Merge branch 'main' into ci/run_validate_kong_image_daily

Author: lahabana

.dockerignore

@@ -5,3 +5,13 @@
 !**/*.sum
 .git
 kong-ingress-controller
+bin/
+config/
+docs/
+examples/
+scripts/
+generators/
+Dockerfile*
+test/
+keps/
+*.md

.gitattributes

@@ -1,4 +1,4 @@
-**/zz_generated*.go linguist-generated=true
+**/zz_generated.*.go linguist-generated=true
 pkg/clientset/** linguist-generated=true
 deploy/single/** linguist-generated=true
 test/e2e/manifests/** linguist-generated=true

.github/ISSUE_TEMPLATE/enhancement.yaml

@@ -9,6 +9,17 @@ body:
     options:
     - label: I have searched the existing issues
       required: true
+- type: checkboxes
+  attributes:
+    label: Does this enhancement require public documentation?
+    description: |
+      Please make sure that Acceptance Criteria section includes for updating our public documentation
+      ([docs.konghq.com](https://github.com/kong/docs.konghq.com), README.md, etc.) with the new feature or enhancement.
+      If the scope of the change is too large to be documented in the Acceptance Criteria, please create a separate
+      issue and link it in the AC.
+    options:
+      - label: I have added an Acceptance Criteria item for adding and/or adjusting public documentation (if applicable)
+        required: true
 - type: textarea
   attributes:
     label: Problem Statement

.github/ISSUE_TEMPLATE/epic.yaml

@@ -0,0 +1,46 @@
+name: ☔ Epic
+description: Use this template to propose a new feature or enhancement that requires multiple changes across the project.
+labels: [ epic ]
+title: ☔
+body:
+  - type: checkboxes
+    attributes:
+      label: Is there an existing issue for this?
+      description: Please search to see if an issue already exists for the bug you encountered.
+      options:
+        - label: I have searched the existing issues
+          required: true
+  - type: textarea
+    attributes:
+      label: Problem Statement
+      description: Without specifying a solution, describe what the project is missing today.
+      placeholder: |
+        The rotating project logo has a fixed size and color.
+        There is no way to make it larger and more shiny.
+    validations:
+      required: true
+  - type: textarea
+    attributes:
+      label: Supporting documentation
+      description: |
+        Link to supporting documentation, such as design documents, user stories, or other relevant information.
+      placeholder: |
+        User stories:
+        - As a user, I want to control the size of the rotating logo using a CLI flag.
+        - As a user, I want to control the color of the rotating logo using a CLI flag.
+        [Design document](https://example.com/design)
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Acceptance Criteria
+      value: |
+        ### Implementation
+        - [ ] Design
+        - [ ] Code
+        
+        ### Docs 
+        - [ ] Guide and required documentation
+        - [ ] User-acceptance testing (someone not involved in the project tries the guide and the feature)
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/release.yaml

