Skip to content

Commit 0f825e1

Browse files
manuschillerdevmanuschillerdev
committed
Add RC hardening gates
1 parent 1fda120 commit 0f825e1

11 files changed

Lines changed: 584 additions & 116 deletions

‎.github/kind-kvm-multinode-config.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
kind: Cluster
2+
apiVersion: kind.x-k8s.io/v1alpha4
3+
nodes:
4+
- role: control-plane
5+
extraMounts:
6+
- hostPath: /dev/kvm
7+
containerPath: /dev/kvm
8+
- hostPath: /tmp/smolvm-kind-control-plane-var-lib
9+
containerPath: /var/lib/smolvm
10+
- hostPath: /tmp/smolvm-kind-control-plane-var-run
11+
containerPath: /var/run/smolvm
12+
- role: worker
13+
extraMounts:
14+
- hostPath: /dev/kvm
15+
containerPath: /dev/kvm
16+
- hostPath: /tmp/smolvm-kind-worker-var-lib
17+
containerPath: /var/lib/smolvm
18+
- hostPath: /tmp/smolvm-kind-worker-var-run
19+
containerPath: /var/run/smolvm
20+
- role: worker
21+
extraMounts:
22+
- hostPath: /dev/kvm
23+
containerPath: /dev/kvm
24+
- hostPath: /tmp/smolvm-kind-worker2-var-lib
25+
containerPath: /var/lib/smolvm
26+
- hostPath: /tmp/smolvm-kind-worker2-var-run
27+
containerPath: /var/run/smolvm

‎.github/workflows/ci.yml‎

Lines changed: 150 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,27 @@ on:
66
pull_request:
77
workflow_dispatch:
88

9+
permissions:
10+
contents: read
11+
packages: write
12+
913
jobs:
14+
lint:
15+
name: lint
16+
runs-on: ubuntu-latest
17+
steps:
18+
- uses: actions/checkout@v4
19+
- uses: actions/setup-go@v5
20+
with:
21+
go-version-file: go.mod
22+
cache: true
23+
- name: Run linters
24+
run: make lint
25+
1026
envtest:
1127
name: envtest controller
1228
runs-on: ubuntu-latest
29+
needs: [lint]
1330
steps:
1431
- uses: actions/checkout@v4
1532
- uses: actions/setup-go@v5
@@ -25,22 +42,77 @@ jobs:
2542
name: envtest-reports
2643
path: reports/
2744

