Bump to Knative 1.2 (#503)

Author: mattmoor

.github/workflows/minkind-apply.yaml

@@ -22,11 +22,11 @@ jobs:
         # To cut down on redundant testing, test each suite against a
         # particular version of K8s.
         include:
-        - k8s-version: v1.20.x
-          selfhost-variant: dockerfile
         - k8s-version: v1.21.x
-          selfhost-variant: buildpacks
+          selfhost-variant: dockerfile
         - k8s-version: v1.22.x
+          selfhost-variant: buildpacks
+        - k8s-version: v1.23.x
           selfhost-variant: ko
 
     env:
@@ -84,7 +84,6 @@ jobs:
       working-directory: ./src/github.com/mattmoor/mink
       run: |
         ./hack/setup-kind.sh \
-          --authenticated-registry \
           --registry-url $(echo ${KO_DOCKER_REPO} | cut -d'/' -f 1) \
           --cluster-suffix c${{ github.run_id }}.local \
           --nodes 3 \
@@ -98,8 +97,6 @@ jobs:
         mink install --replicas=3
 
         cat > $HOME/.mink.yaml <<EOF
-        as: me
-
         # Number of concurrent builds to allow.
         # We match this to nodes
         parallelism: 3
@@ -190,32 +187,8 @@ jobs:
         # Make sure we can curl the sample.
         curl "${URL}/?sleep=100"
 
-    - name: Collect ksvc diagnostics
-      if: ${{ failure() }}
-      run: kubectl get services.serving.knative.dev -oyaml
-
-    - name: Collect pod diagnostics
+    - uses: chainguard-dev/actions/kind-diag@main
       if: ${{ failure() }}
-      run: kubectl describe pods
-
-    - name: Collect system diagnostics
-      if: ${{ failure() }}
-      run: |
-        kubectl -n${SYSTEM_NAMESPACE} get pods
-
-        echo '::group:: describe'
-        kubectl -n${SYSTEM_NAMESPACE} describe pods
-        echo '::endgroup::'
-
-        for x in $(kubectl get pods -n${SYSTEM_NAMESPACE} -oname); do
-          echo "::group:: describe $x"
-          kubectl -n${SYSTEM_NAMESPACE} describe $x
-          echo '::endgroup::'
-
-          echo "::group:: $x logs"
-          kubectl -n${SYSTEM_NAMESPACE} logs $x --all-containers
-          echo '::endgroup::'
-        done
 
     - name: Post failure notice to Slack
       uses: rtCamp/action-slack-notify@v2.1.0

.github/workflows/minkind-bundle.yaml

@@ -57,7 +57,6 @@ jobs:
       working-directory: ./src/github.com/mattmoor/mink
       run: |
         ./hack/setup-kind.sh \
-          --authenticated-registry \
           --registry-url $(echo ${KO_DOCKER_REPO} | cut -d'/' -f 1) \
           --cluster-suffix c${{ github.run_id }}.local \
           --nodes 3 \
@@ -95,24 +94,8 @@ jobs:
           exit 1
         fi
 
-    - name: Collect system diagnostics
+    - uses: chainguard-dev/actions/kind-diag@main
       if: ${{ failure() }}
-      run: |
-        kubectl -n${SYSTEM_NAMESPACE} get pods
-
-        echo '::group:: describe'
-        kubectl -n${SYSTEM_NAMESPACE} describe pods
-        echo '::endgroup::'
-
-        for x in $(kubectl get pods -n${SYSTEM_NAMESPACE} -oname); do
-          echo "::group:: describe $x"
-          kubectl -n${SYSTEM_NAMESPACE} describe $x
-          echo '::endgroup::'
-
-          echo "::group:: $x logs"
-          kubectl -n${SYSTEM_NAMESPACE} logs $x --all-containers
-          echo '::endgroup::'
-        done
 
     - name: Post failure notice to Slack
       uses: rtCamp/action-slack-notify@v2.1.0

