feat: validate APISIX resources in webhooks

.github/workflows/apisix-conformance-test.yml

@@ -58,11 +58,11 @@ jobs:
           go install sigs.k8s.io/kind@v0.23.0
 
       - name: Login to Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ secrets.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
+        run: |
+          echo "${{ secrets.DOCKER_PASSWORD }}" | docker login \
+            "${{ secrets.DOCKER_REGISTRY }}" \
+            --username "${{ secrets.DOCKER_USERNAME }}" \
+            --password-stdin
 
       - name: Build images
         env:

.github/workflows/apisix-e2e-test.yml

@@ -57,11 +57,11 @@ jobs:
           go-version: "1.24"
 
       - name: Login to Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ secrets.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
+        run: |
+          echo "${{ secrets.DOCKER_PASSWORD }}" | docker login \
+            "${{ secrets.DOCKER_REGISTRY }}" \
+            --username "${{ secrets.DOCKER_USERNAME }}" \
+            --password-stdin
 
       - name: Setup Node.js
         uses: actions/setup-node@v3

.github/workflows/conformance-test.yml

@@ -57,18 +57,18 @@ jobs:
           ./get_helm.sh
 
       - name: Login to Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ secrets.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
+        run: |
+          echo "${{ secrets.DOCKER_PASSWORD }}" | docker login \
+            "${{ secrets.DOCKER_REGISTRY }}" \
+            --username "${{ secrets.DOCKER_USERNAME }}" \
+            --password-stdin
 
       - name: Login to Private Registry
-        uses: docker/login-action@v3
-        with:
-          registry: hkccr.ccs.tencentyun.com
-          username: ${{ secrets.PRIVATE_DOCKER_USERNAME }}
-          password: ${{ secrets.PRIVATE_DOCKER_PASSWORD }}
+        run: |
+          echo "${{ secrets.PRIVATE_DOCKER_PASSWORD }}" | docker login \
+            hkccr.ccs.tencentyun.com \
+            --username "${{ secrets.PRIVATE_DOCKER_USERNAME }}" \
+            --password-stdin
 
       - name: Build images
         env:

.github/workflows/e2e-test-k8s.yml

@@ -56,23 +56,32 @@ jobs:
           ./get_helm.sh
 
       - name: Login to Private Registry
-        uses: docker/login-action@v3
-        with:
-          registry: hkccr.ccs.tencentyun.com
-          username: ${{ secrets.PRIVATE_DOCKER_USERNAME }}
-          password: ${{ secrets.PRIVATE_DOCKER_PASSWORD }}
+        run: |
+          echo "${{ secrets.PRIVATE_DOCKER_PASSWORD }}" | docker login \
+            hkccr.ccs.tencentyun.com \
+            --username "${{ secrets.PRIVATE_DOCKER_USERNAME }}" \
+            --password-stdin
 
       - name: Launch Kind Cluster
         env:
           KIND_NODE_IMAGE: kindest/node:v1.18.15
         run: |
+          make kind-down
           make kind-up
-          KIND_NODE_IP=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' apisix-ingress-cluster-control-plane)
-          echo $KIND_NODE_IP
-
-          kubectl config get-clusters
-          kubectl config set-cluster kind-apisix-ingress-cluster --server=https://$KIND_NODE_IP:6443
-          kubectl wait --for=condition=Ready nodes --all
+          mkdir -p "${HOME}/.kube"
+          kind get kubeconfig --name apisix-ingress-cluster --internal > "${HOME}/.kube/config"
+          kubectl config use-context kind-apisix-ingress-cluster
+          for attempt in {1..30}; do
+            if kubectl cluster-info >/dev/null 2>&1; then
+              break
+            fi
+            if [ "${attempt}" -eq 30 ]; then
+              echo "kind apiserver did not become reachable in time" >&2
+              exit 1
+            fi
+            sleep 2
+          done
+          kubectl wait --for=condition=Ready nodes --all --timeout=120s
 
       - name: Build images
         env:
@@ -95,6 +104,23 @@ jobs:
       - name: Loading Docker Image to Kind Cluster
         run: |
           make kind-load-images
+          loaded_postgres_image=false
+          for image in \
+            swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/bitnamilegacy/postgresql:15.4.0-debian-11-r45 \
+            docker.aityp.com/bitnamilegacy/postgresql:15.4.0-debian-11-r45 \
+            bitnamilegacy/postgresql:15.4.0-debian-11-r45 \
+            docker.m.daocloud.io/bitnamilegacy/postgresql:15.4.0-debian-11-r45; do
+            if docker pull "${image}"; then
+              docker tag "${image}" docker.io/bitnamilegacy/postgresql:15.4.0-debian-11-r45
+              kind load docker-image docker.io/bitnamilegacy/postgresql:15.4.0-debian-11-r45 --name apisix-ingress-cluster
+              loaded_postgres_image=true
+              break
+            fi
+          done
+          if [ "${loaded_postgres_image}" != "true" ]; then
+            echo "failed to preload postgres image for kind" >&2
+            exit 1
+          fi
 