45+
release-artifact:
46+
name: install artifact reproducibility
47+
runs-on: ubuntu-latest
48+
steps:
49+
- uses: actions/checkout@v4
50+
- uses: actions/setup-go@v5
51+
with:
52+
go-version-file: go.mod
53+
cache: true
54+
- name: Build reproducible install artifact
55+
run: make rc-artifacts VERSION=ci IMG=ghcr.io/${{ github.repository }}/smolvm-operator:${{ github.sha }} RUNTIME_IMG=ghcr.io/${{ github.repository }}/smolvm-runtime:${{ github.sha }}
56+
- name: Upload install artifact
57+
uses: actions/upload-artifact@v4
58+
with:
59+
name: install-artifact
60+
path: dist/
61+
62+
container-images:
63+
name: immutable container images
64+
runs-on: ubuntu-latest
65+
if: github.event_name != 'pull_request'
66+
steps:
67+
- uses: actions/checkout@v4
68+
- uses: docker/login-action@v3
69+
with:
70+
registry: ghcr.io
71+
username: ${{ github.actor }}
72+
password: ${{ secrets.GITHUB_TOKEN }}
73+
- name: Build and publish immutable images
74+
run: |
75+
docker build -t ghcr.io/${{ github.repository }}/smolvm-operator:${{ github.sha }} .
76+
docker build -f Dockerfile.runtime --build-arg SMOLVM_VERSION=0.8.1 -t ghcr.io/${{ github.repository }}/smolvm-runtime:${{ github.sha }} .
77+
docker push ghcr.io/${{ github.repository }}/smolvm-operator:${{ github.sha }}
78+
docker push ghcr.io/${{ github.repository }}/smolvm-runtime:${{ github.sha }}
79+
2880
kind-e2e:
2981
name: kind topology e2e
3082
runs-on: ubuntu-latest
83+
needs: [envtest, release-artifact]
3184
steps:
3285
- uses: actions/checkout@v4
3386
- uses: actions/setup-go@v5
3487
with:
3588
go-version-file: go.mod
3689
cache: true
90+
- name: Prepare KVM-backed multi-node kind mounts
91+
run: |
92+
set -euxo pipefail
93+
test -e /dev/kvm
94+
sudo chmod 666 /dev/kvm
95+
for node in control-plane worker worker2; do
96+
sudo mkdir -p "/tmp/smolvm-kind-${node}-var-lib" "/tmp/smolvm-kind-${node}-var-run"
97+
sudo chmod 777 "/tmp/smolvm-kind-${node}-var-lib" "/tmp/smolvm-kind-${node}-var-run"
98+
done
99+
- name: Build e2e images and manifest
100+
run: |
101+
docker build -t smolvm-operator:e2e .
102+
docker build -f Dockerfile.runtime --build-arg SMOLVM_VERSION=0.8.1 -t smolvm-runtime:e2e .
103+
make build-installer IMG=smolvm-operator:e2e RUNTIME_IMG=smolvm-runtime:e2e
37104
- uses: helm/kind-action@v1
38105
with:
39106
cluster_name: kind
40-
- name: Run deployed-topology e2e test
107+
config: .github/kind-kvm-multinode-config.yaml
108+
- name: Load e2e images
109+
run: |
110+
kind load docker-image smolvm-operator:e2e --name kind
111+
kind load docker-image smolvm-runtime:e2e --name kind
112+
- name: Run deployed topology e2e
41113
env:
42114
RUN_E2E: "true"
43-
KIND_CLUSTER: kind
115+
E2E_INSTALL_MANIFEST: dist/install.yaml
44116
run: make test-e2e-report
45117
- name: Upload e2e reports
46118
if: always()
@@ -52,28 +124,40 @@ jobs:
52124
smolvm-runtime-e2e:
53125
name: smolvm runtime lifecycle e2e
54126
runs-on: ubuntu-latest
127+
needs: [envtest, release-artifact]
55128
timeout-minutes: 45
56129
steps:
57130
- uses: actions/checkout@v4
58131
- uses: actions/setup-go@v5
59132
with:
60133
go-version-file: go.mod
61134
cache: true
62-
- name: Prepare KVM-backed kind mounts
135+
- name: Prepare KVM-backed multi-node kind mounts
63136
run: |
64137
set -euxo pipefail
65138
test -e /dev/kvm
66139
sudo chmod 666 /dev/kvm
67-
sudo mkdir -p /tmp/smolvm-kind-var-lib /tmp/smolvm-kind-var-run
68-
sudo chmod 777 /tmp/smolvm-kind-var-lib /tmp/smolvm-kind-var-run
140+
for node in control-plane worker worker2; do
141+
sudo mkdir -p "/tmp/smolvm-kind-${node}-var-lib" "/tmp/smolvm-kind-${node}-var-run"
142+
sudo chmod 777 "/tmp/smolvm-kind-${node}-var-lib" "/tmp/smolvm-kind-${node}-var-run"
143+
done
144+
- name: Build runtime e2e images and manifest
145+
run: |
146+
docker build -t smolvm-operator:runtime-e2e .
147+
docker build -f Dockerfile.runtime --build-arg SMOLVM_VERSION=0.8.1 -t smolvm-runtime:runtime-e2e .
148+
make build-installer IMG=smolvm-operator:runtime-e2e RUNTIME_IMG=smolvm-runtime:runtime-e2e
69149
- uses: helm/kind-action@v1
70150
with:
71151
cluster_name: runtime
72-
config: .github/kind-runtime-config.yaml
152+
config: .github/kind-kvm-multinode-config.yaml
153+
- name: Load runtime e2e images
154+
run: |
155+
kind load docker-image smolvm-operator:runtime-e2e --name runtime
156+
kind load docker-image smolvm-runtime:runtime-e2e --name runtime
73157
- name: Run runtime lifecycle e2e
74158
env:
75159
RUN_E2E: "true"
76-
KIND_CLUSTER: runtime
160+
E2E_INSTALL_MANIFEST: dist/install.yaml
77161
RUNTIME_E2E: "true"
78162
run: make test-runtime-e2e-report
79163
- name: Upload runtime logs
@@ -82,3 +166,62 @@ jobs:
82166
with:
83167
name: runtime-e2e-logs
84168
path: reports/
169+
170+
release-hardening-e2e:
171+
name: upgrade multi-node and failure gates
172+
runs-on: ubuntu-latest
173+
needs: [envtest, release-artifact]
174+
steps:
175+
- uses: actions/checkout@v4
176+
- uses: actions/setup-go@v5
177+
with:
178+
go-version-file: go.mod
179+
cache: true
180+
- name: Prepare KVM-backed multi-node kind mounts
181+
run: |
182+
set -euxo pipefail
183+
test -e /dev/kvm
184+
sudo chmod 666 /dev/kvm
185+
for node in control-plane worker worker2; do
186+
sudo mkdir -p "/tmp/smolvm-kind-${node}-var-lib" "/tmp/smolvm-kind-${node}-var-run"
187+
sudo chmod 777 "/tmp/smolvm-kind-${node}-var-lib" "/tmp/smolvm-kind-${node}-var-run"
188+
done
189+
- name: Build hardening e2e images and manifests
190+
env:
191+
PREVIOUS_INSTALL_MANIFEST_URL: ${{ vars.PREVIOUS_INSTALL_MANIFEST_URL }}
192+
run: |
193+
set -euxo pipefail
194+
if [ -z "$PREVIOUS_INSTALL_MANIFEST_URL" ]; then
195+
echo "PREVIOUS_INSTALL_MANIFEST_URL repository variable is required for upgrade e2e" >&2
196+
exit 1
197+
fi
198+
mkdir -p dist
199+
curl -fsSL "$PREVIOUS_INSTALL_MANIFEST_URL" -o dist/previous-install.yaml
200+
docker build -t smolvm-operator:rc .
201+
docker build -f Dockerfile.runtime --build-arg SMOLVM_VERSION=0.8.1 -t smolvm-runtime:rc .
202+
make build-installer IMG=smolvm-operator:rc RUNTIME_IMG=smolvm-runtime:rc
203+
cp dist/install.yaml dist/rc-install.yaml
204+
- uses: helm/kind-action@v1
205+
with:
206+
cluster_name: hardening
207+
config: .github/kind-kvm-multinode-config.yaml
208+
- name: Load hardening images
209+
run: |
210+
kind load docker-image smolvm-operator:rc --name hardening
211+
kind load docker-image smolvm-runtime:rc --name hardening
212+
- name: Run upgrade, multi-node, and failure checks
213+
env:
214+
RUN_E2E: "true"
215+
E2E_INSTALL_MANIFEST: dist/rc-install.yaml
216+
PREVIOUS_INSTALL_MANIFEST: dist/previous-install.yaml
217+
RC_INSTALL_MANIFEST: dist/rc-install.yaml
218+
run: |
219+
make test-upgrade-e2e-report
220+
make test-multinode-e2e-report
221+
make test-failure-e2e-report
222+
- name: Upload release hardening reports
223+
if: always()
224+
uses: actions/upload-artifact@v4
225+
with:
226+
name: release-hardening-reports
227+
path: reports/

