Merge branch 'main' into dependabot/go_modules/github.com/docker/dock…

…er-26.1.5incompatible

CHANGELOG.md

@@ -1,5 +1,7 @@
 # Table of Contents
 
+- [v1.41.1](#v1411)
+- [v1.41.0](#v1410)
 - [v1.40.3](#v1403)
 - [v1.40.2](#v1402)
 - [v1.40.1](#v1401)
@@ -96,6 +98,25 @@
 - [v0.2.0](#v020)
 - [v0.1.0](#v010)
 
+## [v1.41.1]
+> Release date: 2024/10/22
+
+### Fixes
+- `deck gateway validate` for Konnect supports Konnect configs passed by CLI flags now.
+Earlier, the validation was failing if control plane information was passed via CLI flags.
+
+## [v1.41.0]
+> Release date: 2024/10/21
+
+### Added
+- `deck gateway validate` command now supports Konnect. Konnect entities can be validated online with this change. 
+[#1335](https://github.com/Kong/deck/pull/1335)
+
+### Fixes
+- Quoted type constraints are removed for Terraform. Type constraints in quotes were required in Terraform <= 0.11, 
+It is now deprecated and will be removed in a future Terraform versions. Thus, removed them from kong2tf generation, so as
+to avoid potential errors in `terraform apply`. [#1412](https://github.com/Kong/deck/pull/1412)
+
 ## [v1.40.3]
 > Release date: 2024/09/26
 
@@ -1822,6 +1843,8 @@ No breaking changes have been introduced in this release.
 
 Debut release of decK
 
+[v1.41.1]: https://github.com/Kong/deck/compare/v1.40.0...v1.41.1
+[v1.41.0]: https://github.com/Kong/deck/compare/v1.40.3...v1.41.0
 [v1.40.3]: https://github.com/Kong/deck/compare/v1.40.2...v1.40.3
 [v1.40.2]: https://github.com/Kong/deck/compare/v1.40.1...v1.40.2
 [v1.40.1]: https://github.com/Kong/deck/compare/v1.40.0...v1.40.1

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.23.0 AS build
+FROM golang:1.23.2 AS build
 WORKDIR /deck
 COPY go.mod ./
 COPY go.sum ./

README.md

@@ -73,7 +73,7 @@ the GitHub [release page](https://github.com/kong/deck/releases)
 or install by downloading the binary:
 
 ```shell
-$ curl -sL https://github.com/kong/deck/releases/download/v1.40.3/deck_1.40.3_linux_amd64.tar.gz -o deck.tar.gz
+$ curl -sL https://github.com/kong/deck/releases/download/v1.41.1/deck_1.41.1_linux_amd64.tar.gz -o deck.tar.gz
 $ tar -xf deck.tar.gz -C /tmp
 $ sudo cp /tmp/deck /usr/local/bin/
 ```
@@ -84,7 +84,7 @@ If you are on Windows, you can download the binary from the GitHub
 [release page](https://github.com/kong/deck/releases) or via PowerShell:
 
 ```shell
-$ curl -sL https://github.com/kong/deck/releases/download/v1.40.3/deck_1.40.3_windows_amd64.tar.gz -o deck.tar.gz
+$ curl -sL https://github.com/kong/deck/releases/download/v1.41.1/deck_1.41.1_windows_amd64.tar.gz -o deck.tar.gz
 $ tar -xzvf deck.tar.gz
 ```
 

cmd/gateway_validate.go

@@ -27,9 +27,6 @@ var (
 
 func executeValidate(cmd *cobra.Command, _ []string) error {
 	mode := getMode(nil)
-	if validateOnline && mode == modeKonnect {
-		return fmt.Errorf("online validation not yet supported in konnect mode")
-	}
 	_ = sendAnalytics("validate", "", mode)
 	// read target file
 	// this does json schema validation as well
@@ -45,7 +42,7 @@ func executeValidate(cmd *cobra.Command, _ []string) error {
 	ctx := cmd.Context()
 	var kongClient *kong.Client
 	if validateOnline {
-		kongClient, err = getKongClient(ctx, targetContent)
+		kongClient, err = getKongClient(ctx, targetContent, mode)
 		if err != nil {
 			return err
 		}
@@ -143,10 +140,14 @@ func executeValidate(cmd *cobra.Command, _ []string) error {
 		return err
 	}
 
