Sec scanners bump release 1.2 2024 10 10 06 50 37

.github/workflows/create-release.yml

@@ -185,6 +185,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          token: ${{ secrets.BOT_PAT }} # creating git tag using bot token because GITHUB_TOKEN would not trigger build workflow (https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow).
 
       - name: Create changelog
         env:
@@ -199,15 +200,14 @@ jobs:
           RELEASE_ID=$(./hack/ci/create_draft_release.sh $VERSION)
           echo "release_id=$RELEASE_ID" >> $GITHUB_OUTPUT
 
-      - name: Trigger prow job 'release-eventing-manager-build'
+      - name: Add lightweight tag to trigger release build job
+        env:
+          GITHUB_TOKEN: ${{ secrets.BOT_PAT }} # creating git tag using bot token because GITHUB_TOKEN would not trigger build workflow (https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow).
         run: |
-          # The job release-eventing-manager-build will be triggered by pushing a new tag (format: x.y.z) to the repo.
+          # The build job will be triggered by pushing a new tag (format: x.y.z) to the repo.
           git tag $VERSION
           git push origin $VERSION
 
-      - name: Wait for job 'release-eventing-manager-build' to succeed
-        run: ./hack/ci/wait-for-release-build-job.sh ${{ github.ref_name }} 600 10 30 # Inputs: repo (format: "owner/repo"), timeout, interval and initial wait time.
-
       - name: Create and upload eventing-manager.yaml and eventing-default-cr.yaml
         env:
           PULL_BASE_REF: ${{ needs.generate-version.outputs.VERSION }}
@@ -218,11 +218,20 @@ jobs:
         run: |
           ./hack/ci/render_and_upload_manifests.sh
 
+  wait-until-build-succeeds:
+    needs: [generate-version, create-draft]
+    uses: "kyma-project/eventing-tools/.github/workflows/wait-build-reusable.yml@main"
+    with:
+      repository: ${{ github.repository_owner }}/eventing-manager
+      git_ref: ${{ needs.generate-version.outputs.VERSION }}
+      git_check_run_name: "build-${{ needs.generate-version.outputs.VERSION }} / Build image"
+
   bump-sec-scanners-config-main:
     name: Bump sec-scanners-config.yaml on main branch
     needs: 
       - create-draft
       - generate-version
+      - wait-until-build-succeeds
     runs-on: ubuntu-latest
     env:
       VERSION: ${{ needs.generate-version.outputs.VERSION }}

.github/workflows/e2e-backend-switching-reuseable.yml

@@ -111,7 +111,7 @@ jobs:
         run: |
           make -C hack/ci/ wait-istio-cr-ready
           make -C hack/ci/ wait-api-gateway-cr-ready
-          make -C hack/ci/ wait-nats-cr-ready
+          make -C hack/ci/ wait-nats-cr-warning
           make -C hack/ci/ wait-eventing-cr-ready-with-backend ACTIVE_BACKEND=NATS
 
       - name: Setup eventing tests

.github/workflows/e2e-upgrade-test-reusable.yaml

@@ -18,9 +18,6 @@ on:
         required: true
         type: string
         description: "The image tag of the Eventing Manager after the upgrade"
-      build-job-name:
-        type: string
-        description: "The name of the build job to wait for"
       commit-sha:
         type: string
         description: "The commit sha of the new version"
@@ -88,20 +85,6 @@ jobs:
           make e2e-setup
           make e2e-eventing-setup
 
-      - name: Wait for the ${{ inputs.build-job-name }} job to succeed
-        if: ${{ inputs.build-job-name != '' }}
-        uses: kyma-project/wait-for-commit-status-action@2b3ffe09af8b6f40e1213d5fb7f91a7bd41ffb20
-        with:
-          context: ${{ inputs.build-job-name }}
-          commit_ref: "${{ inputs.commit-sha }}"
-          timeout: 600000 # 10 minutes in milliseconds
-          # The check interval is kept long otherwise it will exhaust the GitHub rate limit (More info: https://docs.github.com/en/rest/overview/resources-in-the-rest-api?apiVersion=2022-11-28#rate-limiting)
-          check_interval: 60000 # 1 minute in milliseconds
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-          GITHUB_OWNER: "${{ github.repository_owner }}"
-          GITHUB_REPO: "eventing-manager"
-
       - name: Upgrade Eventing manager
         id: upgrade-eventing-manager
         run: |

