.azure/build-pipeline.yaml

@@ -19,10 +19,6 @@ jobs:
     # Strategy for the job
     strategy:
       matrix:
-        'java-8':
-          image: 'Ubuntu-18.04'
-          jdk_version: '1.8'
-          jdk_path: '/usr/lib/jvm/java-8-openjdk-amd64'
         'java-11':
           image: 'Ubuntu-18.04'
           jdk_version: '11'
@@ -47,8 +43,8 @@ jobs:
         env:
           BUILD_REASON: $(Build.Reason)
           BRANCH: $(Build.SourceBranch)
-          DOCKER_USER: $(DOCKER_USER)
-          DOCKER_PASS: $(DOCKER_PASS)
+          DOCKER_USER: $(QUAY_USER)
+          DOCKER_PASS: $(QUAY_PASS)
           GPG_PASSPHRASE: $(GPG_PASSPHRASE)
           GPG_SIGNING_KEY: $(GPG_SIGNING_KEY)
           NEXUS_USERNAME: $(NEXUS_USERNAME)

.azure/namespace-rbac-scope-acceptance-pipeline.yaml

@@ -0,0 +1,22 @@
+# Triggers
+# This pipeline will be triggered manually for a release or by github comment
+trigger: none
+pr:
+  autoCancel: false
+  branches:
+    include:
+      - '*'
+
+jobs:
+  - template: 'templates/system_test_general.yaml'
+    parameters:
+      name: 'namespace_rbac_scope_acceptance'
+      display_name: 'namespace-rbac-scope-acceptance'
+      test_case: '.*ST'
+      groups: 'acceptance'
+      excludedGroups: 'nodeport'
+      cluster_operator_install_type: 'bundle'
+      strimzi_rbac_scope: NAMESPACE
+      timeout: 240
+
+

.azure/namespace-rbac-scope-regression-pipeline.yaml

@@ -0,0 +1,88 @@
+# Triggers
+# This pipeline will be triggered manually for a release or by github comment
+trigger: none
+pr:
+  autoCancel: false
+  branches:
+    include:
+      - '*'
+      -
+# Regression tests are split into 6 jobs because of timeout set to 360 minutes for each job
+jobs:
+  - template: 'templates/system_test_general.yaml'
+    parameters:
+      name: 'namespace_rbac_scope_regression_kafka'
+      display_name: 'namespace-rbac-scope-regression-bundle I. - kafka'
+      test_case: 'kafka/**/*ST,!kafka/dynamicconfiguration/**/*ST'
+      groups: 'regression'
+      excludedGroups: 'nodeport'
+      cluster_operator_install_type: 'bundle'
+      timeout: 360
+      strimzi_rbac_scope: NAMESPACE
+
+  - template: 'templates/system_test_general.yaml'
+    parameters:
+      name: 'namespace_rbac_scope_regression_security'
+      display_name: 'namespace-rbac-scope-regression-bundle II. - security'
+      test_case: 'security/**/*ST'
+      groups: 'regression'
+      excludedGroups: 'nodeport'
+      cluster_operator_install_type: 'bundle'
+      timeout: 360
+      strimzi_rbac_scope: NAMESPACE
+
+  - template: 'templates/system_test_general.yaml'
+    parameters:
+      name: 'namespace_rbac_scope_regression_connect_tracing_watcher'
+      display_name: 'namespace-rbac-scope-regression-bundle III. - connect + tracing + watcher'
+      test_case: 'connect/**/*ST,tracing/**/*ST,watcher/**/*ST'
+      groups: 'regression'
+      excludedGroups: 'nodeport'
+      cluster_operator_install_type: 'bundle'
+      timeout: 360
+      strimzi_rbac_scope: NAMESPACE
+
+  - template: 'templates/system_test_general.yaml'
+    parameters:
+      name: 'rnamespace_rbac_scope_egression_operators'
+      display_name: 'namespace-rbac-scope-regression-bundle IV. - operators'
+      test_case: 'operators/**/*ST'
+      groups: 'regression'
+      excludedGroups: 'nodeport'
+      cluster_operator_install_type: 'bundle'
+      timeout: 360
+      strimzi_rbac_scope: NAMESPACE
+
+  - template: 'templates/system_test_general.yaml'
+    parameters:
+      name: 'namespace_rbac_scope_regression_rollingupdate_watcher'
+      display_name: 'namespace-rbac-scope-regression-bundle V. - rollingupdate'
+      test_case: 'rollingupdate/**/*ST'
+      groups: 'regression'
+      excludedGroups: 'nodeport'
+      cluster_operator_install_type: 'bundle'
+      timeout: 360
+      strimzi_rbac_scope: NAMESPACE
+
+  - template: 'templates/system_test_general.yaml'
+    parameters:
+      name: 'namespace_rbac_scope_regression_mirrormaker'
+      display_name: 'namespace-rbac-scope-regression-bundle VI. - mirrormaker + dynamicconfiguration'
+      test_case: 'mirrormaker/**/*ST,kafka/dynamicconfiguration/**/*ST'
+      groups: 'regression'
+      excludedGroups: 'nodeport'
+      cluster_operator_install_type: 'bundle'
+      timeout: 360
+      strimzi_rbac_scope: NAMESPACE
+
+  - template: 'templates/system_test_general.yaml'
+    parameters:
+      name: 'namespace_rbac_scope_regression_all_remaining'
+      display_name: 'namespace-rbac-scope-regression-bundle VII. - remaining system tests'
+      # !LoggingChangeST is skipped because it can be flaky on Azure
+      test_case: '!kafka/**/*ST,!mirrormaker/**/*ST,!connect/**/*ST,!security/**/*ST,!LoggingChangeST,!operators/**/*ST,!rollingupdate/**/*ST,!watcher/**/*ST,!tracing/**/*ST'
+      groups: 'regression'
+      excludedGroups: 'nodeport'
+      cluster_operator_install_type: 'bundle'
+      timeout: 360
+      strimzi_rbac_scope: NAMESPACE

