Skip to content

Commit caa15a2

Browse files
haywoodshhaywoodsh
committed
Merge remote-tracking branch 'origin/feat/7427-sni-in-jwt-policy' into feat/7427-sni-in-jwt-policy
2 parents 495e3b6 + 88c2590 commit caa15a2

File tree

24 files changed

+1767
-87
lines changed

24 files changed

+1767
-87
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 87 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,11 @@ on:
1414
description: "Force rebuild"
1515
required: false
1616
default: false
17+
run_tests:
18+
type: boolean
19+
description: "Run unit & e2e tests"
20+
required: false
21+
default: true
1722

1823
defaults:
1924
run:
@@ -35,7 +40,7 @@ jobs:
3540
id-token: write
3641
outputs:
3742
docs_only: ${{ github.event.pull_request && steps.docs.outputs.docs_only == 'true' }}
38-
k8s_latest: "1.32.0"
43+
k8s_latest: ${{ steps.vars.outputs.k8s_latest }}
3944
go_path: ${{ steps.vars.outputs.go_path }}
4045
go_code_md5: ${{ steps.vars.outputs.go_code_md5 }}
4146
binary_cache_hit: ${{ steps.binary-cache.outputs.cache-hit }}
@@ -215,25 +220,25 @@ jobs:
215220
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
216221
with:
217222
go-version-file: go.mod
218-
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' }}
223+
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' && (inputs.run_tests && inputs.run_tests || true) }}
219224

220225
- name: Run Tests
221226
run: make cover
222-
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' }}
227+
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' && (inputs.run_tests && inputs.run_tests || true) }}
223228

224229
- name: Upload coverage to Codecov
225230
uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
226231
with:
227232
files: ./coverage.txt
228233
token: ${{ secrets.CODECOV_TOKEN }} # required
229-
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' }}
234+
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' && (inputs.run_tests && inputs.run_tests || true) }}
230235

231236
- name: Run static check
232237
uses: dominikh/staticcheck-action@024238d2898c874f26d723e7d0ff4308c35589a2 # v1.4.0
233238
with:
234239
version: "v0.6.0"
235240
install-go: false
236-
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' }}
241+
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' && (inputs.run_tests && inputs.run_tests || true) }}
237242

238243
binaries:
239244
name: Build Binaries
@@ -253,7 +258,7 @@ jobs:
253258
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
254259
with:
255260
go-version-file: go.mod
256-
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' }}
261+
if: ${{ (inputs.force && inputs.force || false) || needs.checks.outputs.binary_cache_hit != 'true' }}
257262

258263
- name: Build binaries
259264
uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
@@ -272,14 +277,14 @@ jobs:
272277
AWS_NAP_WAF_DOS_PRODUCT_CODE: ${{ secrets.AWS_NAP_WAF_DOS_PRODUCT_CODE }}
273278
AWS_NAP_WAF_DOS_PUB_KEY: ${{ secrets.AWS_NAP_WAF_DOS_PUB_KEY }}
274279
GORELEASER_CURRENT_TAG: "v${{ needs.checks.outputs.ic_version }}"
275-
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' }}
280+
if: ${{ (inputs.force && inputs.force || false) || needs.checks.outputs.binary_cache_hit != 'true' }}
276281

277282
- name: Store Artifacts in Cache
278283
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
279284
with:
280285
path: ${{ github.workspace }}/dist
281286
key: nginx-ingress-${{ needs.checks.outputs.go_code_md5 }}
282-
if: ${{ needs.checks.outputs.binary_cache_hit != 'true' }}
287+
if: ${{ (inputs.force && inputs.force || false) || needs.checks.outputs.binary_cache_hit != 'true' }}
283288

284289
build-docker:
285290
name: Build Docker OSS
@@ -372,8 +377,68 @@ jobs:
372377
secrets: inherit
373378
if: ${{ inputs.force || (needs.checks.outputs.forked_workflow == 'true' && needs.checks.outputs.docs_only == 'false') || (needs.checks.outputs.forked_workflow == 'false' && needs.checks.outputs.stable_image_exists != 'true' && needs.checks.outputs.docs_only == 'false') }}
374379

