feat(run-integration-test)!: Improve action internals

run-integration-test/README.md

@@ -94,6 +94,7 @@ profiles:
 | Input                  | Required | Description                                                            |
 | ---------------------- | -------- | ---------------------------------------------------------------------- |
 | `replicated-api-token` | Yes      | Replicated API Token, available via `secrets.REPLICATED_API_TOKEN`     |
+| `otlp-bearer-token`    | Yes      | Bearer token for the OTLP ingester (otlp.stackable.build)              |
 | `test-mode`            | Yes      | Either run a `profile` or a `custom` test                              |
 | `test-mode-input`      | Yes      | The name of the profile or runner, based on the `test-mode`            |
 | `test-suite`           | No       | The name of the BeKu test-suite (only used if running a `custom` test) |

run-integration-test/action.yaml

@@ -17,6 +17,14 @@ inputs:
   # Tokens
   replicated-api-token:
     description: Replicated API token
+  otlp-bearer-token:
+    description: Bearer token for the OTLP ingester (otlp.stackable.build)
+  # TODO: Add an input to control the k8sobjects receiver error_mode at runtime, eg:
+  # otel-k8sobjects-error-mode:
+  #   description: k8sobjects receiver error_mode (propagate|ignore|silent)
+  #   default: ignore
+  # Wire it into integration-test-info.env (see the collectors apply step) and reference it
+  # via ${env:OTEL_K8SOBJECTS_ERROR_MODE:-ignore} in the kubernetes-objects collector config.
 
   # Tool versions
   interu-version:
@@ -38,7 +46,7 @@ inputs:
   helm-version:
     description: Version of helm
     # See https://github.com/helm/helm/releases for latest version
-    default: v3.19.0
+    default: v3.21.1
   stackablectl-version:
     description: Version of stackablectl
     # See https://github.com/stackabletech/stackable-cockpit/releases for latest version
@@ -62,7 +70,6 @@ runs:
     - name: Install interu
       env:
         INTERU_VERSION: ${{ inputs.interu-version }}
-        RUNNER_DEBUG: ${{ runner.debug }}
       shell: bash
       run: "$GITHUB_ACTION_PATH/../.scripts/actions/install_interu.sh"
 
@@ -73,16 +80,16 @@ runs:
         TEST_SUITE: ${{ inputs.test-suite }}
         TEST_MODE: ${{ inputs.test-mode }}
         TEST: ${{ inputs.test }}
-        RUNNER_DEBUG: ${{ runner.debug }}
         GITHUB_REPOSITORY: ${{ github.repository }}
+        GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}"
         GITHUB_RUN_ID: ${{ github.run_id }}"
       shell: bash
       run: |
         set -euo pipefail
         [ -n "${RUNNER_DEBUG+set}" ] && set -x
 
         # Generate the cluster name
-        echo "KUBERNETES_CLUSTER_NAME=integration-test-${GITHUB_REPOSITORY}-${GITHUB_RUN_ID}" | tee -a "$GITHUB_OUTPUT"
+        echo "KUBERNETES_CLUSTER_NAME=integration-test-${GITHUB_REPOSITORY}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" | tee -a "$GITHUB_OUTPUT"
 
         # Run interu to expand parameters into GITHUB_OUTPUT for use as env vars in later steps.
         if [ "$TEST_MODE" == "profile" ]; then
@@ -105,7 +112,8 @@ runs:
         KUBECTL_VERSION: ${{ inputs.kubectl-version }}
         KUTTL_VERSION: ${{ inputs.kuttl-version }}
         HELM_VERSION: ${{ inputs.helm-version }}
-        RUNNER_DEBUG: ${{ runner.debug }}
+        # The helm signature is expired since a couple of years...
+        VERIFY_SIGNATURE: "false"
       shell: bash
       run: |
         "$GITHUB_ACTION_PATH/../.scripts/actions/install_kubectl.sh"
@@ -145,7 +153,7 @@ runs:
 
     - name: Prepare Replicated Cluster
       id: prepare-replicated-cluster
-      uses: replicatedhq/replicated-actions/create-cluster@291bef61a059631e39e84f8470f86152171c4c20 # v1.26.0
+      uses: replicatedhq/replicated-actions/create-cluster@0fbf5395cf3e8c744f447bbc92b7de9135eead8e # v1.27.1
       with:
         # See: https://github.com/replicatedhq/replicated-actions/tree/main/create-cluster#inputs
         api-token: ${{ inputs.replicated-api-token }}
@@ -196,6 +204,24 @@ runs:
         kubectl -n opentelemetry-operator get pods
         echo "::endgroup::"
 
