Merge branch 'main' into salah/sc-117404/ec-v2-to-v2-upgrades

.github/actions/build-custom-image-with-apko/action.yml

@@ -47,8 +47,10 @@ runs:
         export GIT_TAG=${{ inputs.git-tag }}
         envsubst '${GIT_TAG}' < ${{ inputs.context }}/apko.yaml.tmpl > ${{ inputs.context }}/apko.yaml
 
-    - uses: chainguard-images/actions/apko-publish@main
+    # pin to work around https://github.com/chainguard-images/actions/issues/160
+    - uses: chainguard-images/actions/apko-publish@49e3bc2feb790da6c3a7f749b38c769174c4ad54
       with:
+        apko-image: ghcr.io/wolfi-dev/sdk@sha256:b3c690e2aff7a6e6259632047b5d6133169204f7011b9936731cf3f403d5a8c1
         config: ${{ inputs.context }}/apko.yaml
         archs: amd64,arm64
         tag: ${{ inputs.image-name }}

.github/actions/build-dep-image-with-apko/action.yml

@@ -40,9 +40,11 @@ runs:
           echo "image-exists=false" >> "$GITHUB_OUTPUT"
         fi
 
-    - uses: chainguard-images/actions/apko-publish@main
+    # pin to work around https://github.com/chainguard-images/actions/issues/160
+    - uses: chainguard-images/actions/apko-publish@49e3bc2feb790da6c3a7f749b38c769174c4ad54
       if: ${{ inputs.overwrite == 'true' || steps.check-image-exists.outputs.image-exists == 'false' }}
       with:
+        apko-image: ghcr.io/wolfi-dev/sdk@sha256:b3c690e2aff7a6e6259632047b5d6133169204f7011b9936731cf3f403d5a8c1
         config: ${{ inputs.apko-config }}
         archs: amd64,arm64
         tag: ${{ inputs.image-name }}

deploy/melange.yaml.tmpl

@@ -1,6 +1,6 @@
 package:
   name: kotsadm-head
-  version: ${GIT_TAG}
+  version: "0.0.1" # our versioning is not compatible with apk
   epoch: 0
   description: Kotsadm package
   copyright:
@@ -41,8 +41,8 @@ pipeline:
       mv deploy/assets/postgres "${DESTDIR}/postgres"
 
       # kotsadm and kots binaries
-      export VERSION=${{package.version}}
-      export GIT_TAG=${{package.version}}
+      export VERSION=${GIT_TAG}
+      export GIT_TAG=${GIT_TAG}
 
       # Set environment variables from repository
       source .image.env

go.mod

@@ -70,7 +70,7 @@ require (
 	github.com/vmware-tanzu/velero v1.14.1
 	go.uber.org/multierr v1.11.0
 	go.uber.org/zap v1.27.0
-	golang.org/x/crypto v0.29.0
+	golang.org/x/crypto v0.31.0
 	golang.org/x/oauth2 v0.23.0
 	golang.org/x/sync v0.10.0
 	google.golang.org/api v0.200.0
@@ -366,10 +366,10 @@ require (
 	go.opentelemetry.io/otel/trace v1.31.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
 	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
-	golang.org/x/mod v0.22.0 // indirect
-	golang.org/x/net v0.31.0 // indirect
+	golang.org/x/mod v0.21.0 // indirect
+	golang.org/x/net v0.30.0 // indirect
 	golang.org/x/sys v0.28.0 // indirect
-	golang.org/x/term v0.26.0 // indirect
+	golang.org/x/term v0.27.0 // indirect
 	golang.org/x/text v0.21.0 // indirect
 	golang.org/x/time v0.7.0 // indirect
 	golang.org/x/tools v0.26.0 // indirect

go.sum

@@ -1706,8 +1706,8 @@ golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
 golang.org/x/crypto v0.9.0/go.mod h1:yrmDGqONDYtNj3tH8X9dzUun2m2lzPa9ngI6/RUPGR0=
 golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/crypto v0.29.0 h1:L5SG1JTTXupVV3n6sUqMTeWbjAyfPwoda2DLX8J8FrQ=
-golang.org/x/crypto v0.29.0/go.mod h1:+F4F4N5hv6v38hfeYwTdx20oUvLLc+QfrE9Ax9HtgRg=
+golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190125153040-c74c464bbbf2/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1985,8 +1985,8 @@ golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
-golang.org/x/term v0.26.0 h1:WEQa6V3Gja/BhNxg540hBip/kkaYtRg3cxg4oXSw4AU=
-golang.org/x/term v0.26.0/go.mod h1:Si5m1o57C5nBNQo5z1iq+XDijt21BDBDp2bK0QI8e3E=
+golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.0.0-20170915090833-1cbadb444a80/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=

