Add service-account type authentication to GitHub Actions and system tests

.github/actions/systemtests/parse-comment/action.yml

@@ -19,7 +19,7 @@ inputs:
     required: false
     default: "tls"
   clusterSecurityAuthentication:
-    description: "Authentication used for the internal Kafka cluster communication ('mtls' or 'none')"
+    description: "Authentication used for the internal Kafka cluster communication ('mtls', 'service-account' or 'none')"
     required: false
     default: "mtls"
 
@@ -178,6 +178,20 @@ runs:
             clusterSecurityAuthentication: getParameter('clustersecurityauthentication', lower) || DEFAULTS.clusterSecurityAuthentication,
           };
 
+          // Only the supported internal cluster security types can be used
+          const CLUSTER_SECURITY_ENCRYPTION_TYPES = ['tls', 'none'];
+          const CLUSTER_SECURITY_AUTHENTICATION_TYPES = ['mtls', 'service-account', 'none'];
+
+          if (!CLUSTER_SECURITY_ENCRYPTION_TYPES.includes(out.clusterSecurityEncryption)) {
+            core.setFailed(`Invalid internal cluster security configuration: clusterSecurityEncryption=${out.clusterSecurityEncryption} is not supported. Supported values are: ${CLUSTER_SECURITY_ENCRYPTION_TYPES.join(', ')}`);
+            return;
+          }
+
+          if (!CLUSTER_SECURITY_AUTHENTICATION_TYPES.includes(out.clusterSecurityAuthentication)) {
+            core.setFailed(`Invalid internal cluster security configuration: clusterSecurityAuthentication=${out.clusterSecurityAuthentication} is not supported. Supported values are: ${CLUSTER_SECURITY_AUTHENTICATION_TYPES.join(', ')}`);
+            return;
+          }
+
           // mTLS authentication of the internal cluster communication can be used only with TLS encryption
           if (out.clusterSecurityAuthentication === 'mtls' && out.clusterSecurityEncryption !== 'tls') {
             core.setFailed(`Invalid internal cluster security configuration: clusterSecurityAuthentication=mtls can be used only with clusterSecurityEncryption=tls`);

.github/docs/README.md

@@ -121,7 +121,7 @@ Currently, we have these parameters that can be passed through the comment:
 | kindVersion                   | Version of Kind binary to install for cluster setup (e.g. `0.29.0`). n case you use different from default version of Kind, you should reference full image via `kindVersion` parameter to achieve supported configuration.                                  | The one set as default in setup scripts (currently 0.31.0)                           |
 | kafkaVersion                  | Which Kafka version will be used in the tests                                                                                                                                                                                                                | Default one from STs config                                                          |
 | clusterSecurityEncryption     | Encryption used for the internal communication of the Kafka clusters deployed by the tests (`tls` or `none`)                                                                                                                                                 | `tls`                                                                                |
-| clusterSecurityAuthentication | Authentication used for the internal communication of the Kafka clusters deployed by the tests (`mtls` or `none`). `mtls` can be used only together with `tls` encryption.                                                                                   | `mtls`                                                                               |
+| clusterSecurityAuthentication | Authentication used for the internal communication of the Kafka clusters deployed by the tests (`mtls`, `service-account` or `none`). `mtls` can be used only together with `tls` encryption.                                                                | `mtls`                                                                               |
 
 The process of parameter usage is as follows:
 - `pipeline` has the highest priority. If `pipeline` is defined, the jobs will be loaded with data from [pipelines.yaml](../actions/systemtests/generate-matrix/pipelines.yaml) that match specific _pipeline_.
@@ -165,6 +165,9 @@ Unit and integration tests invoked via [actions-tests.yml](../workflows/actions-
 It uses files specified within [tests](../tests) folder and via [act](https://github.com/nektos/act) it tries to execute the actions and check the outputs.
 Currently, we tests `generate-matrix` and `parse-comment` actions.
 
+A `parse-comment` scenario can also cover invalid inputs that should be rejected by the action.
+Such a scenario sets `expectFailure: true` (with empty `expectations`) and passes only when the parsing fails.
+
 ### Performance Report Tests
 The performance report generation workflow has test scenarios defined in [tests/scenarios/perf-report.yaml](../tests/scenarios/perf-report.yaml).
 These tests validate the performance report generation for different operator configurations.

