create-demo-clusters.yml

name: Create demo clusters for version
on:
  workflow_call:
    inputs:
      version:
        description: Version of the images
        required: true
        type: string
      create-k8s-cluster:
        description: Create a GKE demo cluster
        default: false
        type: boolean
      create-os4-cluster:
        description: Create an Openshift 4 demo cluster
        default: false
        type: boolean
      create-long-cluster:
        description: Create a long-running cluster on RC1
        default: false
        type: boolean
      dry-run:
        description: Dry-run
        default: false
        type: boolean
      workflow-ref:
        description: Ref of the called workflow
        type: string
      kube-burner-config-ref:
        description: Ref of where the kube-burner config files can be found
        type: string
      kube-burner-config-repo:
        description: The repository where the kube-burner config files can be found
        type: string
      cluster-with-fake-load-name:
        description: "The name of the long running cluster where the central deployment is run with a sensor that creates its own fake workload. Must comply to the regex: [a-z][a-z0-9-]{1,26}[a-z0-9]"
        type: string
      cluster-with-real-load-name:
        description: "The name of the long running cluster where collector is run with real workload. Must comply to the regex: [a-z][a-z0-9-]{1,26}[a-z0-9]"
        type: string

env:
  main_branch: ${{github.event.repository.default_branch}}
  script_url: /repos/${{github.repository}}/contents/.github/workflows/scripts/common.sh?ref=${{ github.ref_name }}
  DRY_RUN: ${{ inputs.dry-run }}
  ACCEPT_RAW: "Accept: application/vnd.github.v3.raw"
  GH_TOKEN: ${{ github.token }}
  GH_NO_UPDATE_NOTIFIER: 1
  TIMEOUT_WAIT_FOR_IMAGES_SECONDS: 3600

jobs:
  properties:
    runs-on: ubuntu-latest
    outputs:
      slack-channel: ${{ fromJSON(format('["{0}","{1}"]', steps.fetch.outputs.dry-slack-channel, steps.fetch.outputs.slack-channel))[inputs.dry-run != true] }}
      jira-projects: ${{ steps.fetch.outputs.jira-projects }}
    steps:
      - name: Read workflow properties file
        id: fetch
        env:
          PROPERTIES_URL: /repos/${{ github.repository }}/contents/.github/properties?ref=${{ github.ref_name }}
        run: gh api -H "$ACCEPT_RAW" "$PROPERTIES_URL" >> "$GITHUB_OUTPUT"

  wait-for-images:
    name: Wait for images on Quay.io
    runs-on: ubuntu-latest
    if: >- # Skip if no clusters are going to be created.
      inputs.create-k8s-cluster != false ||
      inputs.create-os4-cluster != false ||
      inputs.create-long-cluster != false
    strategy:
      matrix:
        image: [main, scanner, scanner-db, collector]
    steps:
      - name: Checkout local action
        uses: actions/checkout@v4
        with:
          repository: stackrox/actions
          path: .actions
          ref: ${{ inputs.workflow-ref }}
      - name: Wait for the ${{matrix.image}} image
        uses: ./.actions/release/wait-for-image
        with:
          token: ${{secrets.QUAY_RHACS_ENG_BEARER_TOKEN}}
          image: "rhacs-eng/${{ matrix.image }}:${{ inputs.version }}"
          # Do not wait if running dry
          interval: ${{ fromJSON('["30", "0"]')[inputs.dry-run == true] }}
          limit: ${{ fromJSON(format('["{0}","{1}"]', env.TIMEOUT_WAIT_FOR_IMAGES_SECONDS, 0))[inputs.dry-run == true] }}

  create-k8s-cluster:
    name: Create k8s cluster
    needs: [wait-for-images]
    if: inputs.dry-run != true && inputs.create-k8s-cluster != false
    runs-on: ubuntu-latest
    steps:
      - name: Checkout local action
        uses: actions/checkout@v4
        with:
          repository: stackrox/actions
          path: .actions
          ref: ${{ inputs.workflow-ref }}
      - uses: ./.actions/infra/create-cluster
        with:
          token: ${{ secrets.INFRA_TOKEN }}
          flavor: qa-demo
          name: qa-k8s-${{ inputs.version }}
          args: main-image=quay.io/rhacs-eng/main:${{ inputs.version }},central-db-image=quay.io/rhacs-eng/central-db:${{ inputs.version }}
          lifespan: 48h

