operators: migrate envtests to Bazel

CMakeLists.txt

@@ -3,7 +3,7 @@ project(constellation LANGUAGES C)
 
 enable_testing()
 
-add_test(NAME integration-node-operator COMMAND make test WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/operators/constellation-node-operator)
+# TODO(malt3): Remove this once every integration test is migrated to Bazel
 add_test(NAME integration-csi COMMAND bash -c "go test -tags integration -c ./test/ && sudo ./test.test -test.v" WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/csi)
 add_test(NAME integration-dm COMMAND bash -c "go test -tags integration -c ./test/ && sudo ./test.test -test.v" WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/disk-mapper/internal)
 add_test(NAME integration-license COMMAND bash -c "go test -tags integration" WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/internal/license)

WORKSPACE.bazel

@@ -173,3 +173,8 @@ node_maintainance_operator_deps()
 load("//bazel/toolchains:ci_deps.bzl", "ci_deps")
 
 ci_deps()
+
+# k8s deps
+load("//bazel/toolchains:k8s.bzl", "k8s_deps")
+
+k8s_deps()

bazel/ci/BUILD.bazel

@@ -4,7 +4,10 @@ load("@com_github_bazelbuild_buildtools//buildifier:def.bzl", "buildifier", "bui
 load("//bazel/ci:proto_targets.bzl", "proto_targets")
 load("//bazel/sh:def.bzl", "noop_warn", "repo_command", "sh_template")
 
-required_tags = ["e2e"]
+required_tags = [
+    "e2e",
+    "integration",
+]
 
 gazelle(
     name = "gazelle_generate",

bazel/envtest/BUILD.bazel

@@ -0,0 +1,47 @@
+load("@aspect_bazel_lib//lib:copy_to_directory.bzl", "copy_to_directory")
+
+# tools (aka KUBEBUILDER_ASSETS) are a collection of binaries that are used by
+# kubebuilder for envtests.
+copy_to_directory(
+    name = "tools",
+    srcs = [
+        ":etcd",
+        ":kube-apiserver",
+        ":kubectl",
+    ],
+    include_external_repositories = ["kubebuilder_tools_*"],
+    visibility = ["//visibility:public"],
+)
+
+alias(
+    name = "etcd",
+    actual = select({
+        "@io_bazel_rules_go//go/platform:darwin_amd64": "@kubebuilder_tools_darwin_amd64//:etcd",
+        "@io_bazel_rules_go//go/platform:darwin_arm64": "@kubebuilder_tools_darwin_arm64//:etcd",
+        "@io_bazel_rules_go//go/platform:linux_amd64": "@kubebuilder_tools_linux_amd64//:etcd",
+        "@io_bazel_rules_go//go/platform:linux_arm64": "@kubebuilder_tools_linux_arm64//:etcd",
+    }),
+    visibility = ["//visibility:public"],
+)
+
+alias(
+    name = "kube-apiserver",
+    actual = select({
+        "@io_bazel_rules_go//go/platform:darwin_amd64": "@kubebuilder_tools_darwin_amd64//:kube-apiserver",
+        "@io_bazel_rules_go//go/platform:darwin_arm64": "@kubebuilder_tools_darwin_arm64//:kube-apiserver",
+        "@io_bazel_rules_go//go/platform:linux_amd64": "@kubebuilder_tools_linux_amd64//:kube-apiserver",
+        "@io_bazel_rules_go//go/platform:linux_arm64": "@kubebuilder_tools_linux_arm64//:kube-apiserver",
+    }),
+    visibility = ["//visibility:public"],
+)
+
+alias(
+    name = "kubectl",
+    actual = select({
+        "@io_bazel_rules_go//go/platform:darwin_amd64": "@kubebuilder_tools_darwin_amd64//:kubectl",
+        "@io_bazel_rules_go//go/platform:darwin_arm64": "@kubebuilder_tools_darwin_arm64//:kubectl",
+        "@io_bazel_rules_go//go/platform:linux_amd64": "@kubebuilder_tools_linux_amd64//:kubectl",
+        "@io_bazel_rules_go//go/platform:linux_arm64": "@kubebuilder_tools_linux_arm64//:kubectl",
+    }),
+    visibility = ["//visibility:public"],
+)