.github/tests/events/parse-comment/issue_comment_15.json

@@ -0,0 +1,24 @@
+{
+  "event_name": "issue_comment",
+  "action": "created",
+  "comment": {
+    "body": "/gha run pipeline=regression clusterSecurityAuthentication=service-account"
+  },
+  "issue": {
+    "number": 42,
+    "pull_request": {
+      "head": {
+        "ref": "feature-123",
+        "sha": "1111111111111111111111111111111111111111",
+        "repo": {
+          "name": "test-repo",
+          "owner": { "login": "batman" }
+        }
+      }
+    }
+  },
+  "repository": {
+    "name": "test-repo",
+    "owner": { "login": "batman" }
+  }
+}

.github/tests/events/parse-comment/issue_comment_16.json

@@ -0,0 +1,24 @@
+{
+  "event_name": "issue_comment",
+  "action": "created",
+  "comment": {
+    "body": "/gha run pipeline=regression clusterSecurityAuthentication=serviceaccount"
+  },
+  "issue": {
+    "number": 42,
+    "pull_request": {
+      "head": {
+        "ref": "feature-123",
+        "sha": "1111111111111111111111111111111111111111",
+        "repo": {
+          "name": "test-repo",
+          "owner": { "login": "batman" }
+        }
+      }
+    }
+  },
+  "repository": {
+    "name": "test-repo",
+    "owner": { "login": "batman" }
+  }
+}

.github/tests/events/parse-comment/issue_comment_17.json

@@ -0,0 +1,24 @@
+{
+  "event_name": "issue_comment",
+  "action": "created",
+  "comment": {
+    "body": "/gha run pipeline=regression clusterSecurityEncryption=none clusterSecurityAuthentication=mtls"
+  },
+  "issue": {
+    "number": 42,
+    "pull_request": {
+      "head": {
+        "ref": "feature-123",
+        "sha": "1111111111111111111111111111111111111111",
+        "repo": {
+          "name": "test-repo",
+          "owner": { "login": "batman" }
+        }
+      }
+    }
+  },
+  "repository": {
+    "name": "test-repo",
+    "owner": { "login": "batman" }
+  }
+}

.github/tests/scenarios/parse-comment.yaml

@@ -395,4 +395,37 @@ scenarios:
       release: "latest"
       ipfamily: "ipv4"
       cluster_security_encryption: "none"
-      cluster_security_authentication: "none"
+      cluster_security_authentication: "none"
+
+  - id: comment-cluster-security-service-account
+    description: "Comment with Service Account authentication of the internal cluster security"
+    event: issue_comment
+    fixture: .github/tests/events/parse-comment/issue_comment_15.json
+    expectations:
+      pipelines: "regression"
+      profiles: ""
+      tests: ""
+      groups: ""
+      kafka: "latest"
+      strimzi_feature_gates: ""
+      strimzi_rbac_scope: ""
+      cluster_operator_install_type: "yaml"
+      kube: "latest"
+      release: "latest"
+      ipfamily: "ipv4"
+      cluster_security_encryption: "tls"
+      cluster_security_authentication: "service-account"
+
+  - id: comment-cluster-security-unsupported-authentication
+    description: "Comment with an unsupported internal cluster security authentication type"
+    event: issue_comment
+    fixture: .github/tests/events/parse-comment/issue_comment_16.json
+    expectFailure: true
+    expectations: {}
+
+  - id: comment-cluster-security-unsupported-combination
+    description: "Comment with mTLS authentication combined with disabled encryption"
+    event: issue_comment
+    fixture: .github/tests/events/parse-comment/issue_comment_17.json
+    expectFailure: true
+    expectations: {}

.github/tests/workflows/parse-comment-template.yaml

@@ -26,7 +26,7 @@ on:
         default: ""
         type: string
       clusterSecurityAuthentication:
-        description: "Authentication used for the internal Kafka cluster communication ('mtls' or 'none')"
+        description: "Authentication used for the internal Kafka cluster communication ('mtls', 'service-account' or 'none')"
         required: false
         default: ""
         type: string

.github/workflows/github-actions-integration.yml

@@ -87,12 +87,15 @@ jobs:
             description=$(yq eval ".scenarios[$i].description" "$SCENARIOS_FILE")
             event=$(yq eval ".scenarios[$i].event" "$SCENARIOS_FILE")
             fixture=$(yq eval ".scenarios[$i].fixture" "$SCENARIOS_FILE")
+            # Scenarios with invalid parameters are expected to fail the parsing instead of producing outputs
+            expect_failure=$(yq eval ".scenarios[$i].expectFailure // false" "$SCENARIOS_FILE")
 
             echo "───────────────────────────────────────"
             echo "🔍 Scenario $((i + 1))/$TOTAL: $id"
             echo "   Description: $description"
             echo "   Event: $event"
             echo "   Fixture: $fixture"
+            echo "   Expected to fail: $expect_failure"
 
