Skip to content

Commit

Permalink
reduce github action permissions (openkruise#1523)
Browse files Browse the repository at this point in the history
  • Loading branch information
furykerry authored Mar 18, 2024
1 parent 28879de commit ee35acf
Show file tree
Hide file tree
Showing 11 changed files with 153 additions and 37 deletions.
3 changes: 3 additions & 0 deletions .github/workflows/ci.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@ on:
pull_request: {}
workflow_dispatch: {}

# Declare default permissions as read only.
permissions: read-all

env:
# Common versions
GO_VERSION: '1.19'
Expand Down
3 changes: 3 additions & 0 deletions .github/workflows/docker-image.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,9 @@ name: Docker Image CI
on:
workflow_dispatch:

# Declare default permissions as read only.
permissions: read-all

jobs:

build:
Expand Down
33 changes: 28 additions & 5 deletions .github/workflows/e2e-1.18.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@ on:
pull_request: {}
workflow_dispatch: {}

# Declare default permissions as read only.
permissions: read-all

env:
# Common versions
GO_VERSION: '1.19'
Expand Down Expand Up @@ -101,7 +104,11 @@ jobs:
echo "test fail, dump kruise-manager logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
echo "test fail, dump kruise-daemon logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=daemon --no-headers | awk '{print $1}')
fi
exit $retVal
Expand Down Expand Up @@ -188,7 +195,11 @@ jobs:
echo "test fail, dump kruise-manager logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
echo "test fail, dump kruise-daemon logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=daemon --no-headers | awk '{print $1}')
fi
exit $retVal
Expand Down Expand Up @@ -275,7 +286,11 @@ jobs:
echo "test fail, dump kruise-manager logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
echo "test fail, dump kruise-daemon logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=daemon --no-headers | awk '{print $1}')
fi
exit $retVal
Expand Down Expand Up @@ -362,7 +377,11 @@ jobs:
echo "test fail, dump kruise-manager logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
echo "test fail, dump kruise-daemon logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=daemon --no-headers | awk '{print $1}')
fi
exit $retVal
Expand Down Expand Up @@ -514,6 +533,10 @@ jobs:
echo "test fail, dump kruise-manager logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
echo "test fail, dump kruise-daemon logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=daemon --no-headers | awk '{print $1}')
fi
exit $retVal
9 changes: 8 additions & 1 deletion .github/workflows/e2e-1.20-EphemeralJob.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@ on:
pull_request: {}
workflow_dispatch: {}

# Declare default permissions as read only.
permissions: read-all

env:
# Common versions
GO_VERSION: '1.19'
Expand Down Expand Up @@ -101,6 +104,10 @@ jobs:
echo "test fail, dump kruise-manager logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
echo "test fail, dump kruise-daemon logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=daemon --no-headers | awk '{print $1}')
fi
exit $retVal
39 changes: 33 additions & 6 deletions .github/workflows/e2e-1.24.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@ on:
pull_request: {}
workflow_dispatch: {}

# Declare default permissions as read only.
permissions: read-all

env:
# Common versions
GO_VERSION: '1.19'
Expand Down Expand Up @@ -89,7 +92,11 @@ jobs:
echo "test fail, dump kruise-manager logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
echo "test fail, dump kruise-daemon logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=daemon --no-headers | awk '{print $1}')
fi
exit $retVal
Expand Down Expand Up @@ -176,7 +183,11 @@ jobs:
echo "test fail, dump kruise-manager logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
echo "test fail, dump kruise-daemon logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=daemon --no-headers | awk '{print $1}')
fi
exit $retVal
Expand Down Expand Up @@ -265,7 +276,11 @@ jobs:
echo "test fail, dump kruise-manager logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
echo "test fail, dump kruise-daemon logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=daemon --no-headers | awk '{print $1}')
fi
exit $retVal
Expand Down Expand Up @@ -353,7 +368,11 @@ jobs:
echo "test fail, dump kruise-manager logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
echo "test fail, dump kruise-daemon logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=daemon --no-headers | awk '{print $1}')
fi
exit $retVal
Expand Down Expand Up @@ -419,7 +438,11 @@ jobs:
echo "test fail, dump kruise-manager logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
echo "test fail, dump kruise-daemon logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=daemon --no-headers | awk '{print $1}')
fi
exit $retVal
Expand Down Expand Up @@ -571,7 +594,11 @@ jobs:
echo "test fail, dump kruise-manager logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
echo "test fail, dump kruise-daemon logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=daemon --no-headers | awk '{print $1}')
fi
exit $retVal
39 changes: 33 additions & 6 deletions .github/workflows/e2e-1.26.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,9 @@ on:
pull_request: {}
workflow_dispatch: {}