380+
package-tests:
381+
if: ${{ needs.checks.outputs.docs_only != 'true' && (inputs.run_tests && inputs.run_tests || true) }}
382+
name: Package Tests
383+
runs-on: ubuntu-22.04
384+
needs: [checks, binaries, build-docker, build-docker-plus, build-docker-nap]
385+
permissions:
386+
contents: read
387+
pull-requests: write # for package report
388+
id-token: write
389+
steps:
390+
- name: Checkout Repository
391+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
392+
393+
- name: Setup QEMU
394+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
395+
with:
396+
platforms: arm64
397+
if: ${{ needs.checks.outputs.forked_workflow == 'false' || needs.checks.outputs.docs_only == 'false' }}
398+
399+
- name: Authenticate to Google Cloud
400+
id: auth
401+
uses: google-github-actions/auth@ba79af03959ebeac9769e648f473a284504d9193 # v2.1.10
402+
with:
403+
token_format: access_token
404+
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
405+
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
406+
if: ${{ needs.checks.outputs.forked_workflow == 'false' || needs.checks.outputs.docs_only == 'false' }}
407+
408+
- name: Login to GCR
409+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
410+
with:
411+
registry: gcr.io
412+
username: oauth2accesstoken
413+
password: ${{ steps.auth.outputs.access_token }}
414+
if: ${{ needs.checks.outputs.forked_workflow == 'false' || needs.checks.outputs.docs_only == 'false' }}
415+
416+
- name: Install Python dependencies
417+
run: |
418+
make -f tests/Makefile setup-venv
419+
if: ${{ needs.checks.outputs.forked_workflow == 'false' || needs.checks.outputs.docs_only == 'false' }}
420+
421+
- name: Run tests
422+
id: packages
423+
run: |
424+
source tests/venv/bin/activate
425+
python tests/scripts/check_container_packages.py --tag ${{ needs.checks.outputs.build_tag }} --log package_output.txt
426+
if: ${{ needs.checks.outputs.forked_workflow == 'false' || needs.checks.outputs.docs_only == 'false' }}
427+
428+
- name: Add comment
429+
run: |
430+
# make sure the comment is formatted correctly, as a code block
431+
echo '### Package Report' > output.txt
432+
echo '```' >> output.txt
433+
cat package_output.txt >> output.txt
434+
echo '```' >> output.txt
435+
gh pr comment --edit-last --create-if-none ${{ github.event.pull_request.number }} -F output.txt
436+
env:
437+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
438+
if: ${{ ( needs.checks.outputs.forked_workflow == 'false' || needs.checks.outputs.docs_only == 'false' ) && github.event.pull_request }}
439+
375440
helm-tests:
376-
if: ${{ needs.checks.outputs.docs_only != 'true' }}
441+
if: ${{ needs.checks.outputs.docs_only != 'true' && (inputs.run_tests && inputs.run_tests || true) }}
377442
name: Helm Tests ${{ matrix.base-os }}
378443
runs-on: ubuntu-22.04
379444
needs: [checks, binaries, build-docker, build-docker-plus]
@@ -512,7 +577,7 @@ jobs:
512577
if: ${{ steps.stable_exists.outputs.exists != 'true' && needs.checks.outputs.docs_only == 'false' }}
513578

514579
setup-matrix:
515-
if: ${{ inputs.force || needs.checks.outputs.docs_only != 'true' }}
580+
if: ${{ inputs.force || (inputs.run_tests && inputs.run_tests || true) || needs.checks.outputs.docs_only != 'true' }}
516581
name: Setup Matrix for Smoke Tests
517582
runs-on: ubuntu-22.04
518583
needs: [binaries, checks]
@@ -574,7 +639,7 @@ jobs:
574639
if: ${{ steps.check-image.outcome == 'failure' && needs.checks.outputs.docs_only == 'false' }}
575640

576641
smoke-tests-oss:
577-
if: ${{ inputs.force || needs.checks.outputs.docs_only != 'true' }}
642+
if: ${{ inputs.force || (inputs.run_tests && inputs.run_tests || true) || needs.checks.outputs.docs_only != 'true' }}
578643
name: ${{ matrix.images.label }} ${{ matrix.images.image }} ${{ matrix.k8s }} smoke tests
579644
needs:
580645
- checks
@@ -601,7 +666,7 @@ jobs:
601666
k8s-version: ${{ matrix.k8s }}
602667

603668
smoke-tests-plus:
604-
if: ${{ inputs.force || needs.checks.outputs.docs_only != 'true' }}
669+
if: ${{ inputs.force || (inputs.run_tests && inputs.run_tests || true) || needs.checks.outputs.docs_only != 'true' }}
605670
name: ${{ matrix.images.label }} ${{ matrix.images.image }} ${{ matrix.k8s }} smoke tests
606671
needs:
607672
- checks
@@ -628,7 +693,7 @@ jobs:
628693
k8s-version: ${{ matrix.k8s }}
629694

