Test dns bicep

.bingo/Variables.mk

@@ -35,3 +35,9 @@ $(GOLANGCI_LINT): $(BINGO_DIR)/golangci-lint.mod
 	@echo "(re)installing $(GOBIN)/golangci-lint-v1.61.0"
 	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=golangci-lint.mod -o=$(GOBIN)/golangci-lint-v1.61.0 "github.com/golangci/golangci-lint/cmd/golangci-lint"
 
+MOCKGEN := $(GOBIN)/mockgen-v0.5.0
+$(MOCKGEN): $(BINGO_DIR)/mockgen.mod
+	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
+	@echo "(re)installing $(GOBIN)/mockgen-v0.5.0"
+	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=mockgen.mod -o=$(GOBIN)/mockgen-v0.5.0 "go.uber.org/mock/mockgen"
+

.bingo/mockgen.mod

@@ -0,0 +1,5 @@
+module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
+
+go 1.23.3
+
+require go.uber.org/mock v0.5.0 // mockgen

.bingo/mockgen.sum

@@ -0,0 +1,8 @@
+go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
+go.uber.org/mock v0.5.0/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
+golang.org/x/mod v0.18.0 h1:5+9lSbEzPSdWkH32vYPBwEpX8KwDbM52Ud9xBUvNlb0=
+golang.org/x/mod v0.18.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/tools v0.22.0 h1:gqSGLZqv+AI9lIQzniJ0nZDRG5GBPsSi+DRNHWNz6yA=
+golang.org/x/tools v0.22.0/go.mod h1:aCwcsjqvq7Yqt6TNyX7QMU2enbQ/Gt0bo6krSeEri+c=

.bingo/variables.env

@@ -14,3 +14,5 @@ GOIMPORTS="${GOBIN}/goimports-v0.26.0"
 
 GOLANGCI_LINT="${GOBIN}/golangci-lint-v1.61.0"
 
+MOCKGEN="${GOBIN}/mockgen-v0.5.0"
+

.github/workflows/aro-hcp-cd.yml

@@ -41,15 +41,6 @@
     cancel-in-progress: false
 
   jobs:
-    is_running_on_fork:
-      name: 'Ensure PR is submitted from Azure/ARO-HCP'
-      if: github.event_name != 'workflow_dispatch'
-      runs-on: ubuntu-latest
-      steps:
-        - name: Fail if PR submitted from fork
-          if: ${{ github.event.pull_request.head.repo.full_name != 'Azure/ARO-HCP' }}
-          run: core.setFailed('Expected source repository to be Azure/ARO-HCP, re-create PR as a branch of Azure/ARO-HCP')
-
     deploy_global_rg:
       name: 'Deploy global resources'
       if: github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch'
@@ -79,7 +70,10 @@
             cd dev-infrastructure/
 
             # Manage ACR
-            make acr-svc acr-ocp
+            make acr acr-svc-cfg acr-ocp-cfg
+
+            # Setup operator roles for platform workload identity
+            make operator-roles
 
     deploy_image_sync_rg:
       name: 'Deploy Image Sync'