+    - name: Install OTLP ingester auth Secret
+      shell: bash
+      env:
+        OTLP_BEARER_TOKEN: ${{ inputs.otlp-bearer-token }}
+      run: |
+        set -euo pipefail
+        # No 'set -x' here: it would risk exposing the token. Mask defensively in case the
+        # value did not arrive via secrets.* (which GitHub redacts automatically).
+        echo "::add-mask::${OTLP_BEARER_TOKEN}"
+
+        echo "::group::kubectl apply secret"
+        # The collectors read this via spec.env -> secretKeyRef (otlp-auth / bearer-token).
+        kubectl create secret generic otlp-auth \
+          --namespace opentelemetry-operator \
+          --from-literal=bearer-token="${OTLP_BEARER_TOKEN}" \
+          --dry-run=client -o yaml | kubectl apply -f -
+        echo "::endgroup::"
+
     - name: Apply OpenTelemetry Collectors configurations
       shell: bash
       env:
@@ -205,6 +231,7 @@ runs:
         INTERU_KUBERNETES_DISTRIBUTION: ${{ steps.extract.outputs.INTERU_KUBERNETES_DISTRIBUTION }}
         INTERU_KUBERNETES_VERSION: ${{ steps.extract.outputs.INTERU_KUBERNETES_VERSION }}
         GITHUB_TRIGGERED_BY: ${{ github.triggering_actor }}
+        GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}
       run: |
         set -euo pipefail
 
@@ -214,6 +241,11 @@ runs:
         echo "KUBERNETES_DISTRIBUTION=${INTERU_KUBERNETES_DISTRIBUTION}" | tee -a "$INTEGRATION_TEST_INFO"
         echo "KUBERNETES_VERSION=${INTERU_KUBERNETES_VERSION}" | tee -a "$INTEGRATION_TEST_INFO"
         echo "TRIGGERED_BY=${GITHUB_TRIGGERED_BY}" | tee -a "$INTEGRATION_TEST_INFO"
+        echo "RUN_ATTEMPT=${GITHUB_RUN_ATTEMPT}" | tee -a "$INTEGRATION_TEST_INFO"
+        # TODO: To make the k8sobjects receiver error_mode runtime-controllable, expose the
+        # otel-k8sobjects-error-mode input in this step's `env:` block above and write it here:
+        #   echo "OTEL_K8SOBJECTS_ERROR_MODE=${OTEL_K8SOBJECTS_ERROR_MODE}" | tee -a "$INTEGRATION_TEST_INFO"
+        # Then reference it via ${env:OTEL_K8SOBJECTS_ERROR_MODE:-ignore} in the collector config.
         echo "::endgroup::"
 
         echo "::group::kubectl apply"
@@ -240,6 +272,9 @@ runs:
         REF_NAME: ${{ github.ref_name }}
         GH_TOKEN: ${{ github.token }}
         OPERATOR_NAME: ${{ steps.extract_operator_name.outputs.OPERATOR_NAME }}
+        BEKU_TEST_PARALLELISM: ${{ steps.extract.outputs.BEKU_TEST_PARALLELISM }}
+        BEKU_TEST_SUITE: ${{ steps.extract.outputs.BEKU_TEST_SUITE }}
+        BEKU_TEST: ${{ steps.extract.outputs.BEKU_TEST }}
       shell: bash
       run: |
         set -euo pipefail
@@ -263,7 +298,7 @@ runs:
       if: always()
       # If the creation of the cluster failed, we don't want to error and abort
       continue-on-error: true
-      uses: replicatedhq/replicated-actions/remove-cluster@291bef61a059631e39e84f8470f86152171c4c20 # v1.26.0
+      uses: replicatedhq/replicated-actions/remove-cluster@0fbf5395cf3e8c744f447bbc92b7de9135eead8e # v1.27.1
       with:
         # See: https://github.com/replicatedhq/replicated-actions/tree/main/remove-cluster#inputs
         api-token: ${{ inputs.replicated-api-token }}

run-integration-test/kustomize/.gitignore

@@ -1 +1,4 @@
 charts/
+
+# Local-only secrets (eg: overlays/local/otlp-auth.secret.env). Never commit tokens.
+*.secret.env

run-integration-test/kustomize/bases/opentelemetry-collectors/container-log-scrape/opentelemetrycollector.yml

@@ -36,7 +36,7 @@ spec:
   config:
     receivers:
       # https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/receiver/filelogreceiver
-      filelog/varlogpods:
+      file_log/varlogpods:
         # A storage extension (eg: redis, or file) can be used for storing log offsets. Otherwise it is held in memory.
         # See: https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/extension/storage
         # storage: {}
@@ -105,7 +105,7 @@ spec:
 
     processors:
       # https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/processor/k8sattributesprocessor
-      k8sattributes:
+      k8s_attributes:
         filter:
           # https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/processor/k8sattributesprocessor/README.md#as-an-agent
           node_from_env_var: KUBE_NODE_NAME # this should be same as the var set from the downward API further up
@@ -124,7 +124,7 @@ spec:
         # This key exists so it can be easily extended in an overlay:
         attributes: []
 