630695
smoke-tests-nap:
631-
if: ${{ inputs.force || needs.checks.outputs.docs_only != 'true' }}
696+
if: ${{ inputs.force || (inputs.run_tests && inputs.run_tests || true) || needs.checks.outputs.docs_only != 'true' }}
632697
name: ${{ matrix.images.label }} ${{ matrix.images.image }} ${{ matrix.k8s }} smoke tests
633698
needs:
634699
- checks
@@ -672,10 +737,12 @@ jobs:
672737
if: ${{ !cancelled() }}
673738
runs-on: ubuntu-22.04
674739
name: Final CI Results
675-
needs: [tag-stable, build-docker, build-docker-plus, build-docker-nap, smoke-tests-oss, smoke-tests-plus, smoke-tests-nap]
740+
needs: [tag-stable, build-docker, build-docker-plus, build-docker-nap, smoke-tests-oss, smoke-tests-plus, smoke-tests-nap, package-tests, helm-tests]
676741
steps:
677742
- run: |
678743
tagResult="${{ needs.tag-stable.result }}"
744+
packageResult="${{ needs.package-tests.result }}"
745+
helmResult="${{ needs.helm-tests.result }}"
679746
smokeOSSResult="${{ needs.smoke-tests-oss.result }}"
680747
smokePlusResult="${{ needs.smoke-tests-plus.result }}"
681748
smokeNAPResult="${{ needs.smoke-tests-nap.result }}"
@@ -703,6 +770,12 @@ jobs:
703770
if [[ $buildNAPResult != "success" && $buildNAPResult != "skipped" ]]; then
704771
exit 1
705772
fi
773+
if [[ $helmResult != "success" && $helmResult != "skipped" ]]; then
774+
exit 1
775+
fi
776+
if [[ $packageResult != "success" && $packageResult != "skipped" ]]; then
777+
exit 1
778+
fi
706779
707780
trigger-image-promotion:
708781
name: Promote images on Force Run

‎.github/workflows/image-promotion.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -669,7 +669,7 @@ jobs:
669669
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
670670

671671
- name: Create/Update Draft
672-
uses: lucacome/draft-release@38def8b74645796e9743b53e0f187d4a8915ea3e # v1.2.3
672+
uses: lucacome/draft-release@00f74370c044c322da6cb52acc707d62c7762c71 # v1.2.4
673673
id: release-notes
674674
with:
675675
minor-label: "enhancement"

‎.github/workflows/release.yml‎

Lines changed: 41 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -469,48 +469,50 @@ jobs:
469469
key: nginx-ingress-release-${{ needs.variables.outputs.go_code_md5 }}
470470
if: ${{ needs.variables.outputs.binary_cache_sign_hit != 'true' }}
471471

472-
# azure-upload:
473-
# if: ${{ ! cancelled() && ! failure() && ! contains(inputs.skip_step, 'azure-upload') }}
474-
# name: Upload packages to Azure
475-
# runs-on: ubuntu-22.04
476-
# needs: [variables, binaries]
477-
# permissions:
478-
# id-token: write
479-
# contents: read
480-
# steps:
481-
# - name: Checkout Repository
482-
# uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
483-
# with:
484-
# ref: ${{ inputs.release_branch }}
472+
# Upload packages, sboms & checksums to release storage
473+
azure-upload:
474+
if: ${{ ! cancelled() && ! failure() && ! contains(inputs.skip_step, 'azure-upload') }}
475+
name: Upload packages to Azure
476+
runs-on: ubuntu-22.04
477+
needs: [variables, binaries]
478+
permissions:
479+
id-token: write
480+
contents: read
481+
environment: release
482+
steps:
483+
- name: Checkout Repository
484+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
485+
with:
486+
ref: ${{ inputs.release_branch }}
485487

486-
# - name: Fetch Cached Tarball Artifacts
487-
# uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
488-
# with:
489-
# key: nginx-ingress-release-${{ needs.variables.outputs.go_code_md5 }}
490-
# path: ${{ github.workspace }}/tarballs
491-
# fail-on-cache-miss: true
488+
- name: Fetch Cached Tarball Artifacts
489+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
490+
with:
491+
key: nginx-ingress-release-${{ needs.variables.outputs.go_code_md5 }}
492+
path: ${{ github.workspace }}/tarballs
493+
fail-on-cache-miss: true
492494