.azure/regression-pipeline.yaml

@@ -29,7 +29,7 @@ jobs:
 
   - template: 'templates/system_test_general.yaml'
     parameters:
-      name: 'regression_connect_tracing'
+      name: 'regression_connect_tracing_watcher'
       display_name: 'regression-bundle III. - connect + tracing + watcher'
       test_case: 'connect/**/*ST,tracing/**/*ST,watcher/**/*ST'
       groups: 'regression'
@@ -38,17 +38,26 @@ jobs:
 
   - template: 'templates/system_test_general.yaml'
     parameters:
-      name: 'regression_operators_rollingupdate_watcher'
-      display_name: 'regression-bundle IV. - operators + rollingupdate'
-      test_case: 'operators/**/*ST,rollingupdate/**/*ST'
+      name: 'regression_operators'
+      display_name: 'regression-bundle IV. - operators'
+      test_case: 'operators/**/*ST'
+      groups: 'regression'
+      cluster_operator_install_type: 'bundle'
+      timeout: 360
+
+  - template: 'templates/system_test_general.yaml'
+    parameters:
+      name: 'regression_rollingupdate_watcher'
+      display_name: 'regression-bundle V. - rollingupdate'
+      test_case: 'rollingupdate/**/*ST'
       groups: 'regression'
       cluster_operator_install_type: 'bundle'
       timeout: 360
 
   - template: 'templates/system_test_general.yaml'
     parameters:
       name: 'regression_mirrormaker'
-      display_name: 'regression-bundle V. - mirrormaker + dynamicconfiguration'
+      display_name: 'regression-bundle VI. - mirrormaker + dynamicconfiguration'
       test_case: 'mirrormaker/**/*ST,kafka/dynamicconfiguration/**/*ST'
       groups: 'regression'
       cluster_operator_install_type: 'bundle'
@@ -57,7 +66,7 @@ jobs:
   - template: 'templates/system_test_general.yaml'
     parameters:
       name: 'regression_all_remaining'
-      display_name: 'regression-bundle VI. - remaining system tests'
+      display_name: 'regression-bundle VII. - remaining system tests'
       # !LoggingChangeST is skipped because it can be flaky on Azure
       test_case: '!kafka/**/*ST,!mirrormaker/**/*ST,!connect/**/*ST,!security/**/*ST,!LoggingChangeST,!operators/**/*ST,!rollingupdate/**/*ST,!watcher/**/*ST,!tracing/**/*ST'
       groups: 'regression'

