integration.yml

name: Integration tests

on:
  pull_request:
    paths:
      - .github/workflows/integration.yml
      - .proxy-version
      - '**/*.go'
      - '**/Dockerfile*'
      - Cargo.lock
      - charts/**
      - go.sum
      - justfile
      - multicluser/**
      - policy-controller/**
      - policy-test/**
      - viz/**
      - '!.devcontainer/**'

permissions:
  contents: read

env:
  CARGO_INCREMENTAL: 0
  CARGO_NET_RETRY: 10
  DOCKER_REGISTRY: ghcr.io/linkerd
  GH_ANNOTATION: true
  K3D_VERSION: v5.4.4
  RUST_BACKTRACE: short
  RUSTUP_MAX_RETRIES: 10
  YQ_VERSION: v4.25.1

jobs:
  cleanup:
    runs-on: ubuntu-20.04
    permissions:
      actions: write
    steps:
      - uses: styfle/cancel-workflow-action@b173b6ec0100793626c2d9e6b90435061f4fc3e5
        with:
          all_but_latest: true
          access_token: ${{ github.token }}

  tag:
    needs: [cleanup]
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - run: echo "tag=$(CI_FORCE_CLEAN=1 bin/root-tag)" >> "$GITHUB_OUTPUT"
        id: tag
    outputs:
      tag: ${{ steps.tag.outputs.tag }}

  build-cli:
    needs: [tag]
    runs-on: ubuntu-20.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - uses: ./.github/actions/docker-build
        id: build
        with:
          docker-registry: ${{ env.DOCKER_REGISTRY }}
          docker-target: linux-amd64
          component: cli-bin
          tag: ${{ needs.tag.outputs.tag }}
      - name: Extract CLI binary
        run: |
          mkdir -p /home/runner/archives
          id=$(docker create '${{ steps.build.outputs.image }}')
          docker cp "$id:/out/linkerd-linux-amd64" /home/runner/archives/linkerd
          v=$(/home/runner/archives/linkerd version --short --client)
          [[ "$v" == '${{ needs.tag.outputs.tag }}' ]] || exit 1
      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce
        with:
          name: image-archives
          path: /home/runner/archives

  ##
  ## Core: Test the core control plane
  ##
  ## TODO(ver) CNI configurations should be tested separately.
  ##

  build-core:
    needs: [tag]
    runs-on: ubuntu-20.04
    strategy:
      matrix:
        component:
          - cni-plugin
          - controller
          - policy-controller
          - proxy
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - uses: ./.github/actions/docker-build
        id: build
        with:
          docker-registry: ${{ env.DOCKER_REGISTRY }}
          docker-target: linux-amd64
          component: ${{ matrix.component }}
          tag: ${{ needs.tag.outputs.tag }}
      - name: Run docker save
        run: |
          mkdir -p /home/runner/archives
          docker save '${{ steps.build.outputs.image }}' >'/home/runner/archives/${{ matrix.component }}.tar'
      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce
        with:
          name: image-archives
          path: /home/runner/archives

  test-core:
    needs: [tag, build-cli, build-core]
    strategy:
      matrix:
        test:
          - cni-calico-deep
          - deep
    continue-on-error: true
    runs-on: ubuntu-20.04
    timeout-minutes: 15
    steps:
      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
        with:
          go-version: '1.19'
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
        with:
          name: image-archives
          path: image-archives
      - run: cp image-archives/linkerd "$HOME" && chmod 755 "$HOME/linkerd"
      - run: find image-archives -ls
      - run: bin/tests --images archive --cleanup-docker --name ${{ matrix.test }} "$HOME/linkerd"
        env:
          LINKERD_DOCKER_REGISTRY: ${{ env.DOCKER_REGISTRY }}
          TAG: ${{ needs.tag.outputs.tag }}

