[CECO-1993][Operator 1.11.1] Release eks addon

.github/CODEOWNERS

@@ -6,12 +6,16 @@
 *.md             @DataDog/documentation @DataDog/container-helm-chart-maintainers
 
 # Charts
-charts/datadog-crds                                  @DataDog/container-ecosystems
-charts/datadog-operator                              @DataDog/container-ecosystems
-charts/extended-daemon-set                           @DataDog/container-ecosystems
-charts/datadog                                       @DataDog/container-helm-chart-maintainers
-charts/datadog/templates/container-system-probe.yaml @DataDog/ebpf-platform @DataDog/container-helm-chart-maintainers
-charts/datadog/templates/system-probe-configmap.yaml @DataDog/ebpf-platform @DataDog/container-helm-chart-maintainers
-charts/datadog/templates/system-probe-init.yaml      @DataDog/ebpf-platform @DataDog/container-helm-chart-maintainers
-charts/synthetics-private-location/                  @Datadog/synthetics
-charts/observability-pipelines-worker                @DataDog/observability-pipelines-worker
+charts/datadog-crds                                    @DataDog/container-ecosystems
+charts/datadog-operator                                @DataDog/container-ecosystems
+charts/extended-daemon-set                             @DataDog/container-ecosystems
+charts/datadog                                         @DataDog/container-helm-chart-maintainers
+charts/datadog/templates/_container-process-agent.yaml @DataDog/container-intake @DataDog/container-helm-chart-maintainers
+charts/datadog/templates/_container-system-probe.yaml  @DataDog/ebpf-platform @DataDog/container-helm-chart-maintainers
+charts/datadog/templates/_container-trace-agent.yaml   @DataDog/agent-apm @DataDog/container-helm-chart-maintainers
+charts/datadog/templates/_system-probe-init.yaml       @DataDog/ebpf-platform @DataDog/container-helm-chart-maintainers
+charts/datadog/templates/system-probe-configmap.yaml   @DataDog/ebpf-platform @DataDog/container-helm-chart-maintainers
+charts/synthetics-private-location/                    @Datadog/synthetics
+charts/observability-pipelines-worker                  @DataDog/observability-pipelines
+charts/private-action-runner                           @DataDog/action-platform
+test/private-action-runner                             @DataDog/action-platform

.github/helm-docs.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 set -euo pipefail
 
-HELM_DOCS_VERSION="1.10.0"
+HELM_DOCS_VERSION="1.14.2"
 OS=$(uname)
 ARCH=$(uname -m)
 

.github/kind_config.yaml

@@ -1,6 +1,10 @@
+---
 kind: Cluster
 apiVersion: kind.x-k8s.io/v1alpha4
 nodes:
-- role: control-plane
-- role: worker
-- role: worker
+  - role: control-plane
+    labels:
+      disktype: ssd
+  - role: worker
+    labels:
+      disktype: ssd

.github/kubeconform.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+set -euo pipefail
+
+KUBECONFORM_VERSION="v0.6.7"
+# https://github.com/yannh/kubeconform/issues/51
+CRD_SPEC_URL="https://raw.githubusercontent.com/kubernetes/kubernetes/master/api/openapi-spec/v3/apis__apiextensions.k8s.io__v1_openapi.json"
+# Remove after v1.16 support / testing is dropped
+LEGACY_SCHEMA_URL="https://github.com/instrumenta/kubernetes-json-schema"
+OS=$(uname)
+
+CHANGED_CHARTS=${CHANGED_CHARTS:-${1:-}}
+if [ -n "$CHANGED_CHARTS" ];
+then
+  CHART_DIRS=$CHANGED_CHARTS
+else
+  CHART_DIRS=$(ls -d charts/*)
+fi
+
+# install kubeconform
+curl --silent --show-error --fail --location --output /tmp/kubeconform.tar.gz "https://github.com/yannh/kubeconform/releases/download/${KUBECONFORM_VERSION}/kubeconform-${OS}-amd64.tar.gz"
+tar -xf /tmp/kubeconform.tar.gz kubeconform
+
+# validate charts
+for CHART_DIR in ${CHART_DIRS}; do
+  echo "Running kubeconform for folder: '$CHART_DIR'"
+
+  # Note: -ignore-missing-schemas could be added if needed, but not currently
+  # needed since we have the schema necessary to validate the CRDs themselves.
+  #
+  # Also, if at some point we needed to validate things _using_ these CRDs,
+  # they're available via
+  # https://github.com/datreeio/CRDs-catalog/tree/main/datadoghq.com
+  helm dep up "${CHART_DIR}" && helm template --kube-version "${KUBERNETES_VERSION#v}" \
+        --values "${CHART_DIR}/ci/kubeconform-values.yaml" "${CHART_DIR}" \
+    | ./kubeconform -strict -schema-location default -schema-location "$CRD_SPEC_URL" \
+        -schema-location $LEGACY_SCHEMA_URL -output pretty \
+        -verbose -kubernetes-version "${KUBERNETES_VERSION#v}" -
+done

.github/workflows/ci.yaml

@@ -5,14 +5,19 @@ on:
     paths:
       - "charts/**"
 