.github/workflows/e2e.yml

@@ -35,60 +35,52 @@ on:
       - PROJECT
 
 jobs:
-  wait-until-build-succeeds:
+  export-info:
     runs-on: ubuntu-latest
     outputs:
       image-name: ${{ steps.extract-image.outputs.image_name }}
+      git-ref: ${{ steps.extract-image.outputs.git_ref }}
     steps:
-      - uses: actions/checkout@v4
-
-      - name: Wait for the 'pull-eventing-manager-build' job to succeed
-        id: pull-wait-build
-        if: github.event_name == 'pull_request'
-        uses: kyma-project/wait-for-commit-status-action@2b3ffe09af8b6f40e1213d5fb7f91a7bd41ffb20
-        with:
-          context: "pull-eventing-manager-build"
-          commit_ref: "${{ github.event.pull_request.head.sha }}" # Note: 'github.event.pull_request.head.sha' is not same as 'github.sha' on pull requests.
-          timeout: 600000 # 10 minutes in milliseconds
-          # The check interval is kept long otherwise it will exhaust the GitHub rate limit (More info: https://docs.github.com/en/rest/overview/resources-in-the-rest-api?apiVersion=2022-11-28#rate-limiting)
-          check_interval: 60000 # 1 minute in milliseconds
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-          GITHUB_OWNER: "${{ github.repository_owner }}"
-          GITHUB_REPO: "eventing-manager"
-
-      - name: Wait for the 'post-eventing-manager-build' job to succeed
-        id: push-wait-build
-        if: github.event_name == 'push'
-        uses: kyma-project/wait-for-commit-status-action@2b3ffe09af8b6f40e1213d5fb7f91a7bd41ffb20
-        with:
-          context: "post-eventing-manager-build"
-          commit_ref: "${{ github.sha }}"
-          timeout: 600000 # 10 minutes in milliseconds
-          # The check interval is kept long otherwise it will exhaust the GitHub rate limit (More info: https://docs.github.com/en/rest/overview/resources-in-the-rest-api?apiVersion=2022-11-28#rate-limiting)
-          check_interval: 60000 # 1 minute in milliseconds
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-          GITHUB_OWNER: "${{ github.repository_owner }}"
-          GITHUB_REPO: "eventing-manager"
-
-      - name: Extract container image name from build logs (pull)
+      - name: export correct info based on event (PR or Push)
         id: extract-image
         env:
-          # Refernce: https://docs.github.com/en/actions/learn-github-actions/expressions#example
-          COMMIT_STATUS_JSON: "${{ github.event_name == 'push' && steps.push-wait-build.outputs.json || steps.pull-wait-build.outputs.json }}"
+          GIT_EVENT_NAME: "${{ github.event_name }}"
+          PR_NUMBER: "${{ github.event.number }}"
+          PR_HEAD_SHA: "${{ github.event.pull_request.head.sha }}"
+          HEAD_SHA: "${{ github.sha }}"
+        run: |
+          if [[ $GIT_EVENT_NAME == "pull_request" ]]
+          then
+            echo "exporting info for pull request..."
+            echo "image_name=europe-docker.pkg.dev/kyma-project/dev/eventing-manager:PR-${PR_NUMBER}" >> "$GITHUB_OUTPUT"
+            echo "git_ref=${PR_HEAD_SHA}" >> "$GITHUB_OUTPUT"
+          else
+            echo "exporting info for push..."
+            echo "image_name=europe-docker.pkg.dev/kyma-project/prod/eventing-manager:${HEAD_SHA}" >> "$GITHUB_OUTPUT"
+            echo "git_ref=${HEAD_SHA}" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Print info
+        env:
+          IMAGE_NAME: ${{ steps.extract-image.outputs.image_name }}
+          GIT_REF: ${{ steps.extract-image.outputs.git_ref }}
         run: |
-          ./scripts/extract_image_from_build_logs.sh
-          # export value to job output
-          export IMAGE_NAME="$(cat image.name)"
-          echo "IMAGE_NAME: ${IMAGE_NAME}"
-          echo "image_name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT"
+          echo "IMAGE: $IMAGE_NAME"
+          echo "Git ref: $GIT_REF"
+
+
+  wait-until-build-succeeds:
+    needs: export-info
+    uses: "kyma-project/eventing-tools/.github/workflows/wait-build-reusable.yml@main"
+    with:
+      repository: ${{ github.repository_owner }}/eventing-manager
+      git_ref: ${{ needs.export-info.outputs.git-ref }}
+      git_check_run_name: "build / Build image"
 
   nats:
     runs-on: ubuntu-latest
-    needs: wait-until-build-succeeds
+    needs: [export-info, wait-until-build-succeeds]
     env:
-      MANAGER_IMAGE: ${{ needs.wait-until-build-succeeds.outputs.image-name }}
+      MANAGER_IMAGE: ${{ needs.export-info.outputs.image-name }}
 
     steps:
       - uses: actions/checkout@v4
@@ -152,9 +144,9 @@ jobs:
 
