fix(cel): scan Opens.Patterns in was_path_opened_with_suffix/prefix (#98) #610
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Node Agent Component Tests | |
| on: | |
| pull_request: | |
| types: [synchronize, ready_for_review, opened, reopened] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build-and-push-image: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Login to Quay.io | |
| if: ${{ github.event.pull_request.head.repo.full_name == github.repository }} | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: quay.io/kubescape | |
| username: ${{ secrets.QUAYIO_REGISTRY_USERNAME }} | |
| password: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }} | |
| - name: Install IG | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y jq curl | |
| IG_ARCH=amd64 | |
| IG_VERSION=$(curl -s https://api.github.com/repos/inspektor-gadget/inspektor-gadget/releases/latest | jq -r .tag_name) | |
| echo "Installing IG version: ${IG_VERSION}" | |
| curl -sL https://github.com/inspektor-gadget/inspektor-gadget/releases/download/${IG_VERSION}/ig-linux-${IG_ARCH}-${IG_VERSION}.tar.gz | sudo tar -C /usr/local/bin -xzf - ig | |
| sudo chmod +x /usr/local/bin/ig | |
| - name: Build the image | |
| id: build-and-push-image | |
| run: | | |
| COMMIT_HASH=$(git rev-parse --short HEAD) | |
| export IMAGE_TAG=test-${COMMIT_HASH} | |
| export IMAGE_REPO=quay.io/kubescape/node-agent | |
| echo "image_repo=${IMAGE_REPO}" >> "$GITHUB_OUTPUT" | |
| echo "image_tag=${IMAGE_TAG}" >> "$GITHUB_OUTPUT" | |
| make docker-build TAG=${IMAGE_TAG} IMAGE=${IMAGE_REPO} | |
| - name: Push image to Quay.io | |
| if: ${{ github.event.pull_request.head.repo.full_name == github.repository }} | |
| run: | | |
| make docker-push \ | |
| TAG=${{ steps.build-and-push-image.outputs.image_tag }} \ | |
| IMAGE=${{ steps.build-and-push-image.outputs.image_repo }} | |
| - name: Save image for fork PR | |
| if: ${{ github.event.pull_request.head.repo.full_name != github.repository }} | |
| run: | | |
| docker save \ | |
| ${{ steps.build-and-push-image.outputs.image_repo }}:${{ steps.build-and-push-image.outputs.image_tag }} \ | |
| -o node-agent-image.tar | |
| - name: Upload image artifact for fork PR | |
| if: ${{ github.event.pull_request.head.repo.full_name != github.repository }} | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: node-agent-image | |
| path: node-agent-image.tar | |
| retention-days: 1 | |
| outputs: | |
| image_tag: ${{ steps.build-and-push-image.outputs.image_tag }} | |
| image_repo: ${{ steps.build-and-push-image.outputs.image_repo }} | |
| component-tests: | |
| runs-on: ubuntu-latest | |
| needs: build-and-push-image | |
| continue-on-error: true | |
| strategy: | |
| matrix: | |
| test: [ | |
| Test_01_BasicAlertTest, | |
| Test_02_AllAlertsFromMaliciousApp, | |
| # Test_03_BasicLoadActivities, | |
| # Test_04_MemoryLeak, | |
| # Test_05_MemoryLeak_10K_Alerts, | |
| Test_06_KillProcessInTheMiddle, | |
| Test_07_RuleBindingApplyTest, | |
| Test_08_ContainerProfilePatching, | |
| Test_11_EndpointTest, | |
| Test_12_AuthoredMultiSubtypeProfile, | |
| Test_13_NaturalLearningLifecycle, | |
| Test_14_RulePoliciesTest, | |
| Test_15_CompletedApCannotBecomeReadyAgain, | |
| Test_16_ApNotStuckOnRestart, | |
| Test_17_ApCompletedToPartialUpdateTest, | |
| Test_18_ShortLivedJobTest, | |
| Test_19_AlertOnPartialProfileTest, | |
| Test_20_AlertOnPartialThenLearnProcessTest, | |
| Test_21_AlertOnPartialThenLearnNetworkTest, | |
| Test_22_AlertOnPartialNetworkProfileTest, | |
| Test_23_RuleCooldownTest, | |
| Test_24_ProcessTreeDepthTest, | |
| Test_25_RuleCooldownExactThreshold, | |
| Test_27_ApplicationProfileOpens, | |
| Test_28_UserDefinedNetworkNeighborhood, | |
| Test_30_IgnoreExcludeAndLearningDuration, | |
