|
|
|
@@ -288,8 +288,41 @@ jobs:
|
|
|
|
|
steps:
|
|
|
|
|
- name: "Checkout Repository"
|
|
|
|
|
uses: actions/checkout@v7
|
|
|
|
|
- name: "Install Helm"
|
|
|
|
|
uses: azure/setup-helm@v5
|
|
|
|
|
- name: "PROBE egress from the job container (throwaway branch only)"
|
|
|
|
|
run: |
|
|
|
|
|
set +e
|
|
|
|
|
echo "### resolv.conf"; cat /etc/resolv.conf
|
|
|
|
|
echo "### DNS"
|
|
|
|
|
for h in get.helm.sh api.github.com raw.githubusercontent.com registry-1.docker.io ghcr.io; do
|
|
|
|
|
printf '%-28s ' "$h"; getent hosts "$h" || echo "DNS FAILED"
|
|
|
|
|
done
|
|
|
|
|
echo "### HTTPS from the JOB container"
|
|
|
|
|
for u in https://get.helm.sh/helm-v3.18.4-linux-amd64.tar.gz https://api.github.com/ https://raw.githubusercontent.com/ https://registry-1.docker.io/v2/ https://ghcr.io/v2/; do
|
|
|
|
|
printf '%-62s ' "$u"
|
|
|
|
|
curl -sS -o /dev/null -m 20 -w 'http=%{http_code} dns=%{time_namelookup}s conn=%{time_connect}s total=%{time_total}s\n' "$u" || echo "CURL FAILED"
|
|
|
|
|
done
|
|
|
|
|
echo "### egress of the DOCKER DAEMON (separate network path)"
|
|
|
|
|
docker pull --quiet alpine:3.20 && echo "docker pull alpine OK" || echo "docker pull alpine FAILED"
|
|
|
|
|
docker pull --quiet ghcr.io/k3d-io/k3d-proxy:5.9.0 && echo "docker pull ghcr OK" || echo "docker pull ghcr FAILED"
|
|
|
|
|
echo "### cgroups (the thing that was fixed)"
|
|
|
|
|
docker info --format 'server={{.ServerVersion}} cgroupDriver={{.CgroupDriver}} cgroupVersion={{.CgroupVersion}} storage={{.Driver}}'
|
|
|
|
|
docker info 2>&1 | grep -iE "rootless|WARNING" || echo "(no rootless/WARNING lines)"
|
|
|
|
|
echo "### done - this step never fails on purpose"
|
|
|
|
|
exit 0
|
|
|
|
|
# PROBE ONLY - this is NOT a proposed fix and is not in PR #253.
|
|
|
|
|
# azure/setup-helm downloads from get.helm.sh, which in this cluster
|
|
|
|
|
# resolves to an IPv6 Azure Front Door address (2603:1061:14:67::1) that
|
|
|
|
|
# never completes a TCP connect. curl -4 forces IPv4; if this succeeds it
|
|
|
|
|
# both unblocks the measurement and proves the diagnosis, because every
|
|
|
|
|
# other host in the probe resolved to IPv4 and answered in under a second.
|
|
|
|
|
- name: "Install Helm (PROBE: forced IPv4)"
|
|
|
|
|
run: |
|
|
|
|
|
curl -4 -sSfL -o /tmp/helm.tgz https://get.helm.sh/helm-v4.3.0-linux-amd64.tar.gz
|
|
|
|
|
tar -xzf /tmp/helm.tgz -C /tmp
|
|
|
|
|
mkdir -p "$HOME/.local/bin"
|
|
|
|
|
mv /tmp/linux-amd64/helm "$HOME/.local/bin/helm"
|
|
|
|
|
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
|
|
|
|
|
"$HOME/.local/bin/helm" version
|
|
|
|
|
# freesailarr is the one chart whose install-test needs credentials:
|
|
|
|
|
# without a real Wireguard key gluetun never completes a handshake, and
|
|
|
|
|
# behind its kill switch not a single app container becomes Ready. The key
|
|
|
|
@@ -332,10 +365,31 @@ jobs:
|
|
|
|
|
: "${FREESAILARR_WG_KEY:?empty - check op://GitHub-Actions/freesailarr-mullvad-test-config/credential}"
|
|
|
|
|
: "${FREESAILARR_WG_ADDRESSES:?empty - check op://GitHub-Actions/freesailarr-mullvad-test-config/ip-address}"
|
|
|
|
|
echo "Both VPN values arrived non-empty."
|
|
|
|
|
- name: "PROBE runner facts (throwaway branch only)"
|
|
|
|
|
run: |
|
|
|
|
|
echo "runner=${RUNNER_NAME:-?} os=${RUNNER_OS:-?} arch=${RUNNER_ARCH:-?} nproc=$(nproc)"
|
|
|
|
|
free -m | head -2 || true
|
|
|
|
|
df -h / | tail -1 || true
|
|
|
|
|
docker info --format 'server={{.ServerVersion}} storage={{.Driver}} cgroupDriver={{.CgroupDriver}} cgroupVersion={{.CgroupVersion}} rootless={{.SecurityOptions}} cpus={{.NCPU}} mem={{.MemTotal}}' || echo "docker info FAILED"
|
|
|
|
|
docker info 2>&1 | grep -iE "rootless|warning" || echo "(no rootless/warning lines)"
|
|
|
|
|
ls -l /dev/fuse 2>&1 || echo "(no /dev/fuse)"
|
|
|
|
|
- name: "Install k3d"
|
|
|
|
|
run: curl -sSfL https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | TAG="$K3D_VERSION" bash
|
|
|
|
|
- name: "Create k3d cluster"
|
|
|
|
|
run: k3d cluster create install-test --image "$K3S_IMAGE" --wait --timeout 180s
|
|
|
|
|
run: k3d cluster create install-test --image "$K3S_IMAGE" --wait --timeout 180s --no-rollback
|
|
|
|
|
- name: "PROBE k3s did not come up (throwaway branch only)"
|
|
|
|
|
if: failure()
|
|
|
|
|
run: |
|
|
|
|
|
docker ps -a
|
|
|
|
|
echo "=== k3s node log ==="
|
|
|
|
|
docker logs k3d-install-test-server-0 2>&1 | tail -120 || true
|
|
|
|
|
echo "=== docker info ==="
|
|
|
|
|
docker info || true
|
|
|
|
|
- name: "PROBE cluster is usable (throwaway branch only)"
|
|
|
|
|
run: |
|
|
|
|
|
kubectl get nodes -o wide
|
|
|
|
|
kubectl get --raw='/readyz?verbose' | tail -5
|
|
|
|
|
kubectl -n kube-system get pods
|
|
|
|
|
# Every chart reaching this step is one the exclusion filter let through,
|
|
|
|
|
# so the script's SKIP branch is never taken here - it exists for local
|
|
|
|
|
# runs. The variables below are empty for every chart but the one that
|
|
|
|
|
jklein