@@ -15,13 +15,6 @@ body:
     - patch
   validations:
     required: true
-- type: checkboxes
-  id: release_branch
-  attributes:
-    label: "**For major/minor releases** Create `release/<MAJOR>.<MINOR>.x` Branch"
-    options:
-      # This can be automated. https://github.com/Kong/kubernetes-ingress-controller/issues/3772 tracks this effort
-      - label: "Create the `release/<MAJOR>.<MINOR>.x` branch at the place where you want to branch of off main"
 - type: checkboxes
   id: prepare_release_branch
   attributes:
@@ -46,6 +39,13 @@ body:
       - label: Once the PR is merged (the `prepare-release/x.y.z` branch will get automatically removed), approve and merge the automatic backport PR and [initiate a release job](https://github.com/Kong/kubernetes-ingress-controller/actions/workflows/release.yaml) on the `main` branch for major or minor release, for patch use the release branch. Your tag must use `vX.Y.Z` format. Set `latest` to true if this is be the latest release. That should be the case if a new major.minor release is done or a patch release is done on the latest minor version.
       - label: CI will validate the requested version, build and push an image, and run tests against the image before finally creating a tag and publishing a release. If tests fail, CI will push the image but not the tag or release. Investigate the failure, correct it as needed, and start a new release job.
       - label: The release workflow ([.github/workflows/release.yaml](/Kong/kubernetes-ingress-controller/blob/main/.github/workflows/release.yaml)) will update the `latest` branch - if the released version was set to be `latest` - to the just released tag.
+- type: checkboxes
+  id: release_branch
+  attributes:
+    label: "**For major/minor releases** Create `release/<MAJOR>.<MINOR>.x` Branch"
+    options:
+      # This can be automated. https://github.com/Kong/kubernetes-ingress-controller/issues/3772 tracks this effort
+      - label: "Create the `release/<MAJOR>.<MINOR>.x` branch at the place where you want to branch of off main. It should be done after the release workflow has run successfully."
 - type: checkboxes
   id: release_documents
   attributes:
@@ -58,18 +58,40 @@ body:
       - label: Update `reference/version-compatibility.md` to include the new versions (make sure you capture any new Kubernetes/Istio versions that have been tested)
       - label: Copy `app/_data/docs_nav_kic_OLDVERSION.yml` to `app/_data/docs_nav_kic_NEWVERSION.yml` and update the `release` field to `NEWVERSION`. Add entries for any new articles.
       - label: Make sure that `app/_data/docs_nav_kic_NEWVERSION.yml` links to the latest generated `custom-resources-X.X.X.md`.
-      - label: Add a section to `app/_data/kong_versions.yml` for your version.
-      - label: "Add entries in support policy documents: `app/_includes/md/support-policy.md` and `app/_src/kubernetes-ingress-controller/support-policy.md`."
+      - label: Add a section to `app/_data/kong_versions.yml` for your version and move the `latest` field to version that's being released.
+      - label: "Add entries in support policy documents: `app/_src/kubernetes-ingress-controller/support-policy.md` and `app/_includes/md/kic/support.md`."
       - label: Mark the PR ready for review.
       - label: Inform and ping the @Kong/team-k8s via slack of impending release with a link to the release PR.
       - label: Ensure that [KGO](https://github.com/Kong/gateway-operator) works with the released version of KIC. Update and release it if needed.
+- type: checkboxes
+  id: release_charts
+  attributes:
+    label: "**For major/minor releases only** Bump charts' dependencies"
+    options:
+      - label: Synchronize `config/crd/bases` with [`kong/kong` charts CRDs][https://github.com/Kong/charts/blob/6c1421bf2f4/charts/kong/crds/custom-resource-definitions.yaml]
+      - label: Update RBAC policy rules (`kong.kubernetesRBACRules` template) in [`kong/kong`'s `charts/kong/templates`][https://github.com/Kong/charts/blob/0b1f635f180220f86d17f5b1b4dd60fc0dc35aae/charts/kong/templates/_helpers.tpl#L1292].
+      - label: Bump the KIC version in the [`kong/kong` Helm chart](https://github.com/Kong/charts/blob/main/charts/kong/values.yaml#L528).
+      - label: Release new version of the `kong/kong` Helm chart.
+      - label: After `kong/kong` is released, bump the dependency on `kong/kong` chart in the [`kong/ingress` Helm chart](https://github.com/Kong/charts/blob/main/charts/ingress/Chart.yaml#L15) and release a new version of the chart.
 - type: textarea
   id: conformance_tests_report
   attributes:
     label: Conformance tests report
-    value: Trigger for released version CI workflow [Generate Kubernetes Gateway API conformance tests report](https://github.com/Kong/kubernetes-ingress-controller/actions/workflows/conformance_tests_report.yaml), verify artifact and submit it to https://github.com/kubernetes-sigs/gateway-api/tree/main/conformance/reports. It's still in experimental phase. Update the KIC version in the README's Gateway API conformance badge.
+    value: Trigger for released version CI workflow [Generate Kubernetes Gateway API conformance tests report](https://github.com/Kong/kubernetes-ingress-controller/actions/workflows/conformance_tests_report.yaml), verify artifact and submit it to https://github.com/kubernetes-sigs/gateway-api/tree/main/conformance/reports. Update the KIC version in the README's Gateway API conformance badge.
+- type: textarea
+  id: post_release_testing
+  attributes:
+    label: Post release testing
+    value: Appoint volunteer(s) to perform end-to-end testing of newly released features by following official documentation. Testing should cover following all the newly added or modified guides/tutorials, etc.
 - type: textarea
   id: release_trouble_shooting_link
   attributes:
     label: Release Troubleshooting
     value: The [Release Troubleshooting guide](https://github.com/Kong/kubernetes-ingress-controller/blob/main/RELEASE.md#release-troubleshooting) covers strategies for dealing with a release that has failed.
+- type: checkboxes
+  id: post_release
+  attributes:
+    label: "**For major/minor releases only** Do post release steps"
+    options:
+      - label: Schedule a retro meeting. Invite the team (team-kubernetes@konghq.com) and a Product Manager. Remember to link to [retro notes](https://docs.google.com/document/d/15gDtl425zyttbDwA8qQrh5yBgTD5OpnhjOquqfSJUx4/edit#heading=h.biunbyheelys) in the invite description.
+      - label: Update [`konnect-ui-apps`](https://github.com/Kong/konnect-ui-apps/) with latest KIC version (see [konnect-ui-apps#4939](https://github.com/Kong/konnect-ui-apps/pull/4939) as an example). Remove this when [#6738](https://github.com/Kong/kubernetes-ingress-controller/issues/6738) is resolved.

.github/dependabot.yml

@@ -1,17 +1,25 @@
 version: 2
 updates:
 - package-ecosystem: gomod
+  ignore:
+    # Ignore updates for `kong/kubernetes-configuration` as it is handled by Renovate.
+    - dependency-name: github.com/kong/kubernetes-configuration
   directory: /
   schedule:
     interval: daily
   labels:
   - dependencies
-- package-ecosystem: gomod
-  directory: /third_party/
-  schedule:
-    interval: daily
-  labels:
-  - dependencies
+  groups:
+     # Specify a name for the group, which will be used in pull request titles and branch names
+     k8s.io:
+        # Define patterns to include dependencies in the group (based on dependency name)
+        applies-to: version-updates # Applies the group rule to version updates
+        patterns:
+          - "k8s.io/*"
+        exclude-patterns:
+        - k8s.io/klog/*
+        - k8s.io/utils
+        - k8s.io/kube-openapi
 - package-ecosystem: github-actions
   directory: /
   schedule:

.github/test_dependencies.yaml

@@ -1,51 +1,57 @@
 e2e:
   kind:
     # renovate: datasource=docker depName=kindest/node versioning=docker
-    - 'v1.28.0'
+    - 'v1.32.0'
     # renovate: datasource=docker depName=kindest/node@only-patch packageName=kindest/node versioning=docker
-    - 'v1.27.3'
+    - 'v1.31.4'
     # renovate: datasource=docker depName=kindest/node@only-patch packageName=kindest/node versioning=docker
-    - 'v1.26.6'
+    - 'v1.30.8'
     # renovate: datasource=docker depName=kindest/node@only-patch packageName=kindest/node versioning=docker
-    - 'v1.25.11'
-    # renovate: datasource=docker depName=kindest/node@only-patch packageName=kindest/node versioning=docker
-    - 'v1.24.15'
+    - 'v1.29.12'
   gke:
     # renovate: datasource=custom.gke-rapid depName=gke versioning=semver
-    - '1.28.3'
-
+    - '1.32.0'
 
   # For Istio, we define combinations of Kind and Istio versions that will be
   # used directly in the test matrix `include` section.
   istio:
     - # renovate: datasource=docker depName=kindest/node versioning=docker
-      kind: 'v1.28.0'
+      kind: 'v1.32.0'
       # renovate: datasource=docker depName=istio/istioctl versioning=docker
-      istio: '1.20.0'
-    - # renovate: datasource=docker depName=kindest/node@only-patch packageName=kindest/node versioning=docker
-      kind: 'v1.27.3'
-      # renovate: datasource=docker depName=istio/istioctl@only-patch packageName=istio/istioctl versioning=docker
-      istio: '1.19.4'
-    - # renovate: datasource=docker depName=kindest/node@only-patch packageName=kindest/node versioning=docker
-      kind: 'v1.26.6'
-      # renovate: datasource=docker depName=istio/istioctl@only-patch packageName=istio/istioctl versioning=docker
-      istio: '1.18.5'
-    - # renovate: datasource=docker depName=kindest/node@only-patch packageName=kindest/node versioning=docker
-      kind: 'v1.25.11'
-      # renovate: datasource=docker depName=istio/istioctl@only-patch packageName=istio/istioctl versioning=docker
-      istio: '1.17.8'
+      istio: '1.24.2'
+    - # renovate: datasource=docker depName=kindest/node@only-patch versioning=docker
+      kind: 'v1.30.8'
+      # renovate: datasource=docker depName=istio/istioctl@only-patch versioning=docker
+      istio: '1.23.3'
+    - # renovate: datasource=docker depName=kindest/node@only-patch versioning=docker
+      kind: 'v1.30.8'
+      # renovate: datasource=docker depName=istio/istioctl@only-patch versioning=docker
+      istio: '1.22.3'
+    - # renovate: datasource=docker depName=kindest/node@only-patch versioning=docker
+      kind: 'v1.29.12'
+      # renovate: datasource=docker depName=istio/istioctl@only-patch versioning=docker
+      istio: '1.21.2'
+
+  # renovate: datasource=helm depName=kuma registryUrl=https://kumahq.github.io/charts versioning=helm
+  kuma: '2.9.2'
 
