k8s-tests.yml

name: k8s Deployment

on:
  workflow_call:

env:
  DD_HOSTNAME: defectdojo.default.minikube.local
jobs:
  setting_minikube_cluster:
    name: Kubernetes Deployment
    runs-on: ubuntu-latest

    strategy:
      matrix:
        include:
          # databases, broker and k8s are independent, so we don't need to test each combination
          # lastest k8s version (https://kubernetes.io/releases/) and the oldest officially supported version
          # are tested (https://kubernetes.io/releases/)
          - k8s: 'v1.34.2' # renovate: datasource=github-releases depName=kubernetes/kubernetes versioning=loose
            os: debian
          - k8s: '1.32.10' # renovate: datasource=custom.endoflife-oldest-maintained depName=kubernetes
            os: debian
    steps:
      - name: Checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

      - name: Setup Minikube
        uses: manusa/actions-setup-minikube@b589f2d61bf96695c546929c72b38563e856059d # v2.14.0
        with:
          minikube version: 'v1.37.0' # renovate: datasource=github-releases depName=kubernetes/minikube
          kubernetes version: ${{ matrix.k8s }}
          driver: docker
          start args: '--addons=ingress --cni calico'
          github token: ${{ secrets.GITHUB_TOKEN }}

      - name: Status of minikube
        run: |-
          minikube status

      - name: Load images from artifacts
        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
        with:
          path: built-docker-image
          pattern: built-docker-image-*
          merge-multiple: true

      - name: Load docker images
        timeout-minutes: 15
        run: |-
             eval $(minikube docker-env)
             docker load -i built-docker-image/nginx-alpine-linux-amd64_img
             docker load -i built-docker-image/django-${{ matrix.os }}-linux-amd64_img
             docker tag defectdojo/defectdojo-nginx:alpine defectdojo/defectdojo-nginx:latest
             docker tag defectdojo/defectdojo-django:${{ matrix.os }} defectdojo/defectdojo-django:latest
             docker images

      - name: Configure HELM repos
        run: |-
             helm dependency list ./helm/defectdojo
             helm dependency update ./helm/defectdojo

      - name: Deploying Django application with ${{ matrix.databases }} ${{ matrix.brokers }}
        timeout-minutes: 15
        run: |-
             helm install \
               --timeout 800s \
               --wait \
               --wait-for-jobs \
               defectdojo \
               ./helm/defectdojo \
               --set django.ingress.enabled=true \
               --set images.django.image.tag=latest \
               --set images.nginx.image.tag=latest \
               --set imagePullPolicy=Never \
               --set initializer.keepSeconds="-1" \
               --set redis.enabled=true \
               --set createRedisSecret=true \
               --set postgresql.enabled=true \
               --set createPostgresqlSecret=true \
               --set createSecret=true

      - name: Check deployment status
        if: always()
        run: |-
             kubectl get all,ingress  # all = pods, services, deployments, replicasets, statefulsets, jobs
             helm status defectdojo
             helm history defectdojo

      - name: Check Application
        timeout-minutes: 10
        run: |-
             to_complete () {
               kubectl wait --for=$1 $2 --timeout=500s --selector=$3 2>/tmp/test || true
               if [[ -s /tmp/test ]]; then
                 echo "ERROR: $2"
                 cat /tmp/test
                 echo "INFO: status:"
                 kubectl get pods
                 echo "INFO: logs:"
                 kubectl logs --selector=$3 --all-containers=true
                 exit 1
               fi
               return ${?}
             }
             echo "Waiting for init job..."
             to_complete "condition=Complete" job "defectdojo.org/component=initializer"
             echo "Waiting for celery pods..."
             to_complete "condition=ready" pod "defectdojo.org/component=celery"
             echo "Waiting for django pod..."
             to_complete "condition=ready" pod "defectdojo.org/component=django"
             echo "Pods up and ready to rumbole"
             kubectl get pods

      - name: Test login page
        timeout-minutes: 10
        run: |-
             RETRY=0
             while :
               do
               DJANGO_IP=$(kubectl get svc defectdojo-django -o jsonpath='{.spec.clusterIP}')
               OUT=$(kubectl run  curl --quiet=true --image=curlimages/curl:8.15.0 \
                  --restart=Never -i --rm -- \
                    --silent \
                    --max-time 20 \
                    --head \
                    --header "Host: $DD_HOSTNAME" \
                    "http://${DJANGO_IP}/login?next=/")
               echo $OUT
               CR=$(echo $OUT | egrep "^HTTP" | cut -d' ' -f2)
               echo $CR
               if [[ $CR -ne 200 ]]; then
                  echo $RETRY
                  if [[ $RETRY -gt 2 ]]; then
                    kubectl get pods
                    echo $(kubectl logs --tail=30 -l defectdojo.org/component=django -c uwsgi)
                    echo "ERROR: cannot display login screen; got HTTP code $CR"
                    exit 1
                  else
                    RETRY=$((RETRY+1))
                    echo "Attempt $RETRY to get login page"
                    sleep 5
                  fi
               else
                echo "Result received"
                break
               fi
             done

      - name: Test API auth call
        timeout-minutes: 10
        run: |-
             ADMIN_PASS=$(kubectl get secret/defectdojo -o jsonpath='{.data.DD_ADMIN_PASSWORD}' | base64 -d)
             echo "Simple API check"
             DJANGO_IP=$(kubectl get svc defectdojo-django -o jsonpath='{.spec.clusterIP}')
             RETRY=0
             while :
               do
                  OUT=$(kubectl run  curl --quiet=true --image=curlimages/curl:8.15.0 \
                    --restart=Never -i --rm -- \
                      --dump-header - \
                      --no-progress-meter \
                      --max-time 20 \
                      --header "Host: $DD_HOSTNAME" \
                      --data-raw "username=admin&password=$ADMIN_PASS" \
                      "http://${DJANGO_IP}/api/v2/api-token-auth/")
                  CR=$(echo $OUT | egrep "^HTTP" | cut -d' ' -f2)
                  echo "Return code $CR"
                  if [[ $CR -ne 200 ]]; then
                    echo "Retry: $RETRY"
                    if [[ $RETRY -gt 2 ]]; then
                      kubectl get pods
                      echo $(kubectl logs --tail=30 -l defectdojo.org/component=django -c uwsgi)
                      echo "ERROR: cannot perform API login; got HTTP code $CR; Full response:"
                      echo $OUT
                      exit 1
                    else
                      RETRY=$((RETRY+1))
                      echo "Attempt $RETRY to perform API login"
                      sleep 5
                    fi
                  else
                    echo "Result received"
                    break
                  fi
              done

      - name: Check of logs
        timeout-minutes: 10
        run: |-
             echo "Final Check of components"
             errors=$(kubectl get pods | grep Error | awk '{print $1}')
             if [[ ! -z $errors ]]; then
               echo "Few pods with errors"
               for line in $errors; do
                 echo "Dumping log from $line"
                 kubectl logs --tail 50 $line
               done
               exit 1
             else
               echo "DD K8S successfully deployed"
             fi

      - name: Failed Logs
        if: failure()
        run: |-
             echo "ERROR: Here are logs from deployment/defectdojo-django containers:"
             kubectl logs deployment/defectdojo-django --all-pods=true --all-containers=true --tail=100
             echo "And all pod status one more time"
             kubectl get pods