# Declare default permissions as read only.
permissions: read-all

env:
# Common versions
GO_VERSION: '1.19'
Expand Down Expand Up @@ -88,7 +91,11 @@ jobs:
echo "test fail, dump kruise-manager logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
echo "test fail, dump kruise-daemon logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=daemon --no-headers | awk '{print $1}')
fi
exit $retVal
Expand Down Expand Up @@ -175,7 +182,11 @@ jobs:
echo "test fail, dump kruise-manager logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
echo "test fail, dump kruise-daemon logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=daemon --no-headers | awk '{print $1}')
fi
exit $retVal
Expand Down Expand Up @@ -264,7 +275,11 @@ jobs:
echo "test fail, dump kruise-manager logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
echo "test fail, dump kruise-daemon logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=daemon --no-headers | awk '{print $1}')
fi
exit $retVal
Expand Down Expand Up @@ -352,7 +367,11 @@ jobs:
echo "test fail, dump kruise-manager logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
echo "test fail, dump kruise-daemon logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=daemon --no-headers | awk '{print $1}')
fi
exit $retVal
Expand Down Expand Up @@ -418,7 +437,11 @@ jobs:
echo "test fail, dump kruise-manager logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
echo "test fail, dump kruise-daemon logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=daemon --no-headers | awk '{print $1}')
fi
exit $retVal
Expand Down Expand Up @@ -570,7 +593,11 @@ jobs:
echo "test fail, dump kruise-manager logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
done < <(kubectl get pods -n kruise-system -l control-plane=controller-manager --no-headers | awk '{print $1}')
echo "test fail, dump kruise-daemon logs"
while read pod; do
kubectl logs -n kruise-system $pod
done < <(kubectl get pods -n kruise-system -l control-plane=daemon --no-headers | awk '{print $1}')
fi
exit $retVal
3 changes: 3 additions & 0 deletions .github/workflows/license.yml
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,9 @@ on:
- master
- release-*

# Declare default permissions as read only.
permissions: read-all

jobs:
license_check:
runs-on: ubuntu-20.04
Expand Down
30 changes: 15 additions & 15 deletions test/e2e/apps/ephemeraljob.go
Original file line number Diff line number Diff line change
Expand Up @@ -288,21 +288,6 @@ var _ = SIGDescribe("EphemeralJob", func() {
},
}})

job2 := tester.CreateTestEphemeralJob(randStr+"2", 1, 1, metav1.LabelSelector{
MatchLabels: map[string]string{
"run": "nginx",
}}, []v1.EphemeralContainer{
{
TargetContainerName: "nginx",
EphemeralContainerCommon: v1.EphemeralContainerCommon{
Name: "debugger",
Image: BusyboxImage,
ImagePullPolicy: v1.PullIfNotPresent,
Command: []string{"sleep", "3000"},
TerminationMessagePolicy: v1.TerminationMessageReadFile,
},
}})

ginkgo.By("Check the status of job")

gomega.Eventually(func() int {
Expand All @@ -320,6 +305,21 @@ var _ = SIGDescribe("EphemeralJob", func() {
return len(targetPod.Status.EphemeralContainerStatuses)
}, 60*time.Second, 3*time.Second).Should(gomega.Equal(1))

job2 := tester.CreateTestEphemeralJob(randStr+"2", 1, 1, metav1.LabelSelector{
MatchLabels: map[string]string{
"run": "nginx",
}}, []v1.EphemeralContainer{
{
TargetContainerName: "nginx",
EphemeralContainerCommon: v1.EphemeralContainerCommon{
Name: "debugger",
Image: BusyboxImage,
ImagePullPolicy: v1.PullIfNotPresent,
Command: []string{"sleep", "3000"},
TerminationMessagePolicy: v1.TerminationMessageReadFile,
},
}})
ginkgo.By("Check whether ephemeral container can updated (not possible yet)")
gomega.Eventually(func() int32 {
job, _ := tester.GetEphemeralJob(job2.Name)
return job.Status.Matches
Expand Down
4 changes: 2 additions & 2 deletions test/e2e/apps/imagelistpulljobs.go
Original file line number Diff line number Diff line change
Expand Up @@ -181,12 +181,12 @@ var _ = SIGDescribe("PullImages", func() {
return job.Status.Desired
}, 3*time.Second, time.Second).Should(gomega.Equal(int32(len(job.Spec.Images))))

ginkgo.By("Wait completed in 180s")
ginkgo.By("Wait completed in 360s")
gomega.Eventually(func() bool {
job, err = testerForImageListPullJob.GetJob(job)
gomega.Expect(err).NotTo(gomega.HaveOccurred())
return job.Status.CompletionTime != nil
}, 180*time.Second, 3*time.Second).Should(gomega.Equal(true))
}, 360*time.Second, 10*time.Second).Should(gomega.Equal(true))
gomega.Expect(job.Status.Succeeded).To(gomega.Equal(int32(len(job.Spec.Images))))

ginkgo.By("Delete job")
Expand Down
5 changes: 3 additions & 2 deletions test/e2e/apps/statefulset.go
Original file line number Diff line number Diff line change
Expand Up @@ -663,7 +663,7 @@ var _ = SIGDescribe("StatefulSet", func() {
gomega.Expect(err).NotTo(gomega.HaveOccurred())

ginkgo.By("InPlace update Pods at the new revision")
sst.WaitForPodNotReady(ss, pods.Items[0].Name)
sst.WaitForPodUpdatedAndRunning(ss, pods.Items[0].Name, currentRevision)
sst.WaitForRunningAndReady(3, ss)
ss = sst.GetStatefulSet(ss.Namespace, ss.Name)
pods = sst.GetPodList(ss)
Expand Down Expand Up @@ -761,8 +761,9 @@ var _ = SIGDescribe("StatefulSet", func() {
gomega.Expect(err).NotTo(gomega.HaveOccurred())

ginkgo.By("InPlace update Pods at the new revision")
sst.WaitForPodNotReady(ss, pods.Items[0].Name)
sst.WaitForPodUpdatedAndRunning(ss, pods.Items[0].Name, currentRevision)
sst.WaitForRunningAndReady(3, ss)

ss = sst.GetStatefulSet(ss.Namespace, ss.Name)
pods = sst.GetPodList(ss)
for i := range pods.Items {
Expand Down
Loading

0 comments on commit ee35acf

Please sign in to comment.