 integration:
   helm:
     # renovate: datasource=helm depName=kong registryUrl=https://charts.konghq.com versioning=helm
-    kong: '2.33.1'
+    kong: '2.46.0'
   # renovate: datasource=docker depName=kindest/node versioning=docker
-  kind: 'v1.28.0'
+  kind: 'v1.32.0'
   # renovate: datasource=docker depName=kong versioning=docker
-  kong-oss: '3.5.0'
+  kong-oss: '3.9.0'
   # renovate: datasource=docker depName=kong/kong-gateway versioning=docker
-  kong-ee: '3.5.0.1'
+  kong-ee: '3.9.0.0'
 
 kongintegration:
   # renovate: datasource=docker depName=kong versioning=docker
-  kong-oss: '3.5.0'
+  kong-oss: '3.9.0'
+  # renovate: datasource=docker depName=kong/kong-gateway versioning=docker
+  kong-ee: '3.9.0.0'
+
+envtests:
+  # renovate: datasource=docker depName=kong/kong-gateway versioning=docker
+  kong-ee: '3.9.0.0'

.github/workflows/_conformance_tests.yaml

@@ -11,21 +11,21 @@ on:
 
 jobs:
   dependencies-versions:
+    timeout-minutes: ${{ fromJSON(vars.GHA_DEFAULT_TIMEOUT || 10) }}
     runs-on: ubuntu-latest
     outputs:
       helm-kong: ${{ steps.set-versions.outputs.helm-kong }}
     steps:
       - name: checkout repository
         uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
 
       - id: set-versions
         name: Set versions
         run: |
           echo "helm-kong=$(yq -ojson -r '.integration.helm.kong' < .github/test_dependencies.yaml )" >> $GITHUB_OUTPUT
 
   conformance-tests:
+    timeout-minutes: ${{ fromJSON(vars.GHA_DEFAULT_TIMEOUT || 10) }}
     name: ${{ matrix.name }}
     runs-on: ubuntu-latest
     needs: dependencies-versions
@@ -35,40 +35,58 @@ jobs:
       fail-fast: false
       matrix:
         include:
-        - name: conformance-tests-traditional-compatible-router
-          expression_routes: "false"
-        - name: "conformance-tests-expressions-router"
-          expression_routes: "true"
+        - name: traditional-compatible-router
+          router-flavor: traditional_compatible
+        - name: expressions-router
+          router-flavor: expressions
     steps:
       - name: checkout repository
         uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
 
       - name: setup golang
         uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
 
+      - uses: jdx/mise-action@v2
+        with:
+          install: false
+
+      - run: echo "JUNIT_REPORT=conformance-tests-${{ matrix.name }}.xml" >> $GITHUB_ENV
+
       - name: run conformance tests
         run: make test.conformance
         env:
-          JUNIT_REPORT: "conformance-tests.xml"
-          KONG_TEST_EXPRESSION_ROUTES: ${{ matrix.expression_routes }}
+          MISE_VERBOSE: 1
+          MISE_DEBUG: 1
+          JUNIT_REPORT: ${{ env.JUNIT_REPORT }}
+          TEST_KONG_ROUTER_FLAVOR: ${{ matrix.router-flavor }}
           TEST_KONG_KIC_MANAGER_LOG_OUTPUT: ${{ inputs.log-output-file }}
-      
+
       # upload logs when test failed
-      - name: upload KIC logs 
+      - name: upload KIC logs
         if: ${{ failure() && inputs.log-output-file != '' }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with: 
           name: ${{ matrix.name }}-kic-logs
           path: ${{ inputs.log-output-file }}
           if-no-files-found: ignore
 
       - name: collect test report
         if: ${{ always() }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-report-conformance-${{ matrix.name }}
+          path: ${{ env.JUNIT_REPORT }}
+
+  merge-junit-test-reports:
+    runs-on: ubuntu-latest
+    needs:
+    - conformance-tests
+    steps:
+      - name: Merge Junit test reports
+        uses: actions/upload-artifact/merge@v4
         with:
-          name: tests-report
-          path: conformance-tests.xml
+          name: test-report-conformance
+          pattern: test-report-conformance-*
+          delete-merged: true