Merge branch 'master' into e2eImprovements

.github/workflows/auto-merge.yaml

@@ -1,16 +1,33 @@
 name: auto-merge
+concurrency:
+  cancel-in-progress: true
+  group: ${{github.workflow}}-${{github.event.pull_request.number}}
 on:
   pull_request:
-    types: [labeled, opened, reopened]
+    types: [labeled, opened, reopened, synchronize]
     branches:
       - 'master'
       - 'release-*'
+permissions:
+  contents: read
 jobs:
-  pr-mgmt:
-    uses: kumahq/.github/.github/workflows/wfc_pr_management.yml@main
-    with:
-      approve: true
-      merge: true
-      matchLabel: "ci/auto-merge"
-    secrets:
-      github-token: ${{ secrets.GITHUB_TOKEN }}
+  approve-and-auto-merge:
+    runs-on: ubuntu-latest
+    if: contains(github.event.pull_request.labels.*.name, 'ci/auto-merge')
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Generate GitHub app token
+        id: github-app-token
+        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
+        with:
+          app_id: ${{ vars.APP_ID }}
+          private_key: ${{ secrets.APP_PRIVATE_KEY }}
+      - name: Approve PR
+        run: gh pr review ${{ github.event.pull_request.number }} -a -R ${{ github.repository }}
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+      - name: Enable auto-merge
+        run: gh pr merge ${{ github.event.pull_request.number }} --auto --squash -R ${{ github.repository }}
+        env:
+          GITHUB_TOKEN: ${{ steps.github-app-token.outputs.token }}

.github/workflows/backport.yaml

@@ -2,6 +2,8 @@ name: backport
 on:
   pull_request_target:
     types: [labeled, closed]
+permissions:
+  contents: read
 jobs:
   maybe-backport:
     uses: kumahq/.github/.github/workflows/wfc_backport.yml@main

.github/workflows/build-test-distribute.yaml

@@ -8,6 +8,8 @@ on:
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
+permissions:
+  contents: read
 env:
   # This is automatically managed by CI
   K8S_MIN_VERSION: v1.23.17-k3s1
@@ -38,7 +40,8 @@ jobs:
       - uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
         with:
           args: --fix=false --verbose
-          version: v1.54.1
+          version: v1.55.2
+          skip-pkg-cache: true
       - run: |
           make clean
       - run: |
@@ -82,13 +85,7 @@ jobs:
           sudo df -h
       - name: Run tests
         run: |
-          make test TEST_REPORTS=1
-      - name: Save test reports
-        uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392 # v4.0.0
-        with:
-          name: test-reports
-          path: build/reports
-          retention-days: 7
+          make test
   distributions:
     needs: ["check", "test", "test_e2e", "test_e2e_env"]
     if: ${{ always() }}

.github/workflows/e2e.yaml

@@ -11,6 +11,8 @@ on:
     secrets:
       circleCIToken:
         required: true
+permissions:
+  contents: read
 env:
   E2E_PARAM_K8S_VERSION: ${{ fromJSON(inputs.matrix).k8sVersion }}
   E2E_PARAM_CNI_NETWORK_PLUGIN: ${{ fromJSON(inputs.matrix).cniNetworkPlugin }}

.github/workflows/pr-comments.yaml

@@ -10,8 +10,6 @@ permissions:
   contents: read
 jobs:
   pr_comments:
-    permissions:
-      contents: write # for Git to git push
     if: github.event.issue.pull_request != '' && (contains(github.event.comment.body, '/format') || contains(github.event.comment.body, '/golden_files'))
     runs-on: ubuntu-latest
     steps:

.github/workflows/pr-merged.yaml

@@ -8,6 +8,8 @@ on:
     branches:
       - master
       - release-*
+permissions:
+  contents: read
 jobs:
   notify-about-merged-pr:
     if: github.event_name != 'pull_request_target' || github.event.pull_request.merged