-	if validateKonnectCompatibility {
-		if errs := validate.KonnectCompatibility(targetContent); len(errs) != 0 {
+	if validateKonnectCompatibility || (mode == modeKonnect && validateOnline) {
+		if errs := validate.KonnectCompatibility(targetContent, dumpConfig); len(errs) != 0 {
 			return validate.ErrorsWrapper{Errors: errs}
 		}
+
+		if validateCmdRBACResourcesOnly {
+			return fmt.Errorf("[rbac] not yet supported by konnect")
+		}
 	}
 
 	if validateOnline {
@@ -212,7 +213,7 @@ this command unless --online flag is used.
 			return preRunSilenceEventsFlag()
 		}
 
-		if validateOnline {
+		if online {
 			short = short + " (online)"
 			long = long + "Validates against the Kong API, via communication with Kong. This increases the\n" +
 				"time for validation but catches significant errors. No resource is created in Kong.\n" +
@@ -255,6 +256,9 @@ this command unless --online flag is used.
 	validateCmd.Flags().BoolVar(&validateKonnectCompatibility, "konnect-compatibility",
 		false, "validate that the state file(s) are ready to be deployed to Konnect")
 
+	validateCmd.MarkFlagsMutuallyExclusive("konnect-compatibility", "workspace")
+	validateCmd.MarkFlagsMutuallyExclusive("konnect-compatibility", "rbac-resources-only")
+
 	if err := ensureGetAllMethods(); err != nil {
 		panic(err.Error())
 	}
@@ -285,9 +289,14 @@ func validateWithKong(
 	return validator.Validate(parsedFormatVersion)
 }
 
-func getKongClient(ctx context.Context, targetContent *file.Content) (*kong.Client, error) {
+func getKongClient(
+	ctx context.Context, targetContent *file.Content, mode mode,
+) (*kong.Client, error) {
 	workspaceName := validateWorkspace
 	if validateWorkspace != "" {
+		if mode == modeKonnect {
+			return nil, fmt.Errorf("[workspaces] not supported by Konnect - use control planes instead")
+		}
 		// check if workspace exists
 		workspaceName := getWorkspaceName(validateWorkspace, targetContent, false)
 		workspaceExists, err := workspaceExists(ctx, rootConfig, workspaceName)
@@ -299,10 +308,22 @@ func getKongClient(ctx context.Context, targetContent *file.Content) (*kong.Clie
 		}
 	}
 
-	wsConfig := rootConfig.ForWorkspace(workspaceName)
-	kongClient, err := reconcilerUtils.GetKongClient(wsConfig)
-	if err != nil {
-		return nil, err
+	var (
+		kongClient *kong.Client
+		err        error
+	)
+	if mode == modeKonnect {
+		kongClient, err = GetKongClientForKonnectMode(ctx, &konnectConfig)
+		if err != nil {
+			return nil, err
+		}
+		dumpConfig.KonnectControlPlane = konnectControlPlane
+	} else {
+		wsConfig := rootConfig.ForWorkspace(workspaceName)
+		kongClient, err = reconcilerUtils.GetKongClient(wsConfig)
+		if err != nil {
+			return nil, err
+		}
 	}
 	return kongClient, nil
 }

tests/integration/test_utils.go

@@ -374,3 +374,21 @@ func render(opts ...string) (string, error) {
 
 	return stripansi.Strip(string(out)), cmdErr
 }
+
+func validate(online bool, opts ...string) error {
+	deckCmd := cmd.NewRootCmd()
+
+	var args []string
+	if online {
+		args = []string{"gateway", "validate"}
+	} else {
+		args = []string{"file", "validate"}
+	}
+
+	if len(opts) > 0 {
+		args = append(args, opts...)
+	}
+	deckCmd.SetArgs(args)
+
+	return deckCmd.ExecuteContext(context.Background())
+}