.azure/scripts/build.sh

@@ -12,7 +12,7 @@ if [ ${JAVA_MAJOR_VERSION} -eq 11 ] ; then
 fi
 
 export DOCKER_ORG=${DOCKER_ORG:-strimzici}
-export DOCKER_REGISTRY=${DOCKER_REGISTRY:-docker.io}
+export DOCKER_REGISTRY=${DOCKER_REGISTRY:-quay.io}
 export DOCKER_TAG=$COMMIT
 
 make docu_check
@@ -55,14 +55,14 @@ fi
 # Push artifatcs (Docker containers, JARs, docs)
 if [ "$BUILD_REASON" == "PullRequest" ] ; then
     echo "Building Pull Request - nothing to push"
-elif [ "$BRANCH" != "refs/tags/*" ] && [ "$BRANCH" != "refs/heads/master" ]; then
+elif [[ "$BRANCH" != "refs/tags/"* ]] && [ "$BRANCH" != "refs/heads/master" ]; then
     echo "Not in master branch and not in release tag - nothing to push"
 else
     if [ "${MAIN_BUILD}" == "TRUE" ] ; then
         echo "Main build on master branch or release tag - going to push to Docker Hub, Nexus and website"
 
         echo "Login into Docker Hub ..."
-        docker login -u $DOCKER_USER -p $DOCKER_PASS
+        docker login -u $DOCKER_USER -p $DOCKER_PASS $DOCKER_REGISTRY
 
         export DOCKER_ORG=strimzi
 

.azure/scripts/check_docs.sh

@@ -12,7 +12,7 @@ function grep_check {
   local description=$2
   local opts=${3:--i -E -r -n}
   local fatalness=${4:-1}
-  local excludes="--exclude-dir=logo --exclude-dir=images --exclude-dir=contributing --exclude-dir=html --exclude-dir=htmlnoheader"
+  local excludes="--exclude-dir=logo --exclude-dir=images --exclude-dir=contributing --exclude-dir=html --exclude-dir=htmlnoheader --exclude-dir=pdf"
   x=$($GREP $opts $excludes "$pattern" documentation/)
   if [ -n "$x" ]; then
     echo "$description:"
@@ -25,7 +25,7 @@ function grep_check {
 # Check for latin abbrevs
 grep_check '[^[:alpha:]](e\.g\.|eg)[^[:alpha:]]' "Replace 'e.g'. with 'for example, '"
 grep_check '[^[:alpha:]](i\.e\.|ie)[^[:alpha:]]' "Replace 'i.e'. with 'that is, '"
-grep_check '[^[:alpha:]]etc\.?[^[:alpha:]]' "Replace 'etc.'. with ' and so on.'"
+grep_check '[^[:alpha:]]etc\.[^[:alpha:]]?' "Replace 'etc.'. with ' and so on.'"
 
 # And/or
 grep_check '[^[:alpha:]]and/or[^[:alpha:]]' "Use either 'and' or 'or', but not 'and/or'"

.azure/scripts/setup-kubernetes.sh

@@ -3,6 +3,8 @@ set -x
 
 rm -rf ~/.kube
 
+KUBE_VERSION=${KUBE_VERSION:-1.16.0}
+
 function install_kubectl {
     if [ "${TEST_KUBECTL_VERSION:-latest}" = "latest" ]; then
         TEST_KUBECTL_VERSION=$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)
@@ -20,38 +22,13 @@ function install_nsenter {
     sudo cp nsenter /usr/bin
 }
 
-function wait_for_minikube {
-    i="0"
-
-    while [ $i -lt 60 ]
-    do
-        # The role needs to be added because Minikube is not fully prepared for RBAC.
-        # Without adding the cluster-admin rights to the default service account in kube-system
-        # some components would be crashing (such as KubeDNS). This should have no impact on
-        # RBAC for Strimzi during the system tests.
-        kubectl create clusterrolebinding add-on-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:default
-        if [ $? -ne 0 ]
-        then
-            sleep 1
-        else
-            return 0
-        fi
-        i=$[$i+1]
-    done
-
-    return 1
-}
-
 function label_node {
-
-    if [ "$TEST_CLUSTER" = "minikube" ]; then
-        echo $(kubectl get nodes)
-        kubectl label node minikube rack-key=zone
-    elif [ "$TEST_CLUSTER" = "minishift" ]; then
-        oc label node minishift rack-key=zone
-    elif [ "$TEST_CLUSTER" = "oc" ]; then
-        oc label node localhost rack-key=zone
-    fi
+	# It should work for all clusters
+	for nodeName in $(kubectl get nodes -o custom-columns=:.metadata.name --no-headers);
+	do
+		echo ${nodeName};
+		kubectl label node ${nodeName} rack-key=zone;
+	done
 }
 