             # Build environment variables from expectations
             env_args=""
@@ -111,10 +114,19 @@ jobs:
             echo "▶️  Running test..."
 
             if eval "act '$event' -W '$WORKFLOW' -e '$fixture' -P ubuntu-latest=ghcr.io/catthehacker/ubuntu:act-22.04 --pull=false $env_args $token_args"; then
-              echo "✅ $id passed"
+              if [ "$expect_failure" = "true" ]; then
+                echo "❌ $id failed => it was expected to fail, but it passed"
+                overall_result=false
+              else
+                echo "✅ $id passed"
+              fi
             else
-              echo "❌ $id failed"
-              overall_result=false
+              if [ "$expect_failure" = "true" ]; then
+                echo "✅ $id passed => it failed as expected"
+              else
+                echo "❌ $id failed"
+                overall_result=false
+              fi
             fi
             # Print blank line for better readability
             echo

.github/workflows/run-system-tests.yml

@@ -33,7 +33,7 @@ on:
         default: "tls"
         type: string
       clusterSecurityAuthentication:
-        description: "Authentication used for the internal Kafka cluster communication ('mtls' or 'none')"
+        description: "Authentication used for the internal Kafka cluster communication ('mtls', 'service-account' or 'none')"
         required: false
         default: "mtls"
         type: string

.github/workflows/system-tests.yml

@@ -32,6 +32,7 @@ on:
         type: choice
         options:
           - mtls
+          - service-account
           - none
   # Automated trigger for issue comment
   issue_comment:

development-docs/TESTING.md

@@ -354,7 +354,7 @@ All environment variables are defined in [Environment](systemtest/src/main/java/
 | KAFKA_TIERED_STORAGE_CLASSPATH        | Classpath to the libs for Tiered Storage plugin - inside the Kafka image. This is then configured inside the classpath field for Tiered Storage spec inside the Kafka CR.                                                                                            | /opt/kafka/plugins/tiered-storage/*                               |
 | KAFKA_TIERED_STORAGE_BASE_IMAGE       | Base Kafka image that will be used for building a new custom one - adding the Aiven Tiered Storage plugin to it. If both this env variable and `KAFKA_TIERED_STORAGE_IMAGE` are configured, the `KAFKA_TIERED_STORAGE_IMAGE` takes precedence and no image is built. | quay.io/strimzi/kafka:latest-kafka-LATEST_SUPPORTED_KAFKA_VERSION |
 | CLUSTER_SECURITY_ENCRYPTION           | Encryption used for the internal communication of the Kafka clusters deployed by the tests. Supported values are `tls` and `none`.                                                                                                                                   | tls                                                               |
-| CLUSTER_SECURITY_AUTHENTICATION       | Authentication used for the internal communication of the Kafka clusters deployed by the tests. Supported values are `mtls` and `none`. `mtls` can be used only together with `tls` encryption.                                                                      | mtls                                                              |
+| CLUSTER_SECURITY_AUTHENTICATION       | Authentication used for the internal communication of the Kafka clusters deployed by the tests. Supported values are `mtls`, `service-account` and `none`. `mtls` can be used only together with `tls` encryption.                                                   | mtls                                                              |
 
 If you want to use your images with a different tag or from a separate repository, you can use `DOCKER_REGISTRY`, `DOCKER_ORG` and `DOCKER_TAG` environment variables.
 

systemtest/src/main/java/io/strimzi/systemtest/Environment.java

@@ -284,6 +284,8 @@ private Environment() { }
      * Converts the value of an environment variable into an enum constant. An environment variable that is set to an
      * empty value is treated as if it was not set at all and the default value is used instead. That is needed because
      * the environment variables are often set from CI pipelines where an unset parameter ends up as an empty value.
+     * Dashes in the value are converted to underscores, so that values such as `service-account` can be matched with
+     * the `SERVICE_ACCOUNT` enum constant.
      *
      * @param enumType      Class of the enum the value should be converted to
      * @param envVarName    Name of the environment variable. Used only in the error message.
@@ -300,7 +302,7 @@ private static <E extends Enum<E>> E enumFromEnvVar(Class<E> enumType, String en
         }
 
         try {
-            return Enum.valueOf(enumType, value.trim().toUpperCase(Locale.ENGLISH));
+            return Enum.valueOf(enumType, value.trim().toUpperCase(Locale.ENGLISH).replace('-', '_'));
         } catch (IllegalArgumentException e) {
             throw new IllegalArgumentException("Invalid value '" + value + "' of the " + envVarName + " environment variable", e);
         }