Add probes to IntegrationSource & -Sink deployments by creydr · Pull Request #8867 · knative/eventing

creydr · 2026-01-30T12:53:20Z

Currently the deployments of the IntegrationSink & IntegrationSource don't have readiness probes.
This PR addresses it and adds the probes

creydr · 2026-01-30T12:54:40Z

/cc @simkam

codecov · 2026-01-30T13:01:00Z

Codecov Report

❌ Patch coverage is 5.59441% with 135 lines in your changes missing coverage. Please review.
✅ Project coverage is 50.63%. Comparing base (4ee1519) to head (b5f7814).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...iler/integration/sink/resources/container_image.go	7.24%	63 Missing and 1 partial ⚠️
pkg/reconciler/integration/helper.go	0.00%	42 Missing ⚠️
cmd/auth_proxy/main.go	0.00%	25 Missing ⚠️
pkg/auth/verifier.go	0.00%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8867      +/-   ##
==========================================
- Coverage   50.91%   50.63%   -0.28%     
==========================================
  Files         409      409              
  Lines       21524    21658     +134     
==========================================
+ Hits        10958    10966       +8     
- Misses       9710     9835     +125     
- Partials      856      857       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

creydr · 2026-01-31T17:23:30Z

/test reconciler-tests

simkam · 2026-02-02T11:19:38Z

/lgtm

knative-prow · 2026-02-02T11:20:05Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: creydr, simkam

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [creydr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

creydr · 2026-02-02T11:41:30Z

Sorry, the test errors seem related :(
/hold

creydr · 2026-02-03T11:29:42Z

I did some auth-proxy refactoring in #8870. I think this is required for the tests, because this removes the need for redeploying the integrationsink deployment when the policy changes

creydr · 2026-02-03T11:57:16Z

Rebased on #8870 to see whole flow

creydr · 2026-02-03T12:30:14Z

I'll rebase when #8870 is in
/hold

fixed in knative#8867

The auth-proxy container was crashing with "required key SINK_URI missing value" due to a circular dependency in the reconciliation order. The deployment (with auth-proxy) was being created before the IntegrationSink status.Address was set, causing the auth-proxy to fail during startup. This commit fixes the issue by deriving the SINK_URI directly from the sink name and namespace (using network.GetServiceHostname()) instead of reading it from status.Address. This matches how the reconcileAddress() function constructs the URL, but without requiring the status to be set first. The same approach is now used for the SINK_AUDIENCE when OIDC authentication is enabled. This eliminates the circular dependency and ensures the auth-proxy always has a valid SINK_URI, regardless of reconciliation timing.

creydr · 2026-02-05T08:43:09Z

I'll rebase when #8870 is in /hold

#8870 merged.
Rebased this PR again

/unhold

creydr · 2026-02-05T10:46:29Z

@simkam can you recheck?

simkam · 2026-02-05T11:55:33Z

/lgtm

fixed in knative#8867

* Add probes to IntegrationSource deployments * Fix auth-proxy SINK_URI missing value error The auth-proxy container was crashing with "required key SINK_URI missing value" due to a circular dependency in the reconciliation order. The deployment (with auth-proxy) was being created before the IntegrationSink status.Address was set, causing the auth-proxy to fail during startup. This commit fixes the issue by deriving the SINK_URI directly from the sink name and namespace (using network.GetServiceHostname()) instead of reading it from status.Address. This matches how the reconcileAddress() function constructs the URL, but without requiring the status to be set first. The same approach is now used for the SINK_AUDIENCE when OIDC authentication is enabled. This eliminates the circular dependency and ensures the auth-proxy always has a valid SINK_URI, regardless of reconciliation timing. * Add readiness check to auth-proxy * Fix unit tests * Use same timings for auth-proxy probes

