feat(execd): add filesystem execution identity core #2721
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Kubernetes nightly build (Monorepo) | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| packages: write | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: "0 20 * * *" | |
| pull_request: | |
| branches: [ main ] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| changes: | |
| uses: ./.github/workflows/detect-changes.yml | |
| with: | |
| area: kubernetes-mini-e2e | |
| # Full Kubernetes version sweep for the controller core e2e suite. | |
| # PRs only run the boundary versions in kubernetes-test.yml; this job keeps | |
| # every supported version covered nightly. | |
| controller-e2e-core-matrix: | |
| name: Controller E2E Core Full Matrix (Kubernetes v${{ matrix.version }}) | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| version: ["1.22.4", "1.24.4", "1.26.4", "1.28.6", "1.30.4", "1.32.2", "1.34.2"] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: '1.25.0' | |
| - name: Run core e2e tests | |
| working-directory: kubernetes | |
| run: | | |
| make test-e2e-core KIND_K8S_VERSION=v${{ matrix.version }} | |
| k8s-mini-e2e: | |
| name: Kubernetes mini E2E (${{ matrix.variant }}) | |
| needs: changes | |
| if: needs.changes.outputs.relevant == 'true' | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - variant: direct | |
| script: scripts/python-k8s-e2e.sh | |
| e2e_gateway_route_mode: "" | |
| - variant: ingress-header | |
| script: scripts/python-k8s-e2e-ingress.sh | |
| e2e_gateway_route_mode: "" | |
| - variant: ingress-uri | |
| script: scripts/python-k8s-e2e-ingress.sh | |
| e2e_gateway_route_mode: uri | |
| env: | |
| KIND_CLUSTER: opensandbox-e2e | |
| KIND_K8S_VERSION: v1.30.4 | |
| KUBECONFIG_PATH: /tmp/opensandbox-kind-kubeconfig | |
| KUBECONFIG: /tmp/opensandbox-kind-kubeconfig | |
| OPENSANDBOX_E2E_SANDBOX_CPU: 250m | |
| OPENSANDBOX_E2E_SANDBOX_MEMORY: 512Mi | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.11" | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: "1.25.0" | |
| - name: Add Go bin to PATH | |
| run: echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH" | |
| - name: Set up uv | |
| uses: astral-sh/setup-uv@v7 | |
| with: | |
| version: "latest" | |
| - name: Set up kubectl | |
| uses: azure/setup-kubectl@v4 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@v4 | |
| - name: Run Kubernetes runtime E2E | |
| env: | |
| E2E_GATEWAY_ROUTE_MODE: ${{ matrix.e2e_gateway_route_mode }} | |
| run: bash "./${{ matrix.script }}" | |
| - name: Dump kind diagnostics | |
| if: always() | |
| run: | | |
| kubectl get pods -A -o wide || true | |
| kubectl get batchsandboxes -A || true | |
| kubectl get pv,pvc -A || true | |
| kubectl describe deployment -n opensandbox-system opensandbox-controller-manager || true | |
| kubectl describe deployment -n opensandbox-system opensandbox-server || true | |
| kubectl get svc -n opensandbox-system opensandbox-server || true | |
| - name: Eval in-cluster server logs | |
| if: always() | |
| run: | | |
| kubectl logs -n opensandbox-system deployment/opensandbox-server || true | |
| cat /tmp/opensandbox-server-port-forward.log || true | |
| - name: Upload Python test artifacts | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: python-k8s-e2e-logs-${{ matrix.variant }} | |
| path: | | |
| /tmp/opensandbox-server-port-forward.log | |