tests/integration/testdata/validate/kong-ee.yaml

@@ -0,0 +1,32 @@
+_format_version: "3.0"
+services:
+  - name: example-service
+    url: http://mockbin.org
+    routes:
+      - name: example-route
+        paths:
+          - /mock
+        methods:
+          - GET
+          - POST
+        strip_path: false
+        preserve_host: true
+    plugins:
+      - name: rate-limiting
+        config:
+          minute: 5
+          policy: local
+consumers:
+  - keyauth_credentials:
+    - key: alice-secret-key
+    username: alice
+  - keyauth_credentials:
+    - key: bob-secret-key
+    username: bob
+plugins:
+  - name: key-auth
+    config:
+      key_names:
+        - apikey
+      hide_credentials: true
+      run_on_preflight: true

tests/integration/testdata/validate/kong.yaml

@@ -0,0 +1,16 @@
+_format_version: "1.1"
+services:
+- connect_timeout: 60000
+  id: 58076db2-28b6-423b-ba39-a797193017f7
+  host: mockbin.org
+  name: svc1
+  port: 80
+  protocol: http
+  read_timeout: 60000
+  retries: 5
+  routes:
+  - name: r1
+    id: 87b6a97e-f3f7-4c47-857a-7464cb9e202b
+    https_redirect_status_code: 301
+    paths:
+    - /r1

tests/integration/testdata/validate/kong3x.yaml

@@ -0,0 +1,16 @@
+_format_version: "3.0"
+services:
+- connect_timeout: 60000
+  id: 58076db2-28b6-423b-ba39-a797193017f7
+  host: mockbin.org
+  name: svc1
+  port: 80
+  protocol: http
+  read_timeout: 60000
+  retries: 5
+  routes:
+  - name: r1
+    id: 87b6a97e-f3f7-4c47-857a-7464cb9e202b
+    https_redirect_status_code: 301
+    paths:
+    - /r1

tests/integration/testdata/validate/konnect.yaml

@@ -0,0 +1,18 @@
+_format_version: "3.0"
+_konnect:
+  control_plane_name: default
+services:
+- connect_timeout: 60000
+  id: 58076db2-28b6-423b-ba39-a797193017f7
+  host: mockbin.org
+  name: svc1
+  port: 80
+  protocol: http
+  read_timeout: 60000
+  retries: 5
+  routes:
+  - name: r1
+    id: 87b6a97e-f3f7-4c47-857a-7464cb9e202b
+    https_redirect_status_code: 301
+    paths:
+    - /r1

tests/integration/testdata/validate/konnect_1_1.yaml

@@ -0,0 +1,18 @@
+_format_version: "1.1"
+_konnect:
+  control_plane_name: default
+services:
+- connect_timeout: 60000
+  id: 58076db2-28b6-423b-ba39-a797193017f7
+  host: mockbin.org
+  name: svc1
+  port: 80
+  protocol: http
+  read_timeout: 60000
+  retries: 5
+  routes:
+  - name: r1
+    id: 87b6a97e-f3f7-4c47-857a-7464cb9e202b
+    https_redirect_status_code: 301
+    paths:
+    - /r1

tests/integration/testdata/validate/konnect_invalid.yaml

@@ -0,0 +1,16 @@
+_format_version: "3.0"
+services:
+- connect_timeout: 60000
+  id: 58076db2-28b6-423b-ba39-a797193017f7
+  host: mockbin.org
+  name: svc1
+  port: 80
+  protocol: http
+  read_timeout: 60000
+  retries: 5
+  routes:
+  - name: r1
+    id: 87b6a97e-f3f7-4c47-857a-7464cb9e202b
+    https_redirect_status_code: 301
+    paths:
+    - /r1

tests/integration/testdata/validate/konnect_no_version.yaml

@@ -0,0 +1,17 @@
+_konnect:
+  control_plane_name: default
+services:
+- connect_timeout: 60000
+  id: 58076db2-28b6-423b-ba39-a797193017f7
+  host: mockbin.org
+  name: svc1
+  port: 80
+  protocol: http
+  read_timeout: 60000
+  retries: 5
+  routes:
+  - name: r1
+    id: 87b6a97e-f3f7-4c47-857a-7464cb9e202b
+    https_redirect_status_code: 301
+    paths:
+    - /r1