Skip to content

Commit 2342bcc

Browse files
madmecodesmadmecodes
authored
Fix: consolidate multiple kserve test workflows into a single job (#3254)
* Fix:consolidate kserve test workflows into job Signed-off-by: madmecodes <[email protected]> * update end to end test for kserve and knative tests Signed-off-by: madmecodes <[email protected]> * fix: not just ready must be functional Signed-off-by: madmecodes <[email protected]> * fix: sleep after deleting Signed-off-by: madmecodes <[email protected]> * fix: wait for deletion Signed-off-by: madmecodes <[email protected]> * remove dublicate run of pytest, now it runs once in kserve_test only Signed-off-by: madmecodes <[email protected]> * update: remove debug echo Signed-off-by: madmecodes <[email protected]> * merge all the kserve tests into one file Signed-off-by: madmecodes <[email protected]> * remove service account creation debug line already created Signed-off-by: madmecodes <[email protected]> * update: remove redundant tests policies Signed-off-by: madmecodes <[email protected]> * test: attacker namespace added Signed-off-by: madmecodes <[email protected]> * test: replicating prev test file Signed-off-by: madmecodes <[email protected]> * update: attacker ns must not have access Signed-off-by: madmecodes <[email protected]> * update: remove duplicate test-sklearn service and simplify test structure Signed-off-by: madmecodes <[email protected]> --------- Signed-off-by: madmecodes <[email protected]>
1 parent a5ab36a commit 2342bcc

File tree

5 files changed

+116
-445
lines changed

5 files changed

+116
-445
lines changed

‎.github/workflows/full_kubeflow_integration_test.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -198,8 +198,7 @@ jobs:
198198
run: ./tests/katib_test.sh "${KF_PROFILE}"
199199

200200
- name: Run KServe Test
201-
run: |
202-
./tests/kserve_test.sh ${KF_PROFILE}
201+
run: ./tests/kserve_test.sh ${KF_PROFILE}
203202

204203
- name: Test KServe Models Web Application API
205204
run: ./tests/kserve_models_web_application_test.sh "${KF_PROFILE}"

‎.github/workflows/kserve_test.yaml‎

Lines changed: 5 additions & 160 deletions
Original file line numberDiff line numberDiff line change
@@ -9,23 +9,20 @@ on:
99
- tests/kserve/**
1010
- tests/kserve_test.sh
1111
- tests/kserve_install.sh
12-
- tests/kserve_jwt_authentication_test.sh
1312
- common/istio*/**
1413
- common/oauth2-proxy/**
1514
- tests/oauth2-proxy_install.sh
1615
- common/cert-manager/**
1716
- tests/istio*
1817
- common/knative/**
1918
- tests/knative_install.sh
20-
- tests/*authentication*test.sh
21-
- tests/final_validation.sh
2219

2320
permissions:
2421
contents: read
2522
actions: read
2623

2724
jobs:
28-
test-basic-kserve:
25+
test-kserve:
2926
runs-on: ubuntu-latest
3027
steps:
3128
- name: Checkout
@@ -72,165 +69,13 @@ jobs:
7269
- name: Port forward
7370
run: ./tests/port_forward_gateway.sh
7471