 if [ "$TEST_CLUSTER" = "minikube" ]; then
@@ -75,19 +52,21 @@ if [ "$TEST_CLUSTER" = "minikube" ]; then
     docker run -d -p 5000:5000 registry
 
     export KUBECONFIG=$HOME/.kube/config
-    sudo -E minikube start --vm-driver=none --kubernetes-version=v1.15.0 \
-      --insecure-registry=localhost:5000 --extra-config=apiserver.authorization-mode=RBAC
-    sudo chown -R travis: /home/travis/.minikube/
-    sudo -E minikube addons enable default-storageclass
-
-    wait_for_minikube
+    # We can turn on network polices support by adding the following options --network-plugin=cni --cni=calico
+    # We have to allow trafic for ITS when NPs are turned on
+    # We can allow NP after Strimzi#4092 which should fix some issues on STs side
+    sudo -E minikube start --vm-driver=none --kubernetes-version=v${KUBE_VERSION} \
+      --insecure-registry=localhost:5000 --extra-config=apiserver.authorization-mode=Node,RBAC
 
     if [ $? -ne 0 ]
     then
         echo "Minikube failed to start or RBAC could not be properly set up"
         exit 1
     fi
 
+    sudo -E minikube addons enable default-storageclass
+	kubectl create clusterrolebinding add-on-cluster-admin --clusterrole=cluster-admin --serviceaccount=kube-system:default
+
 elif [ "$TEST_CLUSTER" = "minishift" ]; then
     #install_kubectl
     MS_VERSION=1.13.1
@@ -116,6 +95,4 @@ else
     exit 1
 fi
 
-if [ "$TRAVIS" = false ]; then
-    label_node
-fi
+label_node

.azure/templates/default_variables.yaml

@@ -21,10 +21,10 @@ variables:
   test_cluster: minikube
   test_kubectl_version: v1.16.0
   test_nsenter_version: 2.32
-  test_helm_version: v2.16.3
+  test_helm_version: v2.17.0
   test_minikube_version: v1.2.0
   strimzi_default_log_level: DEBUG
-  docker_registry: docker.io
+  docker_registry: quay.io
   operator_image_pull_policy: IfNotPresent
   components_image_pull_policy: IfNotPresent
   MVN_CACHE_FOLDER: $(HOME)/.m2/repository

.azure/templates/general_steps.yaml

@@ -35,5 +35,5 @@ steps:
 - bash: ".azure/scripts/setup-helm.sh"
   displayName: "Setup Helm"
   env:
-    TEST_HELM2_VERSION: 'v2.16.3'
-    TEST_HELM3_VERSION: 'v3.2.0'
+    TEST_HELM2_VERSION: 'v2.17.0'
+    TEST_HELM3_VERSION: 'v3.4.2'

.azure/templates/setup_java.yaml

@@ -1,32 +1,21 @@
 # Step to setup JAVA on the agent
-# We use openjdk-X, where X is Java version (8 or 11). Images are based on Java 8
+# We use openjdk-X, where X is Java version (currently, only 11 is used). Images are based on Java 11
 parameters:
   - name: JDK_PATH
-    default: '/usr/lib/jvm/java-8-openjdk-amd64'
+    default: '/usr/lib/jvm/java-11-openjdk-amd64'
   - name: JDK_VERSION
-    default: '1.8'
+    default: '11'
 steps:
 
 - bash: |
     sudo apt-get update
   displayName: 'Update package list'
 
-- bash: |
-    sudo apt-get install openjdk-8-jdk
-  displayName: 'Install openjdk8'
-  condition: eq(variables['JDK_VERSION'], '1.8')
-
 - bash: |
     sudo apt-get install openjdk-11-jdk
   displayName: 'Install openjdk11'
   condition: eq(variables['JDK_VERSION'], '11')
 
-- bash: |
-    echo "##vso[task.setvariable variable=JAVA_VERSION_BUILD]1.8"
-    echo "##vso[task.setvariable variable=JAVA_VERSION]1.8.0"
-  displayName: 'Setup JAVA_VERSION=1.8'
-  condition: eq(variables['JDK_VERSION'], '1.8')
-
 - bash: |
     echo "##vso[task.setvariable variable=JAVA_VERSION_BUILD]11"
     echo "##vso[task.setvariable variable=JAVA_VERSION]11"