       - name: Extract adc binary
         if: ${{ env.ADC_VERSION == 'dev' }}
@@ -116,5 +142,8 @@ jobs:
           TEST_LABEL: ${{ matrix.cases_subset }}
           INGRESS_VERSION: v1beta1
           TEST_ENV: CI
+          POSTGRESQL_IMAGE_REGISTRY: docker.io
+          POSTGRESQL_IMAGE_REPOSITORY: bitnamilegacy/postgresql
+          POSTGRESQL_IMAGE_TAG: 15.4.0-debian-11-r45
         run: |
           make e2e-test

.github/workflows/e2e-test.yml

@@ -59,18 +59,18 @@ jobs:
           chmod 700 get_helm.sh
           ./get_helm.sh
       - name: Login to Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ${{ secrets.DOCKER_REGISTRY }}
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
+        run: |
+          echo "${{ secrets.DOCKER_PASSWORD }}" | docker login \
+            "${{ secrets.DOCKER_REGISTRY }}" \
+            --username "${{ secrets.DOCKER_USERNAME }}" \
+            --password-stdin
 
       - name: Login to Private Registry
-        uses: docker/login-action@v3
-        with:
-          registry: hkccr.ccs.tencentyun.com
-          username: ${{ secrets.PRIVATE_DOCKER_USERNAME }}
-          password: ${{ secrets.PRIVATE_DOCKER_PASSWORD }}
+        run: |
+          echo "${{ secrets.PRIVATE_DOCKER_PASSWORD }}" | docker login \
+            hkccr.ccs.tencentyun.com \
+            --username "${{ secrets.PRIVATE_DOCKER_USERNAME }}" \
+            --password-stdin
 
       - name: Build images
         env:

.github/workflows/spell-checker.yml

@@ -31,10 +31,14 @@ jobs:
     steps:
       - name: Check out code.
         uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
       - name: Install
         run: |
-          wget -O - -q https://git.io/misspell | sh -s -- -b .
+          go install github.com/client9/misspell/cmd/misspell@v0.3.4
       - name: Misspell
         run: |
-          find . -name "*.go" -type f | xargs ./misspell -i mosquitto -error
-          find docs -type f | xargs ./misspell -error
+          find . -name "*.go" -type f | xargs "$(go env GOPATH)/bin/misspell" -i mosquitto -error
+          find docs -type f | xargs "$(go env GOPATH)/bin/misspell" -error

Makefile

@@ -194,7 +194,7 @@ kind-down:
 		|| echo "kind cluster does not exist"
 
 .PHONY: kind-load-images
-kind-load-images: pull-infra-images kind-load-ingress-image kind-load-adc-image
+kind-load-images: pull-infra-images build-e2e-echo-server-image kind-load-ingress-image kind-load-adc-image
 	@kind load docker-image hkccr.ccs.tencentyun.com/api7-dev/api7-ee-3-gateway:dev --name $(KIND_NAME)
 	@kind load docker-image hkccr.ccs.tencentyun.com/api7-dev/api7-ee-dp-manager:$(DASHBOARD_VERSION)  --name $(KIND_NAME)
 	@kind load docker-image hkccr.ccs.tencentyun.com/api7-dev/api7-ee-3-integrated:$(DASHBOARD_VERSION)  --name $(KIND_NAME)
@@ -222,16 +222,39 @@ kind-load-adc-image:
 	@docker tag ghcr.io/api7/adc:$(ADC_VERSION) ghcr.io/api7/adc:dev
 	@kind load docker-image ghcr.io/api7/adc:dev --name $(KIND_NAME)
 
+.PHONY: build-e2e-echo-server-image
+build-e2e-echo-server-image:
+	@CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o bin/e2e-echo-server ./cmd/e2e-echo-server
+	@docker build -f test/e2e/images/echo-server.Dockerfile -t jmalloc/echo-server:latest .
+
 .PHONY: pull-infra-images
 pull-infra-images:
-	@docker pull hkccr.ccs.tencentyun.com/api7-dev/api7-ee-3-gateway:dev
-	@docker pull hkccr.ccs.tencentyun.com/api7-dev/api7-ee-dp-manager:$(DASHBOARD_VERSION)
-	@docker pull hkccr.ccs.tencentyun.com/api7-dev/api7-ee-3-integrated:$(DASHBOARD_VERSION)
-	@docker pull kennethreitz/httpbin:latest
-	@docker pull jmalloc/echo-server:latest
-	@docker pull ghcr.io/api7/adc:dev
-	@docker pull apache/apisix:dev
-	@docker pull openresty/openresty:1.27.1.2-4-bullseye-fat
+	@retry_pull() { \
+		source="$$1"; \
+		target="$$2"; \
+		for attempt in 1 2 3; do \
+			if docker pull "$$source"; then \
+				if [ "$$source" != "$$target" ]; then \
+					docker tag "$$source" "$$target"; \
+				fi; \
+				return 0; \
+			fi; \
+			if [ $$attempt -eq 3 ]; then \
+				echo "failed to pull $$source after $$attempt attempts" >&2; \
+				exit 1; \
+			fi; \
+			echo "retrying docker pull for $$source (attempt $$((attempt + 1))/3)..." >&2; \
+			sleep 5; \
+		done; \
+	}; \
+	retry_pull "hkccr.ccs.tencentyun.com/api7-dev/api7-ee-3-gateway:dev" "hkccr.ccs.tencentyun.com/api7-dev/api7-ee-3-gateway:dev"; \
+	retry_pull "hkccr.ccs.tencentyun.com/api7-dev/api7-ee-dp-manager:$(DASHBOARD_VERSION)" "hkccr.ccs.tencentyun.com/api7-dev/api7-ee-dp-manager:$(DASHBOARD_VERSION)"; \
+	retry_pull "hkccr.ccs.tencentyun.com/api7-dev/api7-ee-3-integrated:$(DASHBOARD_VERSION)" "hkccr.ccs.tencentyun.com/api7-dev/api7-ee-3-integrated:$(DASHBOARD_VERSION)"; \
+	dockerhub_proxy="$${DOCKERHUB_PROXY:-docker.m.daocloud.io}"; \
+	retry_pull "$$dockerhub_proxy/kennethreitz/httpbin:latest" "kennethreitz/httpbin:latest"; \
+	retry_pull "ghcr.io/api7/adc:dev" "ghcr.io/api7/adc:dev"; \
+	retry_pull "$$dockerhub_proxy/apache/apisix:dev" "apache/apisix:dev"; \
+	retry_pull "$$dockerhub_proxy/openresty/openresty:1.27.1.2-4-bullseye-fat" "openresty/openresty:1.27.1.2-4-bullseye-fat"
 