  ##
  ## Policy: Only run policy tests when the policy controller or proxy changes
  ##

  changed-policy:
    needs: [cleanup]
    runs-on: ubuntu-20.04
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - uses: tj-actions/changed-files@c860b5c47fa71f461da850094ef2f6e3d6514e44
        id: changed
        with:
          files: |
            .github/workflows/integration.yml
            .proxy-version
            Cargo.lock
            charts/linkerd-control-plane/**
            charts/linkerd-crds/templates/policy/**
            justfile
            policy-controller/**
            policy-test/**
    outputs:
      modified: ${{ steps.changed.outputs.any_modified }}

  test-policy:
    needs: [tag, changed-policy, build-cli, build-core]
    if: needs.changed-policy.outputs.modified == 'true'
    runs-on: ubuntu-20.04
    timeout-minutes: 20
    strategy:
      matrix:
        k8s:
          - v1.21
          - v1.26
    steps:
      - uses: extractions/setup-just@69d82fb0233557aec017ef13706851d0694e0f1d
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - uses: olix0r/cargo-action-fmt/setup@9269f3aa1ff01775d95efc97037e2cbdb41d9684
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
        with:
          name: image-archives
          path: image-archives
      - run: find image-archives -ls
      - run: cp image-archives/linkerd "$HOME" && chmod 755 "$HOME/linkerd"
      - name: Setup deps
        shell: bash
        run: |
          rm -rf "$HOME/.cargo"
          bin/scurl -v https://sh.rustup.rs | sh -s -- -y --default-toolchain "$(cat rust-toolchain)"
          # shellcheck disable=SC1090
          source ~/.cargo/env
          echo "PATH=$PATH" >> "$GITHUB_ENV"
          bin/scurl -v "https://raw.githubusercontent.com/k3d-io/k3d/${K3D_VERSION}/install.sh" | bash
          bin/scurl -vo /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" && chmod +x /usr/local/bin/yq
      - run: just policy-test-build
      - run: just k3d-k8s='${{ matrix.k8s }}' k3d-create
      - run: docker load <image-archives/controller.tar
      - run: docker load <image-archives/policy-controller.tar
      - run: docker load <image-archives/proxy.tar
      - run: docker image ls
      - run: just linkerd-tag='${{ needs.tag.outputs.tag }}' linkerd-exec="$HOME/linkerd" linkerd-install
      - name: Load images
        run: |
          # Image loading is flakey in CI, so retry!
          for _ in {1..6} ; do
            if just linkerd-tag='${{ needs.tag.outputs.tag }}' policy-test-deps-load ; then exit 0 ; fi
            sleep 10
            echo retrying...
          done
          exit 1
      - run: just policy-test-run --jobs=1

  ##
  ## Ext: Run tests that require non-core components.
  ##

  build-ext:
    needs: [tag]
    runs-on: ubuntu-20.04
    strategy:
      matrix:
        component:
          - jaeger-webhook
          - metrics-api
          - tap
          - web
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - uses: ./.github/actions/docker-build
        id: build
        with:
          docker-registry: ${{ env.DOCKER_REGISTRY }}
          docker-target: linux-amd64
          component: ${{ matrix.component }}
          tag: ${{ needs.tag.outputs.tag }}
      - name: Run docker save
        run: |
          mkdir -p /home/runner/archives
          docker save '${{ steps.build.outputs.image }}' >'/home/runner/archives/${{ matrix.component }}.tar'
      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce
        with:
          name: image-archives
          path: /home/runner/archives

