mirror of
https://github.com/kubernetes-sigs/kubespray.git
synced 2026-10-30 06:13:29 -02:30
Frank
1c1ed9562a
* ci: run the Ansible controller as an unprivileged user * ci: clarify non-root controller check * ci: make the sudo privilege check fail when sudo succeeds Bash does not apply errexit to the negated sudo command. The old check could not fail the job even when passwordless sudo worked. Exit explicitly when sudo succeeds. Remove --break-system-packages from both upgrade pip installs because they run inside the controller virtual environment.
75 lines
2.2 KiB
YAML
75 lines
2.2 KiB
YAML
---
|
|
stages:
|
|
- build # build docker image used in most other jobs
|
|
- test # unit tests
|
|
- deploy-part1 # kubespray runs - common setup
|
|
- deploy-extended # kubespray runs - rarer or costlier (to test) setups
|
|
|
|
variables:
|
|
FAILFASTCI_NAMESPACE: 'kargo-ci'
|
|
GITLAB_REPOSITORY: 'kargo-ci/kubernetes-sigs-kubespray'
|
|
# Let the helper assign checkout ownership to the build user.
|
|
FF_DISABLE_UMASK_FOR_DOCKER_EXECUTOR: "true"
|
|
FF_DISABLE_UMASK_FOR_KUBERNETES_EXECUTOR: "true"
|
|
GIT_CONFIG_COUNT: 3
|
|
GIT_CONFIG_KEY_0: user.email
|
|
GIT_CONFIG_VALUE_0: "ci@kubespray.io"
|
|
GIT_CONFIG_KEY_1: user.name
|
|
GIT_CONFIG_VALUE_1: "Kubespray CI"
|
|
# TODO: Remove this safe.directory workaround after fixing the inconsistent GitLab Runner versions.
|
|
# Runners older than 17.11 may leave checkout ownership incorrect despite the FF_DISABLE_UMASK flags.
|
|
# https://github.com/kubernetes-sigs/kubespray/pull/13527#discussion_r4198076964
|
|
GIT_CONFIG_KEY_2: safe.directory
|
|
GIT_CONFIG_VALUE_2: "$CI_PROJECT_DIR"
|
|
ANSIBLE_FORCE_COLOR: "true"
|
|
MAGIC: "ci check this"
|
|
GS_ACCESS_KEY_ID: $GS_KEY
|
|
GS_SECRET_ACCESS_KEY: $GS_SECRET
|
|
CONTAINER_ENGINE: docker
|
|
GCE_PREEMPTIBLE: "false"
|
|
ANSIBLE_KEEP_REMOTE_FILES: "1"
|
|
ANSIBLE_CONFIG: ./tests/ansible.cfg
|
|
ANSIBLE_REMOTE_USER: kubespray
|
|
ANSIBLE_PRIVATE_KEY_FILE: /tmp/id_rsa
|
|
ANSIBLE_INVENTORY: /tmp/inventory
|
|
ANSIBLE_STDOUT_CALLBACK: "default"
|
|
RESET_CHECK: "false"
|
|
REMOVE_NODE_CHECK: "false"
|
|
UPGRADE_TEST: "false"
|
|
MITOGEN_ENABLE: "false"
|
|
ANSIBLE_VERBOSITY: 2
|
|
RECOVER_CONTROL_PLANE_TEST: "false"
|
|
RECOVER_CONTROL_PLANE_TEST_GROUPS: "etcd[2:]:kube_control_plane[1:]"
|
|
OPENTOFU_VERSION: v1.9.1
|
|
PIPELINE_IMAGE: "$CI_REGISTRY_IMAGE/pipeline:${CI_PIPELINE_ID}-${CI_COMMIT_SHORT_SHA}"
|
|
|
|
before_script:
|
|
- ./tests/scripts/rebase.sh
|
|
- mkdir -p cluster-dump $ANSIBLE_INVENTORY
|
|
|
|
.job: &job
|
|
tags:
|
|
- ffci
|
|
image: $PIPELINE_IMAGE
|
|
artifacts:
|
|
when: always
|
|
paths:
|
|
- cluster-dump/
|
|
needs:
|
|
- pipeline-image
|
|
|
|
.job-moderated:
|
|
extends: .job
|
|
needs:
|
|
- pipeline-image
|
|
- pre-commit # lint
|
|
- vagrant-validate # lint
|
|
|
|
include:
|
|
- .gitlab-ci/build.yml
|
|
- .gitlab-ci/lint.yml
|
|
- .gitlab-ci/terraform.yml
|
|
- .gitlab-ci/kubevirt.yml
|
|
- .gitlab-ci/vagrant.yml
|
|
- .gitlab-ci/molecule.yml
|