  notify-k8s-cluster:
    name: Notify about K8s cluster creation
    needs: [properties, create-k8s-cluster]
    runs-on: ubuntu-latest
    env:
      NAME: qa-k8s-${{ inputs.version }}
    steps:
      - name: Determine demo url and cluster name
        id: get_demo_artifacts
        run: |
          echo "cluster-name=${NAME//./-}" >> "$GITHUB_OUTPUT"
          echo "url=https://${NAME//[.-]/}.demos.rox.systems/login" >> "$GITHUB_OUTPUT"
      - name: Post to Slack
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
        uses: slackapi/slack-github-action@v1.27.0
        with:
          channel-id: ${{ needs.properties.outputs.slack-channel }}
          payload: >-
            {
              "text": "QA Demo cluster is being created. Check #acs-infra-notifications for cluster access.",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": ":tada: *<https://infra.rox.systems/cluster/${{ steps.get_demo_artifacts.outputs.cluster-name }}|QA demo cluster> `${{ steps.get_demo_artifacts.outputs.cluster-name }}` is being created for ${{ inputs.version }} milestone of <${{ github.server_url }}/${{ github.repository }}|${{ github.repository }}>.*"
                  }
                },
                {
                  "type": "divider"
                },
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": ":arrow_right: When it is ready in ca. 20 minutes, a notification will be posted in #acs-infra-notifications channel, and the cluster will be accessible at ${{ steps.get_demo_artifacts.outputs.url }}. You can find the admin password and kubeconfig with `infractl artifacts ${{ steps.get_demo_artifacts.outputs.cluster-name }}`."
                  }
                }
              ]
            }

  create-os4-cluster:
    name: Create OS4 cluster
    needs: [wait-for-images]
    if: inputs.dry-run == false && inputs.create-os4-cluster == true
    runs-on: ubuntu-latest
    steps:
      - name: Checkout local action
        uses: actions/checkout@v4
        with:
          repository: stackrox/actions
          path: .actions
          ref: ${{ inputs.workflow-ref }}
      - uses: ./.actions/infra/create-cluster
        with:
          token: ${{ secrets.INFRA_TOKEN }}
          flavor: openshift-4-demo
          name: openshift-4-demo-${{ inputs.version }}
          args: central-services-helm-chart-version=${{ inputs.version }},secured-cluster-services-helm-chart-version=${{ inputs.version }}
          lifespan: 48h

  notify-os4-cluster:
    name: Notify about Openshift cluster creation
    needs: [properties, create-os4-cluster]
    runs-on: ubuntu-latest
    env:
      NAME: openshift-4-demo-${{ inputs.version }}
    steps:
      - name: Determine demo url and cluster name
        id: get_demo_artifacts
        run: |
          echo "cluster-name=${NAME//./-}" >> "$GITHUB_OUTPUT"
          echo "url=https://central-stackrox.apps.${NAME//./-}.ocp.infra.rox.systems/login" >> "$GITHUB_OUTPUT"
      - name: Post to Slack
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
        uses: slackapi/slack-github-action@v1.27.0
        with:
          channel-id: ${{ needs.properties.outputs.slack-channel }}
          payload: >-
            {
              "text": "Openshift 4 Demo cluster is being created. Check #acs-infra-notifications for cluster access.",

              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": ":tada: *<https://infra.rox.systems/cluster/${{ steps.get_demo_artifacts.outputs.cluster-name }}|Openshift 4 Demo cluster> `${{ steps.get_demo_artifacts.outputs.cluster-name }}` is being created for ${{ inputs.version }} milestone of <${{ github.server_url }}/${{ github.repository }}|${{ github.repository }}>.*"
                  }
                },
                {
                  "type": "divider"
                },
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": ":arrow_right: The cluster will be accessible at ${{ steps.get_demo_artifacts.outputs.url }} in ~40 minutes. You can find the admin password and kubeconfig with `infractl artifacts ${{ steps.get_demo_artifacts.outputs.cluster-name }}`."
                  }
                }
              ]
            }

  create-long-running-cluster-for-fake-load:
    name: Create GKE long-running cluster for fake load
    needs: [wait-for-images]
    if: >-
      inputs.dry-run != true &&
      inputs.create-long-cluster == true
    runs-on: ubuntu-latest
    steps:
      - name: Checkout local action
        uses: actions/checkout@v4
        with:
          repository: stackrox/actions
          path: .actions
          ref: ${{ inputs.workflow-ref }}
      - uses: ./.actions/infra/create-cluster
        with:
          token: ${{ secrets.INFRA_TOKEN }}
          flavor: gke-default
          name: ${{ inputs.cluster-with-fake-load-name }}
          lifespan: 168h
          args: nodes=5,machine-type=e2-standard-8
          wait: true

