chore(deps): update dependency defenseunicorns/uds-package-dubbd to v0.16.0

[renovate]

This PR contains the following updates:

Package	Update	Change
defenseunicorns/uds-package-dubbd	minor	0.14.0 -> 0.16.0

• ⚠️ The E2E tests need to be run, they have a manual trigger. To start them add a comment to this PR that says /test all

---

Release Notes

defenseunicorns/uds-package-dubbd (defenseunicorns/uds-package-dubbd)

v0.16.0

Compare Source

Miscellaneous

• deps: update dependency defenseunicorns/zarf to v0.31.4 (#​646) (d85e047)
• deps: update gitlab tag big-bang/bigbang to v2.17.0 (#​658) (935cc84)
• deps: update google-github-actions/release-please-action action to v4 (#​641) (7a44bee)
• deps: update terraform-linters/setup-tflint action to v4 (#​633) (d0f36f3)
• refactor dubbd-k3d ci to use the uds task runner (#​644) (1a1e381)
• update k8s from 1.26 to 1.27 (#​639) (cd6997c)

v0.15.0

Compare Source

Features

• add velero for rke2 by default (d59ff4e)

Miscellaneous

• deps: update actions/checkout action to v4 (#​630) (016b09e)
• deps: update dependency defenseunicorns/zarf to v0.31.3 (#​613) (b4b79d4)
• deps: update gitlab tag big-bang/bigbang to v2.16.0 (#​642) (d47c7aa)
• deps: update hashicorp/setup-terraform action to v3 (#​631) (042f3bb)
• set tf version in publish.dubbd.package.yaml (#​637) (d2d50ca)

---

Configuration

📅 Schedule: Branch creation - "after 7am and before 9am every weekday" in timezone America/New_York, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[RothAndrew]

Looks like everything deployed okay, but the validation failed: https://github.com/defenseunicorns/narwhal-delivery-reference-deployment/actions/runs/7402617865/job/20140854313#step:4:15894

[ldgriswold]

Looks like everything deployed okay, but the validation failed: https://github.com/defenseunicorns/narwhal-delivery-reference-deployment/actions/runs/7402617865/job/20140854313#step:4:15894

Hmmmm, makes me think this issue is maybe with the SSO deployment or auth policy. I forgot what I was seeing in the feature/custom-domain-tests branch but I had the same test result with a custom domain / cert. Could manually curl -sI "https://podinfo.bigbang.dev" | grep "location" to see what's being returned

[RothAndrew]

I think the TLS cert may have expired. They have to be updated every 90 days. Was planning on taking a look and updating it here in a few minutes.

[RothAndrew]

It might be worth us adding another line to the test that outputs the expiration date of the TLS cert.

[RothAndrew]

It's not the cert. The cert is good until february

[RothAndrew]

#63 is running right now. If it passes, then it's likely there's some breaking change in the new version of DUBBD

[ldgriswold]

#63 is running right now. If it passes, then it's likely there's some breaking change in the new version of DUBBD

It looks like it skiped the e2e tests. I'm building this branch manually in aws and am going to look at some of the curl outputs to see what it's returning.

[ldgriswold]

Looks like maybe an IP problem of some kind? Of note, keycloak.bigbang.dev resolved as well as the realm test.

 curl -sI "https://podinfo.bigbang.dev"
HTTP/2 503
content-length: 19
content-type: text/plain
date: Fri, 05 Jan 2024 13:54:40 GMT

sh-4.2$ cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost6 localhost6.localdomain6
10.0.255.1 kiali.bigbang.dev grafana.bigbang.dev neuvector.bigbang.dev tracing.bigbang.dev
10.0.255.3 keycloak.bigbang.dev
10.0.255.2 podinfo.bigbang.dev
sh-4.2$ ping 10.0.255.2
PING 10.0.255.2 (10.0.255.2) 56(84) bytes of data.
^C
--- 10.0.255.2 ping statistics ---
12 packets transmitted, 0 received, 100% packet loss, time 11269ms

None of these IPs respond to ping due to the networking stuff it looks like, but the curl of keycloak resolves.

[ldgriswold]

Updated coredns to include podinfo, no change. Then I checked the deployment and found out podinfo isn't running:

root@ip-10-200-35-13 narwhal-delivery-reference-deployment]# zarf tools kubectl get all -n podinfo
NAME              TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)             AGE
service/podinfo   ClusterIP   10.43.22.86   <none>        9898/TCP,9999/TCP   27m

NAME                      READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/podinfo   0/1     0            0           27m

NAME                                DESIRED   CURRENT   READY   AGE
replicaset.apps/podinfo-d7d9d9576   1         0         0       27m
[root@ip-10-200-35-13 narwhal-delivery-reference-deployment]# kubectl logs podinfo -n podinfo
Error from server (NotFound): pods "podinfo" not found
[root@ip-10-200-35-13 narwhal-delivery-reference-deployment]# kubectl events podinfo -n podinfo
LAST SEEN   TYPE      REASON              OBJECT                         MESSAGE
28m         Normal    ScalingReplicaSet   Deployment/podinfo             Scaled up replica set podinfo-d7d9d9576 to 1
28m         Warning   FailedCreate        ReplicaSet/podinfo-d7d9d9576   Error creating: admission webhook "validate.kyverno.svc-fail" denied the request:

resource Pod/podinfo/podinfo-d7d9d9576-7g4z6 was blocked due to the following policies

require-non-root-user:
  non-root-user: 'validation failure: validation error: Either `runAsNonRoot` must
    be set to true or `runAsUser` must be > 0 in spec.securityContext or (spec.containers[*].securityContext,
    spec.initContainers[*].securityContext, and spec.ephemeralContainers[*].securityContext).
    rule non-root-user[0] failed at path /securityContext/ rule non-root-user[1] failed
    at path /securityContext/'
restrict-host-path-write:
  require-readonly-hostpath: rule skipped

[RothAndrew]

Letting renovate rebase, here's the code change so we don't lose it (let's add it in a separate PR):

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠ Warning: custom changes will be lost.