Merge branch 'main' of https://github.com/kubefleet-dev/kubefleet into feat/status-backreporting-controller

Author: michaelawyu

.github/.copilot/breadcrumbs/2025-11-05-0000-k8s-version-collection-with-ttl.md

@@ -0,0 +1,81 @@
+# Implementation: Kubernetes Version Collection with TTL Caching
+
+## Overview
+Add a `collectK8sVersion` function to the Azure property provider that collects the Kubernetes server version using the discoveryClient with a 15-minute TTL cache to minimize API calls.
+
+## Plan
+
+### Phase 1: Add Cache Fields
+**Task 1.1: Add cache-related fields to PropertyProvider struct**
+- Add `cachedK8sVersion` string field to store the cached version
+- Add `k8sVersionCacheTime` time.Time field to track when the cache was last updated
+- Add `k8sVersionCacheTTL` time.Duration field set to 15 minutes
+- Add a mutex for thread-safe access to cached values
+
+### Phase 2: Implement collectK8sVersion Function
+**Task 2.1: Implement the collectK8sVersion function**
+- Check if cached version exists and is still valid (within TTL)
+- If cache is valid, return cached version
+- If cache is expired or empty, call discoveryClient.ServerVersion()
+- Update cache with new version and current timestamp
+- Return the version as a property with observation time
+
+### Phase 3: Integrate into Collect Method
+**Task 3.1: Call collectK8sVersion in Collect method**
+- Add call to collectK8sVersion in the Collect method
+- Store the k8s version in the properties map
+
+### Phase 4: Write Unit Tests
+**Task 4.1: Create unit tests for collectK8sVersion**
+- Test cache hit scenario (cached version within TTL)
+- Test cache miss scenario (no cached version)
+- Test cache expiration scenario (cached version expired)
+- Test error handling from discoveryClient
+- Test thread safety of cache access
+
+### Phase 5: Verify Tests Pass
+**Task 5.1: Run unit tests**
+- Execute `go test` for the provider package
+- Verify all tests pass
+
+## Success Criteria
+- [x] Cache fields added to PropertyProvider struct
+- [x] collectK8sVersion function implemented with TTL logic
+- [x] Function integrated into Collect method
+- [x] Unit tests created and passing
+- [x] Thread-safe implementation verified
+
+## Implementation Notes
+- Using sync.RWMutex for thread-safe cache access
+- TTL set to 15 minutes as specified
+- Uses the standard `propertyprovider.K8sVersionProperty` constant instead of creating a new one
+- Changed `discoveryClient` field type from `discovery.DiscoveryInterface` to `discovery.ServerVersionInterface` for better testability and to only depend on the interface we actually need
+- Fixed test nil pointer issue by conditionally setting the discoveryClient field only when it's non-nil
+
+## Final Implementation Summary
+All tasks completed successfully. The `collectK8sVersion` function now:
+1. Caches the Kubernetes version with a 15-minute TTL
+2. Uses thread-safe mutex locks for concurrent access
+3. Properly handles nil discovery client cases
+4. Returns early if cache is still valid to minimize API calls
+5. Updates cache atomically when fetching new version
+6. Has comprehensive unit tests covering all scenarios including cache hits, misses, expiration, errors, and concurrency
+
+## Integration Test Updates
+Updated integration tests to ignore the new k8s version property in comparisons:
+- Added `ignoreK8sVersionProperty` using `cmpopts.IgnoreMapEntries` to filter out the k8s version from test expectations
+- Integration tests now pass successfully (33 specs all passed)
+- The k8s version is being collected correctly from the test Kubernetes environment, validating the implementation works end-to-end
+
+## Test Results
+- Unit tests: ✅ 8/8 passed (7 in TestCollectK8sVersion + 1 in TestCollectK8sVersionConcurrency)
+- Integration tests: ✅ 33/33 specs passed
+- All scenarios validated including cache behavior, TTL expiration, error handling, and thread safety
+
+## Refactoring
+Simplified the implementation by removing the `k8sVersionCacheTTL` instance field from PropertyProvider:
+- Removed the `k8sVersionCacheTTL time.Duration` field from the struct
+- Updated `collectK8sVersion` to use the `K8sVersionCacheTTL` constant directly
+- Removed field initialization from `New()` and `NewWithPricingProvider()` constructors
+- Updated unit tests to remove the field from test PropertyProvider instances
+- All tests still pass after refactoring ✅

.github/workflows/chart.yml

@@ -18,7 +18,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6.0.1
         with:
           submodules: true
           fetch-depth: 0