  # TODO ROX-19190 Don't DRY. Make this and the above into a separate action.
  create-long-running-cluster-for-real-load:
    name: Create GKE long-running cluster for real load
    needs: [wait-for-images]
    if: >-
      inputs.dry-run != true &&
      inputs.create-long-cluster == true
    runs-on: ubuntu-latest
    steps:
      - name: Checkout local action
        uses: actions/checkout@v4
        with:
          repository: stackrox/actions
          path: .actions
          ref: ${{ inputs.workflow-ref }}
      - uses: ./.actions/infra/create-cluster
        with:
          token: ${{ secrets.INFRA_TOKEN }}
          flavor: gke-default
          name: ${{ inputs.cluster-with-real-load-name }}
          lifespan: 168h
          args: nodes=5,machine-type=e2-standard-8
          wait: true

  start-acs:
    name: Start ACS
    needs: [properties, create-long-running-cluster-for-fake-load]
    runs-on: ubuntu-latest
    outputs:
      rox-password: ${{ steps.launch-central.outputs.rox-password }}
      central-ip: ${{ steps.launch-central.outputs.central-ip }}
    env:
      NAME: ${{ inputs.cluster-with-fake-load-name }}
      KUBECONFIG: artifacts/kubeconfig
      INFRA_TOKEN: ${{secrets.INFRA_TOKEN}}
      USE_GKE_GCLOUD_AUTH_PLUGIN: "True"
    steps:
      - uses: stackrox/actions/infra/install-infractl@v1
      - name: Test readiness
        run: |
          STATUS=$(infractl get "${NAME//./-}" --json | jq -r .Status)
          if [ "$STATUS" != "READY" ]; then
            exit 1
          fi
      - name: Check out stackrox code
        uses: actions/checkout@v4
        with:
          ref: ${{inputs.version}}
          repository: stackrox/stackrox
      - name: Checkout local action
        uses: actions/checkout@v4
        with:
          repository: stackrox/actions
          path: .actions
          ref: ${{ inputs.workflow-ref }}
      - uses: "google-github-actions/auth@v2"
        with:
          credentials_json: "${{ secrets.GCP_RELEASE_AUTOMATION_SA }}"
      - name: "Set up Cloud SDK"
        uses: "google-github-actions/setup-gcloud@v2"
        with:
          install_components: "gke-gcloud-auth-plugin"
      - name: Download artifacts
        id: artifacts
        run: |
          infractl artifacts "${NAME//./-}" -d artifacts >> "$GITHUB_STEP_SUMMARY"
      - name: Launch central
        id: launch-central
        uses: ./.actions/release/start-acs
        with:
          main-image-tag: ${{inputs.version}}
          kubeconfig: ${{ env.KUBECONFIG }}
          pagerduty-integration-key: ${{ secrets.RELEASE_MANAGEMENT_PAGERDUTY_INTEGRATION_KEY }}
          registry-username: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
          registry-password: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
          stackrox-dir: ${{ github.workspace }}
          name: ${{ env.NAME }}

      - name: Post to Slack
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
        uses: slackapi/slack-github-action@v1.27.0
        with:
          channel-id: ${{ needs.properties.outputs.slack-channel }}
          payload: >-
            {
              "text": "Long-running cluster created. Setup your local access with `scripts/release-tools/setup-central-access.sh | bash -s -- ${{ inputs.cluster-with-fake-load-name }}`",

              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": ":tada: *Long-running cluster `${{ inputs.cluster-with-fake-load-name }}` created for ${{ inputs.version }} milestone of <${{ github.server_url }}/${{ github.repository }}|${{ github.repository }}>.*"
                  }
                },
                {
                  "type": "divider"
                },
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": ":arrow_right: Setup your local access to Central by running:\n```./scripts/release-tools/setup-central-access.sh ${{ inputs.cluster-with-fake-load-name }}```\nfrom your local machine."
                  }
                }
              ]
            }