.github/workflows/release.yaml

@@ -25,6 +25,8 @@ env:
   CHECK: ${{ inputs.check || 'false' }}
   EDITION: kuma
   MIN_VERSION: "1.2.0"
+permissions:
+  contents: read
 jobs:
   release:
     runs-on: ubuntu-latest
@@ -39,10 +41,16 @@ jobs:
         run: |
           echo $(go env GOPATH)/bin >> $GITHUB_PATH
           go install github.com/kumahq/ci-tools/cmd/release-tool@latest
+      - name: Generate GitHub app token
+        id: github-app-token
+        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
+        with:
+          app_id: ${{ secrets.APP_ID }}
+          private_key: ${{ secrets.APP_PRIVATE_KEY }}
       - name: create-release
         if: env.RELEASE != '0.0.0'
         env:
-          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ steps.github-app-token.outputs.token }}
         run: |
           release-tool release changelog --repo ${{ github.repository }} --release ${{ env.RELEASE }}
       - name: check-helm
@@ -69,12 +77,6 @@ jobs:
         if: fromJSON(env.CHECK)
         run: |
           release-tool release docker --repo ${{ github.repository }} --release ${{ env.RELEASE }} --docker-repo ${{env.DOCKER_REPO }} --images ${{ env.DOCKER_IMAGES }}
-      - name: Generate GitHub app token
-        id: github-app-token
-        uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0
-        with:
-          app_id: ${{ secrets.APP_ID }}
-          private_key: ${{ secrets.APP_PRIVATE_KEY }}
       - name: update-active-branches.json
         env:
           GITHUB_TOKEN: ${{ steps.github-app-token.outputs.token }}

app/kumactl/cmd/apply/apply_test.go

@@ -505,7 +505,7 @@ mesh: default
 networking:
   inbound: 0 # should be a string
 `,
-			err: `YAML contains invalid resource: invalid Dataplane object: 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal number into Go value of type []json.RawMessage'`,
+			err: `YAML contains invalid resource: invalid Dataplane object: "error unmarshaling JSON: while decoding JSON: json: cannot unmarshal number into Go value of type []json.RawMessage"`,
 		}),
 		Entry("no resource", testCase{
 			resource: ``,

mk/dependencies/deps.lock

@@ -1 +1 @@
-a576bd0d7a0f15ce1905d50613193ee847611b67
+2ba2dc429cb050355e7039e307399bf99cfb56b4

mk/dev.mk

@@ -24,7 +24,7 @@ CI_TOOLS_BIN_DIR=$(CI_TOOLS_DIR)/bin
 K8S_MIN_VERSION = v1.23.17-k3s1
 K8S_MAX_VERSION = v1.28.1-k3s1
 export GO_VERSION=$(shell go mod edit -json | jq -r .Go)
-export GOLANGCI_LINT_VERSION=v1.54.1
+export GOLANGCI_LINT_VERSION=v1.55.2
 GOOS := $(shell go env GOOS)
 GOARCH := $(shell go env GOARCH)
 

mk/test.mk

@@ -16,6 +16,9 @@ ifdef TEST_REPORTS
 	$(if $(findstring coverage,$(TEST_REPORTS)),GOFLAGS='${GOFLAGS}' go tool cover -html=$(REPORTS_DIR)/coverage.out -o "$(REPORTS_DIR)/coverage.html")
 endif
 ifndef TEST_REPORTS
+ifdef CI
+	go clean -testcache
+endif
 	$(UNIT_TEST_ENV) go test $(GOFLAGS) $(LD_FLAGS) -race $$(go list $(TEST_PKG_LIST) | grep -E -v "test/e2e" | grep -E -v "test/blackbox_network_tests")
 endif
 

pkg/api-server/testdata/resource_400onInvalidJson.golden.json

@@ -2,6 +2,6 @@
  "type": "/std-errors",
  "status": 400,
  "title": "Bad Request",
- "detail": "invalid TrafficRoute object: 'invalid character '}' looking for beginning of value'",
- "details": "invalid TrafficRoute object: 'invalid character '}' looking for beginning of value'"
+ "detail": "invalid TrafficRoute object: \"invalid character '}' looking for beginning of value\"",
+ "details": "invalid TrafficRoute object: \"invalid character '}' looking for beginning of value\""
 }

