gatekeeper-k8s-integrationtests.yaml

name: Run gatekeeper-k8s-integrationtests.sh

on: [push, pull_request]

# Declare default permissions as read only.
permissions: read-all

jobs:
  kind:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4

      - name: Find test data to validate
        shell: bash
        id: data
        run: |
          echo "files=$(find policy/* -regex '.*test_data\/integration\/.*$' | xargs)" >> "$GITHUB_OUTPUT"

      - name: Validate integration test data via kubeconform
        uses: docker://ghcr.io/yannh/kubeconform:v0.6.4
        with:
          args: -summary -schema-location "https://raw.githubusercontent.com/garethahealy/openshift-json-schema/main/4.13/schemas/{{ .ResourceKind }}{{ .KindSuffix }}.json" ${{ steps.data.outputs.files }}

      - name: Create k8s Kind Cluster
        uses: helm/kind-action@99576bfa6ddf9a8e612d83b513da5a75875caced # v1.9.0

      - name: Setup confbatstest
        uses: redhat-cop/github-actions/confbatstest@11f2ce27643eb7c76ac3623cb99d9b08be30d762 # v4
        with:
          raw: echo "Needed for next stage"

      - name: Test against KinD
        run: |
          confbatstest=$(docker images --filter=label=com.github.actions.name=confbatstest --format "{{.Repository}}:{{.Tag}}")
          docker run --rm --network host --workdir /conftest --volume "/home/runner/.kube/":"/opt/app-root/src/.kube/" --volume "/home/runner/work/rego-policies/rego-policies":"/conftest" --entrypoint .github/workflows/tests-entrypoint.sh ${confbatstest}

      - name: Get pods and events if tests failed
        if: ${{ failure() }}
        run: |
          echo "## nodes:"
          kubectl get nodes

          echo "## namespaces:"
          kubectl get namespaces

          echo "## deployments:"
          kubectl get deployments --all-namespaces

          echo "## pods:"
          kubectl get pods --all-namespaces

          echo "## events:"
          kubectl get events --all-namespaces

          echo "## api-versions:"
          kubectl api-versions
          
          echo "## describe deployment/gatekeeper-audit:"
          kubectl describe deployment/gatekeeper-audit -n gatekeeper-system
          
          echo "## logs deployment/gatekeeper-audit:"
          kubectl logs deployment/gatekeeper-audit -n gatekeeper-system
          
          echo "## describe deployment/gatekeeper-controller-manager:"
          kubectl describe deployment/gatekeeper-controller-manager -n gatekeeper-system
          
          echo "## logs deployment/gatekeeper-controller-manager:"
          kubectl logs deployment/gatekeeper-controller-manager -n gatekeeper-system