| /tmp/opensandbox-ingress-gateway-port-forward.log | |
| if-no-files-found: ignore | |
| retention-days: 5 | |
| - name: Clean up Kind cluster | |
| if: always() | |
| run: | | |
| kind delete cluster --name "${KIND_CLUSTER}" || true | |
| execd-init-e2e: | |
| name: Execd-Init + Hardening E2E | |
| needs: changes | |
| if: needs.changes.outputs.relevant == 'true' | |
| runs-on: ubuntu-latest | |
| env: | |
| KIND_CLUSTER: opensandbox-e2e | |
| KIND_K8S_VERSION: v1.30.4 | |
| KUBECONFIG_PATH: /tmp/opensandbox-kind-kubeconfig | |
| KUBECONFIG: /tmp/opensandbox-kind-kubeconfig | |
| OPENSANDBOX_E2E_SANDBOX_CPU: 250m | |
| OPENSANDBOX_E2E_SANDBOX_MEMORY: 512Mi | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.11" | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: "1.25.0" | |
| - name: Add Go bin to PATH | |
| run: echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH" | |
| - name: Set up uv | |
| uses: astral-sh/setup-uv@v7 | |
| with: | |
| version: "latest" | |
| - name: Set up kubectl | |
| uses: azure/setup-kubectl@v4 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@v4 | |
| - name: Run execd-init + hardening E2E | |
| run: bash scripts/python-k8s-execd-init-e2e.sh | |
| - name: Dump kind diagnostics | |
| if: always() | |
| run: | | |
| kubectl get pods -A -o wide || true | |
| kubectl get batchsandboxes -A || true | |
| kubectl describe deployment -n opensandbox-system opensandbox-server || true | |
| - name: Eval in-cluster server logs | |
| if: always() | |
| run: | | |
| kubectl logs -n opensandbox-system deployment/opensandbox-server || true | |
| cat /tmp/opensandbox-server-port-forward.log || true | |
| - name: Upload Python test artifacts | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: execd-init-e2e-logs | |
| path: | | |
| /tmp/opensandbox-server-port-forward.log | |
| /tmp/opensandbox-e2e-pods.yaml | |
| /tmp/opensandbox-e2e-batchsandboxes.yaml | |
| if-no-files-found: ignore | |
| retention-days: 5 | |
| - name: Clean up Kind cluster | |
| if: always() | |
| run: | | |
| kind delete cluster --name "${KIND_CLUSTER}" || true | |
| k8s-pool-e2e: | |
| name: Kubernetes Pool E2E (ingress-header) | |
| needs: changes | |
| if: needs.changes.outputs.relevant == 'true' | |
| runs-on: ubuntu-latest | |
| env: | |
| KIND_CLUSTER: opensandbox-e2e | |
| KIND_K8S_VERSION: v1.30.4 | |
| KUBECONFIG_PATH: /tmp/opensandbox-kind-kubeconfig | |
| KUBECONFIG: /tmp/opensandbox-kind-kubeconfig | |
| OPENSANDBOX_E2E_SANDBOX_CPU: 250m | |
| OPENSANDBOX_E2E_SANDBOX_MEMORY: 512Mi | |
| E2E_TEST_SUITE: pool | |
| E2E_GATEWAY_ROUTE_MODE: "" | |
| # Catch event-loop cross-thread misuse in the pool warmup loop. | |
| PYTHONASYNCIODEBUG: "1" | |
| # Lifecycle-stress test round count (tests/python POOL_STRESS_ROUNDS). | |
| POOL_STRESS_ROUNDS: "10" | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.11" | |
| - name: Set up Go | |
| uses: actions/setup-go@v6 | |
| with: | |
| go-version: "1.25.0" | |
| - name: Add Go bin to PATH | |
| run: echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH" | |
| - name: Set up uv | |
| uses: astral-sh/setup-uv@v7 | |
| with: | |
| version: "latest" | |
| - name: Set up kubectl | |
| uses: azure/setup-kubectl@v4 | |
| - name: Set up Helm | |
| uses: azure/setup-helm@v4 | |
| - name: Run Kubernetes Pool E2E | |
| run: bash scripts/python-k8s-e2e-ingress.sh | |
| - name: Dump kind diagnostics | |
| if: always() | |
| run: | | |
