Add perf soc attack workflow

Signed-off-by: Dom Del Nano <ddelnano@gmail.com>

Author: ddelnano

.github/workflows/perf_soc_attack.yaml

@@ -0,0 +1,157 @@
+---
+name: perf-eval-soc-attack
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Branch or commit'
+        required: false
+        type: string
+      tags:
+        description: 'Tags (comma separated)'
+        required: false
+        type: string
+permissions:
+  contents: read
+  packages: write
+jobs:
+  get-dev-image-with-extras:
+    uses: ./.github/workflows/get_image.yaml
+    with:
+      image-base-name: "dev_image_with_extras"
+      ref: ${{ inputs.ref }}
+
+  soc-attack-perf:
+    name: Sovereign SOC redis-attack perf eval
+    needs: get-dev-image-with-extras
+    runs-on: oracle-vm-16cpu-64gb-x86-64
+    container:
+      image: ${{ needs.get-dev-image-with-extras.outputs.image-with-tag }}
+      options: --cap-add=NET_ADMIN --device=/dev/net/tun
+    steps:
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
+      with:
+        ref: ${{ inputs.ref }}
+        fetch-depth: 0
+    - name: Add pwd to git safe dir
+      run: git config --global --add safe.directory `pwd`
+    - id: get-commit-sha
+      run: echo "commit-sha=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
+
+    # TODO(ddelnano): swap TAILSCALE_AUTH_KEY for an OAuth client once one is
+    # provisioned in the k8sstormcenter tailnet. Use
+    # `tailscale/github-action@v2` with `oauth-client-id` and `oauth-secret`
+    # inputs (`TS_OAUTH_CLIENT_ID` / `TS_OAUTH_CLIENT_SECRET` secrets) so
+    # credentials rotate automatically instead of expiring on a fixed cadence.
+    - name: Start Tailscale sidecar
+      env:
+        TS_AUTHKEY: ${{ secrets.TAILSCALE_AUTH_KEY }}
+      run: |
+        curl -fsSL https://tailscale.com/install.sh | sh
+        mkdir -p /var/run/tailscale /var/lib/tailscale
+        tailscaled \
+          --socket=/var/run/tailscale/tailscaled.sock \
+          --state=/var/lib/tailscale/tailscaled.state &
+        until tailscale status --json >/dev/null 2>&1; do sleep 1; done
+        tailscale up \
+          --authkey="${TS_AUTHKEY}" \
+          --accept-routes \
+          --hostname="pixie-perf-ci-${GITHUB_RUN_ID}"
+
+    - name: Write kubeconfig
+      env:
+        KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
+      run: |
+        mkdir -p "${RUNNER_TEMP}"
+        echo "${KUBECONFIG_B64}" | base64 -d > "${RUNNER_TEMP}/kubeconfig"
+        chmod 600 "${RUNNER_TEMP}/kubeconfig"
+
+    # Fail fast if Tailscale can't reach the cluster API, before the 2+ minute
+    # bazel/skaffold build wastes time.
+    - name: Tailscale connectivity probe
+      env:
+        KUBECONFIG: ${{ runner.temp }}/kubeconfig
+      run: |
+        tailscale status
+        tailscale netcheck
+        api_host="$(kubectl --kubeconfig="$KUBECONFIG" config view --minify -o jsonpath='{.clusters[0].cluster.server}' | sed -E 's|https?://||; s|/.*||')"
+        api_ip="${api_host%%:*}"
+        api_port="${api_host##*:}"
+        echo "--- tailscale ping ${api_ip} ---"
+        tailscale ping --c 3 --until-direct=false "${api_ip}" || true
+        echo "--- tcp probe ${api_ip}:${api_port} ---"
+        timeout 5 bash -c "</dev/tcp/${api_ip}/${api_port}" \
+          && echo "API port reachable" \
+          || { echo "API port UNREACHABLE"; exit 1; }
+        echo "--- kubectl get nodes ---"
+        kubectl --kubeconfig="$KUBECONFIG" get nodes
+
+    - name: Use github bazel config
+      uses: ./.github/actions/bazelrc
+      with:
+        download_toplevel: 'true'
+        BB_API_KEY: ${{ secrets.BB_IO_API_KEY }}
+
+    # TODO(ddelnano): revert to `./.github/actions/gcloud_creds` once GCP_SA_KEY
+    # is re-uploaded with `base64 -w0`. The shared composite uses plain
+    # `base64 --decode` which rejects the wrapped (multi-line/CRLF) value
+    # currently stored in the secret.
+    - id: gcloud-creds
+      env:
+        SERVICE_ACCOUNT_KEY: ${{ secrets.GCP_SA_KEY }}
+      run: |
+        printf '%s' "$SERVICE_ACCOUNT_KEY" | base64 -di > /tmp/gcloud.json
+        chmod 600 /tmp/gcloud.json
+        echo "gcloud-creds=/tmp/gcloud.json" >> $GITHUB_OUTPUT
+    - name: Activate gcloud service account
+      env:
+        GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
+      run: |
+        service_account="$(jq -r '.client_email' "$GOOGLE_APPLICATION_CREDENTIALS")"
+        gcloud auth activate-service-account "${service_account}" --key-file="$GOOGLE_APPLICATION_CREDENTIALS"
+        gcloud auth configure-docker
+
+    - name: Log in to GHCR
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: echo "${GH_TOKEN}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+    - name: Build and install px CLI
+      run: |
+        bazel build --config=x86_64_sysroot //src/pixie_cli:px
+        install -m 0755 bazel-bin/src/pixie_cli/px_/px /usr/local/bin/px
+        px version
+
+    # The sovereign-soc suite installs Kubescape + Vector on the experiment
+    # cluster as part of the run (see KubescapeVectorWorkload). The
+    # kubescape-operator chart is pre-rendered under
+    # src/e2e_test/perf_tool/pkg/suites/k8s/sovereign-soc/helm-rendered/
+    # and applied via PrerenderedDeploy, so no extra ./scripts step is needed.
+    #
+    # ClickHouse operator metrics are scraped on the forensic cluster via
+    # the prom_recorder_override; the kubescape node-agent prom recorder
+    # is intentionally NOT overridden — kubescape runs on the experiment
+    # cluster (where redis+bobctl drive traffic), so the recorder uses the
+    # default kubeconfig.
+    - name: Run sovereign-soc redis-attack perf
+      env:
+        PX_API_KEY: ${{ secrets.PX_API_KEY }}
+        GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
+        KUBECONFIG: ${{ runner.temp }}/kubeconfig
+      run: |
+        bazel run //src/e2e_test/perf_tool:perf_tool -- run \
+          --api_key="${PX_API_KEY}" \
+          --cloud_addr=pixie.austrianopencloudcommunity.org:443 \
+          --commit_sha="${{ steps.get-commit-sha.outputs.commit-sha }}" \
+          --experiment_name=redis-attack \
+          --suite=sovereign-soc \
+          --use_local_cluster \
+          --export_backend=parquet-gcs \
+          --gcs_bucket=k8sstormcenter-soc-perf \
+          --container_repo=ghcr.io/k8sstormcenter \
+          --prom_recorder_override 'clickhouse-operator=:k8ss-forensic' \
+          --tags "${{ inputs.tags }}"
+
+    - name: Tailscale logout
+      if: always()
+      run: tailscale logout || true