Skip to content

Commit e36abbd

Browse files
Molter73Molter73
committed
ROX-30630: run BPF bootstrap test in CI
With this change, we will start running our integration tests on GCP hosted VMs, allowing us to have better visibility into what is the compatibility of our code with different kernel versions. This is achieved by running a small bootstrap unit test that load our code into the kernel, exercising the verifier on it.
1 parent fe72605 commit e36abbd

File tree

11 files changed

+289
-0
lines changed

11 files changed

+289
-0
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,10 @@ jobs:
150150
base-image: ${{ needs.vars.outputs.image-name }}
151151
archs: ${{ env.ARCHS }}
152152

153+
unit-tests:
154+
uses: ./.github/workflows/unit-tests.yml
155+
secrets: inherit
156+
153157
integration-tests:
154158
needs:
155159
- vars

‎.github/workflows/unit-tests.yml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
name: Run unit tests
2+
on:
3+
workflow_call:
4+
inputs:
5+
version:
6+
description: The version of fact to be tested (commit SHA or tag)
7+
default: ${{ github.head_ref || github.ref_name }}
8+
type: string
9+
job-tag:
10+
description: Additional tag to prevent collision on GCP VM naming
11+
type: string
12+
default: '-ut'
13+
14+
jobs:
15+
unit-tests:
16+
runs-on: ubuntu-24.04
17+
strategy:
18+
fail-fast: false
19+
matrix:
20+
vm:
21+
- rhel
22+
- rhel-arm64
23+
- rhcos
24+
25+
steps:
26+
- uses: actions/checkout@v4
27+
with:
28+
path: fact
29+
- uses: actions/checkout@v4
30+
with:
31+
repository: stackrox/collector
32+
path: collector
33+
ref: master
34+
- uses: actions/setup-python@v5
35+
with:
36+
python-version: "3.10"
37+
38+
- name: Authenticate with GCP
39+
uses: 'google-github-actions/auth@v2'
40+
with:
41+
credentials_json: '${{ secrets.GOOGLE_CREDENTIALS_COLLECTOR_CI_VM_SVC_ACCT }}'
42+
43+
- name: Setup GCP
44+
uses: 'google-github-actions/setup-gcloud@v2'
45+
46+
- uses: ./collector/.github/actions/setup-vm-creds
47+
with:
48+
gcp-ssh-key: ${{ secrets.GCP_SSH_KEY }}
49+
gcp-ssh-key-pub: ${{ secrets.GCP_SSH_KEY_PUB }}
50+
s390x-ssh-key: ${{ secrets.IBM_CLOUD_S390X_SSH_PRIVATE_KEY }}
51+
ppc64le-ssh-key: ${{ secrets.IBM_CLOUD_POWER_SSH_PRIVATE_KEY }}
52+
ppc64le-ssh-key-pub: ${{ secrets.IBM_CLOUD_POWER_SSH_PUBLIC_KEY }}
53+
s390x-key: ${{ secrets.IBM_CLOUD_S390x_API_KEY }}
54+
ppc64le-key: ${{ secrets.IBM_CLOUD_POWER_API_KEY }}
55+
redhat-username: ${{ secrets.REDHAT_USERNAME }}
56+
redhat-password: ${{ secrets.REDHAT_PASSWORD }}
57+
vm-type: ${{ matrix.vm }}
58+
job-tag: ${{ inputs.job-tag }}
59+
workspace: ${{ github.workspace }}/collector
60+
61+
- name: Create vars.yml
62+
run: |
63+
cat << EOF > vars.yml
64+
---
65+
job_id: ${JOB_ID}
66+
fact:
67+
version: ${{ inputs.version }}
68+
workdir: ${{ github.workspace }}
69+
excluded_vms:
70+
# RHEL 8 doesn't handle file creation properly,
71+
# need more investigation
72+
- rhel-8
73+
- rhcos-412-86-202402272018-0-gcp-x86-64
74+
# BPF trampolines are only implemented starting with RHEL 10
75+
- rhel-9-arm64
76+
EOF
77+
78+
- name: Create Test VMs
79+
env:
80+
ANSIBLE_CONFIG: "${{ github.workspace }}/collector/ansible/ansible.cfg"
81+
run: |
82+
ansible-playbook \
83+
-i "${GITHUB_WORKSPACE}/collector/ansible/ci" \
84+
-e @vars.yml \
85+
--tags setup,provision \
86+
"${GITHUB_WORKSPACE}/collector/ansible/integration-tests.yml"
87+
88+
- name: Run the tests
89+
run: |
90+
ansible-playbook \
91+
-i "${GITHUB_WORKSPACE}/collector/ansible/ci" \
92+
-e @vars.yml \
93+
"${GITHUB_WORKSPACE}/fact/ansible/run-unit-tests.yml"
94+
95+
- name: Teardown VMs
96+
if: always()
97+
run: |
98+
make -C "./collector/ansible" destroy-vms
99+
100+
- name: Store artifacts
101+
if: always()
102+
uses: actions/upload-artifact@v4
103+
with:
104+
name: ${{ matrix.vm }}-unit-test-logs
105+
path: |
106+
${{ github.workspace }}/unit-test-*.log
107+
if-no-files-found: ignore

‎ansible/group_vars/all.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
---
2+
runtime_command: docker

‎ansible/group_vars/container_engine_podman.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
---
2+
runtime_command: podman