.github/workflows/ci.yml

@@ -40,7 +40,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6.0.1
 
       - name: Set up Ginkgo CLI
         run: |
@@ -91,7 +91,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6.0.1
 
       - name: Install Ginkgo CLI
         run: |
@@ -139,7 +139,7 @@ jobs:
 
       - name: Upload logs
         if: always()
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v6
         with:
           name: e2e-logs-${{ matrix.customized-settings }}
           path: test/e2e/logs-${{ matrix.customized-settings }}/

.github/workflows/code-lint.yml

@@ -43,7 +43,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6.0.1
         with:
           submodules: true
 
@@ -64,7 +64,7 @@ jobs:
         go-version: ${{ env.GO_VERSION }}
 
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6.0.1
 
     - name: golangci-lint
       run: make lint

.github/workflows/codeql-analysis.yml

@@ -38,7 +38,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6.0.1
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/codespell.yml

@@ -12,12 +12,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493 # v4.1.7
-      - uses: codespell-project/actions-codespell@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630 # master
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4.1.7
+      - uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579 # master
         with:
           check_filenames: true
           skip: ./.git,./.github/workflows/codespell.yml,.git,*.png,*.jpg,*.svg,*.sum,./vendor,go.sum,testdata

.github/workflows/markdown-lint.yml

@@ -10,7 +10,7 @@ jobs:
   markdown-link-check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@v6.0.1
     - uses: tcort/github-action-markdown-link-check@v1
       with:
         # this will only show errors in the output

.github/workflows/release.yml

@@ -0,0 +1,87 @@
+name: Release Images
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag (e.g., v1.0.0)'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  REGISTRY: ghcr.io
+  HUB_AGENT_IMAGE_NAME: hub-agent
+  MEMBER_AGENT_IMAGE_NAME: member-agent
+  REFRESH_TOKEN_IMAGE_NAME: refresh-token
+  GO_VERSION: '1.24.9'
+
+jobs:
+  export-registry:
+    runs-on: ubuntu-latest
+    outputs:
+      registry: ${{ steps.export.outputs.registry }}
+      tag: ${{ steps.export.outputs.tag }}
+    steps:
+      - name: Checkout code
+        uses: actions/[email protected]
+        
+      - id: export
+        run: |
+          # registry must be in lowercase
+          echo "registry=$(echo "${{ env.REGISTRY }}/${{ github.repository }}" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
+          
+          # Extract tag from github ref or workflow input
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            TAG="${{ inputs.tag }}"
+          elif [[ "${{ github.ref }}" == refs/tags/* ]]; then
+            TAG=${GITHUB_REF#refs/tags/}
+          else
+            echo "Error: Workflow triggered by unsupported event or ref"
+            echo "Event: ${{ github.event_name }}"
+            echo "Ref: ${{ github.ref }}"
+            exit 1
+          fi
+          echo "tag=${TAG}" >> $GITHUB_OUTPUT
+          echo "Release tag: ${TAG}"
+
+  build-and-publish:
+    needs: export-registry
+    env:
+      REGISTRY: ${{ needs.export-registry.outputs.registry }}
+      TAG: ${{ needs.export-registry.outputs.tag }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Go ${{ env.GO_VERSION }}
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - name: Checkout code
+        uses: actions/[email protected]
+
+      - name: Login to ghcr.io
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push images with tag ${{ env.TAG }}
+        run: |
+          make push
+
+      - name: Verify images
+        run: |
+          echo "✅ Published images:"
+          echo "  - ${{ env.REGISTRY }}/${{ env.HUB_AGENT_IMAGE_NAME }}:${{ env.TAG }}"
+          echo "  - ${{ env.REGISTRY }}/${{ env.MEMBER_AGENT_IMAGE_NAME }}:${{ env.TAG }}"
+          echo "  - ${{ env.REGISTRY }}/${{ env.REFRESH_TOKEN_IMAGE_NAME }}:${{ env.TAG }}"
+          echo ""
+          echo "📦 Images are now public!"

.github/workflows/trivy.yml

@@ -44,7 +44,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6.0.1
 
       - name: Login to ${{ env.REGISTRY }}
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef

.github/workflows/upgrade.yml

@@ -44,7 +44,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6.0.1
         with:
           # Fetch the history of all branches and tags.
           # This is needed for the test suite to switch between releases.
@@ -127,7 +127,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6.0.1
         with:
           # Fetch the history of all branches and tags.
           # This is needed for the test suite to switch between releases.
@@ -210,7 +210,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6.0.1
         with:
           # Fetch the history of all branches and tags.
           # This is needed for the test suite to switch between releases.