pkg/api-server/testdata/resource_400onInvalidMetaSchema.golden.json

@@ -2,6 +2,6 @@
  "type": "/std-errors",
  "status": 400,
  "title": "Bad Request",
- "detail": "invalid TrafficRoute object: 'json: cannot unmarshal number into Go struct field ResourceMeta.name of type string'",
- "details": "invalid TrafficRoute object: 'json: cannot unmarshal number into Go struct field ResourceMeta.name of type string'"
+ "detail": "invalid TrafficRoute object: \"json: cannot unmarshal number into Go struct field ResourceMeta.name of type string\"",
+ "details": "invalid TrafficRoute object: \"json: cannot unmarshal number into Go struct field ResourceMeta.name of type string\""
 }

pkg/api-server/testdata/resource_400onInvalidSpecSchema.golden.json

@@ -2,6 +2,6 @@
  "type": "/std-errors",
  "status": 400,
  "title": "Bad Request",
- "detail": "invalid TrafficRoute object: 'json: cannot unmarshal number into Go value of type string'",
- "details": "invalid TrafficRoute object: 'json: cannot unmarshal number into Go value of type string'"
+ "detail": "invalid TrafficRoute object: \"json: cannot unmarshal number into Go value of type string\"",
+ "details": "invalid TrafficRoute object: \"json: cannot unmarshal number into Go value of type string\""
 }

pkg/core/resources/apis/mesh/virtual_outbound_helpers.go

@@ -30,11 +30,11 @@ func (t *VirtualOutboundResource) evalTemplate(tmplStr string, tags map[string]s
 	sb := strings.Builder{}
 	tmpl, err := template.New("").Parse(tmplStr)
 	if err != nil {
-		return "", fmt.Errorf("failed compiling gotemplate error='%s'", err.Error())
+		return "", fmt.Errorf("failed compiling gotemplate error=%q", err.Error())
 	}
 	err = tmpl.Execute(&sb, entries)
 	if err != nil {
-		return "", fmt.Errorf("pre evaluation of template with parameters failed with error='%s'", err.Error())
+		return "", fmt.Errorf("pre evaluation of template with parameters failed with error=%q", err.Error())
 	}
 	return sb.String(), nil
 }
@@ -46,10 +46,10 @@ func (t *VirtualOutboundResource) EvalPort(tags map[string]string) (uint32, erro
 	}
 	i, err := strconv.ParseInt(s, 10, 64)
 	if err != nil {
-		return 0, fmt.Errorf("evaluation of template with parameters didn't evaluate to a parsable number result='%s'", s)
+		return 0, fmt.Errorf("evaluation of template with parameters didn't evaluate to a parsable number result=%q", s)
 	}
 	if i <= 0 || i > 65535 {
-		return 0, fmt.Errorf("evaluation of template returned a port outside of the range [1..65535] result='%d'", i)
+		return 0, fmt.Errorf("evaluation of template returned a port outside of the range [1..65535] result=%d", i)
 	}
 	return uint32(i), nil
 }
@@ -60,7 +60,7 @@ func (t *VirtualOutboundResource) EvalHost(tags map[string]string) (string, erro
 		return "", err
 	}
 	if !govalidator.IsDNSName(s) {
-		return "", fmt.Errorf("evaluation of template with parameters didn't return a valid dns name result='%s'", s)
+		return "", fmt.Errorf("evaluation of template with parameters didn't return a valid dns name result=%q", s)
 	}
 	return s, nil
 }

pkg/core/resources/apis/mesh/virtual_outbound_helpers_test.go

@@ -40,7 +40,7 @@ var _ = Describe("VirtualOutbound_Helpers", func() {
 				},
 			},
 			givenTags: map[string]string{"port": "hello"},
-			thenErr:   "evaluation of template with parameters didn't evaluate to a parsable number result='hello'",
+			thenErr:   `evaluation of template with parameters didn't evaluate to a parsable number result="hello"`,
 		}),
 		Entry("complex template", portTestCase{
 			in: &mesh_proto.VirtualOutbound_Conf{
@@ -61,7 +61,7 @@ var _ = Describe("VirtualOutbound_Helpers", func() {
 				},
 			},
 			givenTags: map[string]string{"port": "80000", "offset": "81"},
-			thenErr:   "a port outside of the range [1..65535] result='80000'",
+			thenErr:   "a port outside of the range [1..65535] result=80000",
 		}),
 	)
 
@@ -96,7 +96,7 @@ var _ = Describe("VirtualOutbound_Helpers", func() {
 				},
 			},
 			givenTags: map[string]string{"kuma.io/service": "foo()bar"},
-			thenErr:   "evaluation of template with parameters didn't return a valid dns name result='foo()bar'",
+			thenErr:   `evaluation of template with parameters didn't return a valid dns name result="foo()bar"`,
 		}),
 		Entry("simple eval", hostTestCase{
 			in: &mesh_proto.VirtualOutbound_Conf{

pkg/core/resources/apis/mesh/virtual_outbound_validator.go

@@ -83,7 +83,7 @@ func (t *VirtualOutboundResource) validateHost(path validators.PathBuilder) vali
 	}
 	_, lerr := t.EvalHost(fakeTags)
 	if lerr != nil {
-		err.AddViolationAt(path, fmt.Sprintf("template pre evaluation failed with error='%s'", lerr.Error()))
+		err.AddViolationAt(path, fmt.Sprintf("template pre evaluation failed with error=%q", lerr.Error()))
 	}
 	return err
 }
@@ -101,7 +101,7 @@ func (t *VirtualOutboundResource) validatePort(path validators.PathBuilder) vali
 	}
 	_, lerr := t.EvalPort(fakeTags)
 	if lerr != nil {
-		err.AddViolationAt(path, fmt.Sprintf("template pre evaluation failed with error='%s'", lerr.Error()))
+		err.AddViolationAt(path, fmt.Sprintf("template pre evaluation failed with error=%q", lerr.Error()))
 	}
 	return err
 }

pkg/core/resources/apis/mesh/virtual_outbound_validator_test.go

@@ -166,7 +166,7 @@ var _ = Describe("VirtualOutbound_validator", func() {
 			expected: `
                 violations:
                 - field: conf.host
-                  message: 'template pre evaluation failed with error=''failed compiling gotemplate error=''template: :1: function "mesh" not defined'''''
+                  message: 'template pre evaluation failed with error="failed compiling gotemplate error=\"template: :1: function \\\"mesh\\\" not defined\""'
 `,
 		}),
 		Entry("bad port template", testCase{
@@ -184,7 +184,7 @@ var _ = Describe("VirtualOutbound_validator", func() {
 			expected: `
                 violations:
                 - field: conf.port
-                  message: 'template pre evaluation failed with error=''failed compiling gotemplate error=''template: :1: function "port" not defined'''''
+                  message: 'template pre evaluation failed with error="failed compiling gotemplate error=\"template: :1: function \\\"port\\\" not defined\""'
 `,
 		}),
 		Entry("port is not a number template", testCase{
@@ -204,7 +204,7 @@ var _ = Describe("VirtualOutbound_validator", func() {
 			expected: `
                 violations:
                 - field: conf.port
-                  message: template pre evaluation failed with error='evaluation of template with parameters didn't evaluate to a parsable number result='1a''
+                  message: template pre evaluation failed with error="evaluation of template with parameters didn't evaluate to a parsable number result=\"1a\""
 `,
 		}),
 		Entry("parameter is not good tag", testCase{

pkg/core/resources/model/rest/unmarshaller.go

@@ -45,7 +45,7 @@ func (e *InvalidResourceError) Is(target error) bool {
 func (u *unmarshaler) UnmarshalCore(bytes []byte) (core_model.Resource, error) {
 	m := v1alpha1.ResourceMeta{}
 	if err := u.unmarshalFn(bytes, &m); err != nil {
-		return nil, &InvalidResourceError{Reason: fmt.Sprintf("invalid meta type: '%s'", err.Error())}
+		return nil, &InvalidResourceError{Reason: fmt.Sprintf("invalid meta type: %q", err.Error())}
 	}
 	desc, err := registry.Global().DescriptorFor(core_model.ResourceType(m.Type))
 	if err != nil {
@@ -70,7 +70,7 @@ func (u *unmarshaler) Unmarshal(bytes []byte, desc core_model.ResourceTypeDescri
 		rawObj := map[string]interface{}{}
 		// Unfortunately to validate new policies we must first unmarshal into a rawObj
 		if err := u.unmarshalFn(bytes, &rawObj); err != nil {
-			return nil, &InvalidResourceError{Reason: fmt.Sprintf("invalid %s object: '%s'", desc.Name, err.Error())}
+			return nil, &InvalidResourceError{Reason: fmt.Sprintf("invalid %s object: %q", desc.Name, err.Error())}
 		}
 		validator := validate.NewSchemaValidator(desc.Schema, nil, "", strfmt.Default)
 		res := validator.Validate(rawObj)
@@ -80,7 +80,7 @@ func (u *unmarshaler) Unmarshal(bytes []byte, desc core_model.ResourceTypeDescri
 	}
 
 	if err := u.unmarshalFn(bytes, restResource); err != nil {
-		return nil, &InvalidResourceError{Reason: fmt.Sprintf("invalid %s object: '%s'", desc.Name, err.Error())}
+		return nil, &InvalidResourceError{Reason: fmt.Sprintf("invalid %s object: %q", desc.Name, err.Error())}
 	}
 
 	if err := core_model.Validate(resource); err != nil {

pkg/plugins/policies/core/matchers/dataplane.go

@@ -43,7 +43,7 @@ func MatchedPolicies(rType core_model.ResourceType, dpp *core_mesh.DataplaneReso
 		selectedInbounds, delegatedGatewaySelected, err := dppSelectedByPolicy(policy.GetMeta(), refPolicy.GetTargetRef(), dpp, gateway, resources)
 		if err != nil {
 			warnings = append(warnings,
-				fmt.Sprintf("unable to resolve TargetRef on policy: mesh:'%s' name:'%s' error:'%s'",
+				fmt.Sprintf("unable to resolve TargetRef on policy: mesh:%s name:%s error:%q",
 					policy.GetMeta().GetMesh(), policy.GetMeta().GetName(), err.Error(),
 				),
 			)

pkg/plugins/policies/meshfaultinjection/api/v1alpha1/validator.go

@@ -74,7 +74,9 @@ func validateTo(topTargetRef common_api.TargetRef, to []To) validators.Validatio
 func validateDefault(path validators.PathBuilder, conf Conf) validators.ValidationError {
 	var verr validators.ValidationError
 	path = path.Field("http")
-	for idx, fault := range pointer.Deref(conf.Http) {
+	cfg := pointer.Deref(conf.Http)
+	for idx := range cfg {
+		fault := cfg[idx]
 		if fault.Abort != nil {
 			path := path.Field("abort").Index(idx)
 			verr.Add(validators.ValidateStatusCode(path.Field("httpStatus"), fault.Abort.HttpStatus))

pkg/test/resources/samples/global_secret_samples.go

@@ -5,6 +5,7 @@ import (
 	"github.com/kumahq/kuma/pkg/test/resources/builders"
 )
 
+//nolint:gosec
 const SampleSigningKeyValue = `-----BEGIN RSA PRIVATE KEY-----
 MIIEowIBAAKCAQEA2hVWqy1JzpbMEIrTr2UTdEsCMrTaUhAqZlhNLJrS8kc0mbPK
 Z7nT1JErJGUI4/NRHSQQZND3biPEcVktu0P5Ui6Ieum8HH7ENoRaSwLgaV451LOG

pkg/test/store/store_test_template.go

@@ -85,7 +85,7 @@ func ExecuteStoreTests(
 				Expect(resource.Meta.GetName()).To(Equal(name))
 				Expect(resource.Meta.GetMesh()).To(Equal(mesh))
 				Expect(resource.Meta.GetVersion()).ToNot(BeEmpty())
-				Expect(resource.Meta.GetCreationTime().Unix()).ToNot(Equal(0))
+				Expect(resource.Meta.GetCreationTime()).ToNot(BeZero())
 				Expect(resource.Meta.GetCreationTime()).To(Equal(resource.Meta.GetModificationTime()))
 				Expect(resource.Meta.GetLabels()).To(HaveKeyWithValue("foo", "bar"))
 				Expect(resource.Spec).To(MatchProto(created.Spec))

pkg/transparentproxy/iptables/builder/builder.go

@@ -174,7 +174,7 @@ func restoreIPTablesWithRetry(cfg config.Config, rulesFile *os.File, ipv6 bool)
 		}
 
 		_, _ = cfg.RuntimeStderr.Write([]byte(fmt.Sprintf(
-			"# [%d/%d] %s returned error: '%s'",
+			"# [%d/%d] %s returned error: %q",
 			i+1,
 			maxRetries+1,
 			strings.Join(append([]string{cmdName}, params...), " "),