      - name: Start fake workload
        env:
          API_ENDPOINT: localhost:8000
          ROX_PASSWORD: ${{ steps.launch-central.outputs.rox-password }}
        run: |
          kubectl -n stackrox port-forward deploy/central 8000:8443 > /dev/null 2>&1 &
          sleep 20
          ./scale/launch_workload.sh np-load
          echo "Fake workload has been deployed to the long-running cluster" >> "$GITHUB_STEP_SUMMARY"

  start-secured-cluster:
    name: Start secured cluster
    needs: [properties, start-acs, create-long-running-cluster-for-real-load]
    runs-on: ubuntu-latest
    env:
      SECURED_CLUSTER_NAME: ${{ inputs.cluster-with-real-load-name }}
      KUBECONFIG: artifacts/kubeconfig
      INFRA_TOKEN: ${{secrets.INFRA_TOKEN}}
      USE_GKE_GCLOUD_AUTH_PLUGIN: "True"
    steps:
      - uses: stackrox/actions/infra/install-infractl@v1
      - name: Test readiness for secured cluster
        run: |
          STATUS=$(infractl get "${SECURED_CLUSTER_NAME//./-}" --json | jq -r .Status)
          if [ "$STATUS" != "READY" ]; then
            exit 1
          fi
      - name: Check out code
        uses: actions/checkout@v4
        with:
          ref: ${{inputs.version}}
          repository: stackrox/stackrox
      - uses: "google-github-actions/auth@v2"
        with:
          credentials_json: "${{ secrets.GCP_RELEASE_AUTOMATION_SA }}"
      - name: "Set up Cloud SDK"
        uses: "google-github-actions/setup-gcloud@v2"
        with:
          install_components: "gke-gcloud-auth-plugin"
      - name: Download artifacts
        id: artifacts
        run: |
          infractl artifacts "${SECURED_CLUSTER_NAME//./-}" -d artifacts
      - name: Launch secured cluster
        id: launch-secured-cluster
        env:
          MAIN_IMAGE_TAG: ${{inputs.version}} # Release version, e.g. 3.63.0-rc.2.
          REGISTRY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
          REGISTRY_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
          ROX_ADMIN_PASSWORD: ${{ needs.start-acs.outputs.rox-password }}
          ROX_ADMIN_USERNAME: admin
          CENTRAL_IP: ${{ needs.start-acs.outputs.central-ip }}
          CLUSTER_API_ENDPOINT: https://${{ needs.start-acs.outputs.central-ip }}:443
          API_ENDPOINT: ${{ needs.start-acs.outputs.central-ip }}:443
          CLUSTER: secured-cluster
          COLLECTION_METHOD: core_bpf
          MONITORING_SUPPORT: "true"
          STORAGE: pvc
          MONITORING_LOAD_BALANCER: none
          COMMON_DIR: ${{ github.workspace }}/deploy/common
        run: |
          # Overriding COLLECTION_METHOD for 3.x releases because 'core_bpf' was introduced in 4.1.0
          # 4.0 is already out of support
          # TODO(ROX-20631): remove the override after 3.74 is out of support
          if [[ "${MAIN_IMAGE_TAG}" == 3.* ]]; then
            export COLLECTION_METHOD="kernel-module"
          fi
          "${{ github.workspace }}/deploy/k8s/sensor.sh"
          kubectl -n stackrox create secret generic access-rhacs \
            --from-literal="username=${ROX_ADMIN_USERNAME}" \
            --from-literal="password=${ROX_ADMIN_PASSWORD}" \
            --from-literal="central_url=${CLUSTER_API_ENDPOINT}"

          echo "Deploying Monitoring..."
          helm_args=(
            --set persistence.type="${STORAGE}"
            --set exposure.type="${MONITORING_LOAD_BALANCER}"
          )
         
          helm dependency update "${COMMON_DIR}/../charts/monitoring"
          envsubst < "${COMMON_DIR}/../charts/monitoring/values.yaml" > "${COMMON_DIR}/../charts/monitoring/values_substituted.yaml"
          helm upgrade -n stackrox --install --create-namespace stackrox-monitoring "${COMMON_DIR}/../charts/monitoring" --values "${COMMON_DIR}/../charts/monitoring/values_substituted.yaml" "${helm_args[@]}"
          rm "${COMMON_DIR}/../charts/monitoring/values_substituted.yaml"
          echo "Deployed Monitoring..."