‎.golangci.yml‎

Lines changed: 1 addition & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -3,38 +3,21 @@ run:
33
allow-parallel-runners: true
44

55
issues:
6-
# don't skip warning about doc comments
7-
# don't exclude the default set of lint
86
exclude-use-default: false
9-
# restore some of the defaults
10-
# (fill in the rest as needed)
11-
exclude-rules:
12-
- path: "api/*"
13-
linters:
14-
- lll
15-
- path: "internal/*"
16-
linters:
17-
- dupl
18-
- lll
7+
198
linters:
209
disable-all: true
2110
enable:
2211
- dupl
23-
- errcheck
24-
- exportloopref
25-
- goconst
2612
- gocyclo
2713
- gofmt
2814
- goimports
2915
- gosimple
3016
- govet
3117
- ineffassign
32-
- lll
3318
- misspell
3419
- nakedret
3520
- prealloc
3621
- staticcheck
3722
- typecheck
3823
- unconvert
39-
- unparam
40-
- unused

‎Makefile‎

Lines changed: 43 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,21 @@ test-runtime-e2e-report: ## Run runtime lifecycle e2e tests and write a Ginkgo J
8686
mkdir -p reports
8787
go test ./test/e2e -v -ginkgo.v -ginkgo.label-filter=runtime -ginkgo.junit-report=reports/runtime.xml
8888

89+
.PHONY: test-upgrade-e2e-report
90+
test-upgrade-e2e-report: ## Run deployed upgrade e2e tests and write a Ginkgo JUnit report under reports/.
91+
mkdir -p reports
92+
go test ./test/e2e -v -ginkgo.v -ginkgo.label-filter=upgrade -ginkgo.junit-report=reports/upgrade.xml
93+
94+
.PHONY: test-multinode-e2e-report
95+
test-multinode-e2e-report: ## Run deployed multi-node e2e tests and write a Ginkgo JUnit report under reports/.
96+
mkdir -p reports
97+
go test ./test/e2e -v -ginkgo.v -ginkgo.label-filter=multinode -ginkgo.junit-report=reports/multinode.xml
98+
99+
.PHONY: test-failure-e2e-report
100+
test-failure-e2e-report: ## Run deployed failure-recovery e2e tests and write a Ginkgo JUnit report under reports/.
101+
mkdir -p reports
102+
go test ./test/e2e -v -ginkgo.v -ginkgo.label-filter=failure -ginkgo.junit-report=reports/failure.xml
103+
89104
.PHONY: lint
90105
lint: golangci-lint ## Run golangci-lint linter & yamllint
91106
$(GOLANGCI_LINT) run
@@ -139,15 +154,34 @@ docker-buildx: ## Build and push docker image for the manager for cross-platform
139154
rm Dockerfile.cross
140155