75-
- name: Run KServe tests
76-
run: ./tests/kserve_test.sh kubeflow-user-example-com
77-
78-
- name: Detailed KServe Access Diagnostics
79-
run: |
80-
export KSERVE_INGRESS_HOST_PORT=localhost:8080
81-
export KSERVE_M2M_TOKEN="$(kubectl -n kubeflow-user-example-com create token default-editor)"
82-
83-
echo "=== AuthorizationPolicy Details ==="
84-
kubectl get authorizationpolicy -n kubeflow-user-example-com -o yaml
85-
86-
echo "=== Detailed Curl Test ==="
87-
curl -vv \
88-
-H "Host: isvc-sklearn.kubeflow-user-example-com.example.com" \
89-
-H "Authorization: Bearer ${KSERVE_M2M_TOKEN}" \
90-
-H "Content-Type: application/json" \
91-
"http://${KSERVE_INGRESS_HOST_PORT}/v1/models/isvc-sklearn:predict" \
92-
-d '{"instances": [[6.8, 2.8, 4.8, 1.4], [6.0, 3.4, 4.5, 1.6]]}'
93-
94-
- name: Run kserve models webapp test
95-
run: |
96-
kubectl wait --for=condition=Available --timeout=300s -n kubeflow deployment/kserve-models-web-app
97-
98-
- name: Apply Pod Security Standards restricted levels
99-
run: ./tests/PSS_enable.sh
100-
101-
test-jwt-authentication:
102-
runs-on: ubuntu-latest
103-
steps:
104-
- name: Checkout
105-
uses: actions/checkout@v4
106-
107-
- name: Install KinD, Create KinD cluster and Install kustomize
108-
run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
109-
110-
- name: Install kubectl
111-
run: ./tests/kubectl_install.sh
112-
113-
- name: Create kubeflow namespace
114-
run: kustomize build common/kubeflow-namespace/base | kubectl apply -f -
115-
116-
- name: Install Istio CNI
117-
run: ./tests/istio-cni_install.sh
118-
119-
- name: Install oauth2-proxy
120-
run: ./tests/oauth2-proxy_install.sh
121-
122-
- name: Install knative CNI with secure cluster-local-gateway
123-
run: ./tests/knative_install.sh
124-
125-
- name: Verify secure cluster-local-gateway configuration
126-
run: |
127-
kubectl get authorizationpolicy,requestauthentication -n istio-system | grep cluster-local-gateway
128-
kubectl get requestauthentication cluster-local-gateway-jwt -n istio-system -o yaml
129-
kubectl get authorizationpolicy cluster-local-gateway -n istio-system -o yaml
130-
kubectl get authorizationpolicy cluster-local-gateway-require-jwt -n istio-system -o yaml
131-
132-
- name: Setup python 3.12
133-
uses: actions/setup-python@v4
134-
with:
135-
python-version: 3.12
136-
137-
- name: Port forward
138-
run: ./tests/port_forward_gateway.sh
139-
140-
- name: Wait for cluster-local-gateway to be ready
72+
- name: Wait for Istio configurations to propagate
14173
run: |
14274
kubectl wait --for=condition=Available --timeout=120s deployment/cluster-local-gateway -n istio-system
143-
sleep 100
144-
145-
- name: Run Basic JWT Authentication Tests
146-
run: |
147-
export KSERVE_INGRESS_HOST_PORT=localhost:8080
148-
curl -s -o /dev/null -w "%{http_code}" -H "Host: test.example.com" "http://localhost:8080/" | grep -q "403"
149-
150-
- name: Run Knative Service JWT Authentication Tests
151-
run: |
152-
export KSERVE_INGRESS_HOST_PORT=localhost:8080
153-
./tests/knative_authentication_test.sh
75+
sleep 60
15476
155-
- name: Test External Access Configuration
156-
run: |
157-
export KSERVE_INGRESS_HOST_PORT=localhost:8080
158-
./tests/kserve_setup_external_access.sh kubeflow-user-example-com secure-model-predictor
159-
# Test external access pattern
160-
TOKEN=$(kubectl -n kubeflow-user-example-com create token default-editor)
161-
RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" \
162-
-H "Authorization: Bearer $TOKEN" \
163-
-H "Content-Type: application/json" \
164-
"http://localhost:8080/kserve/kubeflow-user-example-com/secure-model-predictor/" \
165-
2>/dev/null || echo "404")
166-
if [ "$RESPONSE" != "404" ] && [ "$RESPONSE" != "200" ] && [ "$RESPONSE" != "503" ]; then
167-
exit 1
168-
fi
169-
170-
- name: Apply Pod Security Standards restricted levels
171-
run: ./tests/PSS_enable.sh
172-
173-
test-secure-authentication:
174-
runs-on: ubuntu-latest
175-
steps:
176-
- name: Checkout
177-
uses: actions/checkout@v4
178-
179-
- name: Install KinD, Create KinD cluster and Install kustomize
180-
run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
181-
182-
- name: Install kubectl
183-
run: ./tests/kubectl_install.sh
184-
185-
- name: Create kubeflow namespace
186-
run: kustomize build common/kubeflow-namespace/base | kubectl apply -f -
187-
188-
- name: Install Istio CNI
189-
run: ./tests/istio-cni_install.sh
190-
191-
- name: Install oauth2-proxy
192-
run: ./tests/oauth2-proxy_install.sh
193-
194-
- name: Install cert-manager
195-
run: ./tests/cert_manager_install.sh
196-
197-
- name: Install knative CNI (with secure cluster-local-gateway)
198-
run: ./tests/knative_install.sh
199-
200-
- name: Install KServe
201-
run: ./tests/kserve_install.sh
202-
203-
- name: Install KF Multi Tenancy
204-
run: ./tests/multi_tenancy_install.sh
205-
206-
- name: Install kubeflow-istio-resources
207-
run: kustomize build common/istio/kubeflow-istio-resources/base | kubectl apply -f -
208-
209-
- name: Create KF Profile
210-
run: ./tests/kubeflow_profile_install.sh
211-
212-
- name: Setup python 3.12
213-
uses: actions/setup-python@v4
214-
with:
215-
python-version: 3.12
216-
217-
- name: Port forward
218-
run: ./tests/port_forward_gateway.sh
219-
220-
- name: Verify JWT authentication policies are applied
221-
run: |
222-
kubectl get authorizationpolicy cluster-local-gateway-require-jwt -n istio-system
223-
kubectl get requestauthentication cluster-local-gateway-jwt -n istio-system
224-
kubectl get authorizationpolicy cluster-local-gateway -n istio-system
225-
kubectl get deployment cluster-local-gateway -n istio-system
226-
kubectl wait --for=condition=Available deployment/cluster-local-gateway -n istio-system --timeout=120s
227-
kubectl get pods -n istio-system -l app=cluster-jwks-proxy | grep -q Running || kubectl get pods -n istio-system -l app=cluster-jwks-proxy
228-
229-
- name: Wait for configurations to propagate
230-
run: sleep 60
231-
232-
- name: Run KServe secure authentication tests
233-
run: ./tests/kserve_jwt_authentication_test.sh kubeflow-user-example-com
77+
- name: Run KServe tests
78+
run: ./tests/kserve_test.sh kubeflow-user-example-com
23479

23580
- name: Apply Pod Security Standards restricted levels
23681
run: ./tests/PSS_enable.sh

‎tests/knative_authentication_test.sh‎

Lines changed: 0 additions & 116 deletions
This file was deleted.

0 commit comments

Comments
 (0)