bazel/toolchains/k8s.bzl

@@ -0,0 +1,52 @@
+"""versioned kubernetes release artifacts (dl.k8s.io)"""
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+def k8s_deps():
+    envtest_deps()
+
+def envtest_deps():
+    http_archive(
+        name = "kubebuilder_tools_darwin_amd64",
+        strip_prefix = "kubebuilder/bin",
+        type = "tar.gz",
+        urls = [
+            "https://cdn.confidential.cloud/constellation/cas/sha256/e1913674bacaa70c067e15649237e1f67d891ba53f367c0a50786b4a274ee047",
+            "https://kubebuilder-tools.storage.googleapis.com/kubebuilder-tools-1.27.1-darwin-amd64.tar.gz",
+        ],
+        sha256 = "e1913674bacaa70c067e15649237e1f67d891ba53f367c0a50786b4a274ee047",
+        build_file_content = """exports_files(["etcd", "kubectl", "kube-apiserver"], visibility = ["//visibility:public"])""",
+    )
+    http_archive(
+        name = "kubebuilder_tools_darwin_arm64",
+        strip_prefix = "kubebuilder/bin",
+        type = "tar.gz",
+        urls = [
+            "https://cdn.confidential.cloud/constellation/cas/sha256/0422632a2bbb0d4d14d7d8b0f05497a4d041c11d770a07b7a55c44bcc5e8ce66",
+            "https://kubebuilder-tools.storage.googleapis.com/kubebuilder-tools-1.27.1-darwin-arm64.tar.gz",
+        ],
+        sha256 = "0422632a2bbb0d4d14d7d8b0f05497a4d041c11d770a07b7a55c44bcc5e8ce66",
+        build_file_content = """exports_files(["etcd", "kubectl", "kube-apiserver"], visibility = ["//visibility:public"])""",
+    )
+    http_archive(
+        name = "kubebuilder_tools_linux_amd64",
+        strip_prefix = "kubebuilder/bin",
+        type = "tar.gz",
+        urls = [
+            "https://cdn.confidential.cloud/constellation/cas/sha256/f9699df7b021f71a1ab55329b36b48a798e6ae3a44d2132255fc7e46c6790d4d",
+            "https://kubebuilder-tools.storage.googleapis.com/kubebuilder-tools-1.27.1-linux-amd64.tar.gz",
+        ],
+        sha256 = "f9699df7b021f71a1ab55329b36b48a798e6ae3a44d2132255fc7e46c6790d4d",
+        build_file_content = """exports_files(["etcd", "kubectl", "kube-apiserver"], visibility = ["//visibility:public"])""",
+    )
+    http_archive(
+        name = "kubebuilder_tools_linux_arm64",
+        strip_prefix = "kubebuilder/bin",
+        type = "tar.gz",
+        urls = [
+            "https://cdn.confidential.cloud/constellation/cas/sha256/9d2803e8ca85c465b33c12b06d0b2eba3ddb64b53a468628f741e50b462c46ad",
+            "https://kubebuilder-tools.storage.googleapis.com/kubebuilder-tools-1.27.1-linux-arm64.tar.gz",
+        ],
+        sha256 = "9d2803e8ca85c465b33c12b06d0b2eba3ddb64b53a468628f741e50b462c46ad",
+        build_file_content = """exports_files(["etcd", "kubectl", "kube-apiserver"], visibility = ["//visibility:public"])""",
+    )

csi/test/BUILD.bazel

@@ -0,0 +1,25 @@
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_test(
+    name = "test_test",
+    srcs = ["mount_integration_test.go"],
+    # keep
+    tags = ["manual"],
+    deps = select({
+        "@io_bazel_rules_go//go/platform:android": [
+            "//csi/cryptmapper",
+            "//internal/cryptsetup",
+            "@com_github_stretchr_testify//assert",
+            "@com_github_stretchr_testify//require",
+            "@org_uber_go_goleak//:goleak",
+        ],
+        "@io_bazel_rules_go//go/platform:linux": [
+            "//csi/cryptmapper",
+            "//internal/cryptsetup",
+            "@com_github_stretchr_testify//assert",
+            "@com_github_stretchr_testify//require",
+            "@org_uber_go_goleak//:goleak",
+        ],
+        "//conditions:default": [],
+    }),
+)