  start-kube-burner:
    name: Start kube-burner
    needs: [properties, start-secured-cluster]
    runs-on: ubuntu-latest
    env:
      SECURED_CLUSTER_NAME: ${{ inputs.cluster-with-real-load-name }}
      KUBECONFIG: ${{ github.workspace }}/artifacts/kubeconfig
      INFRA_TOKEN: ${{secrets.INFRA_TOKEN}}
      USE_GKE_GCLOUD_AUTH_PLUGIN: "True"
    steps:
      - uses: stackrox/actions/infra/install-infractl@v1
      - name: Check out kube-burner config repository code
        uses: actions/checkout@v4
        with:
          repository: stackrox/${{ inputs.kube-burner-config-repo }}
          path: .kube-burner-config
          ref: ${{ inputs.kube-burner-config-ref }}
      - name: Check out cloud-bulldozer/benchmark-operator code
        run: |
          git clone https://github.com/cloud-bulldozer/benchmark-operator.git
          cd ${{ github.workspace }}/benchmark-operator
          git checkout 081359d2a90ba556a603840b18015d10d05a89ec
      - name: Checkout local action
        uses: actions/checkout@v4
        with:
          repository: stackrox/actions
          path: .actions
          ref: ${{ inputs.workflow-ref }}
      - uses: "google-github-actions/auth@v2"
        with:
          credentials_json: "${{ secrets.GCP_RELEASE_AUTOMATION_SA }}"
      - name: "Set up Cloud SDK"
        uses: "google-github-actions/setup-gcloud@v2"
        with:
          install_components: "gke-gcloud-auth-plugin"
      - name: Download artifacts
        id: artifacts
        run: |
          infractl artifacts "${SECURED_CLUSTER_NAME//./-}" -d ${{ github.workspace }}/artifacts
      - name: Launch kube-burner
        id: launch-kube-burner
        env:
          REGISTRY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
          REGISTRY_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
        uses: ./.actions/release/start-kube-burner
        with:
          kube-burner-config-dir: ./.kube-burner-config/scripts/release-tools/kube-burner-configs
          benchmark-operator-dir: ${{ github.workspace }}/benchmark-operator

  notify-failed-clusters:
    name: Notify about failed cluster creation
    needs:
      [
        properties,
        create-k8s-cluster,
        create-os4-cluster,
        create-long-running-cluster-for-fake-load,
        create-long-running-cluster-for-real-load,
      ]
    if:
      >- # Required as create-*-cluster jobs could be skipped while other jobs could fail.
      always() && (
        needs.create-k8s-cluster.result == 'failure' ||
        needs.create-os4-cluster.result == 'failure' ||
        needs.create-long-running-cluster-for-fake-load.result == 'failure' ||
        needs.create-long-running-cluster-for-real-load.result == 'failure'
      )
    runs-on: ubuntu-latest
    steps:
      - name: Post to Slack
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
        uses: slackapi/slack-github-action@v1.27.0
        with:
          channel-id: ${{ needs.properties.outputs.slack-channel }}
          payload: >-
            {
              "text": "Couldn't create test cluster. Check <${{github.server_url}}/${{github.repository}}/actions/runs/${{github.run_id}}|${{github.workflow}}>" for details",

              "blocks": [
              { "type": "section", "text": { "type": "mrkdwn", "text":
              ":red_circle: *Couldn't create test clusters for ${{inputs.version}} milestone of <${{github.server_url}}/${{github.repository}}|${{github.repository}}>.*" }},

            { "type": "divider" },

            { "type": "section", "text": { "type": "mrkdwn", "text":
            ":arrow_right: *Please investigate the output of the
            <${{github.server_url}}/${{github.repository}}/actions/runs/${{github.run_id}}|${{github.workflow}}>
            workflow run and then restart the workflow.*" }},

            { "type": "section", "text": { "type": "mrkdwn", "text":
            ">
            Repository: <${{github.server_url}}/${{github.repository}}|${{github.repository}}>\n>
            Milestone: ${{inputs.version}}\n>
            Workflow: <${{github.server_url}}/${{github.repository}}/actions/runs/${{github.run_id}}|${{github.workflow}}>" }}
            ]}