493-
# - name: Azure login
494-
# uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
495-
# with:
496-
# client-id: ${{ secrets.AZURE_CLIENT_ID }}
497-
# tenant-id: ${{ secrets.AZURE_TENANT_ID }}
498-
# subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
495+
- name: Azure login
496+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
497+
with:
498+
client-id: ${{ secrets.AZURE_CLIENT_ID }}
499+
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
500+
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
499501

500-
# - name: Azure Upload Release Packages
501-
# uses: azure/CLI@089eac9d8cc39f5d003e94f8b65efc51076c9cbd # v2.1.0
502-
# with:
503-
# inlineScript: |
504-
# for i in $(find tarballs -type f); do
505-
# echo -n "Uploading ${i} to kubernetes-ingress/v${{ inputs.nic_version }}/${i##*/} ... "
506-
# if ${{ ! inputs.dry_run}}; then
507-
# az storage blob upload --auth-mode=login -f "$i" -c ${{ secrets.AZURE_BUCKET_NAME }} \
508-
# --account-name ${{ secrets.AZURE_STORAGE_ACCOUNT }} --overwrite -n kubernetes-ingress/v${{ inputs.nic_version }}/${i##*/}
509-
# echo "done"
510-
# else
511-
# echo "skipped, dry_run."
512-
# fi
513-
# done
502+
- name: Azure Upload Release Packages
503+
uses: azure/CLI@089eac9d8cc39f5d003e94f8b65efc51076c9cbd # v2.1.0
504+
with:
505+
inlineScript: |
506+
for i in $(find tarballs -type f); do
507+
echo -n "Uploading ${i} to kubernetes-ingress/v${{ inputs.nic_version }}/${i##*/} ... "
508+
if ${{ ! inputs.dry_run}}; then
509+
az storage blob upload --auth-mode=login -f "$i" -c ${{ secrets.AZURE_BUCKET_NAME }} \
510+
--account-name ${{ secrets.AZURE_STORAGE_ACCOUNT }} --overwrite -n kubernetes-ingress/v${{ inputs.nic_version }}/${i##*/}
511+
echo "done"
512+
else
513+
echo "skipped, dry_run."
514+
fi
515+
done
514516
515517
github-release:
516518
if: ${{ ! cancelled() && ! failure() && ! contains(inputs.skip_step, 'github-release') }}

‎.github/workflows/update-release-draft.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ jobs:
6161
ref: ${{ inputs.branch }}
6262

6363
- name: Create/Update Draft
64-
uses: lucacome/draft-release@38def8b74645796e9743b53e0f187d4a8915ea3e # v1.2.3
64+
uses: lucacome/draft-release@00f74370c044c322da6cb52acc707d62c7762c71 # v1.2.4
6565
id: release-notes
6666
with:
6767
minor-label: "enhancement"

‎.pre-commit-config.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ repos:
2727
args: [--fix=lf]
2828
- id: name-tests-test
2929
args: [--pytest-test-first]
30-
exclude: ^(tests/suite/utils|tests/suite/fixtures|tests/suite/grpc|tests/settings.py)
30+
exclude: ^(tests/suite/utils|tests/suite/fixtures|tests/suite/grpc|tests/settings.py|tests/scripts)
3131
- id: no-commit-to-branch
3232
- id: requirements-txt-fixer
3333
- id: fix-byte-order-marker
@@ -44,7 +44,7 @@ repos:
4444
pass_filenames: false
4545

4646
- repo: https://github.com/golangci/golangci-lint
47-
rev: v2.2.1
47+
rev: v2.2.2
4848
hooks:
4949
- id: golangci-lint
5050
args: [--new-from-patch=/tmp/diff.patch]

‎README.md‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,12 +33,11 @@ We value community input and would love to see you at the next community call. A
3333

3434
| **Community Call Dates** |
3535
| ------------------------ |
36-
| **2025-05-06** |
37-
| **2025-05-19** |
38-
| **2025-06-03** |
39-
| **2025-06-16** |
40-
| **2025-06-30** |
41-
| **2025-07-14** |
36+
| **2025-07-28** |
37+
| **2025-08-11** |
38+
| **2025-08-25** |
39+
| **2025-09-08** |
40+
| **2025-09-22** |
4241

4342
---
4443

0 commit comments

Comments
 (0)