.github/workflows/aro-hcp-login-check.yml

@@ -0,0 +1,52 @@
+---
+  name: Azure Login Check
+  on:
+    workflow_dispatch:
+    pull_request:
+      branches:
+        - main
+      paths:
+        - '.github/workflows/aro-hcp-cd.yml'
+        - '.github/workflows/environment-infra-cd.yml'
+        - '.github/workflows/services-cd.yml'
+        - '.github/workflows/services-ci.yml'
+        - 'config/config.yaml'
+        - 'dev-infrastructure/**/*.bicep'
+        - 'dev-infrastructure/**/*.bicepparam'
+        - 'dev-infrastructure/configurations/*'
+        - 'frontend/**'
+        - 'backend/**'
+        - 'cluster-service/**'
+        - 'internal/**'
+        - 'maestro/**'
+        - 'pko/**'
+        - 'acm/**'
+        - 'hypershiftoperator/**'
+        - 'image-sync/**/'
+        - 'tooling/image-sync/**'
+        - 'tooling/templatize/**'
+        - 'config/*'
+      types:
+        - opened
+        - synchronize
+        - reopened
+        - closed
+
+  jobs:
+    is_running_on_fork:
+      name: 'Ensure PR is submitted from Azure/ARO-HCP'
+      if: github.event_name != 'workflow_dispatch'
+      runs-on: ubuntu-latest
+      permissions:
+        id-token: 'write'
+        contents: 'read'
+      steps:
+        - name: 'Az CLI login - will fail if PR is submitted from a fork of the repo'
+          uses: azure/login@a65d910e8af852a8061c627c456678983e180302 # v2.2.0
+          with:
+            client-id: ${{ secrets.AZURE_CLIENT_ID }}
+            tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+            subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+        - name: Fail if PR submitted from fork
+          if: failure()
+          run: core.setFailed('Expected source repository to be Azure/ARO-HCP, not ${{ github.event.pull_request.head.repo.full_name }}, re-create PR as a branch of Azure/ARO-HCP')

.github/workflows/ci-go.yml

@@ -12,21 +12,47 @@ on:
 jobs:
   test:
     permissions:
+      id-token: 'write'
       contents: 'read'
     runs-on: 'ubuntu-latest'
     steps:
+      - name: "install azure-cli"
+        uses: "Azure/ARO-HCP@main"
+
+      - uses: azure/use-kubelogin@76597ae0fcbaace21b05e13a2cbf8daee2c6e820 # v1.2
+        with:
+          kubelogin-version: 'v0.1.3'
+
+      - name: 'Az CLI login'
+        uses: azure/login@a65d910e8af852a8061c627c456678983e180302 # v2.2.0
+        with:
+            client-id: ${{ secrets.AZURE_CLIENT_ID }}
+            tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+            subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 1
 
       - name: 'Set up Go'
-        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
         with:
           go-version-file: 'go.work'
           check-latest: true
 
+      - name: 'Regenerate mocks'
+        run: |
+          make mocks
+          if [[ ! -z "$(git status --short)" ]]
+          then
+            echo "there are some modified files"
+            git status
+            exit 1
+          fi
+
       - name: 'Test'
-        run: make test
+        run: JOB_ID=${{ github.job }} PRINCIPAL_ID=${{ secrets.GHA_PRINCIPAL_ID }} make test
+
   lint:
     permissions:
       contents: 'read'
@@ -37,7 +63,7 @@ jobs:
           fetch-depth: 1
 
       - name: 'Set up Go'
-        uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
         with:
           go-version-file: 'go.work'
           check-latest: true

.github/workflows/environment-infra-cd.yml

@@ -76,6 +76,10 @@
         - name: "install azure-cli"
           uses: "Azure/ARO-HCP@main"
 
+        - uses: azure/use-kubelogin@76597ae0fcbaace21b05e13a2cbf8daee2c6e820 # v1.3
+          with:
+            kubelogin-version: 'v0.1.3'
+
         - name: 'Az CLI login'
           uses: azure/login@a65d910e8af852a8061c627c456678983e180302 # v2.2.0
           with:
@@ -101,7 +105,7 @@
         - name: 'Deploy rest'
           run: |
             cd dev-infrastructure/
-            PRINCIPAL_ID=${{ secrets.GHA_PRINCIPAL_ID }} make svc.aks.admin-access svc.enable-aks-metrics
+            PRINCIPAL_ID=${{ secrets.GHA_PRINCIPAL_ID }} make svc.aks.admin-access svc.istio
 
