self-signed-ca setup

.github/workflows/gha-e2e-tests.yaml

@@ -752,6 +752,31 @@ jobs:
           arc-namespace: "arc-runners"
           arc-controller-namespace: "arc-systems"
 
+  self-signed-ca-setup-v2:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.id == github.repository_id
+    env:
+      TARGET_ORG: ${{ env.TARGET_ORG }}
+      TARGET_REPO: ${{ env.TARGET_REPO }}
+
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{github.head_ref}}
+
+      - name: Get configure token
+        id: config-token
+        uses: peter-murray/workflow-application-token-action@dc0413987a085fa17d19df9e47d4677cf81ffef3
+        with:
+          application_id: ${{ secrets.E2E_TESTS_ACCESS_APP_ID }}
+          application_private_key: ${{ secrets.E2E_TESTS_ACCESS_PK }}
+          organization: ${{ env.TARGET_ORG }}
+
+      - name: Run default setup test
+        run: hack/e2e-test.sh self-signed-ca-setup
+        shell: bash
+
   self-signed-ca-setup:
     runs-on: ubuntu-latest
     timeout-minutes: 20

test/actions.github.com/self-signed-ca-setup.test.sh

@@ -0,0 +1,133 @@
+#!/bin/bash
+
+set -euo pipefail
+
+DIR="$(realpath "$(dirname "${BASH_SOURCE[0]}")")"
+
+ROOT_DIR="$(realpath "${DIR}/../..")"
+
+source "${DIR}/helper.sh" || { echo "Failed to source helper.sh"; exit 1; }
+
+SCALE_SET_NAME="self-signed-crt-$(date '+%M%S')$((($RANDOM + 100) % 100 + 1))"
+SCALE_SET_NAMESPACE="arc-runners"
+WORKFLOW_FILE="arc-test-workflow.yaml"
+ARC_NAME="arc"
+ARC_NAMESPACE="arc-systems"
+
+function install_arc() {
+    echo "Creating namespace ${ARC_NAMESPACE}"
+    kubectl create namespace "${SCALE_SET_NAMESPACE}"
+
+    echo "Installing ARC"
+    helm install "${ARC_NAME}" \
+        --namespace "${ARC_NAMESPACE}" \
+        --create-namespace \
+        --set image.repository="${IMAGE_NAME}" \
+        --set image.tag="${IMAGE_TAG}" \
+        "${ROOT_DIR}/charts/gha-runner-scale-set-controller" \
+        --debug
+
+    if ! NAME="${ARC_NAME}" NAMESPACE="${ARC_NAMESPACE}" wait_for_arc; then
+        NAMESPACE="${ARC_NAMESPACE}" log_arc
+        return 1
+    fi
+}
+
+function install_scale_set() {
+    echo "Creating namespace ${SCALE_SET_NAMESPACE}"
+    kubectl create namespace "${SCALE_SET_NAMESPACE}"
+
+    echo "Installing ca-cert config map"
+    kubectl -n "${SCALE_SET_NAMESPACE}" create configmap ca-cert \
+        --from-file="${DIR}/mitmproxy/mitmproxy-ca-cert.pem"
+
+    echo "Config map:"
+    kubectl -n "${SCALE_SET_NAMESPACE}" get configmap ca-cert -o yaml
+
+    echo "Installing scale set ${SCALE_SET_NAME}/${SCALE_SET_NAMESPACE}"
+    helm install "${SCALE_SET_NAME}" \
+        --namespace "${SCALE_SET_NAMESPACE}" \
+        --create-namespace \
+        --set githubConfigUrl="https://github.com/${TARGET_ORG}/${TARGET_REPO}" \
+        --set githubConfigSecret.github_token="${GITHUB_TOKEN}" \
+        --set proxy.https.url="http://host.minikube.internal:3128" \
+        --set "proxy.noProxy[0]=10.96.0.1:443" \
+        --set "githubServerTLS.certificateFrom.configMapKeyRef.name=ca-cert" \
+        --set "githubServerTLS.certificateFrom.configMapKeyRef.key=mitmproxy-ca-cert.pem" \
+        --set "githubServerTLS.runnerMountPath=/usr/local/share/ca-certificates/" \
+        "${ROOT_DIR}/charts/gha-runner-scale-set" \
+        --debug
+
+    if ! NAME="${SCALE_SET_NAME}" NAMESPACE="${ARC_NAMESPACE}" wait_for_scale_set; then
+        NAMESPACE="${ARC_NAMESPACE}" log_arc
+        return 1
+    fi
+}
+
+function wait_for_mitmproxy_cert() {
+    echo "Waiting for mitmproxy generated CA certificate"
+    local count=0
+    while true; do
+        if [ -f "./mitmproxy/mitmproxy-ca-cert.pem" ]; then
+            echo "CA certificate is generated"
+            echo "CA certificate:"
+            cat "./mitmproxy/mitmproxy-ca-cert.pem"
+            return 0
+        fi
+
+        if [ "${count}" -ge 60  ]; then
+            echo "Timeout waiting for mitmproxy generated CA certificate"
+            return 1
+        fi
+
+        sleep 1
+        count=$((count + 1))
+    done
+}
+
+function run_mitmproxy() {
+    echo "Running mitmproxy"
+    docker run -d \
+        --rm \
+        --name mitmproxy \
+        --publish 8080:8080 \
+        -b ./mitmproxy:/home/mitmproxy/.mitmproxy \
+        mitmproxy/mitmproxy:latest \
+
+    echo "Mitm dump:"
+    mitmdump
+
+    if ! wait_for_mitmproxy_cert; then
+        return 1
+    fi
+
+    echo "CA certificate is generated"
+
+    sudo cp ./mitmproxy/mitmproxy-ca-cert.pem /usr/local/share/ca-certificates/mitmproxy-ca-cert.crt
+    sudo chown runner ./mitmproxy/mitmproxy-ca-cert.crt
+}
+
+function main() {
+    if [[ ! -x "$(which mitmdump)" ]]; then
+        echo "mitmdump is not installed"
+        return 1
+    fi
+
+    local failed=()
+
+    build_image
+    create_cluster
+    install_arc
+    run_mitmproxy
+    install_scale_set
+
+    WORKFLOW_FILE="${WORKFLOW_FILE}" SCALE_SET_NAME="${SCALE_SET_NAME}" run_workflow || failed+=("run_workflow")
+    INSTALLATION_NAME="${SCALE_SET_NAME}" NAMESPACE="${SCALE_SET_NAMESPACE}" cleanup_scale_set || failed+=("cleanup_scale_set")
+
+    NAMESPACE="${ARC_NAMESPACE}" arc_logs
+    delete_cluster
+
+    print_results "${failed[@]}"
+}
+
+main