  # These tests exercise core functionality, but need the viz extension.
  test-ext:
    needs: [tag, build-cli, build-core, build-ext]
    strategy:
      matrix:
        integration_test:
          - cluster-domain
          - default-policy-deny
          - external
          - rsa-ca
          - helm-upgrade
          - uninstall
          - upgrade-edge
          - upgrade-stable
    continue-on-error: true
    runs-on: ubuntu-20.04
    timeout-minutes: 15
    steps:
      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
        with:
          go-version: '1.19'
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
        with:
          name: image-archives
          path: image-archives
      - run: cp image-archives/linkerd "$HOME" && chmod 755 "$HOME/linkerd"
      - run: ls -l image-archives/linkerd
      - run: bin/tests --images archive --cleanup-docker --name '${{ matrix.integration_test }}' "$HOME/linkerd"
        env:
          LINKERD_DOCKER_REGISTRY: ${{ env.DOCKER_REGISTRY }}

  ##
  ## Viz: Run the (flakey) `viz` suite only when the `viz` extension is updated.
  ##

  changed-viz:
    needs: [cleanup]
    runs-on: ubuntu-20.04
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - uses: tj-actions/changed-files@c860b5c47fa71f461da850094ef2f6e3d6514e44
        id: changed
        with:
          files: |
            .github/workflows/integration.yml
            .proxy-version
            justfile
            viz/**
            test/integration/viz/**
    outputs:
      modified: ${{ steps.changed.outputs.any_modified }}

  test-viz:
    needs: [tag, changed-viz, build-cli, build-core, build-ext]
    if: needs.changed-viz.outputs.modified == 'true'
    continue-on-error: true
    runs-on: ubuntu-20.04
    timeout-minutes: 15
    steps:
      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
        with:
          go-version: '1.19'
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
        with:
          name: image-archives
          path: image-archives
      - run: cp image-archives/linkerd "$HOME" && chmod 755 "$HOME/linkerd"
      - run: ls -l image-archives/linkerd
      - run: bin/tests --images archive --cleanup-docker --name viz "$HOME/linkerd"
        env:
          LINKERD_DOCKER_REGISTRY: ${{ env.DOCKER_REGISTRY }}

  ##
  ## Multicluster: Run 'multicluster' suite only when the 'multicluster' extension is updated.
  ##               Tests are run on min and max k8s versions
  ##

  changed-multicluster:
    needs: [cleanup]
    runs-on: ubuntu-20.04
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - uses: tj-actions/changed-files@c860b5c47fa71f461da850094ef2f6e3d6514e44
        id: changed
        with:
          files: |
            .github/workflows/integration.yml
            .proxy-version
            justfile
            multicluster/**
            test/integration/multicluster/**
    outputs:
      modified: ${{ steps.changed.outputs.any_modified }}

  test-multicluster:
    needs: [tag, changed-multicluster, build-cli, build-core, build-ext]
    if: needs.changed-multicluster.outputs.modified == 'true'
    runs-on: ubuntu-20.04
    timeout-minutes: 20
    strategy:
      matrix:
        k8s:
          - v1.21
          - v1.26
    steps:
      - uses: extractions/setup-just@69d82fb0233557aec017ef13706851d0694e0f1d
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
        with:
          go-version: '1.19'
      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
        with:
          name: image-archives
          path: image-archives
      - run: cp image-archives/linkerd "$HOME" && chmod 755 "$HOME/linkerd"
      - run: ls -l image-archives/linkerd
      - name: Setup deps
        shell: bash
        run: |
          echo "PATH=$PATH" >> "$GITHUB_ENV"
          bin/scurl -v "https://raw.githubusercontent.com/k3d-io/k3d/${K3D_VERSION}/install.sh" | bash
      - name: Load docker images
        run: |
          for img in controller policy-controller proxy; do
            docker load <"image-archives/${img}.tar"
          done
      - run: docker image ls
      - run: just mc-test-build
      - name: Run just mc-test-load
        run: |
          just linkerd-tag='${{ needs.tag.outputs.tag }}' \
              k3d-k8s='${{ matrix.k8s }}' \
              mc-test-load
      - name: Run just mc-test-run
        run: |
          just linkerd-tag='${{ needs.tag.outputs.tag }}' \
              k3d-k8s='${{ matrix.k8s }}' \
              mc-test-run