ci: fix envtest suite CI failures (#7771)

Author: pmalek

.github/supported_k8s_node_versions.yaml

@@ -0,0 +1,2 @@
+# renovate: datasource=docker packageName=kindest/node depName=kindest/node@only-patch
+- v1.34.0

.github/workflows/_envtest_tests.yaml

@@ -7,9 +7,32 @@ permissions:
   contents: read
 
 jobs:
+  matrix_k8s_node_versions:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+      latest: ${{ steps.set-latest.outputs.latest }}
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - id: set-matrix
+        run: |
+          (
+            echo 'matrix<<EOF'
+            yq eval -o=json '.' .github/supported_k8s_node_versions.yaml
+            echo 'EOF'
+          ) >> "${GITHUB_OUTPUT}"
+      - id: set-latest
+        run: |
+          (
+            echo 'latest<<EOF'
+            yq eval -r -o=json '. | sort | reverse | .[0]' .github/supported_k8s_node_versions.yaml
+            echo 'EOF'
+          ) >> "${GITHUB_OUTPUT}"
   envtest-tests:
     timeout-minutes: ${{ fromJSON(vars.GHA_DEFAULT_TIMEOUT || 10) }}
     runs-on: ubuntu-latest
+    needs:
+      - matrix_k8s_node_versions
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
@@ -33,11 +56,18 @@ jobs:
           op-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
 
       - name: run envtest tests
-        run: make test.envtest.pretty
         env:
           GOTESTSUM_JUNITFILE: envtest-tests.xml
           TEST_KONG_ENTERPRISE: "true"
           KONG_LICENSE_DATA: ${{ steps.license.outputs.license }}
+        run: |
+          VERSION="${{ needs.matrix_k8s_node_versions.outputs.latest }}"
+          # Remove leading 'v'
+          VERSION="${VERSION#v}"
+          # Remove patch number as envtest releases are not provided for every patch version
+          VERSION="${VERSION%.*}"
+          echo "Cluster version: $VERSION"
+          make test.envtest.pretty CLUSTER_VERSION=${VERSION}
 
       - name: collect test coverage
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

Makefile

@@ -439,7 +439,10 @@ ENVTEST_TIMEOUT ?= 8m
 .PHONY: _test.envtest
 .ONESHELL: _test.envtest
 _test.envtest: gotestsum setup-envtest use-setup-envtest
-	KUBEBUILDER_ASSETS="$(shell $(SETUP_ENVTEST) use -p path)" \
+	# Disable testcontainer's reaper (Ryuk). It's needed because Ryuk requires
+	# privileged mode to run, which is not desired and could cause issues in CI.
+	TESTCONTAINERS_RYUK_DISABLED="true" \
+	KUBEBUILDER_ASSETS="$(shell $(SETUP_ENVTEST) use $(CLUSTER_VERSION) -p path)" \
 		GOTESTSUM_FORMAT=$(GOTESTSUM_FORMAT) \
 		$(GOTESTSUM) \
 		--hide-summary output \