build: update e2e tests to validate secure-port

* pull out script blocks into `hack` path
* update e2e workflow to use scripts in `hack`
* install cert manager and self-signed cluster issuer in e2e
* deploy podinfo with secure port and certificate enabled
* add `hack/e2e.sh` script, which can be used to execute the github
  workflow locally

.github/workflows/e2e.yml

@@ -21,8 +21,7 @@ jobs:
         uses: engineerd/setup-kind@v0.5.0
       - name: Build container image
         run: |
-          GIT_COMMIT=$(git rev-list -1 HEAD) && \
-          docker build -t test/podinfo:latest --build-arg "REVISION=${GIT_COMMIT}" .
+          ./hack/build.sh
           kind load docker-image test/podinfo:latest
       - name: Setup Helm
         uses: ./.github/actions/helm
@@ -30,20 +29,11 @@ jobs:
           helm-version: ${{ matrix.helm-version }}
       - name: Install Tiller
         if: ${{ startsWith(matrix.helm-version, '2') }}
-        run: |
-          kubectl --namespace kube-system create sa tiller
-          kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller
-          helm init --service-account tiller --upgrade --wait
+        run: ./hack/tiller.sh
       - name: Deploy
-        run: |
-          helm upgrade -i podinfo ./charts/podinfo \
-          --set image.repository=test/podinfo \
-          --set image.tag=latest \
-          --namespace=default
+        run: ./hack/deploy.sh
       - name: Run integration tests
-        run: |
-          kubectl rollout status deployment/podinfo --timeout=1m
-          helm test podinfo
+        run: ./hack/test.sh
       - name: Debug failure
         if: failure()
         run: |

deploy/kind.sh

@@ -6,34 +6,18 @@ kind create cluster --config=kind.yaml
 # add certificate manager
 kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.0.4/cert-manager.yaml
 
-# wait for cert manager webhook
-kubectl wait --namespace cert-manager \
-  --for=condition=available deployment \
-  --selector=app=webhook \
-  --timeout=120s
+# wait for cert manager
+kubectl rollout status --namespace cert-manager deployment/cert-manager --timeout=2m
+kubectl rollout status --namespace cert-manager deployment/cert-manager-webhook --timeout=2m
+kubectl rollout status --namespace cert-manager deployment/cert-manager-cainjector --timeout=2m
 
-# wait for the injector
-kubectl wait --namespace cert-manager \
-  --for=condition=available deployment \
-  --selector=app=cainjector \
-  --timeout=120s
-
-# wait for the cert manager
-kubectl wait --namespace cert-manager \
-  --for=condition=available deployment \
-  --selector=app=cert-manager \
-  --timeout=120s
-
-# apply the secure webapp
+# # apply the secure webapp
 kubectl apply -f ./secure/common
 kubectl apply -f ./secure/backend
 kubectl apply -f ./secure/frontend
 
-# wait for the podinfo frontend to come up
-kubectl wait --namespace secure \
-  --for=condition=ready pod \
-  --selector=app=frontend \
-  --timeout=120s
+# # wait for the podinfo frontend to come up
+kubectl rollout status --namespace secure deployment/frontend --timeout=1m
 
 # curl the endpoints (responds with info due to header regexp on route handler)
 echo

hack/build.sh

@@ -0,0 +1,7 @@
+#! /usr/bin/env sh
+
+set -e
+
+# build the docker file
+GIT_COMMIT=$(git rev-list -1 HEAD) && \
+DOCKER_BUILDKIT=1 docker build --tag test/podinfo --build-arg "REVISION=${GIT_COMMIT}" .

hack/deploy.sh

@@ -0,0 +1,32 @@
+#! /usr/bin/env sh
+
+# add jetstack repository
+helm repo add jetstack https://charts.jetstack.io || true
+
+# install cert-manager
+helm upgrade --install cert-manager jetstack/cert-manager \
+    --set installCRDs=true \
+    --namespace default
+
+# wait for cert manager
+kubectl rollout status deployment/cert-manager --timeout=2m
+kubectl rollout status deployment/cert-manager-webhook --timeout=2m
+kubectl rollout status deployment/cert-manager-cainjector --timeout=2m
+
+# install self-signed certificate
+cat << 'EOF' | kubectl apply -f -
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: self-signed
+spec:
+  selfSigned: {}
+EOF
+
+# install podinfo with tls enabled
+helm upgrade --install podinfo ./charts/podinfo \
+    --set image.repository=test/podinfo \
+    --set image.tag=latest \
+    --set tls.enabled=true \
+    --set certificate.create=true \
+    --namespace=default

hack/e2e.sh

@@ -0,0 +1,20 @@
+#! /usr/bin/env sh
+
+set -e
+
+SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd -P)
+
+# run the build
+$SCRIPT_DIR/build.sh
+
+# create the kind cluster
+kind create cluster || true
+
+# load the docker image
+kind load docker-image test/podinfo:latest
+
+# run the deploy
+$SCRIPT_DIR/deploy.sh
+
+# run the tests
+$SCRIPT_DIR/test.sh

hack/test.sh

@@ -0,0 +1,9 @@
+#1 /usr/bin/env sh
+
+set -e
+
+# wait for podinfo
+kubectl rollout status deployment/podinfo --timeout=3m
+
+# test podinfo
+helm test podinfo

hack/tiller.sh

@@ -0,0 +1,7 @@
+#! /usr/bin/env sh
+
+set -e
+
+kubectl --namespace kube-system create sa tiller
+kubectl create clusterrolebinding tiller-cluster-rule --clusterrole=cluster-admin --serviceaccount=kube-system:tiller
+helm init --service-account tiller --upgrade --wait