knative-extensions
diff --git a/‎.github/workflows/kind-e2e.yaml‎
Lines changed: 60 additions & 7 deletions b/‎.github/workflows/kind-e2e.yaml‎
Lines changed: 60 additions & 7 deletions
diff --git a/‎cmd/broker/main.go‎
Lines changed: 0 additions & 3 deletions b/‎cmd/broker/main.go‎
Lines changed: 0 additions & 3 deletions
diff --git a/‎cmd/ingress/main.go‎
Lines changed: 2 additions & 0 deletions b/‎cmd/ingress/main.go‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎config/broker/200-broker-controller-clusterrole.yaml‎
Lines changed: 3 additions & 1 deletion b/‎config/broker/200-broker-controller-clusterrole.yaml‎
Lines changed: 3 additions & 1 deletion
diff --git a/‎config/broker/200-broker-controller-role.yaml‎
Lines changed: 14 additions & 0 deletions b/‎config/broker/200-broker-controller-role.yaml‎
Lines changed: 14 additions & 0 deletions
diff --git a/‎config/broker/500-broker-controller.yaml‎
Lines changed: 4 additions & 4 deletions b/‎config/broker/500-broker-controller.yaml‎
Lines changed: 4 additions & 4 deletions
diff --git a/‎config/broker/500-shared-ingress.yaml‎
Lines changed: 102 additions & 0 deletions b/‎config/broker/500-shared-ingress.yaml‎
Lines changed: 102 additions & 0 deletions
diff --git a/‎config/mtbroker/natsjsm.yaml‎
Lines changed: 1 addition & 1 deletion b/‎config/mtbroker/natsjsm.yaml‎
Lines changed: 1 addition & 1 deletion
@@ -15,10 +15,18 @@ jobs:
       fail-fast: false # Keep running if one leg fails.
       matrix:
         k8s-version:
-        - v1.34.x
+        - v1.34.3
 
         eventing-version:
         - knative-v1.21.0
+
+        # Map between K8s and KinD versions.
+        # This is attempting to make it a bit clearer what's being tested.
+        # See: https://github.com/kubernetes-sigs/kind/releases/tag/v0.29.0
+        include:
+        - k8s-version: v1.34.3
+          kind-version: v0.31.0
+          kind-image-sha: sha256:08497ee19eace7b4b5348db5c6a1591d7752b164530a36f855cb0f2bdcbadd48
     env:
       KO_DOCKER_REPO: kind.local
       SYSTEM_NAMESPACE: knative-eventing
@@ -41,12 +49,46 @@ jobs:
       uses: actions/checkout@v4
 
     - name: Install KinD
-      # TODO: replace with chainguard-dev/actions/setup-kind
-      uses: chainguard-dev/actions/setup-kind@5e84f02889db0de213947c80a5d75b51bb899048 # main
-      with:
-        k8s-version: ${{ matrix.k8s-version }}
-        kind-worker-count: 2
-        cluster-suffix: c${{ github.run_id }}.local
+      env:
+        KIND_VERSION: ${{ matrix.kind-version }}
+      run: |
+        set -x
+
+        curl -Lo ./kind https://github.com/kubernetes-sigs/kind/releases/download/${{ matrix.kind-version }}/kind-$(uname)-amd64
+        chmod +x ./kind
+        sudo mv kind /usr/local/bin
+
+    - name: Create KinD Cluster
+      run: |
+        set -x
+
+        # KinD configuration.
+        cat > kind.yaml <<EOF
+        apiVersion: kind.x-k8s.io/v1alpha4
+        kind: Cluster
+
+        # This is needed in order to support projected volumes with service account tokens.
+        # See: https://kubernetes.slack.com/archives/CEKK1KTN2/p1600268272383600
+        kubeadmConfigPatches:
+          - |
+            apiVersion: kubeadm.k8s.io/v1beta2
+            kind: ClusterConfiguration
+            metadata:
+              name: config
+            apiServer:
+              extraArgs:
+                "service-account-issuer": "kubernetes.default.svc"
+                "service-account-signing-key-file": "/etc/kubernetes/pki/sa.key"
+        nodes:
+        - role: control-plane
+          image: kindest/node:${{ matrix.k8s-version }}@${{ matrix.kind-image-sha }}
+        - role: worker
+          image: kindest/node:${{ matrix.k8s-version }}@${{ matrix.kind-image-sha }}
+
+        EOF
+
+        # Create a cluster!
+        kind create cluster --config kind.yaml
 
     - name: Install nats
       run: |
@@ -58,6 +100,16 @@ jobs:
         kubectl create namespace knative-eventing
         kubectl apply -n knative-eventing -f ./config/mtbroker/config-br-default-channel-jsm.yaml
         kubectl apply -n knative-eventing -f ./config/mtbroker/config-nats.yaml
+        
+        set +x
+        source ./vendor/knative.dev/hack/infra-library.sh
+        wait_until_pods_running nats-io
+        
+        set -x
+        kubectl get pods -n nats-io
+        kubectl get svc nats -n nats-io
+        kubectl get pods -n kube-system -l k8s-app=kube-dns
+        kubectl logs -n kube-system -l k8s-app=kube-dns
 
     - name: Install Knative Eventing
       run: |
@@ -76,6 +128,7 @@ jobs:
         # Install the nats channel
         ko apply -f ./config/webhook
         ko apply -f ./config/jetstream
+        ko apply -f ./config/broker
 
     - name: Wait for Ready
       run: |
 
@@ -21,10 +21,8 @@ import (
 	_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
 
 	"knative.dev/pkg/configmap"
-	"knative.dev/pkg/injection"
 	"knative.dev/pkg/injection/sharedmain"
 	"knative.dev/pkg/signals"
-	"knative.dev/pkg/system"
 
 	"knative.dev/eventing-natss/pkg/broker/controller"
 	"knative.dev/eventing-natss/pkg/broker/trigger"
@@ -36,7 +34,6 @@ func main() {
 
 	// nats-config is volume mounted so initialize the fsloader
 	ctx = fsloader.WithLoader(ctx, configmap.Load)
-	ctx = injection.WithNamespaceScope(ctx, system.Namespace())
 
 	sharedmain.MainWithContext(ctx, controller.ComponentName,
 		controller.NewController,
 
@@ -30,6 +30,8 @@ func main() {
 	component := "natsjs-broker-ingress"
 
 	ctx := signals.NewContext()
+	ctx = sharedmain.WithHealthProbesDisabled(ctx)
+
 	ns := os.Getenv("NAMESPACE")
 	if ns != "" {
 		ctx = injection.WithNamespaceScope(ctx, ns)
 
@@ -66,7 +66,9 @@ rules:
       - create
       - patch
       - update
-  # Read configmaps for configuration
+  # Read broker config ConfigMaps from user namespaces (broker's own namespace).
+  # Writes to the contract ConfigMap happen only in knative-eventing and are
+  # covered by the namespaced Role in that namespace.
   - apiGroups:
       - ""
     resources:
 
@@ -20,6 +20,20 @@ metadata:
   labels:
     nats.eventing.knative.dev/release: devel
 rules:
+  # Full access to ConfigMaps in knative-eventing for the contract ConfigMap
+  # (nats-broker-ingress-contract) and sharedmain config maps (config-logging, etc.).
+  # Write operations on ConfigMaps never leave this namespace.
+  - apiGroups:
+      - ""
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - delete
   # Read secrets for NATS credentials/TLS — only ever accessed in the
   # controller's own namespace, so a namespaced Role is sufficient.
   - apiGroups:
 
@@ -50,14 +50,14 @@ spec:
               value: config-observability
             - name: METRICS_DOMAIN
               value: knative.dev/eventing
-            - name: BROKER_INGRESS_IMAGE
-              value: ko://knative.dev/eventing-natss/cmd/ingress
             - name: BROKER_FILTER_IMAGE
               value: ko://knative.dev/eventing-natss/cmd/filter
-            - name: BROKER_INGRESS_SERVICE_ACCOUNT
-              value: natsjetstream-broker-dataplane
             - name: BROKER_FILTER_SERVICE_ACCOUNT
               value: natsjetstream-broker-dataplane
+            - name: INGRESS_SERVICE_NAME
+              value: nats-broker-ingress
+            - name: INGRESS_NAMESPACE
+              value: knative-eventing
           ports:
             - containerPort: 9090
               name: metrics
 
@@ -0,0 +1,102 @@
+# Copyright 2024 The Knative Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nats-broker-ingress
+  namespace: knative-eventing
+  labels:
+    nats.eventing.knative.dev/release: devel
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nats-broker-ingress
+  template:
+    metadata:
+      labels:
+        app: nats-broker-ingress
+    spec:
+      serviceAccountName: natsjetstream-broker-dataplane
+      containers:
+        - name: ingress
+          image: ko://knative.dev/eventing-natss/cmd/ingress
+          env:
+            - name: SYSTEM_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: NATS_URL
+              value: "nats://nats.nats-io.svc.cluster.local:4222"
+            - name: PORT
+              value: "8080"
+          ports:
+            - containerPort: 8080
+              name: http
+              protocol: TCP
+            - containerPort: 9090
+              name: metrics
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          resources:
+            requests:
+              cpu: 100m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nats-broker-ingress
+  namespace: knative-eventing
+  labels:
+    nats.eventing.knative.dev/release: devel
+    eventing.knative.dev/brokerRole: ingress
+spec:
+  selector:
+    app: nats-broker-ingress
+  ports:
+    - name: http
+      port: 80
+      targetPort: 8080
+    - name: metrics
+      port: 9090
+      targetPort: 9090
@@ -83,7 +83,7 @@ spec:
     spec:
       containers:
         - name: nats-jetstream
-          image: nats:2.3.4
+          image: nats:2.10.26
           imagePullPolicy: IfNotPresent
           args:
           - -D