ci: test across several k8s versions

Author: pmalek

.github/supported_k8s_node_images.yaml

@@ -0,0 +1,3 @@
+- node_image: kindest/node:v1.32.2@sha256:f226345927d7e348497136874b6d207e0b32cc52154ad8323129352923a3142f
+- node_image: kindest/node:v1.31.6@sha256:28b7cbb993dfe093c76641a0c95807637213c9109b761f1d422c2400e22b8e87
+- node_image: kindest/node:v1.30.10@sha256:4de75d0e82481ea846c0ed1de86328d821c1e6a6a91ac37bf804e5313670e507

.github/workflows/tests.yaml

@@ -106,8 +106,28 @@ jobs:
 
     - run: make lint
 
+  matrix_k8s_node_images:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - id: set-matrix
+        run: |
+          (
+            echo 'matrix<<EOF'
+            yq eval -o=json '.' .github/supported_k8s_node_images.yaml
+            echo 'EOF'
+          ) >> "${GITHUB_OUTPUT}"
+
   apply:
     runs-on: ubuntu-latest
+    needs:
+    - matrix_k8s_node_images
+    strategy:
+      matrix:
+        include: ${{ fromJson(needs.matrix_k8s_node_images.outputs.matrix) }}
+
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
@@ -121,6 +141,11 @@ jobs:
 
     - name: Create k8s KinD Cluster
       uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
+      with:
+        # NOTE: default is 0.26.0 https://github.com/helm/kind-action/blob/a1b0e391336a6ee6713a0583f8c6240d70863de3/kind.sh#L21
+        # so bump this manually
+        version: v0.27.0
+        node_image: ${{ matrix.node_image }}
 
     - name: Verify installing CRDs via kustomize works
       run: make install
@@ -130,6 +155,12 @@ jobs:
 
   CRDs-validation:
     runs-on: ubuntu-latest
+    needs:
+    - matrix_k8s_node_images
+    strategy:
+      matrix:
+        include: ${{ fromJson(needs.matrix_k8s_node_images.outputs.matrix) }}
+
     steps:
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
@@ -143,6 +174,11 @@ jobs:
 
     - name: Create k8s KinD Cluster
       uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
+      with:
+        # NOTE: default is 0.26.0 https://github.com/helm/kind-action/blob/a1b0e391336a6ee6713a0583f8c6240d70863de3/kind.sh#L21
+        # so bump this manually
+        version: v0.27.0
+        node_image: ${{ matrix.node_image }}
 
     - name: Verify installing CRDs via kustomize works
       run: make install

api/konnect/v1alpha1/konnect_cloudgateway_dataplane_configuration_types.go

@@ -92,8 +92,11 @@ type KonnectConfigurationDataPlaneGroup struct {
 
 	// NetworkRef is the reference to the network that this data-plane group will be deployed on.
 	//
+	// Cross namespace references are not supported for networkRef of type namespacedRef.
+	// This will be enforced in the future but currently (due to limitation in CEL validation
+	// in Kubernetes 1.31 and older) it is not.
+	//
 	// +kubebuilder:validation:Required
-	// +kubebuilder:validation:XValidation:rule="self.type == 'namespacedRef' && has(self.namespacedRef) ? !has(self.namespacedRef.namespace) : true", message="cross namespace references are not supported for networkRef of type namespacedRef"
 	NetworkRef commonv1alpha1.ObjectRef `json:"networkRef"`
 
 	// Autoscale configuration for the data-plane group.

config/crd/gateway-operator/konnect.konghq.com_konnectcloudgatewaydataplanegroupconfigurations.yaml

@@ -3847,7 +3847,7 @@ KonnectConfigurationDataPlaneGroup is the schema for the KonnectConfiguration ty
 | --- | --- |
 | `provider` _[ProviderName](#providername)_ | Name of cloud provider. |
 | `region` _string_ | Region for cloud provider region. |
-| `networkRef` _[ObjectRef](#objectref)_ | NetworkRef is the reference to the network that this data-plane group will be deployed on. |
+| `networkRef` _[ObjectRef](#objectref)_ | NetworkRef is the reference to the network that this data-plane group will be deployed on.<br /><br /> Cross namespace references are not supported for networkRef of type namespacedRef. This will be enforced in the future but currently (due to limitation in CEL validation in Kubernetes 1.31 and older) it is not. |
 | `autoscale` _[ConfigurationDataPlaneGroupAutoscale](#configurationdataplanegroupautoscale)_ | Autoscale configuration for the data-plane group. |
 | `environment` _[ConfigurationDataPlaneGroupEnvironmentField](#configurationdataplanegroupenvironmentfield) array_ | Array of environment variables to set for a data-plane group. |
 

docs/all-api-reference.md

@@ -489,7 +489,7 @@ KonnectConfigurationDataPlaneGroup is the schema for the KonnectConfiguration ty
 | --- | --- |
 | `provider` _[ProviderName](#providername)_ | Name of cloud provider. |
 | `region` _string_ | Region for cloud provider region. |
-| `networkRef` _[ObjectRef](#objectref)_ | NetworkRef is the reference to the network that this data-plane group will be deployed on. |
+| `networkRef` _[ObjectRef](#objectref)_ | NetworkRef is the reference to the network that this data-plane group will be deployed on.<br /><br /> Cross namespace references are not supported for networkRef of type namespacedRef. This will be enforced in the future but currently (due to limitation in CEL validation in Kubernetes 1.31 and older) it is not. |
 | `autoscale` _[ConfigurationDataPlaneGroupAutoscale](#configurationdataplanegroupautoscale)_ | Autoscale configuration for the data-plane group. |
 | `environment` _[ConfigurationDataPlaneGroupEnvironmentField](#configurationdataplanegroupenvironmentfield) array_ | Array of environment variables to set for a data-plane group. |
 

docs/konnect-api-reference.md

@@ -53,6 +53,9 @@ type TestCase[T client.Object] struct {
 	// Name is the name of the test case.
 	Name string
 
+	// SkipReason is the reason to skip the test case.
+	SkipReason string
+
 	// TestObject is the object to be tested.
 	TestObject T
 
@@ -73,6 +76,10 @@ type TestCase[T client.Object] struct {
 
 // RunWithConfig runs the test case against the provided rest.Config's cluster.
 func (tc *TestCase[T]) RunWithConfig(t *testing.T, cfg *rest.Config, scheme *runtime.Scheme) {
+	if tc.SkipReason != "" {
+		t.Skip(tc.SkipReason)
+	}
+
 	timeout := DefaultEventuallyTimeout
 	if tc.ExpectedErrorEventuallyConfig.Timeout != 0 {
 		timeout = tc.ExpectedErrorEventuallyConfig.Timeout

test/crdsvalidation/common/testcase.go

@@ -303,6 +303,9 @@ func TestKonnectDataPlaneGroupConfiguration(t *testing.T) {
 			},
 			{
 				Name: "networkRef namespacedRef cannot specify namespace",
+				SkipReason: "cross namespace references are not allowed but using the CEL reserved fields like 'namespace' " +
+					"is only allowed in Kubernetes 1.32+ (https://github.com/kubernetes/kubernetes/pull/126977). " +
+					"Re-enable this test and reintroduce the rule that enforces this when 1.32 becomes the oldest supported version.",
 				TestObject: &konnectv1alpha1.KonnectCloudGatewayDataPlaneGroupConfiguration{
 					ObjectMeta: common.CommonObjectMeta,
 					Spec: konnectv1alpha1.KonnectCloudGatewayDataPlaneGroupConfigurationSpec{