ms2k
20ea9557fd
Run package test jobs across every selected provider combination with isolated lane state, released-image canaries, controlled OIDC DNS, and deterministic cleanup.
117 lines
4.6 KiB
YAML
117 lines
4.6 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: @@JOB_NAME@@
|
|
namespace: remora-testbed
|
|
spec:
|
|
activeDeadlineSeconds: 300
|
|
backoffLimit: 0
|
|
ttlSecondsAfterFinished: 300
|
|
template:
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
enableServiceLinks: false
|
|
restartPolicy: Never
|
|
dnsPolicy: None
|
|
dnsConfig:
|
|
nameservers: [10.96.0.53]
|
|
searches: [remora-testbed.svc.cluster.local, svc.cluster.local, cluster.local]
|
|
options:
|
|
- {name: ndots, value: "5"}
|
|
initContainers:
|
|
- name: durable-canary
|
|
image: @@POSTGRES_IMAGE@@
|
|
imagePullPolicy: Never
|
|
command: [/bin/sh, -ec]
|
|
args: [psql "$DATABASE_URL" --set ON_ERROR_STOP=1 --command "SELECT 1"]
|
|
envFrom:
|
|
- configMapRef: {name: @@PROFILE_NAME@@}
|
|
resources:
|
|
requests: {cpu: 25m, memory: 32Mi}
|
|
limits: {cpu: "1", memory: 128Mi}
|
|
- name: coordination-canary
|
|
image: @@REDIS_IMAGE@@
|
|
imagePullPolicy: Never
|
|
command: [/bin/sh, -ec]
|
|
args:
|
|
- |
|
|
key="${REMORA_COORDINATION_NAMESPACE}sample-canary"
|
|
redis-cli -u "$REMORA_COORDINATION_URL" SET "$key" passed >/dev/null
|
|
test "$(redis-cli -u "$REMORA_COORDINATION_URL" GET "$key")" = passed
|
|
envFrom:
|
|
- configMapRef: {name: @@PROFILE_NAME@@}
|
|
resources:
|
|
requests: {cpu: 25m, memory: 32Mi}
|
|
limits: {cpu: "1", memory: 128Mi}
|
|
- name: oidc-canary
|
|
image: @@CURL_IMAGE@@
|
|
imagePullPolicy: Never
|
|
command: [/bin/sh, -ec]
|
|
args:
|
|
- |
|
|
discovery="$(curl --fail --silent --show-error "$REMORA_OIDC_ISSUER/.well-known/openid-configuration")"
|
|
printf '%s' "$discovery" | grep -F '"issuer"' >/dev/null
|
|
printf '%s' "$discovery" | grep -F "$REMORA_OIDC_ISSUER" >/dev/null
|
|
case "$REMORA_OIDC_PROVIDER" in
|
|
keycloak) keys="$REMORA_OIDC_ISSUER/protocol/openid-connect/certs" ;;
|
|
zitadel) keys="$REMORA_OIDC_ISSUER/oauth/v2/keys" ;;
|
|
*) exit 1 ;;
|
|
esac
|
|
curl --fail --silent --show-error "$keys" | grep -F '"keys"' >/dev/null
|
|
envFrom:
|
|
- configMapRef: {name: @@PROFILE_NAME@@}
|
|
resources:
|
|
requests: {cpu: 25m, memory: 32Mi}
|
|
limits: {cpu: "1", memory: 128Mi}
|
|
- name: target-canary
|
|
image: @@AWS_CLI_IMAGE@@
|
|
imagePullPolicy: Never
|
|
command: [/bin/sh, -ec]
|
|
args:
|
|
- |
|
|
export AWS_ACCESS_KEY_ID="$REMORA_TARGET_ACCESS_KEY"
|
|
export AWS_SECRET_ACCESS_KEY="$REMORA_TARGET_SECRET_KEY"
|
|
export AWS_DEFAULT_REGION="$REMORA_TARGET_REGION"
|
|
key="${REMORA_TARGET_PREFIX}sample-canary"
|
|
printf 'passed\n' >/tmp/input
|
|
aws --endpoint-url "$REMORA_TARGET_ENDPOINT" s3api put-object --bucket "$REMORA_TARGET_BUCKET" --key "$key" --body /tmp/input >/dev/null
|
|
aws --endpoint-url "$REMORA_TARGET_ENDPOINT" s3api get-object --bucket "$REMORA_TARGET_BUCKET" --key "$key" /tmp/output >/dev/null
|
|
IFS= read -r output </tmp/output
|
|
test "$output" = passed
|
|
envFrom:
|
|
- configMapRef: {name: @@PROFILE_NAME@@}
|
|
resources:
|
|
requests: {cpu: 25m, memory: 64Mi}
|
|
limits: {cpu: "1", memory: 256Mi}
|
|
- name: secret-canary
|
|
image: @@VAULT_IMAGE@@
|
|
imagePullPolicy: Never
|
|
command: [/bin/sh, -ec]
|
|
args:
|
|
- |
|
|
export VAULT_ADDR="$REMORA_VAULT_ADDR"
|
|
export VAULT_TOKEN="$REMORA_VAULT_TOKEN"
|
|
vault kv put "$REMORA_VAULT_PATH" value=passed >/dev/null
|
|
test "$(vault kv get -field=value "$REMORA_VAULT_PATH")" = passed
|
|
envFrom:
|
|
- configMapRef: {name: @@PROFILE_NAME@@}
|
|
resources:
|
|
requests: {cpu: 25m, memory: 64Mi}
|
|
limits: {cpu: "1", memory: 256Mi}
|
|
containers:
|
|
- name: tests
|
|
image: @@TEST_IMAGE@@
|
|
imagePullPolicy: Never
|
|
envFrom:
|
|
- configMapRef: {name: @@PROFILE_NAME@@}
|
|
volumeMounts:
|
|
- {name: fixture-profile, mountPath: /run/remora-fixture, readOnly: true}
|
|
resources:
|
|
requests: {cpu: 100m, memory: 64Mi}
|
|
limits: {cpu: "2", memory: 512Mi}
|
|
volumes:
|
|
- name: fixture-profile
|
|
configMap:
|
|
name: @@PROFILE_NAME@@-file
|
|
items:
|
|
- {key: profile.env, path: profile.env}
|