   PeerAuthentication:
     runs-on: ubuntu-latest
-    needs: wait-until-build-succeeds
+    needs: [export-info, wait-until-build-succeeds]
     env:
-      MANAGER_IMAGE: ${{ needs.wait-until-build-succeeds.outputs.image-name }}
+      MANAGER_IMAGE: ${{ needs.export-info.outputs.image-name }}
 
     steps:
       - uses: actions/checkout@v4
@@ -200,10 +192,10 @@ jobs:
           kubectl get peerauthentications.security.istio.io -A -o yaml
 
   backend-switching:
-    needs: wait-until-build-succeeds
+    needs: [export-info, wait-until-build-succeeds]
     if: github.event_name == 'push'
     uses: "./.github/workflows/e2e-backend-switching-reuseable.yml"
     with:
-      eventing-manager-image: ${{ needs.wait-until-build-succeeds.outputs.image-name }}
+      eventing-manager-image: ${{ needs.export-info.outputs.image-name }}
       cluster-name-prefix: "ghem-"
     secrets: inherit

.github/workflows/k8s-compatibility-test.yml

@@ -0,0 +1,188 @@
+name: k8s-compatibility-test
+
+on:
+    workflow_dispatch:
+      inputs:
+        k8s-version: # k8s version
+          description: 'Kubernetes version (i.e. x.y.z)'
+          required: true
+
+jobs:
+  k8s-compatibility-test:
+    # Tests the compatibility of Kubernetes version with Eventing and NATS modules.
+    # The steps of this job are:
+    # 1. Provision Gardener cluster with the given k8s version.
+    # 2. Install latest released versions of Istio, Api-gateway, NATS and Eventing modules.
+    # 3. Run eventing tests with NATS backend.
+    # 4. Run eventing tests with EventMesh backend.
+    runs-on: ubuntu-latest
+    env:
+      KYMA_STABILITY: "unstable"
+      KYMA: "./hack/kyma"
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Go via go.mod
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - run: go version
+
+      - name: Install Kyma CLI
+        run: |
+          make kyma
+
+      - name: Provision Gardener cluster
+        env:
+          GARDENER_CLUSTER_VERSION: ${{ inputs.k8s-version }}
+          CLUSTER_PREFIX: "ghem-"
+          GARDENER_PROJECT_NAME: ${{ vars.GARDENER_PROJECT_NAME }}
+          GARDENER_PROVIDER_SECRET_NAME: ${{ vars.GARDENER_PROVIDER_SECRET_NAME_AWS }}
+          MACHINE_TYPE: "m5.xlarge"
+          SCALER_MIN: "1"
+          SCALER_MAX: "2"
+          RETRY_ATTEMPTS: "1"
+          GARDENER_KYMATUNAS: ${{ secrets.GARDENER_KYMATUNAS }}
+        run: |
+          # setup Gardener kubeconfig.
+          mkdir -p "${HOME}/.gardener"
+          export GARDENER_KUBECONFIG="${HOME}/.gardener/kubeconfig"
+          echo ${GARDENER_KYMATUNAS} | base64 --decode > ${GARDENER_KUBECONFIG}
+          # generate cluster name and export it to Github env for cleanup step to access it.
+          export CLUSTER_NAME="${CLUSTER_PREFIX}$(openssl rand -hex 2)"
+          echo "CLUSTER_NAME=${CLUSTER_NAME}" >> $GITHUB_ENV
+          # set random region for AWS.
+          export GARDENER_REGION=$(./scripts/gardener/aws/get_random_region.sh)
+          export GARDENER_ZONES="${GARDENER_REGION}a"
+          # provision gardener cluster.
+          make -C hack/ci/ provision-gardener-cluster
+          kubectl version
+          kubectl cluster-info
+          kubectl get nodes
+          kubectl get ns
+
+      - name: Create kyma-system namespace
+        run: |
+          kubectl create ns kyma-system || true
+
+      - name: Create EventMesh secret
+        env:
+          EVENTMESH_K8S_SECRET: ${{ secrets.EVENTMESH_K8S_SECRET }}
+        run: |
+          echo "${EVENTMESH_K8S_SECRET}" | base64 --decode > k8s-em.yaml
+          kubectl apply -n kyma-system -f k8s-em.yaml
+          rm k8s-em.yaml
+
+      - name: Create IAS application for EventMesh
+        env:
+          TEST_EVENTING_AUTH_IAS_URL: ${{ vars.EVENTING_AUTH_IAS_URL }}
+          TEST_EVENTING_AUTH_IAS_USER: ${{ vars.EVENTING_AUTH_IAS_USER }}