-      resourcedetection/env:
+      resource_detection/env:
         detectors: [env]
         timeout: 2s
         override: false
@@ -146,8 +146,8 @@ spec:
       extensions: []
       pipelines:
         logs:
-          receivers: [filelog/varlogpods]
+          receivers: [file_log/varlogpods]
           # processors: [memory_limiter, batch]
-          processors: [k8sattributes, resourcedetection/env, resource]
+          processors: [k8s_attributes, resource_detection/env, resource]
           # Enable configured exporters in the overlay
           exporters: []

run-integration-test/kustomize/bases/opentelemetry-collectors/kubernetes-events/opentelemetrycollector.yml

@@ -29,10 +29,25 @@ spec:
 
     processors:
       # https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/processor/k8sattributesprocessor
-      k8sattributes:
-        # Use the k8s attributes set by the receiver
-        # https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/processor/k8sattributesprocessor#as-a-gateway
-        passthrough: true
+      k8s_attributes:
+        # Enrich telemetry with pod metadata (including the owning workload) via the k8s API.
+        # The k8s_cluster/k8s_events receivers describe other objects and are not "sent" by
+        # those pods, so there is no source connection IP to match on. Associate by the
+        # k8s.pod.uid the k8s_cluster receiver stamps as a resource attribute instead.
+        passthrough: false
+        pod_association:
+          - sources:
+              - from: resource_attribute
+                name: k8s.pod.uid
+        extract:
+          metadata:
+            # Owning workload of each pod (deployment is resolved via its replicaset).
+            - k8s.deployment.name
+            - k8s.replicaset.name
+            - k8s.daemonset.name
+            - k8s.statefulset.name
+            - k8s.job.name
+            - k8s.cronjob.name
 
       # https://github.com/open-telemetry/opentelemetry-collector-contrib/tree/main/processor/attributesprocessor
       # These are attributes for the specific spans, log events, etc...
@@ -51,7 +66,7 @@ spec:
             key: service.name
             value: kubernetes-events
 
-      resourcedetection/env:
+      resource_detection/env:
         detectors: [env]
         timeout: 2s
         override: false
@@ -75,12 +90,12 @@ spec:
         logs:
           receivers: [k8s_events]
           # processors: [memory_limiter, batch]
-          processors: [k8sattributes, resourcedetection/env, resource]
+          processors: [k8s_attributes, resource_detection/env, resource]
           # Enable configured exporters in the overlay
           exporters: []
         metrics:
           receivers: [k8s_cluster]
           # processors: [memory_limiter, batch]
-          processors: [k8sattributes, resourcedetection/env, resource]
+          processors: [k8s_attributes, resource_detection/env, resource]
           # Enable configured exporters in the overlay
           exporters: []

run-integration-test/kustomize/bases/opentelemetry-collectors/kubernetes-objects/clusterrole-kubernetes-objects.yml

@@ -6,20 +6,102 @@ metadata:
   labels:
     app: kubernetes-objects
 rules:
-  # TODO: Add Stackable objects, and other common k8s objects
+  # Read-only across the object types watched by the k8sobjects receiver.
+  # NOTE: core "secrets" is deliberately omitted - the receiver emits full object data.
   - apiGroups:
       - ""
     resources:
-      - events
       - pods
+      - services
+      - endpoints
+      - configmaps
+      - persistentvolumeclaims
+      - persistentvolumes
+      - namespaces
+      - nodes
+      - serviceaccounts
+      - resourcequotas
+      - limitranges
     verbs:
       - get
       - list
       - watch
   - apiGroups:
-      - "events.k8s.io"
+      - "apps"
     resources:
-      - events
+      - deployments
+      - statefulsets
+      - daemonsets
+      - replicasets
     verbs:
+      - get
+      - list
       - watch
+  - apiGroups:
+      - "batch"
+    resources:
+      - jobs
+      - cronjobs
+    verbs:
+      - get
       - list
+      - watch
+  - apiGroups:
+      - "networking.k8s.io"
+    resources:
+      - ingresses
+      - networkpolicies
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - "autoscaling"
+    resources:
+      - horizontalpodautoscalers
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - "policy"
+    resources:
+      - poddisruptionbudgets
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - "storage.k8s.io"
+    resources:
+      - storageclasses
+    verbs:
+      - get
+      - list
+      - watch
+  # All Stackable CRDs, by API group. Wildcard resources so this survives plural typos and
+  # new CRDs across SDP releases. Read-only. Groups are far more stable than plural names.
+  - apiGroups:
+      - airflow.stackable.tech
+      - druid.stackable.tech
+      - hbase.stackable.tech
+      - hdfs.stackable.tech
+      - hive.stackable.tech
+      - kafka.stackable.tech
+      - nifi.stackable.tech
+      - spark.stackable.tech
+      - superset.stackable.tech
+      - trino.stackable.tech
+      - zookeeper.stackable.tech
+      - opa.stackable.tech
+      - opensearch.stackable.tech
+      - authentication.stackable.tech
+      - s3.stackable.tech
+      - listeners.stackable.tech
+      - secrets.stackable.tech
+    resources:
+      - "*"
+    verbs:
+      - get
+      - list
+      - watch