‎ansible/group_vars/platform_rhcos.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
---
2+
ansible_user: core

‎ansible/group_vars/platform_rhcos_arm64.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
---
2+
ansible_user: core

‎ansible/roles/unit-tests/tasks/docker.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
- name: Start test-runner
3+
community.docker.docker_container:
4+
name: test-runner
5+
image: quay.io/centos/centos:stream9
6+
interactive: true
7+
cgroupns_mode: host
8+
pid_mode: host
9+
privileged: true
10+
register:
11+
test_result
12+
13+
- name: Install dependencies
14+
community.docker.docker_container_exec:
15+
container: test-runner
16+
command: >
17+
dnf install --enablerepo=crb -y
18+
clang-19.1.7
19+
libbpf-devel
20+
protobuf-compiler
21+
protobuf-devel
22+
git
23+
24+
- name: Download rustup
25+
community.docker.docker_container_exec:
26+
container: test-runner
27+
command: curl --tlsv1.2 -sSf https://sh.rustup.rs -o rustup.sh
28+
29+
- name: Make rustup executable
30+
community.docker.docker_container_exec:
31+
container: test-runner
32+
command: chmod +x rustup.sh
33+
34+
- name: Install rust toolchain
35+
community.docker.docker_container_exec:
36+
container: test-runner
37+
command: ./rustup.sh -y --default-toolchain 1.84 --profile minimal
38+
39+
- name: Clone fact repo
40+
community.docker.docker_container_exec:
41+
container: test-runner
42+
command: >
43+
git clone -b "{{ fact.version }}"
44+
--recurse-submodules
45+
https://github.com/stackrox/fact
46+
register: clone_res
47+
48+
- name: Run unit tests
49+
block:
50+
- name: Run unit tests
51+
community.docker.docker_container_exec:
52+
container: test-runner
53+
env:
54+
PATH: /root/.cargo/bin:${PATH}
55+
FACT_LOGLEVEL: debug
56+
chdir: /fact
57+
command: cargo test --all-features
58+
register: test_result
59+
60+
always:
61+
- name: Dump logs
62+
ansible.builtin.include_tasks:
63+
file: dump-result.yml

‎ansible/roles/unit-tests/tasks/dump-result.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
- name: stderr dump
3+
ansible.builtin.debug:
4+
var: test_result.stderr_lines
5+
when: test_result.rc != 0
6+
7+
- name: Test result
8+
ansible.builtin.debug:
9+
var: test_result.stdout_lines
10+
when: test_result.rc != 0
11+
12+
- name: Write stdout to log
13+
copy:
14+
content: "{{ test_result.stdout }}"
15+
dest: "unit-test-{{ vm_config }}-stdout.log"
16+
delegate_to: localhost
17+
18+
- name: Write stderr to log
19+
copy:
20+
content: "{{ test_result.stderr }}"
21+
dest: "unit-test-{{ vm_config }}-stderr.log"
22+
delegate_to: localhost
23+

‎ansible/roles/unit-tests/tasks/main.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
- name: Run unit tests with docker
3+
include_tasks: docker.yml
4+
when: runtime_command == 'docker'
5+
6+
- name: Run unit tests with podman
7+
include_tasks: podman.yml
8+
when: runtime_command == 'podman'

‎ansible/roles/unit-tests/tasks/podman.yml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
---
2+
- name: Start test-runner
3+
become: true
4+
containers.podman.podman_container:
5+
name: test-runner
6+
image: quay.io/centos/centos:stream9
7+
interactive: true
8+
cgroupns: host
9+
pid_mode: host
10+
privileged: true
11+
register:
12+
test_result
13+
14+
- name: Install dependencies
15+
become: true
16+
containers.podman.podman_container_exec:
17+
name: test-runner
18+
command: >
19+
dnf install --enablerepo=crb -y
20+
clang-19.1.7
21+
libbpf-devel
22+
protobuf-compiler
23+
protobuf-devel
24+
git
25+
26+
- name: Download rustup
27+
become: true
28+
containers.podman.podman_container_exec:
29+
name: test-runner
30+
command: curl --tlsv1.2 -sSf https://sh.rustup.rs -o rustup.sh
31+
32+
- name: Make rustup executable
33+
become: true
34+
containers.podman.podman_container_exec:
35+
name: test-runner
36+
command: chmod +x rustup.sh
37+
38+
- name: Install rust toolchain
39+
become: true
40+
containers.podman.podman_container_exec:
41+
name: test-runner
42+
command: ./rustup.sh -y --default-toolchain 1.84 --profile minimal
43+
44+
- name: Clone fact repo
45+
become: true
46+
containers.podman.podman_container_exec:
47+
name: test-runner
48+
command: >
49+
git clone -b "{{ fact.version }}"
50+
--recurse-submodules
51+
https://github.com/stackrox/fact
52+
register: clone_res
53+
54+
- name: Run unit tests
55+
become: true
56+
block:
57+
- name: Run unit tests
58+
containers.podman.podman_container_exec:
59+
name: test-runner
60+
env:
61+
PATH: /root/.cargo/bin:${PATH}
62+
FACT_LOGLEVEL: debug
63+
workdir: /fact
64+
command: cargo test --all-features
65+
register: test_result
66+
67+
always:
68+
- name: Dump logs
69+
ansible.builtin.include_tasks:
70+
file: dump-result.yml

0 commit comments

Comments
 (0)