 ##@ Build
 
@@ -398,8 +421,12 @@ $(ADC_BIN):
 ifeq ($(ADC_VERSION),dev)
 	@echo "ADC_VERSION=dev, skip download"
 else
-	curl -sSfL https://github.com/api7/adc/releases/download/v${ADC_VERSION}/adc_${ADC_VERSION}_${GOOS}_${GOARCH}.tar.gz \
-		| tar -xz -C $(LOCALBIN)
+	tmp_archive=$$(mktemp); \
+	trap 'rm -f "$$tmp_archive"' EXIT; \
+	curl --retry 5 --retry-delay 2 --retry-connrefused -sSfL \
+		-o "$$tmp_archive" \
+		https://github.com/api7/adc/releases/download/v${ADC_VERSION}/adc_${ADC_VERSION}_${GOOS}_${GOARCH}.tar.gz; \
+	tar -xzf "$$tmp_archive" -C $(LOCALBIN)
 endif
 
 gofmt: ## Apply go fmt

cmd/e2e-echo-server/main.go

@@ -0,0 +1,44 @@
+package main
+
+import (
+	"log"
+	"net/http"
+
+	"github.com/gorilla/websocket"
+)
+
+var upgrader = websocket.Upgrader{
+	CheckOrigin: func(*http.Request) bool {
+		return true
+	},
+}
+
+func main() {
+	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		if websocket.IsWebSocketUpgrade(r) {
+			conn, err := upgrader.Upgrade(w, r, nil)
+			if err != nil {
+				return
+			}
+			defer func() {
+				_ = conn.Close()
+			}()
+
+			for {
+				messageType, message, err := conn.ReadMessage()
+				if err != nil {
+					return
+				}
+				if err := conn.WriteMessage(messageType, message); err != nil {
+					return
+				}
+			}
+		}
+
+		w.Header().Set("Content-Type", "text/plain")
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("ok"))
+	})
+
+	log.Fatal(http.ListenAndServe(":8080", nil))
+}

internal/adc/client/client.go

@@ -174,6 +174,43 @@ func (c *Client) DeleteConfig(ctx context.Context, args Task) error {
 	return err
 }
 
+func (c *Client) Validate(ctx context.Context, task Task) error {
+	if len(task.Configs) == 0 || task.Resources == nil {
+		return nil
+	}
+
+	fileIOStart := time.Now()
+	syncFilePath, cleanup, err := prepareSyncFile(task.Resources)
+	if err != nil {
+		pkgmetrics.RecordFileIODuration("prepare_sync_file", "failure", time.Since(fileIOStart).Seconds())
+		return err
+	}
+	pkgmetrics.RecordFileIODuration("prepare_sync_file", adctypes.StatusSuccess, time.Since(fileIOStart).Seconds())
+	defer cleanup()
+
+	args := BuildADCExecuteArgs(syncFilePath, task.Labels, task.ResourceTypes)
+
+	var errs types.ADCValidationErrors
+	for _, config := range task.Configs {
+		if config.BackendType == "" {
+			config.BackendType = c.defaultMode
+		}
+		if err := c.executor.Validate(ctx, config, args); err != nil {
+			var validationErr types.ADCValidationError
+			if errors.As(err, &validationErr) {
+				errs.Errors = append(errs.Errors, validationErr)
+				continue
+			}
+			return err
+		}
+	}
+
+	if len(errs.Errors) > 0 {
+		return errs
+	}
+	return nil
+}
+
 func (c *Client) Sync(ctx context.Context) (map[string]types.ADCExecutionErrors, error) {
 	c.syncMu.Lock()
 	defer c.syncMu.Unlock()