.github/workflows/minkind-cli.yaml

@@ -23,14 +23,16 @@ jobs:
         # particular version of K8s.
         include:
         - suite: GCP buildpacks
-          k8s-version: v1.20.x
-        - suite: Paketo buildpacks
           k8s-version: v1.21.x
-        - suite: Boson buildpacks
+        - suite: Paketo buildpacks
           k8s-version: v1.22.x
-          ko-flags: --platform=linux/amd64,linux/arm64
+        # TODO: The layout of the func stuff has gotten complicated,
+        # and manifest.yaml are no longer 1:1 with samples.
+        # - suite: Boson buildpacks
+        #   k8s-version: v1.23.x
+        #   ko-flags: --platform=linux/amd64,linux/arm64
         - suite: Knative helloworld
-          k8s-version: v1.22.x
+          k8s-version: v1.23.x
 
     env:
       GOPATH: ${{ github.workspace }}
@@ -87,7 +89,6 @@ jobs:
       working-directory: ./src/github.com/mattmoor/mink
       run: |
         ./hack/setup-kind.sh \
-          --authenticated-registry \
           --registry-url $(echo ${KO_DOCKER_REPO} | cut -d'/' -f 1) \
           --cluster-suffix c${{ github.run_id }}.local \
           --nodes 3 \
@@ -104,8 +105,6 @@ jobs:
         mink install --replicas=3
 
         cat > $HOME/.mink.yaml <<EOF
-        as: me
-
         # Bundle source context to here by default!
         bundle: ${KO_DOCKER_REPO}/bundle:latest
 
@@ -134,7 +133,7 @@ jobs:
       working-directory: ./src/github.com/knative/docs
       run: |
         ERROR=0
-        for dir in $(find ./docs/serving/samples/hello-world/ -mindepth 1 -maxdepth 1 -type d); do
+        for dir in $(find ./code-samples/serving/hello-world/ -mindepth 1 -maxdepth 1 -type d); do
           TEST="$(basename $dir)"
 
           if [[ ! -f $dir/Dockerfile ]]; then
@@ -148,6 +147,13 @@ jobs:
             continue
           fi
 
+          if [[ "${TEST}" =~ "csharp" ]]; then
+            # TODO: this consistently hits:
+            #   unlinkat //product_uuid: device or resource busy
+            echo Skipping csharp sample: ${TEST}
+            continue
+          fi
+
           echo "::group:: Test ${TEST}"
           # Build and deploy this sample.
           kn service create ${TEST} --image=$(mink build --directory=$dir)
@@ -260,9 +266,9 @@ jobs:
       if: matrix.suite == 'Boson buildpacks'
       working-directory: ./src/github.com/boson-project/faas
       run: |
-        for cfg in $(find templates -name '.builders.yaml'); do
+        for cfg in $(find templates -name 'manifest.yaml'); do
           TEST="$(echo $dir | sed 's@^./@@g' | sed 's@[/_]@-@g')";
-          BUILDER="$(yq r $cfg default)"
+          BUILDER="$(yq r $cfg builders.default)"
 
           if [[ "${TEST}" =~ "spring" ]]; then
             # TODO(https://github.com/boson-project/faas/pull/231): Support Spring
@@ -346,32 +352,8 @@ jobs:
 
         exit ${ERROR}
 
-    - name: Collect ksvc diagnostics
+    - uses: chainguard-dev/actions/kind-diag@main
       if: ${{ failure() }}
-      run: kubectl get services.serving.knative.dev -oyaml
-
-    - name: Collect pod diagnostics
-      if: ${{ failure() }}
-      run: kubectl describe pods
-
-    - name: Collect system diagnostics
-      if: ${{ failure() }}
-      run: |
-        kubectl -n${SYSTEM_NAMESPACE} get pods
-
-        echo '::group:: describe'
-        kubectl -n${SYSTEM_NAMESPACE} describe pods
-        echo '::endgroup::'
-
-        for x in $(kubectl get pods -n${SYSTEM_NAMESPACE} -oname); do
-          echo "::group:: describe $x"
-          kubectl -n${SYSTEM_NAMESPACE} describe $x
-          echo '::endgroup::'
-
-          echo "::group:: $x logs"
-          kubectl -n${SYSTEM_NAMESPACE} logs $x --all-containers
-          echo '::endgroup::'
-        done
 
