agent
b26acb5dfd
The probe kept succeeding while its results vanished: the grep -vE plus tail -40 dropped the buildkit progress lines that carry the actual curl output. Keep the full log, then print only the RUN lines with their #N prefix stripped.
67 lines
3.4 KiB
YAML
67 lines
3.4 KiB
YAML
name: probe registry from buildkitd
|
|
|
|
# TEMPORARY probe branch — not for merge.
|
|
#
|
|
# The first probe ran in the RUNNER pod. buildkitd is a different pod in a
|
|
# different namespace with its own NetworkPolicies, so those results cannot be
|
|
# transferred: an UNREACHABLE there may be the runner's policy, not routing.
|
|
# This runs the same probes THROUGH buildkitd, by building a stage whose RUN
|
|
# does the curling — that egresses from the buildkitd pod, which is the network
|
|
# position that actually has to push.
|
|
#
|
|
# It prints results and always exits 0: this is a measurement, not a gate.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
BUILDKIT_HOST: tcp://buildkitd.buildkit-system.svc.cluster.local:1234
|
|
BUILDKIT_VERSION: v0.32.2
|
|
|
|
jobs:
|
|
probe:
|
|
if: ${{ github.server_url != 'https://github.com' }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Install buildctl
|
|
run: |
|
|
set -euo pipefail
|
|
case "$(uname -m)" in x86_64) arch=amd64;; aarch64) arch=arm64;; *) exit 1;; esac
|
|
mkdir -p "$GITHUB_WORKSPACE/.bin"
|
|
curl -fsSL "https://github.com/moby/buildkit/releases/download/${BUILDKIT_VERSION}/buildkit-${BUILDKIT_VERSION}.linux-${arch}.tar.gz" \
|
|
| tar -xz -C "$GITHUB_WORKSPACE/.bin" --strip-components=1 bin/buildctl
|
|
echo "$GITHUB_WORKSPACE/.bin" >> "$GITHUB_PATH"
|
|
"$GITHUB_WORKSPACE/.bin/buildctl" --version
|
|
|
|
- name: Probe from inside buildkitd
|
|
run: |
|
|
set -euo pipefail
|
|
work=$(mktemp -d)
|
|
{
|
|
echo 'FROM alpine:3.20'
|
|
echo 'RUN apk add --no-cache curl >/dev/null 2>&1 || true'
|
|
echo 'RUN set -u; \'
|
|
echo ' f="http=%{http_code} tls=%{ssl_verify_result} t=%{time_total}\\n"; \'
|
|
echo ' echo "== public name via cluster DNS =="; \'
|
|
echo ' curl -s -o /dev/null -w "$f" --max-time 8 https://gitea.langenoja.se/v2/ || echo UNREACHABLE; \'
|
|
echo ' echo "== resolves to =="; getent hosts gitea.langenoja.se || echo "(none)"; \'
|
|
echo ' echo "== istio-gateway external lb 10.40.0.10 =="; \'
|
|
echo ' curl -s -o /dev/null -w "$f" --max-time 8 --resolve gitea.langenoja.se:443:10.40.0.10 https://gitea.langenoja.se/v2/ || echo UNREACHABLE; \'
|
|
echo ' echo "== istio-gateway clusterip 10.43.1.114 =="; \'
|
|
echo ' curl -s -o /dev/null -w "$f" --max-time 8 --resolve gitea.langenoja.se:443:10.43.1.114 https://gitea.langenoja.se/v2/ || echo UNREACHABLE; \'
|
|
echo ' echo "== gitea http service in-cluster =="; \'
|
|
echo ' curl -s -o /dev/null -w "$f" --max-time 8 http://gitea-system-gitea-http.gitea-system.svc.cluster.local:3000/v2/ || echo UNREACHABLE; \'
|
|
echo ' echo "== gitea http service, headers =="; \'
|
|
echo ' curl -s -D- -o /dev/null --max-time 8 http://gitea-system-gitea-http.gitea-system.svc.cluster.local:3000/v2/ | head -5 || true'
|
|
} > "$work/Dockerfile"
|
|
cat "$work/Dockerfile"
|
|
buildctl build --progress=plain \
|
|
--frontend dockerfile.v0 \
|
|
--local context="$work" \
|
|
--local dockerfile="$work" \
|
|
--opt platform=linux/amd64 2>&1 | tee /tmp/probe.log | tail -80
|
|
echo "=== PROBE RESULTS ==="
|
|
grep -E "^#[0-9]+ [0-9.]+ " /tmp/probe.log | sed -E "s/^#[0-9]+ [0-9.]+ //" || echo "(no RUN output captured)"
|
|
echo "probe finished (results above, from buildkitd's network position)"
|