forked from DefectDojo/django-DefectDojo
-
Notifications
You must be signed in to change notification settings - Fork 0
270 lines (246 loc) · 9.28 KB
/
k8s-testing.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
name: k8s deployment
on:
pull_request:
push:
branches:
- master
- dev
- release/**
- hotfix/**
env:
DD_DOCKER_REPO: defectdojo
DD_HOSTNAME: defectdojo.default.minikube.local
GITHUB_CACHE_REPO: containers.pkg.github.com
HELM_RABBIT_BROKER_SETTINGS: " \
--set redis.enabled=false \
--set rabbitmq.enabled=true \
--set celery.broker=rabbitmq \
--set createRabbitMqSecret=true \
"
HELM_REDIS_BROKER_SETTINGS: " \
--set redis.enabled=false \
--set rabbitmq.enabled=true \
--set celery.broker=rabbitmq \
--set createRabbitMqSecret=true \
"
HELM_MYSQL_DATABASE_SETTINGS: " \
--set database=mysql \
--set postgresql.enabled=false \
--set mysql.enabled=true \
--set createMysqlSecret=true \
"
HELM_PG_DATABASE_SETTINGS: " \
--set database=postgresql \
--set postgresql.enabled=true \
--set mysql.enabled=false \
--set createPostgresqlSecret=true \
"
HELM_PGHA_DATABASE_SETTINGS: " \
--set database=postgresqlha \
--set postgresql.enabled=false \
--set mysql.enabled=false \
--set postgresqlha.enabled=true \
--set createPostgresqlHaSecret=true \
--set createPostgresqlHaPgpoolSecret=true \
"
jobs:
build:
name: Build Image
runs-on: ubuntu-latest
strategy:
matrix:
docker-image: [django, nginx]
steps:
# - name: Login to DockerHub
# uses: docker/login-action@v1
# with:
# username: ${{ secrets.DOCKERHUB_USERNAME }}
# password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Checkout
uses: actions/checkout@v3
with:
persist-credentials: false
- name: Read Docker Image Identifiers
id: read-docker-image-identifiers
run: echo "IMAGE_REPOSITORY=$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2
- name: Cache Docker layers
uses: actions/cache@v3
env:
docker-image: ${{ matrix.docker-image }}
with:
path: /tmp/.buildx-cache-${{ env.docker-image }}
key: ${{ runner.os }}-buildx-${{ env.docker-image }}-${{ github.workflow }}-${{ github.sha }}-${{ github.run_id }}
restore-keys: |
${{ runner.os }}-buildx-${{ env.docker-image }}-${{ github.workflow }}-${{ github.sha }}
${{ runner.os }}-buildx-${{ env.docker-image }}-${{ github.workflow }}
${{ runner.os }}-buildx-${{ env.docker-image }}
- name: Build
id: docker_build
uses: docker/build-push-action@v3
env:
docker-image: ${{ matrix.docker-image }}
with:
context: .
push: false
tags: |
${{ env.DD_DOCKER_REPO }}/defectdojo-${{ env.docker-image }}:latest
file: Dockerfile.${{ env.docker-image }}
outputs: type=docker,dest=${{ env.docker-image }}_img
cache-from: type=local,src=/tmp/.buildx-cache-${{ env.docker-image }}
cache-to: type=local,dest=/tmp/.buildx-cache-${{ env.docker-image }}
- name: Upload image ${{ env.docker-image }} as artifact
uses: actions/upload-artifact@v3
with:
name: ${{ matrix.docker-image }}
path: ${{ matrix.docker-image }}_img
retention-days: 1
setting_minikube_cluster:
name: Kubernetes Deployment
runs-on: ubuntu-latest
needs: build
strategy:
matrix:
include:
# databases, broker and k8s are independent, so we don't need to test each combination
# lastest k8s version (https://kubernetes.io/releases/) and oldest supported version from aws
# are tested (https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html#available-versions)
- databases: pgsql
brokers: redis
k8s: 'v1.22.0'
- databases: mysql
brokers: rabbit
k8s: 'v1.22.0'
- databases: pgsql
brokers: rabbit
k8s: 'v1.23.9'
- databases: mysql
brokers: redis
k8s: 'v1.23.9'
- databases: pgsqlha
brokers: rabbit
k8s: 'v1.23.9'
steps:
# - name: Login to DockerHub
# uses: docker/login-action@v1
# with:
# username: ${{ secrets.DOCKERHUB_USERNAME }}
# password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Checkout
uses: actions/checkout@v3
- name: Setup Minikube
uses: manusa/[email protected]
with:
minikube version: 'v1.24.0'
kubernetes version: ${{ matrix.k8s }}
driver: docker
start args: '--addons=ingress --cni calico'
github token: ${{ secrets.GITHUB_TOKEN }}
- name: Status of minikube
run: |-
minikube status
- name: Load images from artifacts
uses: actions/download-artifact@v3
- name: Load docker images
run: |-
eval $(minikube docker-env)
docker load -i nginx/nginx_img
docker load -i django/django_img
docker images
- name: Configure HELM repos
run: |-
helm repo add bitnami https://charts.bitnami.com/bitnami
helm dependency list ./helm/defectdojo
helm dependency update ./helm/defectdojo
- name: Set confings into Outputs
id: set
run: |-
echo "pgsql=${{ env.HELM_PG_DATABASE_SETTINGS }}" >> $GITHUB_ENV
echo "pgsqlha=${{ env.HELM_PGHA_DATABASE_SETTINGS }}" >> $GITHUB_ENV
echo "mysql=${{ env.HELM_MYSQL_DATABASE_SETTINGS }}" >> $GITHUB_ENV
echo "redis=${{ env.HELM_REDIS_BROKER_SETTINGS }}" >> $GITHUB_ENV
echo "rabbit=${{ env.HELM_RABBIT_BROKER_SETTINGS }}" >> $GITHUB_ENV
# - name: Create image pull Secrets
# run: |-
# kubectl create secret docker-registry defectdojoregistrykey --docker-username=${{ secrets.DOCKERHUB_USERNAME }} --docker-password=${{ secrets.DOCKERHUB_TOKEN }}
# kubectl get secrets
- name: Deploying Djano application with ${{ matrix.databases }} ${{ matrix.brokers }}
run: |-
helm install \
--timeout 800s \
defectdojo \
./helm/defectdojo \
--set django.ingress.enabled=true \
--set imagePullPolicy=Never \
${{ env[matrix.databases] }} \
${{ env[matrix.brokers] }} \
--set createSecret=true \
# --set imagePullSecrets=defectdojoregistrykey
- name: Check deployment status
run: |-
kubectl get pods
kubectl get ingress
kubectl get services
- name: Check Application
run: |-
to_complete () {
kubectl wait --for=$1 $2 --timeout=500s --selector=$3 2>/tmp/test || true
if [[ -s /tmp/test ]]; then
echo "ERROR: $2"
cat /tmp/test
echo "INFO: status:"
kubectl get pods
echo "INFO: logs:"
kubectl logs --selector=$3 --all-containers=true
exit 1
fi
return ${?}
}
echo "Waiting for init job..."
to_complete "condition=Complete" job "defectdojo.org/component=initializer"
echo "Waiting for celery pods..."
to_complete "condition=ready" pod "defectdojo.org/component=celery"
echo "Waiting for django pod..."
to_complete "condition=ready" pod "defectdojo.org/component=django"
echo "Pods up and ready to rumbole"
kubectl get pods
RETRY=0
while :
do
OUT=$(kubectl run curl --quiet=true --image=curlimages/curl:7.73.0 \
--overrides='{ "apiVersion": "v1" }' \
--restart=Never -i --rm -- -s -m 20 -I --header "Host: $DD_HOSTNAME" http://`kubectl get service defectdojo-django -o json \
| jq -r '.spec.clusterIP'`/login?next=/)
echo $OUT
CR=`echo $OUT | egrep "^HTTP" | cut -d' ' -f2`
echo $CR
if [[ $CR -ne 200 ]]; then
echo $RETRY
if [[ $RETRY -gt 2 ]]; then
kubectl get pods
echo `kubectl logs --tail=30 -l defectdojo.org/component=django -c uwsgi`
echo "ERROR: cannot display login screen; got HTTP code $CR"
exit 1
else
((RETRY++))
echo "Attempt $RETRY to get login page"
sleep 5
fi
else
echo "Result received"
break
fi
done
echo "Final Check of components"
errors=`kubectl get pods | grep Error | awk '{print $1}'`
if [[ ! -z $errors ]]; then
echo "Few pods with errors"
for line in $errors; do
echo "Dumping log from $line"
kubectl logs --tail 50 $line
done
exit 1
else
echo "DD K8S successfully deployed"
fi