     - name: Post failure notice to Slack
       uses: rtCamp/action-slack-notify@v2.1.0

.github/workflows/minkind-cosigned.yaml

@@ -98,24 +98,8 @@ jobs:
         sed -i 's/cosign-system/mink-system/g' ./vendor/github.com/sigstore/cosign/test/e2e_test_cosigned.sh
         bash ./vendor/github.com/sigstore/cosign/test/e2e_test_cosigned.sh
 
-    - name: Collect system diagnostics
+    - uses: chainguard-dev/actions/kind-diag@main
       if: ${{ failure() }}
-      run: |
-        kubectl -n${SYSTEM_NAMESPACE} get pods
-
-        echo '::group:: describe'
-        kubectl -n${SYSTEM_NAMESPACE} describe pods
-        echo '::endgroup::'
-
-        for x in $(kubectl get pods -n${SYSTEM_NAMESPACE} -oname); do
-          echo "::group:: describe $x"
-          kubectl -n${SYSTEM_NAMESPACE} describe $x
-          echo '::endgroup::'
-
-          echo "::group:: $x logs"
-          kubectl -n${SYSTEM_NAMESPACE} logs $x --all-containers
-          echo '::endgroup::'
-        done
 
     - name: Post failure notice to Slack
       uses: rtCamp/action-slack-notify@v2.1.0

.github/workflows/minkind-run.yaml

@@ -57,7 +57,6 @@ jobs:
       working-directory: ./src/github.com/mattmoor/mink
       run: |
         ./hack/setup-kind.sh \
-          --authenticated-registry \
           --registry-url $(echo ${KO_DOCKER_REPO} | cut -d'/' -f 1) \
           --cluster-suffix c${{ github.run_id }}.local \
           --nodes 3 \
@@ -210,24 +209,8 @@ jobs:
         mink run task --as=me kaniko --git-url=https://github.com/kubernetes-up-and-running/kuard.git
         echo '::endgroup::'
 
-    - name: Collect system diagnostics
+    - uses: chainguard-dev/actions/kind-diag@main
       if: ${{ failure() }}
-      run: |
-        kubectl -n${SYSTEM_NAMESPACE} get pods
-
-        echo '::group:: describe'
-        kubectl -n${SYSTEM_NAMESPACE} describe pods
-        echo '::endgroup::'
-
-        for x in $(kubectl get pods -n${SYSTEM_NAMESPACE} -oname); do
-          echo "::group:: describe $x"
-          kubectl -n${SYSTEM_NAMESPACE} describe $x
-          echo '::endgroup::'
-
-          echo "::group:: $x logs"
-          kubectl -n${SYSTEM_NAMESPACE} logs $x --all-containers
-          echo '::endgroup::'
-        done
 
     - name: Post failure notice to Slack
       uses: rtCamp/action-slack-notify@v2.1.0

.github/workflows/minkind.yaml

@@ -20,9 +20,9 @@ jobs:
       fail-fast: false # Keep running if one leg fails.
       matrix:
         k8s-version:
-        - v1.20.x
         - v1.21.x
         - v1.22.x
+        - v1.23.x
 
         leg:
         - ingress conformance
@@ -194,32 +194,8 @@ jobs:
            ${{ matrix.extra-go-flags }} ${{ matrix.test-suite }} \
            ${{ matrix.extra-test-flags }}
 
-    - name: Collect ksvc diagnostics
+    - uses: chainguard-dev/actions/kind-diag@main
       if: ${{ failure() }}
-      run: kubectl get ksvc -oyaml
-
-    - name: Collect pod diagnostics
-      if: ${{ failure() }}
-      run: kubectl describe pods
-
-    - name: Collect system diagnostics
-      if: ${{ failure() }}
-      run: |
-        kubectl -n${SYSTEM_NAMESPACE} get pods
-
-        echo '::group:: describe'
-        kubectl -n${SYSTEM_NAMESPACE} describe pods
-        echo '::endgroup::'
-
-        for x in $(kubectl get pods -n${SYSTEM_NAMESPACE} -oname); do
-          echo "::group:: describe $x"
-          kubectl -n${SYSTEM_NAMESPACE} describe $x
-          echo '::endgroup::'
-
-          echo "::group:: $x logs"
-          kubectl -n${SYSTEM_NAMESPACE} logs $x --all-containers
-          echo '::endgroup::'
-        done
 