kurl_proxy/deploy/melange.yaml.tmpl

@@ -1,6 +1,6 @@
 package:
   name: kurl-proxy-head
-  version: ${GIT_TAG}
+  version: "0.0.1" # our versioning is not compatible with apk
   epoch: 0
   description: kurl-proxy package
   copyright:

migrations/deploy/melange.yaml.tmpl

@@ -1,6 +1,6 @@
 package:
   name: kotsadm-migrations-head
-  version: ${GIT_TAG}
+  version: "0.0.1" # our versioning is not compatible with apk
   epoch: 0
   description: kotsadm-migrations package
   copyright:

pkg/appstate/ingress.go

@@ -7,6 +7,7 @@ import (
 	"github.com/replicatedhq/kots/pkg/appstate/types"
 	"github.com/replicatedhq/kots/pkg/k8sutil"
 	"github.com/replicatedhq/kots/pkg/logger"
+	v1 "k8s.io/api/core/v1"
 	networkingv1 "k8s.io/api/networking/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -118,6 +119,7 @@ func makeIngressResourceState(r *networkingv1.Ingress, state types.State) types.
 }
 
 func CalculateIngressState(clientset kubernetes.Interface, r *networkingv1.Ingress) types.State {
+	ctx := context.TODO()
 	ns := r.Namespace
 	backend := r.Spec.DefaultBackend
 
@@ -139,30 +141,43 @@ func CalculateIngressState(clientset kubernetes.Interface, r *networkingv1.Ingre
 		ns = metav1.NamespaceSystem
 	}
 
-	var states []types.State
+	services := []*v1.Service{} // includes nils which are mapped to unavailable
 	if backend != nil {
-		states = append(states, ingressGetStateFromBackend(clientset, ns, *backend))
+		service, _ := clientset.CoreV1().Services(ns).Get(ctx, backend.Service.Name, metav1.GetOptions{})
+		services = append(services, service)
 	}
 
 	for _, rules := range r.Spec.Rules {
 		for _, path := range rules.HTTP.Paths {
-			states = append(states, ingressGetStateFromBackend(clientset, r.Namespace, path.Backend))
+			service, _ := clientset.CoreV1().Services(r.Namespace).Get(ctx, path.Backend.Service.Name, metav1.GetOptions{})
+			services = append(services, service)
 		}
 	}
-	// https://github.com/kubernetes/kubernetes/blob/badcd4af3f592376ce891b7c1b7a43ed6a18a348/pkg/printers/internalversion/printers.go#L1067
-	states = append(states, ingressGetStateFromExternalIP(r))
-	return types.MinState(states...)
-}
 
-func ingressGetStateFromBackend(clientset kubernetes.Interface, namespace string, backend networkingv1.IngressBackend) (minState types.State) {
-	if backend.Service == nil {
-		return types.StateUnavailable
+	hasLoadBalancer := false
+	for _, service := range services {
+		if service != nil && service.Spec.Type == v1.ServiceTypeLoadBalancer {
+			hasLoadBalancer = true
+			break
+		}
 	}
-	service, _ := clientset.CoreV1().Services(namespace).Get(context.TODO(), backend.Service.Name, metav1.GetOptions{})
-	if service == nil {
-		return types.StateUnavailable
+
+	var states []types.State
+	for _, service := range services {
+		if service == nil {
+			states = append(states, types.StateUnavailable)
+		} else {
+			states = append(states, serviceGetStateFromEndpoints(clientset, service))
+		}
+	}
+
+	// An ingress will have an IP associated with it if it's type is LoadBalancer.
+	if hasLoadBalancer {
+		// https://github.com/kubernetes/kubernetes/blob/badcd4af3f592376ce891b7c1b7a43ed6a18a348/pkg/printers/internalversion/printers.go#L1067
+		states = append(states, ingressGetStateFromExternalIP(r))
 	}
-	return serviceGetStateFromEndpoints(clientset, service)
+
+	return types.MinState(states...)
 }
 
 func ingressGetStateFromExternalIP(ing *networkingv1.Ingress) types.State {

pkg/appstate/ingress_test.go

@@ -16,7 +16,7 @@ import (
 
 func mockClientsetK8sVersion(expectedMajor string, expectedMinor string) kubernetes.Interface {
 	clientset := fake.NewSimpleClientset(
-		// add a service
+		// Defaul backend service and endpoint
 		&v1.Service{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      "default-http-backend",
@@ -52,6 +52,82 @@ func mockClientsetK8sVersion(expectedMajor string, expectedMinor string) kuberne
 				},
 			},
 		},
+
+		// LoadBalancer service and endpoint
+		&v1.Service{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "app-lb",
+				Namespace: "",
+			},
+			Spec: v1.ServiceSpec{
+				Type: v1.ServiceTypeLoadBalancer,
+				Ports: []v1.ServicePort{
+					{
+						Name: "http",
+						Port: 8080,
+					},
+				},
+			},
+		},
+		&v1.Endpoints{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "app-lb",
+				Namespace: "",
+			},
+			Subsets: []v1.EndpointSubset{
+				{
+					Ports: []v1.EndpointPort{
+						{
+							Name: "http",
+							Port: 8080,
+						},
+					},
+					Addresses: []v1.EndpointAddress{
+						{
+							IP: "172.0.0.2",
+						},
+					},
+				},
+			},
+		},
+
+		// NodePort service and endpoint
+		&v1.Service{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "app-nodeport",
+				Namespace: "",
+			},
+			Spec: v1.ServiceSpec{
+				Type: v1.ServiceTypeNodePort,
+				Ports: []v1.ServicePort{
+					{
+						Name: "http",
+						Port: 8080,
+					},
+				},
+			},
+		},
+		&v1.Endpoints{
+			ObjectMeta: metav1.ObjectMeta{
+				Name:      "app-nodeport",
+				Namespace: "",
+			},
+			Subsets: []v1.EndpointSubset{
+				{
+					Ports: []v1.EndpointPort{
+						{
+							Name: "http",
+							Port: 8080,
+						},
+					},
+					Addresses: []v1.EndpointAddress{
+						{
+							IP: "172.0.0.2",
+						},
+					},
+				},
+			},
+		},
 	)
 	clientset.Discovery().(*discoveryfake.FakeDiscovery).FakedServerVersion = &version.Info{
 		Major: expectedMajor,
@@ -88,22 +164,30 @@ func TestCalculateIngressState(t *testing.T) {
 				},
 			},
 			want: types.StateReady,
-		},
-		{
-			name: "expect unavailable state when ingress with k8s version > 1.22 and no default backend",
-			args: args{
-				clientset: mockClientsetK8sVersion("1", "23"),
-				r: &networkingv1.Ingress{
-					Spec: networkingv1.IngressSpec{},
-				},
-			},
-			want: types.StateUnavailable,
 		}, {
-			name: "expect ready state when ingress with k8s version > 1.22 and no default backend and with load balancer status",
+			name: "expect ready state when there is a load balancer and an IP address",
 			args: args{
 				clientset: mockClientsetK8sVersion("1", "23"),
 				r: &networkingv1.Ingress{
-					Spec: networkingv1.IngressSpec{},
+					Spec: networkingv1.IngressSpec{
+						Rules: []networkingv1.IngressRule{
+							{
+								IngressRuleValue: networkingv1.IngressRuleValue{
+									HTTP: &networkingv1.HTTPIngressRuleValue{
+										Paths: []networkingv1.HTTPIngressPath{
+											{
+												Backend: networkingv1.IngressBackend{
+													Service: &networkingv1.IngressServiceBackend{
+														Name: "app-lb",
+													},
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+					},
 					Status: networkingv1.IngressStatus{
 						LoadBalancer: networkingv1.IngressLoadBalancerStatus{
 							Ingress: []networkingv1.IngressLoadBalancerIngress{
@@ -116,6 +200,61 @@ func TestCalculateIngressState(t *testing.T) {
 				},
 			},
 			want: types.StateReady,
+		}, {
+			name: "expect ready state when there is no LoadBalancer and no address is assigned",
+			args: args{
+				clientset: mockClientsetK8sVersion("1", "23"),
+				r: &networkingv1.Ingress{
+					Spec: networkingv1.IngressSpec{
+						Rules: []networkingv1.IngressRule{
+							{
+								IngressRuleValue: networkingv1.IngressRuleValue{
+									HTTP: &networkingv1.HTTPIngressRuleValue{
+										Paths: []networkingv1.HTTPIngressPath{
+											{
+												Backend: networkingv1.IngressBackend{
+													Service: &networkingv1.IngressServiceBackend{
+														Name: "app-nodeport",
+													},
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+					Status: networkingv1.IngressStatus{},
+				},
+			},
+			want: types.StateReady,
+		}, {
+			name: "expect unavailable state when there is a LoadBalancer but no address is assigned",
+			args: args{
+				clientset: mockClientsetK8sVersion("1", "23"),
+				r: &networkingv1.Ingress{
+					Spec: networkingv1.IngressSpec{
+						Rules: []networkingv1.IngressRule{
+							{
+								IngressRuleValue: networkingv1.IngressRuleValue{
+									HTTP: &networkingv1.HTTPIngressRuleValue{
+										Paths: []networkingv1.HTTPIngressPath{
+											{
+												Backend: networkingv1.IngressBackend{
+													Service: &networkingv1.IngressServiceBackend{
+														Name: "app-lb",
+													},
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			want: types.StateUnavailable,
 		},
 	}
 	for _, tt := range tests {