141156
.PHONY: build-installer
142-
build-installer: manifests generate kustomize ## Generate a consolidated YAML with CRDs and deployment.
157+
build-installer: manifests generate kustomize ## Generate a consolidated install manifest without mutating config/.
143158
mkdir -p dist
144-
@if [ -d "config/crd" ]; then \
145-
$(KUSTOMIZE) build config/crd > dist/install.yaml; \
146-
fi
147-
echo "---" >> dist/install.yaml # Add a document separator before appending
148-
cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
149-
cd config/runtime && $(KUSTOMIZE) edit set image smolvm-runtime=${RUNTIME_IMG}
150-
$(KUSTOMIZE) build config/default >> dist/install.yaml
159+
out="$$(pwd)/dist/install.yaml"; \
160+
tmpdir="$$(mktemp -d)"; \
161+
trap 'rm -rf "$${tmpdir}"' EXIT; \
162+
cp -R config "$${tmpdir}/config"; \
163+
cd "$${tmpdir}/config/manager" && $(KUSTOMIZE) edit set image controller=${IMG}; \
164+
cd "$${tmpdir}/config/runtime" && $(KUSTOMIZE) edit set image smolvm-runtime=${RUNTIME_IMG}; \
165+
$(KUSTOMIZE) build "$${tmpdir}/config/default" > "$${out}"
166+
167+
.PHONY: release-artifacts
168+
release-artifacts: build-installer ## Generate versioned release artifacts under dist/.
169+
@if [ -z "$(VERSION)" ]; then echo "VERSION is required" >&2; exit 1; fi
170+
cp dist/install.yaml dist/smolvm-operator-$(VERSION).yaml
171+
shasum -a 256 dist/smolvm-operator-$(VERSION).yaml > dist/smolvm-operator-$(VERSION).yaml.sha256
172+
173+
.PHONY: verify-release-artifacts
174+
verify-release-artifacts: release-artifacts ## Verify release artifacts are reproducible for the current inputs.
175+
tmp="$$(mktemp)"; \
176+
cp dist/smolvm-operator-$(VERSION).yaml "$${tmp}"; \
177+
$(MAKE) release-artifacts VERSION=$(VERSION) IMG=$(IMG) RUNTIME_IMG=$(RUNTIME_IMG); \
178+
cmp "$${tmp}" dist/smolvm-operator-$(VERSION).yaml
179+
180+
.PHONY: rc-check
181+
rc-check: lint test-report test-e2e-report test-runtime-e2e-report test-upgrade-e2e-report test-multinode-e2e-report test-failure-e2e-report ## Run the release-candidate validation suite.
182+
183+
.PHONY: rc-artifacts
184+
rc-artifacts: verify-release-artifacts ## Generate and verify RC install artifacts. Requires VERSION, IMG, and RUNTIME_IMG.
151185

152186
##@ Deployment
153187

@@ -192,7 +226,7 @@ GOTESTSUM ?= $(LOCALBIN)/gotestsum-$(GOTESTSUM_VERSION)
192226
KUSTOMIZE_VERSION ?= v5.3.0
193227
CONTROLLER_TOOLS_VERSION ?= v0.19.0
194228
ENVTEST_VERSION ?= latest
195-
GOLANGCI_LINT_VERSION ?= v1.54.2
229+
GOLANGCI_LINT_VERSION ?= v1.64.8
196230
GOTESTSUM_VERSION ?= v1.13.0
197231

198232
.PHONY: kustomize

‎docs/compatibility.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Compatibility matrix
2+
3+
| Component | Supported for RC | Notes |
4+
| --- | --- | --- |
5+
| Kubernetes | 1.29 | Envtest and kind validation use Kubernetes 1.29 assets/configuration. |
6+
| smolvm | 0.8.1 | Runtime image downloads the pinned upstream smolvm release. |
7+
| Runtime CPU architecture | linux/amd64 | smolvm 0.8.1 publishes `linux-x86_64`; runtime e2e must run on amd64. |
8+
| Operator CPU architecture | linux/amd64, linux/arm64 | Go binaries are buildable for both; runtime image support is constrained by smolvm artifacts. |
9+
| Container runtime | containerd via kind/Kubernetes CRI | Other CRI implementations require separate validation. |
10+
| Host virtualization | KVM at `/dev/kvm` | Required on every schedulable runtime node. |
11+
| Runtime state | `/var/lib/smolvm`, `/var/run/smolvm` host paths | Mounted by the runtime DaemonSet. |
12+
| Runtime API | HTTPS on pod port 9443 | Bearer token from `smolvm-runtime-auth`; ingress restricted by NetworkPolicy. |
13+
14+
## Known limitations
15+
16+
- Bound VMs are node-local and do not migrate automatically after node or runtime loss.
17+
- Force delete removes the Kubernetes finalizer while accepting possible orphaned node-local state.

0 commit comments

Comments
 (0)