     - name: Dump Artifacts
       if: ${{ failure() }}

cmd/webhook/main.go

@@ -27,6 +27,7 @@ import (
 	chains "github.com/tektoncd/chains/pkg/reconciler/taskrun"
 	"github.com/tektoncd/pipeline/pkg/apis/pipeline"
 	"github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1"
+	"github.com/tektoncd/pipeline/pkg/clock"
 	"github.com/tektoncd/pipeline/pkg/reconciler/pipelinerun"
 	"github.com/tektoncd/pipeline/pkg/reconciler/taskrun"
 	"knative.dev/eventing/pkg/reconciler/apiserversource"
@@ -88,6 +89,7 @@ func main() {
 	flag.StringVar(&opts.Images.GsutilImage, "gsutil-image", "", "The container image containing gsutil")
 	flag.StringVar(&opts.Images.PRImage, "pr-image", "", "The container image containing our PR binary.")
 	flag.StringVar(&opts.Images.ImageDigestExporterImage, "imagedigest-exporter-image", "", "The container image containing our image digest exporter binary.")
+	flag.StringVar(&opts.Images.WorkingDirInitImage, "workingdirinit-image", "", "The container image containing our working dir init binary.")
 
 	flag.Parse()
 
@@ -166,8 +168,8 @@ func main() {
 		sinkbinding.NewController, newSinkBindingWebhook(sbSelector),
 
 		// Tekton stuff
-		taskrun.NewController(opts),
-		pipelinerun.NewController(opts),
+		taskrun.NewController(opts, clock.RealClock{}),
+		pipelinerun.NewController(opts, clock.RealClock{}),
 		chains.NewController,
 
 		// HTTP01 Solver

config/core/200-imported/200-serving/100-resources/configuration.yaml

@@ -119,12 +119,12 @@ spec:
                             type: object
                             properties:
                               args:
-                                description: 'Arguments to the entrypoint. The docker image''s CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container''s environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell'
+                                description: 'Arguments to the entrypoint. The docker image''s CMD is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container''s environment. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell'
                                 type: array
                                 items:
                                   type: string
                               command:
-                                description: 'Entrypoint array. Not executed within a shell. The docker image''s ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container''s environment. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell'
+                                description: 'Entrypoint array. Not executed within a shell. The docker image''s ENTRYPOINT is used if this is not provided. Variable references $(VAR_NAME) are expanded using the container''s environment. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Cannot be updated. More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell'
                                 type: array
                                 items:
                                   type: string
@@ -141,7 +141,7 @@ spec:
                                       description: Name of the environment variable. Must be a C_IDENTIFIER.
                                       type: string
                                     value:
-                                      description: 'Variable references $(VAR_NAME) are expanded using the previous defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. The $(VAR_NAME) syntax can be escaped with a double $$, ie: $$(VAR_NAME). Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".'
+                                      description: 'Variable references $(VAR_NAME) are expanded using the previously defined environment variables in the container and any service environment variables. If a variable cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless of whether the variable exists or not. Defaults to "".'
                                       type: string
                                     valueFrom:
                                       description: Source for the environment variable's value. Cannot be used if value is not empty.
@@ -407,7 +407,7 @@ spec:
                                         - type: string
                                       x-kubernetes-int-or-string: true
                               securityContext:
-                                description: 'Security options the pod should run with. More info: https://kubernetes.io/docs/concepts/policy/security-context/ More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/'
+                                description: 'SecurityContext defines the security options the container should be run with. If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/'
                                 type: object
                                 properties:
                                   capabilities: