | ||
| - ./:/jimm/ | ||
| - ./local/vault/approle.json:/vault/approle.json:rw | ||
| - ./local/vault/roleid.txt:/vault/roleid.txt:rw | ||
| - ./local/vault/vault.env:/vault/vault.env:rw | ||
| healthcheck: | ||
| test: [ "CMD", "curl", "http://jimm.localhost:80" ] | ||
|
|
@@ -193,7 +193,7 @@ services: | |
| # Adds the auth model and updates its authorisation model id to be the expected hard-coded id such that our local JIMM can utilise it for queries. | ||
| # The auth model json is retrieved from file via volume mount. | ||
| insert-hardcoded-auth-model: | ||
| profiles: ["dev"] | ||
| profiles: ["dev", "test"] | ||
| image: governmentpaas/psql | ||
| container_name: insert-hardcoded-auth-model | ||
| volumes: | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| #!/bin/bash | ||
|
|
||
| # This script is used to setup a Juju CLI to be authenticated with JIMM without going through login. | ||
| # This is particularly useful in headless environments like CI/CD. | ||
|
|
||
| set -eux | ||
|
|
||
| # Note that we are working around the fact that yq is a snap and doesn't have permission to hidden folders due to snap confinement. | ||
| cat ~/.local/share/juju/accounts.yaml | yq '.controllers += {"jimm":{"type": "oauth2-device", "user": "[email protected]", "access-token": strenv(JWT)}}' | cat > temp-accounts.yaml && mv temp-accounts.yaml ~/.local/share/juju/accounts.yaml | ||
| cat ~/.local/share/juju/controllers.yaml | yq '.controllers += {"jimm":{"uuid": "3217dbc9-8ea9-4381-9e97-01eab0b3f6bb", "api-endpoints": ["jimm.localhost:443"]}}' | cat > temp-controllers.yaml && mv temp-controllers.yaml ~/.local/share/juju/controllers.yaml |
Oops, something went wrong.