disk-mapper/internal/test/BUILD.bazel

@@ -0,0 +1,34 @@
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_test(
+    name = "test_test",
+    srcs = [
+        "benchmark_test.go",
+        "integration_test.go",
+    ],
+    # keep
+    tags = ["manual"],
+    deps = select({
+        "@io_bazel_rules_go//go/platform:android": [
+            "//disk-mapper/internal/diskencryption",
+            "//internal/cryptsetup",
+            "//internal/logger",
+            "@com_github_martinjungblut_go_cryptsetup//:go-cryptsetup",
+            "@com_github_stretchr_testify//assert",
+            "@com_github_stretchr_testify//require",
+            "@org_uber_go_goleak//:goleak",
+            "@org_uber_go_zap//zapcore",
+        ],
+        "@io_bazel_rules_go//go/platform:linux": [
+            "//disk-mapper/internal/diskencryption",
+            "//internal/cryptsetup",
+            "//internal/logger",
+            "@com_github_martinjungblut_go_cryptsetup//:go-cryptsetup",
+            "@com_github_stretchr_testify//assert",
+            "@com_github_stretchr_testify//require",
+            "@org_uber_go_goleak//:goleak",
+            "@org_uber_go_zap//zapcore",
+        ],
+        "//conditions:default": [],
+    }),
+)

internal/api/attestationconfigapi/test/BUILD.bazel

@@ -0,0 +1,13 @@
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_test(
+    name = "test_test",
+    srcs = ["integration_test.go"],
+    deps = [
+        "//internal/api/attestationconfigapi",
+        "//internal/logger",
+        "//internal/staticupload",
+        "@com_github_stretchr_testify//require",
+        "@org_uber_go_zap//:zap",
+    ],
+)

internal/kms/test/BUILD.bazel

@@ -0,0 +1,29 @@
+load("//bazel/go:go_test.bzl", "go_test")
+
+go_test(
+    name = "test_test",
+    srcs = [
+        "aws_test.go",
+        "azure_test.go",
+        "gcp_test.go",
+        "integration_test.go",
+    ],
+    deps = [
+        "//internal/kms/config",
+        "//internal/kms/kms",
+        "//internal/kms/kms/aws",
+        "//internal/kms/kms/azure",
+        "//internal/kms/kms/gcp",
+        "//internal/kms/storage",
+        "//internal/kms/storage/awss3",
+        "//internal/kms/storage/azureblob",
+        "//internal/kms/storage/gcs",
+        "//internal/kms/storage/memfs",
+        "//internal/kms/uri",
+        "@com_github_aws_aws_sdk_go_v2_config//:config",
+        "@com_github_aws_aws_sdk_go_v2_service_s3//:s3",
+        "@com_github_aws_aws_sdk_go_v2_service_s3//types",
+        "@com_github_stretchr_testify//assert",
+        "@com_github_stretchr_testify//require",
+    ],
+)

internal/license/BUILD.bazel

@@ -26,6 +26,7 @@ go_test(
     name = "license_test",
     srcs = [
         "file_test.go",
+        "license_integration_test.go",
         "license_test.go",
     ],
     embed = [":license"],

internal/sigstore/BUILD.bazel

@@ -28,6 +28,7 @@ go_library(
 go_test(
     name = "sigstore_test",
     srcs = [
+        "rekor_integration_test.go",
         "rekor_test.go",
         "sign_test.go",
         "verify_test.go",
@@ -38,5 +39,6 @@ go_test(
         "@com_github_sigstore_rekor//pkg/types/hashedrekord/v0.0.1:v0_0_1",
         "@com_github_stretchr_testify//assert",
         "@com_github_stretchr_testify//require",
+        "@org_uber_go_goleak//:goleak",
     ],
 )

operators/constellation-node-operator/BUILD.bazel

@@ -68,3 +68,15 @@ oci_image(
     ],
     visibility = ["//visibility:public"],
 )
+
+filegroup(
+    name = "crd_bases",
+    srcs = glob(["config/crd/bases/*.yaml"]),
+    visibility = ["//visibility:public"],
+)
+
+filegroup(
+    name = "external_crds",
+    srcs = glob(["external/**/*.yaml"]),
+    visibility = ["//visibility:public"],
+)

operators/constellation-node-operator/Makefile

@@ -48,8 +48,6 @@ endif
 
 # Image URL to use all building/pushing image targets
 IMG ?= $(IMAGE_TAG_BASE):v$(VERSION)
-# ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
-ENVTEST_K8S_VERSION = 1.26.1
 
 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
 ifeq (,$(shell go env GOBIN))
@@ -103,8 +101,8 @@ vet: ## Run go vet against code.
 	go vet ./...
 
