Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dbp 1012 setup loadtest env #11

Open
wants to merge 36 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 17 additions & 4 deletions .github/workflows/install-and-run-spsh-loadtest.yml
Original file line number Diff line number Diff line change
Expand Up @@ -16,14 +16,14 @@ on:
type: string
required: false
default: "debug"
scenario:
scenario-list:
simoncolincap marked this conversation as resolved.
Show resolved Hide resolved
type: string
required: true
default: dev-scenario
execute:
type: boolean
required: true
default: true
default: false

secrets:
KUBECONFIG:
Expand Down Expand Up @@ -103,8 +103,21 @@ jobs:
echo "Lowercase branch: $LOWERCASE_BRANCH"
echo "::set-output name=lowercase_branch::$LOWERCASE_BRANCH"

- name: Trigger Loadtest CronJob
- name: Split the input string into an array
if: ${{ inputs.execute }}
run: |
kubectl create job --from=cronjob/loadtest-spsh-${{inputs.scenario}} ${{ inputs.scenario}}-${{steps.convert_branch.outputs.lowercase_branch}}-$(date +%d.%m.%Y-%H%M) -n spsh
IFS=',' read -ra SCENARIOS <<< "${{ github.event.inputs.scenario-list }}"
echo "SCENARIOS=${SCENARIOS[@]}" >> $GITHUB_ENV

- name: Trigger Loadtest CronJob
if: ${{ inputs.execute }}

#run: |

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this commented out code needed?

# kubectl create job --from=cronjob/loadtest-spsh-${{matrix.scenario}} ${{ matrix.scenario}}-${{steps.convert_branch.outputs.lowercase_branch}}-$(date +%d.%m.%Y-%H%M) -n spsh
# kubectl create job --from=cronjob/<cronjob-name> <job-name> -n <namespace-name>

run: |
for scenario in "${SCENARIOS[@]}"; do
kubectl create job --from=cronjob/loadtest-spsh-${scenario} ${scenario}-${{ steps.convert_branch.outputs.lowercase_branch }}-$(date +%d.%m.%Y-%H%M) -n spsh
done
shell: bash
8 changes: 4 additions & 4 deletions .github/workflows/trigger-loadtest.yml
Original file line number Diff line number Diff line change
Expand Up @@ -19,16 +19,16 @@ on:
required: false
type: string
default: "debug"
scenario:
description: 'name of test scenario defined in values.yaml'
scenario-list:
description: 'name list of test scenarios defined in values.yaml (scenario1,scenario2,...)'
type: string
required: true
default: dev-scenario
execute:
description: "execute cronjob scenario after install"
type: boolean
required: true
default: true
default: false

jobs:
install_loadtest:
Expand All @@ -41,7 +41,7 @@ jobs:
branch: ${{ inputs.branch }}
pattern: ${{ inputs.pattern }}
config: ${{ inputs.config }}
scenario: ${{ inputs.scenario }}
scenario-list: ${{ inputs.scenario-list }}
execute: ${{ inputs.execute }}
secrets:
KUBECONFIG: ${{ secrets.KUBECONFIG }}
Expand Down
7 changes: 7 additions & 0 deletions charts/schulportal-load-tests/templates/cronjob.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,14 @@
readOnly: true
ports:
- containerPort: {{ $.Values.port }}
name: loadtest-pod

Check warning on line 56 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] Container Running As Root

Containers should only run as non-root user. This limits the exploitability of security misconfigurations and restricts an attacker's possibilities in case of compromise

Check warning on line 56 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] Container Running As Root

Containers should only run as non-root user. This limits the exploitability of security misconfigurations and restricts an attacker's possibilities in case of compromise

Check warning on line 56 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] Container Running With Low UID

Check if containers are running with low UID, which might cause conflicts with the host's user table.

Check warning on line 56 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] Container Running With Low UID

Check if containers are running with low UID, which might cause conflicts with the host's user table.

Check warning on line 56 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] NET_RAW Capabilities Not Being Dropped

Containers should drop 'ALL' or at least 'NET_RAW' capabilities

Check warning on line 56 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] NET_RAW Capabilities Not Being Dropped

Containers should drop 'ALL' or at least 'NET_RAW' capabilities

Check warning on line 56 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] Seccomp Profile Is Not Configured

Containers should be configured with a secure Seccomp profile to restrict potentially dangerous syscalls

Check warning on line 56 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[MEDIUM] Seccomp Profile Is Not Configured

Containers should be configured with a secure Seccomp profile to restrict potentially dangerous syscalls
resources:

Check warning on line 57 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[LOW] Container Requests Not Equal To It's Limits

Containers must have the same resource requests set as limits. This is recommended to avoid resource DDoS of the node during spikes and means that 'requests.memory' and 'requests.cpu' must equal 'limits.memory' and 'limits.cpu', respectively

Check warning on line 57 in charts/schulportal-load-tests/templates/cronjob.yaml

View workflow job for this annotation

GitHub Actions / scan_helm / Kics Helm Chart Scan

[LOW] Container Requests Not Equal To It's Limits

Containers must have the same resource requests set as limits. This is recommended to avoid resource DDoS of the node during spikes and means that 'requests.memory' and 'requests.cpu' must equal 'limits.memory' and 'limits.cpu', respectively
limits:
memory: "12288Mi"
cpu: "3500m"
requests:
memory: "8192Mi"
cpu: "3000m"
volumes:
- name: secret-volume
secret:
Expand Down
12 changes: 6 additions & 6 deletions charts/schulportal-load-tests/values.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -9,13 +9,13 @@ cronjobs:
dev-scenario:
serviceName: dev-scenario
spsh_base: "https://main.dev.spsh.dbildungsplattform.de"
kc_base: "kc_base"
kc_base: "main-keycloak.dev.spsh.dbildungsplattform.de"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i think the https:// may be missing here, if not please standardize how urls are provided

# jobsParallelism: not used yet but available? test it
# staging-scenario:
# serviceName: staging-scenario
# image: ghcr.io/dbildungsplattform/schulportal-load-tests:latest
# environment: spsh.staging.dbildungsplattform.de
dev-scenario-looptest:
serviceName: dev-scenario-looptest
spsh_base: "https://main.dev.spsh.dbildungsplattform.de"
kc_base: "main-keycloak.dev.spsh.dbildungsplattform.de"

# prod-scenario:
# serviceName: prod-scenario
# image: ghcr.io/dbildungsplattform/schulportal-load-tests:latest
# environment: spsh.dbildungsplattform.de
Loading