| Test_32_UnexpectedProcessArguments, | |
| Test_33_AnalyzeOpensWildcardAnchoring, | |
| Test_34_NetworkNeighborsCIDRCollapse, | |
| Test_35_ExecTTYFieldTest, | |
| Test_36_MultiContainerPerContainerBinding, | |
| Test_43_RelativeOpenPathResolution, | |
| Test_48_MultiSubtypeGroupedProfileDocument, | |
| Test_49_EphemeralContainerFullTreatment | |
| ] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Download fork PR image | |
| if: ${{ github.event.pull_request.head.repo.full_name != github.repository }} | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: node-agent-image | |
| - name: Load fork PR image | |
| if: ${{ github.event.pull_request.head.repo.full_name != github.repository }} | |
| run: | | |
| docker load -i node-agent-image.tar | |
| - name: Set up Kind | |
| run: | | |
| curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.31.0/kind-linux-amd64 | |
| chmod +x ./kind | |
| ./kind create cluster | |
| curl -LO "https://dl.k8s.io/release/v1.35.0/bin/linux/amd64/kubectl" | |
| chmod +x ./kubectl | |
| sudo mv ./kubectl /usr/local/bin/kubectl | |
| - name: Load fork PR image into Kind | |
| if: ${{ github.event.pull_request.head.repo.full_name != github.repository }} | |
| run: | | |
| ./kind load docker-image \ | |
| ${{ needs.build-and-push-image.outputs.image_repo }}:${{ needs.build-and-push-image.outputs.image_tag }} | |
| - name: Install Helm and Kubectl | |
| run: | | |
| curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | |
| chmod 700 get_helm.sh | |
| sudo ./get_helm.sh | |
| - name: Install Prometheus and Node Exporter | |
| run: | | |
| helm repo add prometheus-community https://prometheus-community.github.io/helm-charts | |
| helm repo update | |
| helm upgrade --install prometheus prometheus-community/kube-prometheus-stack --set grafana.enabled=false --namespace monitoring --create-namespace --set prometheus.prometheusSpec.podMonitorSelectorNilUsesHelmValues=false,prometheus.prometheusSpec.serviceMonitorSelectorNilUsesHelmValues=false --set prometheus.prometheusSpec.maximumStartupDurationSeconds=300 --wait --timeout 5m | |
| # Check that the prometheus pod is running | |
| kubectl wait --for=condition=Ready pod -l app.kubernetes.io/name=prometheus -n monitoring --timeout=300s | |
| - name: Install Node Agent Chart | |
| run: | | |
| STORAGE_TAG=$(./tests/scripts/storage-tag.sh) | |
| echo "Storage tag that will be used: ${STORAGE_TAG}" | |
| helm upgrade --install kubescape ./tests/chart --set clusterName=`kubectl config current-context` --set nodeAgent.image.tag=${{ needs.build-and-push-image.outputs.image_tag }} --set nodeAgent.image.repository=${{ needs.build-and-push-image.outputs.image_repo }} --set storage.image.tag=${STORAGE_TAG} -n kubescape --create-namespace --wait --timeout 10m --debug | |
| # Check that the node-agent pod is running | |
| kubectl wait --for=condition=Ready pod -l app.kubernetes.io/name=node-agent -n kubescape --timeout=600s | |
| sleep 5 | |
| - name: Run Port Forwarding | |
| run: | | |
| ./tests/scripts/port-forward.sh | |
| - name: Set up Go | |
| env: | |
| CGO_ENABLED: 0 | |
| uses: actions/setup-go@v4 | |
| with: | |
| go-version: "1.25" | |
| - name: Set unlimited memlock limit | |
| run: | | |
| sudo sh -c "ulimit -l unlimited" | |
| - name: Run test | |
| run: | | |
| cd tests && go test -v ./... -run ${{ matrix.test }} --timeout=20m --tags=component | |
| - name: Print node agent & storage logs | |
| if: always() | |
| run: | | |
| echo "Node agent logs" | |
| kubectl logs $(kubectl get pods -n kubescape -o name | grep node-agent) -n kubescape -c node-agent | |
| echo "-----------------------------------------" | |
| echo "Storage logs" | |
| kubectl logs $(kubectl get pods -n kubescape -o name | grep storage) -n kubescape |