kube-integration-tests-non-root.yaml

name: Kube Integration Tests (Non-root)
run-name: Kube Integration Tests (Non-root) - ${{ github.run_id }} - @${{ github.actor }}

on:
  push:
    branches:
      - master
      - branch/*
  pull_request:
    paths:
      - '.github/workflows/kube-integration-tests-non-root.yaml'
      - '**.go'
      - 'go.mod'
      - 'go.sum'
      - 'build.assets/Makefile'
      - 'build.assets/Dockerfile*'
      - 'Makefile'
  merge_group:
    paths:
      - '.github/workflows/kube-integration-tests-non-root.yaml'
      - '**.go'
      - 'go.mod'
      - 'go.sum'
      - 'build.assets/Makefile'
      - 'build.assets/Dockerfile*'
      - 'Makefile'

env:
  TEST_KUBE: true
  KUBECONFIG: /home/.kube/config
  ALPINE_VERSION: 3.20.3

jobs:
  test:
    name: Kube Integration Tests (Non-root)
    if: ${{ !startsWith(github.head_ref, 'dependabot/') }}
    runs-on: ubuntu-22.04-16core

    permissions:
      contents: read
      packages: read

    container:
      image: ghcr.io/gravitational/teleport-buildbox:teleport14
      env:
        WEBASSETS_SKIP_BUILD: 1
      options: --cap-add=SYS_ADMIN --privileged

    steps:
      - name: Checkout Teleport
        uses: actions/checkout@v4

      - name: Prepare workspace
        uses: ./.github/actions/prepare-workspace

      - name: Chown
        run: |
          mkdir -p $(go env GOMODCACHE)
          mkdir -p $(go env GOCACHE)
          chown -Rf ci:ci ${GITHUB_WORKSPACE} $(go env GOMODCACHE) $(go env GOCACHE)
        continue-on-error: true

      - name: Create KinD cluster
        uses: helm/kind-action@dda0770415bac9fc20092cacbc54aa298604d140 # v1.8.0
        with:
          cluster_name: kind
          config: fixtures/kind/config.yaml

# The current container where tests run isn't linked to the KinD network and
# we won't be able to access the KinD control plane without linking them.
# This step is required because our tests run in teleport-buildbox container
# and by default the KinD container network isn't exposed to it.
# Connecting the network allow us to access the control plane using DNS kind-control-plane.
# It also copies the default kubeconfig and places it in /home/.kube so ci user
# is able to access it.
      - name: Link test container to KinD network
        run: |
          docker network connect kind $(cat /etc/hostname)
          kubectl config set-cluster kind-kind --server=https://kind-control-plane:6443
          kubectl cluster-info
          kubectl apply -f  fixtures/ci-teleport-rbac/ci-teleport.yaml
          cp -r $HOME/.kube /home/
          chown -R ci:ci /home/.kube

      - name: Build Alpine image with webserver
        run: |

          export SHORT_VERSION=${ALPINE_VERSION%.*}

          # download the alpine image
          # store the files in the fixtures/alpine directory
          # to avoid passing all the repository files to the docker build context.
          cd ./fixtures/alpine

          # download alpine minirootfs and signature
          curl -fSsLO https://dl-cdn.alpinelinux.org/alpine/v$SHORT_VERSION/releases/x86_64/alpine-minirootfs-$ALPINE_VERSION-x86_64.tar.gz
          curl -fSsLO https://dl-cdn.alpinelinux.org/alpine/v$SHORT_VERSION/releases/x86_64/alpine-minirootfs-$ALPINE_VERSION-x86_64.tar.gz.asc
          curl -fSsLO https://dl-cdn.alpinelinux.org/alpine/v$SHORT_VERSION/releases/x86_64/alpine-minirootfs-$ALPINE_VERSION-x86_64.tar.gz.sha256

          # verify the checksum
          sha256sum -c alpine-minirootfs-$ALPINE_VERSION-x86_64.tar.gz.sha256

          # verify the signature
          gpg --import  ./alpine-ncopa.at.alpinelinux.org.asc
          gpg --verify ./alpine-minirootfs-$ALPINE_VERSION-x86_64.tar.gz.asc ./alpine-minirootfs-$ALPINE_VERSION-x86_64.tar.gz

          # build the webserver
          CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o ./webserver ./webserver.go

          docker build -t alpine-webserver:v1 --build-arg=ALPINE_VERSION=$ALPINE_VERSION -f ./Dockerfile .

          # load the image into the kind cluster
          kind load docker-image alpine-webserver:v1

          cd - 

      - name: Run tests
        timeout-minutes: 40
        run: |
          runuser -u ci -g ci make integration-kube RDPCLIENT_SKIP_BUILD=1