KubeArmor/.github/workflows/ci-test-lvh-matrix.yml at 56c0c15c6279ee92f7d7702af0a545ec81a50df9 · asmit27rai/KubeArmor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
name: ci-test-lvh-matrix

on:
  workflow_call:

# Declare default permissions as read only.
permissions: read-all

jobs:
  run-lvh-tests:
    name: "LVH Matrix Tests"
    runs-on: ubuntu-latest
    timeout-minutes: 30
    strategy:
      fail-fast: false # Prevents one failing VM from cancelling the other
      matrix:
        # Grouping the configurations ensures we only test the specific pairs you requested
        vm_config:
          - test_name: 'Kernel v4.18 (RHEL 8.10) / Debian 12 / Clang 14'
            image: 'base-bookworm'
            image_version: 'latest'
            image_repo: 'docker.io/kubearmor'
            kernel_version: 'rhel8.10-main'
          - test_name: 'Kernel v5.4 / Debian 12 / Clang 14'
            image: 'base-bookworm'
            image_version: 'latest'
            image_repo: 'docker.io/kubearmor'
            kernel_version: '5.4-main'
          - test_name: 'Kernel v6.0 / Debian 13 / Clang 19'
            image: 'base-trixie'
            image_version: 'latest'
            image_repo: 'docker.io/kubearmor'
            kernel_version: '6.0-main'
          - test_name: 'Kernel v6.18 / Debian 13 / Clang 19'
            image: 'base-trixie'
            image_version: 'latest'
            image_repo: 'docker.io/kubearmor'
            kernel_version: '6.18-main'
          - test_name: 'Kernel v7.2 / Debian 13 / Clang 19'
            image: 'base-trixie'
            image_version: 'latest'
            image_repo: 'docker.io/kubearmor'
            kernel_version: 'bpf-next-main'

    steps:
      - name: Checkout KubeArmor repository
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
        with:
          go-version-file: 'KubeArmor/go.mod'

      - name: Install the latest LLVM toolchain
        run: ./.github/workflows/install-llvm.sh

      - name: Install libbpf headers
        run: sudo apt-get update && sudo apt-get install -y libbpf-dev

      - name: Install bpftool
        run: ./.github/workflows/install-bpftool.sh

      - name: Generate vmlinux.h
        run: make -C BPF kernel_headers
        working-directory: KubeArmor

      - name: Generate BPF files
        run: go generate ./...
        working-directory: KubeArmor

      - name: Build system monitor loader binary
        working-directory: KubeArmor/monitor
        run: go build ci_load.go

      - name: Build enforcer loader binary
        working-directory: KubeArmor/enforcer/bpflsm/ci_loader
        run: go build -o ci_load main.go

      - name: Spin up VM and Run Tests
        uses: cilium/little-vm-helper@5ae749011735fd77f30f38add52f1a53a5568671 # v0.0.30
        with:
          # Create a dynamic, unique name for the test run based on the matrix
          test-name: ${{ matrix.vm_config.test_name }}

          # Pass the matrix variables into the action
          image: ${{ matrix.vm_config.image }}
          image-repo: ${{ matrix.vm_config.image_repo }}
          image-version: ${{ matrix.vm_config.image_version }}

          # Providing this triggers lvh to pull the specific kernel dynamically
          kernel-version: ${{ matrix.vm_config.kernel_version }}

          # Mandatory for setting up QEMU on GitHub-hosted runners
          install-dependencies: 'true'

          # Mount the checked-out KubeArmor code into the VM at /host
          host-mount: ${{ github.workspace }}

          # The commands to run inside the VM over SSH
          cmd: |
            # Remount root filesystem as read-write
            mount -o remount,rw /

            # Mount KubeArmor dir
            mkdir -p /tmp/KubeArmor
            mount -t 9p -o trans=virtio,version=9p2000.L host_mount /tmp/KubeArmor

            # Set the KubeArmor directory as a safe directory for Git
            git config --global --add safe.directory /tmp/KubeArmor

            # Set DNS to a public resolver to avoid DNS resolution issues in the VM
            rm /etc/resolv.conf
            echo "nameserver 1.1.1.1" > /etc/resolv.conf

            # Compile system monitor eBPF bytecode
            cd /tmp/KubeArmor/KubeArmor/BPF
            make

            # Load system monitor eBPF bytecode
            echo "Testing system monitor eBPF bytecode load..."
            cd ../monitor/
            ./ci_load

            # Load enforcer eBPF bytecode if BPF-LSM is enabled
            if grep -q "bpf" /sys/kernel/security/lsm; then
              echo "Testing enforcer eBPF bytecode load..."
              cd ../enforcer/bpflsm/ci_loader
              ./ci_load
            else
              echo "BPF-LSM not enabled, skipping enforcer eBPF bytecode load"
            fi