+          TEST_EVENTING_AUTH_IAS_PASSWORD: ${{ secrets.EVENTING_AUTH_IAS_PASSWORD }}
+        run: |
+          export DISPLAY_NAME=${CLUSTER_NAME}
+          make -C hack/ci/ create-ias-app
+
+      - name: Install latest released Istio Module
+        run: |
+          make -C hack/ci/ install-istio-module
+
+      - name: Install latest released API Gateway Manager
+        run: |
+          make -C hack/ci/ install-api-gateway-module
+
+      - name: Install latest released NATS Manager
+        run: |
+          make -C hack/ci/ install-nats-module
+
+      - name: Install latest released Eventing Manager
+        run: |
+          make -C hack/ci/ install-eventing-module
+          kubectl apply -f config/samples/default_nats.yaml
+
+      - name: Wait for Installed modules to be ready
+        run: |
+          make -C hack/ci/ wait-istio-cr-ready
+          make -C hack/ci/ wait-api-gateway-cr-ready
+          make -C hack/ci/ wait-nats-cr-warning
+          make -C hack/ci/ wait-eventing-cr-ready-with-backend ACTIVE_BACKEND=NATS
+
+      - name: Setup eventing tests
+        run: |
+          # create API Rules for EPP and Sink.
+          export DOMAIN_TO_EXPOSE_WORKLOADS="$(kubectl get cm -n kube-system shoot-info -o=jsonpath='{.data.domain}')"
+          ./hack/e2e/scripts/expose_epp_and_sink.sh
+          # define URLs.
+          export SINK_PORT_FORWARDED_URL=https://sink-e2e-tests.${DOMAIN_TO_EXPOSE_WORKLOADS}
+          export PUBLISHER_URL=https://epp-e2e-tests.${DOMAIN_TO_EXPOSE_WORKLOADS}
+          # export ENVs to Github for all next steps.
+          echo "SINK_PORT_FORWARDED_URL=${SINK_PORT_FORWARDED_URL}" >> $GITHUB_ENV
+          echo "PUBLISHER_URL=${PUBLISHER_URL}" >> $GITHUB_ENV
+          # setup e2e tests.
+          make e2e-eventing-setup
+
+      - name: Test eventing with NATS
+        run: |
+          make e2e-eventing
+
+      - name: Switch to EventMesh backend
+        run: |
+          kubectl apply -f config/samples/default_eventmesh.yaml
+          make -C hack/ci/ wait-eventing-cr-ready-with-backend ACTIVE_BACKEND=EventMesh
+
+      - name: Test eventing with EventMesh
+        env:
+          BACKEND_TYPE: "EventMesh"
+        run: |
+          # run tests.
+          make e2e-eventing
+
+      - name: Test eventing cleanup
+        run: |
+          make e2e-cleanup
+
+      - name: On error, fetch NATS CR
+        if: failure()
+        run: |
+          kubectl get nats.operator.kyma-project.io -n kyma-system -o yaml
+
+      - name: On error, fetch Eventing CRs
+        if: failure()
+        run: |
+          kubectl get eventing.operator.kyma-project.io -n kyma-system -o yaml
+
+      - name: On error, fetch Istio CR
+        if: failure()
+        run: |
+          kubectl get istios.operator.kyma-project.io -n kyma-system -o yaml
+
+      - name: On error, fetch API Gateway CR
+        if: failure()
+        run: |
+          kubectl get apigateways.operator.kyma-project.io -n kyma-system -o yaml
+
+      - name: Cleanup modules
+        if: ${{ always() }}
+        run: |
+          ./scripts/cleanup_modules.sh
+
+      - name: Delete IAS application
+        if: ${{ always() }}
+        env:
+          TEST_EVENTING_AUTH_IAS_URL: ${{ vars.EVENTING_AUTH_IAS_URL }}
+          TEST_EVENTING_AUTH_IAS_USER: ${{ vars.EVENTING_AUTH_IAS_USER }}
+          TEST_EVENTING_AUTH_IAS_PASSWORD: ${{ secrets.EVENTING_AUTH_IAS_PASSWORD }}
+        run: |
+          export IAS_APPLICATION_LOCATION=$(cat ~/.ias_location)
+          make -C hack/ci/ delete-ias-app
+
+      - name: Delete Gardener cluster
+        if: ${{ always() }}
+        env:
+          GARDENER_PROVIDER_SECRET_NAME: "tunas-aws"
+          GARDENER_PROJECT_NAME: "kymatunas"
+          WAIT_FOR_DELETE_COMPLETION: "false"
+        run: |
+          export GARDENER_KUBECONFIG="${HOME}/.gardener/kubeconfig"
+          make -C hack/ci/ deprovision-gardener-cluster