         - name: 'CS PR check MSI'
           if: inputs.deploy_cs_pr_check_deps
@@ -134,4 +138,16 @@
         - name: 'Deploy or Update'
           run: |
             cd dev-infrastructure/
-            PRINCIPAL_ID=${{ secrets.GHA_PRINCIPAL_ID }} make mgmt mgmt.aks.admin-access mgmt.enable-aks-metrics
+            PRINCIPAL_ID=${{ secrets.GHA_PRINCIPAL_ID }} make mgmt
+
+        - name: 'Az CLI login again'
+          uses: azure/login@a65d910e8af852a8061c627c456678983e180302 # v2.2.0
+          with:
+            client-id: ${{ secrets.AZURE_CLIENT_ID }}
+            tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+            subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+        - name: 'Deploy rest'
+          run: |
+            cd dev-infrastructure/
+            PRINCIPAL_ID=${{ secrets.GHA_PRINCIPAL_ID }} make mgmt.aks.admin-access

.github/workflows/services-cd.yml

@@ -33,6 +33,8 @@
   jobs:
 
     deploy_to_service_cluster:
+      env:
+        PRINCIPAL_ID: ${{ secrets.GHA_PRINCIPAL_ID }}
       permissions:
         id-token: 'write'
         contents: 'read'
@@ -78,34 +80,40 @@
 
         - name: 'Deploy Istio Configuration'
           run: |
-            make isto.deploy
+            make istio.deploy_pipeline
+
+        - name: 'Deploy ACR Pull Configuration'
+          run: |
+            make acrpull.deploy_pipeline
 
         - name: 'Deploy Frontend'
           run: |
-            make rp.frontend.deploy
+            make frontend.deploy_pipeline
 
         - name: 'Deploy Backend'
           run: |
-            make rp.backend.deploy
+            make backend.deploy_pipeline
 
         - name: 'Deploy Cluster Service'
           run: |
-            make cs.deploy
+            make cluster-service.deploy_pipeline
 
         - name: 'Deploy Maestro'
           run: |
-            make maestro.server.deploy maestro.registration.deploy
+            make maestro.server.deploy_pipeline maestro.registration.deploy
 
         - name: 'Deploy Prometheus Config'
           run: |
-            make metrics.deploy
+            make metrics.deploy_pipeline
 
         - name: 'Deploy CS PR check environment dressup'
           if: inputs.deploy_cs_pr_check_deps
           run: |
             ./svc-deploy.sh ${DEPLOY_ENV} cluster-service svc deploy-pr-env-deps
 
     deploy_to_management_cluster:
+      env:
+        PRINCIPAL_ID: ${{ secrets.GHA_PRINCIPAL_ID }}
       permissions:
         id-token: 'write'
         contents: 'read'
@@ -141,18 +149,22 @@
           cd dev-infrastructure/
           make mgmt.aks.kubeconfig
 
-      - name: 'Deploy PKO'
+      - name: 'Deploy ACR Pull Configuration'
         run: |
-          make pko.deploy
+          make acrpull.mgmt.deploy
+
+      # - name: 'Deploy PKO'
+      #   run: |
+      #     make pko.deploy
 
       - name: 'Deploy ACM'
         run: |
-          make acm.deploy
+          make acm.deploy_pipeline
 
       - name: 'Deploy Maestro Agent'
         run: |
-          make maestro.agent.deploy
+          make maestro.agent.deploy_pipeline
 
       - name: 'Deploy Hypershift Operator and External DNS Operator'
         run: |
-          make hypershift.deploy
+          make hypershiftoperator.deploy_pipeline

.github/workflows/services-ci.yml

@@ -157,3 +157,31 @@
           run: |
             cd tooling/image-sync
             make push
+
+    build_push_package_operator:
+      permissions:
+        id-token: 'write'
+        contents: 'read'
+      runs-on: 'ubuntu-latest'
+      steps:
+        - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+          with:
+            fetch-depth: 1
+
+        - name: "install azure-cli"
+          if: inputs.push == true
+          uses: "Azure/ARO-HCP@main"
+
+        - name: 'Az CLI login'
+          if: inputs.push == true
+          uses: azure/login@v2
+          with:
+            client-id: ${{ secrets.AZURE_CLIENT_ID }}
+            tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+            subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+        - name: Build package operator container image from git@github.com:package-operator/package-operator.git
+          if: inputs.push == true
+          run: |
+            cd pko
+            make image