 .PHONY: test
-test: manifests generate fmt vet envtest ## Run tests.
-	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) -p path)" go test ./... -tags integration -coverprofile cover.out
+test: manifests generate fmt vet ## Run tests.
+	bazel test //operators/constellation-node-operator/...
 
 ##@ Build
 
@@ -161,7 +159,6 @@ $(LOCALBIN):
 ## Tool Binaries
 KUSTOMIZE ?= $(LOCALBIN)/kustomize
 CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
-ENVTEST ?= $(LOCALBIN)/setup-envtest
 
 ## Tool Versions
 KUSTOMIZE_VERSION ?= v3.8.7
@@ -178,11 +175,6 @@ controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessar
 $(CONTROLLER_GEN): $(LOCALBIN)
 	GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_TOOLS_VERSION)
 
-.PHONY: envtest
-envtest: $(ENVTEST) ## Download envtest-setup locally if necessary.
-$(ENVTEST): $(LOCALBIN)
-	GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
-
 .PHONY: bundle
 bundle: manifests kustomize ## Generate bundle manifests and metadata, then validate generated files.
 	operator-sdk generate kustomize manifests -q

operators/constellation-node-operator/controllers/BUILD.bazel

@@ -47,20 +47,43 @@ go_library(
 go_test(
     name = "controllers_test",
     srcs = [
+        "autoscalingstrategy_controller_env_test.go",
         "client_test.go",
+        "joiningnode_controller_env_test.go",
+        "nodeversion_controller_env_test.go",
         "nodeversion_controller_test.go",
         "nodeversion_watches_test.go",
+        "pendingnode_controller_env_test.go",
         "pendingnode_controller_test.go",
+        "scalinggroup_controller_env_test.go",
         "scalinggroup_controller_test.go",
         "schemes_test.go",
+        "suite_test.go",
+    ],
+    # keep
+    count = 1,
+    # keep
+    data = [
+        "//bazel/envtest:tools",
+        "//operators/constellation-node-operator:crd_bases",
+        "//operators/constellation-node-operator:external_crds",
     ],
     embed = [":controllers"],
+    # keep
+    env = {
+        "KUBEBUILDER_ASSETS": "../../../$(rootpath //bazel/envtest:tools)",
+    },
+    # keep
+    gotags = ["integration"],
     deps = [
         "//3rdparty/node-maintenance-operator/api/v1beta1",
         "//internal/constants",
         "//operators/constellation-node-operator/api/v1alpha1",
+        "@com_github_onsi_ginkgo_v2//:ginkgo",
+        "@com_github_onsi_gomega//:gomega",
         "@com_github_stretchr_testify//assert",
         "@com_github_stretchr_testify//require",
+        "@io_k8s_api//apps/v1:apps",
         "@io_k8s_api//core/v1:core",
         "@io_k8s_apimachinery//pkg/api/errors",
         "@io_k8s_apimachinery//pkg/api/meta",
@@ -70,8 +93,14 @@ go_test(
         "@io_k8s_apimachinery//pkg/types",
         "@io_k8s_apimachinery//pkg/version",
         "@io_k8s_client_go//kubernetes/scheme",
+        "@io_k8s_client_go//rest",
+        "@io_k8s_sigs_controller_runtime//:controller-runtime",
         "@io_k8s_sigs_controller_runtime//pkg/client",
+        "@io_k8s_sigs_controller_runtime//pkg/envtest",
         "@io_k8s_sigs_controller_runtime//pkg/event",
+        "@io_k8s_sigs_controller_runtime//pkg/log",
+        "@io_k8s_sigs_controller_runtime//pkg/log/zap",
         "@io_k8s_sigs_controller_runtime//pkg/reconcile",
+        "@io_k8s_utils//clock/testing",
     ],
 )