+# Permission forced by repo-level setting; only elevate on job-level
+permissions:
+  contents: read
+  # packages: read
+
 jobs:
   changed:
     runs-on: ubuntu-latest
     outputs:
       charts: ${{ steps.list-changed.outputs.changed }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Set up Helm
@@ -21,9 +26,9 @@ jobs:
           version: v3.6.3
       - uses: actions/setup-python@v4
         with:
-          python-version: 3.7
+          python-version: 3.12
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.3.1
+        uses: helm/chart-testing-action@v2.6.1
       - name: Run chart-testing (list-changed)
         id: list-changed
         env:
@@ -33,7 +38,9 @@ jobs:
           if [[ -n "$changed" ]]; then
             echo -n "Charts changed:"
             echo "$changed"
-            echo "::set-output name=changed::$changed"
+            echo "changed<<EOF" >> $GITHUB_OUTPUT
+            echo "$changed" >> $GITHUB_OUTPUT
+            echo "EOF" >> $GITHUB_OUTPUT
           else
             echo "PR without any chart changes - failing"
             exit 1
@@ -45,14 +52,14 @@ jobs:
       - changed
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - uses: actions/setup-python@v4
         with:
-          python-version: 3.7
+          python-version: 3.12
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.3.1
+        uses: helm/chart-testing-action@v2.6.1
       - name: Run chart-testing (lint)
         run: ct lint --config .github/ct.yaml
 
@@ -62,13 +69,13 @@ jobs:
       - changed
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Run helm-docs
         run: .github/helm-docs.sh
 
-  kubeval-chart:
+  kubeconform-chart:
     runs-on: ubuntu-latest
     needs:
       - changed
@@ -80,55 +87,78 @@ jobs:
         # https://github.com/instrumenta/kubernetes-json-schema is no
         # longer updated
         k8s:
-          # - v1.14.10 (deprecated with kind 1.16)
-          - v1.16.15
+          - v1.16.4
           - v1.18.20
-          - v1.22.9
-          - v1.24.2
-          # v1.25.2 (when agent 7.40 is out)
+          - v1.22.17
+          - v1.24.17
+          - v1.25.16
+          - v1.26.15
+          - v1.27.16
+          - v1.28.13
+          - v1.29.8
+          - v1.30.4
+          - v1.31.1
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Add datadog helm repo
         run: helm repo add datadog https://helm.datadoghq.com && helm repo update
       - name: Add KSM helm repo
         run: helm repo add kube-state-metrics https://prometheus-community.github.io/helm-charts
-      - name: Run kubeval
+      - name: Run kubeconform
         env:
           KUBERNETES_VERSION: ${{ matrix.k8s }}
           CHANGED_CHARTS: ${{needs.changed.outputs.charts}}
-        run: .github/kubeval.sh
+        run: .github/kubeconform.sh
 
   install-chart:
     name: install-chart
     runs-on: ubuntu-20.04
+    timeout-minutes: 60
     needs:
       - lint-chart
-      - kubeval-chart
+      - kubeconform-chart
     strategy:
       matrix:
-        k8s:
-          - v1.16.15
-          - v1.18.20
-          - v1.22.9
-          - v1.24.2
-          - v1.25.2
+        versions:
+          - k8s: v1.18.20
+            kind: v0.17.0
+          - k8s: v1.22.17
+            kind: v0.22.0
+          - k8s: v1.24.17
+            kind: v0.22.0
+          - k8s: v1.25.16
+            kind: v0.22.0
+          - k8s: v1.26.15
+            kind: v0.22.0
+          - k8s: v1.27.16
+            kind: v0.22.0
+          - k8s: v1.28.13
+            kind: v0.22.0
+          - k8s: v1.29.8
+            kind: v0.22.0
+          - k8s: v1.30.4
+            kind: v0.22.0
+          - k8s: v1.31.1
+            kind: v0.22.0
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Create kind ${{ matrix.k8s }} cluster
-        uses: helm/kind-action@v1.5.0
+      - name: Create kind ${{ matrix.versions.k8s }} cluster with kind version ${{ matrix.versions.kind }}
+        uses: helm/kind-action@v1.10.0
         with:
-          node_image: kindest/node:${{ matrix.k8s }}
+          version: ${{ matrix.versions.kind }}
+          node_image: kindest/node:${{ matrix.versions.k8s}}
+          config: .github/kind_config.yaml
       - uses: actions/setup-python@v4
         with:
-          python-version: 3.7
+          python-version: 3.12
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.3.1
+        uses: helm/chart-testing-action@v2.6.1
       - name: Run chart-testing (install)
         run: ct install --config .github/ct.yaml
 

.github/workflows/go-test-private-action-runner.yaml

@@ -0,0 +1,40 @@
+name: Go Test Private Action Runner
+on:
+  push:
+    paths:
+      - 'test/private-action-runner/**'
+      - 'charts/private-action-runner/**'
+  pull_request:
+    paths:
+      - 'test/private-action-runner/**'
+      - 'charts/private-action-runner/**'
+
+# Permission forced by repo-level setting; only elevate on job-level
+permissions:
+  contents: read
+  # packages: read
+
+env:
+  GO111MODULE: "on"
+  PROJECTNAME: "helm-charts"
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Set up Go
+      uses: actions/setup-go@v1
+      with:
+        go-version: 1.21
+      id: go
+    - name: Set up Helm
+      uses: azure/[email protected]
+      with:
+        version: v3.10.1
+    - name: Add Datadog Helm repo
+      run: helm repo add datadog https://helm.datadoghq.com && helm repo update
+    - name: Check out code into the Go module directory
+      uses: actions/checkout@v1
+    - name: run Go tests
+      run: |
+        helm dependency build ./charts/private-action-runner
+        make unit-test-private-action-runner