| kubectl get pods -A -o wide || true | |
| kubectl get batchsandboxes -A || true | |
| kubectl get pools -A || true | |
| kubectl get pv,pvc -A || true | |
| kubectl describe deployment -n opensandbox-system opensandbox-controller-manager || true | |
| kubectl describe deployment -n opensandbox-system opensandbox-server || true | |
| kubectl get svc -n opensandbox-system opensandbox-server || true | |
| - name: Eval in-cluster server logs | |
| if: always() | |
| run: | | |
| kubectl logs -n opensandbox-system deployment/opensandbox-server || true | |
| cat /tmp/opensandbox-server-port-forward.log || true | |
| - name: Upload Python test artifacts | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: python-k8s-pool-e2e-logs | |
| path: | | |
| /tmp/opensandbox-server-port-forward.log | |
| /tmp/opensandbox-ingress-gateway-port-forward.log | |
| if-no-files-found: ignore | |
| retention-days: 5 | |
| - name: Clean up Kind cluster | |
| if: always() | |
| run: | | |
| kind delete cluster --name "${KIND_CLUSTER}" || true | |
| publish-nightly-latest: | |
| name: Publish latest (${{ matrix.component }} nightly) | |
| needs: [k8s-mini-e2e, k8s-pool-e2e, execd-init-e2e] | |
| if: github.event_name != 'pull_request' | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - component: execd | |
| workdir: components/execd | |
| - component: ingress | |
| workdir: components/ingress | |
| - component: egress | |
| workdir: components/egress | |
| - component: controller | |
| workdir: kubernetes | |
| k8s_component: controller | |
| - component: task-executor | |
| workdir: kubernetes | |
| k8s_component: task-executor | |
| - component: server | |
| workdir: server | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Login to DockerHub | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_PASSWORD }} | |
| - name: Login to ACR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: sandbox-registry.cn-zhangjiakou.cr.aliyuncs.com | |
| username: ${{ secrets.ACR_USERNAME }} | |
| password: ${{ secrets.ACR_PASSWORD }} | |
| - name: Login to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push (TAG=latest) | |
| working-directory: ${{ matrix.workdir }} | |
| run: | | |
| export TAG=latest | |
| export GHCR_REPO="ghcr.io/${GITHUB_REPOSITORY_OWNER,,}/opensandbox" | |
| if [ -n "${{ matrix.k8s_component }}" ]; then | |
| export COMPONENT="${{ matrix.k8s_component }}" | |
| fi | |
| chmod +x build.sh | |
| ./build.sh | |
| required: | |
| name: Kubernetes Mini E2E CI | |
| if: ${{ always() && github.event_name == 'pull_request' }} | |
| needs: [changes, k8s-mini-e2e, k8s-pool-e2e, execd-init-e2e] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Verify required jobs | |
| env: | |
| RELEVANT: ${{ needs.changes.outputs.relevant }} | |
| CHANGES_RESULT: ${{ needs.changes.result }} | |
| E2E_RESULT: ${{ needs.k8s-mini-e2e.result }} | |
| POOL_E2E_RESULT: ${{ needs.k8s-pool-e2e.result }} | |
| EXECD_INIT_RESULT: ${{ needs.execd-init-e2e.result }} | |
| run: | | |
| if [[ "$CHANGES_RESULT" != "success" ]]; then | |
| echo "Change detection failed: $CHANGES_RESULT" | |
| exit 1 | |
| fi | |
| if [[ "$RELEVANT" == "true" ]]; then | |
| [[ "$E2E_RESULT" == "success" && "$POOL_E2E_RESULT" == "success" && "$EXECD_INIT_RESULT" == "success" ]] | |
| else | |
| [[ "$RELEVANT" == "false" && "$E2E_RESULT" == "skipped" && "$POOL_E2E_RESULT" == "skipped" && "$EXECD_INIT_RESULT" == "skipped" ]] | |
| fi |