* Make auth-proxy query EventPolicies dynamically (knative#8870) * Make auth-proxy query EventPolicies dynamically IntegrationSink was baking EventPolicies into the AUTH_POLICIES env var, requiring deployment rollouts whenever policies changed. This caused test failures because old pods with stale policies continued serving traffic during RollingUpdate. Change auth-proxy to query EventPolicies dynamically using a namespace-scoped informer, similar to how Broker and Channel work. This eliminates deployment rollouts when EventPolicies change. - Add knative-eventing-eventpolicy-reader ClusterRole - Create namespace-scoped EventPolicy informer in auth-proxy - Add parent resource env vars to identify which resource to query policies for - Create RoleBinding in sink's namespace for EventPolicy access - Remove AUTH_POLICIES env var from deployment spec - Add test coverage for OIDC-enabled deployments with RoleBindings * Get resync period from context * Use rolebindingLister instead of kubeclient directly * Delete EventPolicy RBAC when OIDC gets disabled * Recreate subjectsWithFilters only on eventPolicy changes * Add probes to IntegrationSource & -Sink deployments (knative#8867) * Add probes to IntegrationSource deployments * Fix auth-proxy SINK_URI missing value error The auth-proxy container was crashing with "required key SINK_URI missing value" due to a circular dependency in the reconciliation order. The deployment (with auth-proxy) was being created before the IntegrationSink status.Address was set, causing the auth-proxy to fail during startup. This commit fixes the issue by deriving the SINK_URI directly from the sink name and namespace (using network.GetServiceHostname()) instead of reading it from status.Address. This matches how the reconcileAddress() function constructs the URL, but without requiring the status to be set first. The same approach is now used for the SINK_AUDIENCE when OIDC authentication is enabled. This eliminates the circular dependency and ensures the auth-proxy always has a valid SINK_URI, regardless of reconciliation timing. * Add readiness check to auth-proxy * Fix unit tests * Use same timings for auth-proxy probes

* [e2e tests] rename integrationsource_test.go to integrationsource_timer_test.go * [e2e tests] use more descriptive source name and sink name variables * [e2e tests] parametrize IntegrationSource type * [e2e tests] fix typos in IntegrationSource tests * [e2e-tests] add test for AWS S3 IntegrationSource * [e2e-tests] add test for AWS SQS IntegrationSource * [e2e-tests] add test for DynamoDB Stream IntegrationSource * [e2e-tests] integrationsource: move "trigger event" to Assert phase * [e2e tests] parametrize IntegrationSink type * [e2e-tests] add test for AWS S3 IntegrationSink * [e2e-tests] add test for AWS SQS IntegrationSink * [e2e-tests] add test for AWS SNS IntegrationSink * [e2e-tests] use long polling to eliminate empty receiveMessage calls for SQS * [e2e-tests] move AWS related code to single place * [e2e-tests] run AWS tests only with e2e_aws tag * [e2e-tests] update README for e2e rekt tests * [e2e-tests] use UUID as primary key for DynamoDB table * [e2e-tests] workaround delayed readiness of ddbstreams source * update-codegen * [e2e-tests] remove workaround for SRVKE-1834 fixed in #8867 * [e2e-tests] move sink/source code to reusable Feature Steps, improve setup and teardown cleanups

* [e2e tests] rename integrationsource_test.go to integrationsource_timer_test.go * [e2e tests] use more descriptive source name and sink name variables * [e2e tests] parametrize IntegrationSource type * [e2e tests] fix typos in IntegrationSource tests * [e2e-tests] add test for AWS S3 IntegrationSource * [e2e-tests] add test for AWS SQS IntegrationSource * [e2e-tests] add test for DynamoDB Stream IntegrationSource * [e2e-tests] integrationsource: move "trigger event" to Assert phase * [e2e tests] parametrize IntegrationSink type * [e2e-tests] add test for AWS S3 IntegrationSink * [e2e-tests] add test for AWS SQS IntegrationSink * [e2e-tests] add test for AWS SNS IntegrationSink * [e2e-tests] use long polling to eliminate empty receiveMessage calls for SQS * [e2e-tests] move AWS related code to single place * [e2e-tests] run AWS tests only with e2e_aws tag * [e2e-tests] update README for e2e rekt tests * [e2e-tests] use UUID as primary key for DynamoDB table * [e2e-tests] workaround delayed readiness of ddbstreams source * update-codegen * [e2e-tests] remove workaround for SRVKE-1834 fixed in knative#8867 * [e2e-tests] move sink/source code to reusable Feature Steps, improve setup and teardown cleanups

* [e2e tests] rename integrationsource_test.go to integrationsource_timer_test.go * [e2e tests] use more descriptive source name and sink name variables * [e2e tests] parametrize IntegrationSource type * [e2e tests] fix typos in IntegrationSource tests * [e2e-tests] add test for AWS S3 IntegrationSource * [e2e-tests] add test for AWS SQS IntegrationSource * [e2e-tests] add test for DynamoDB Stream IntegrationSource * [e2e-tests] integrationsource: move "trigger event" to Assert phase * [e2e tests] parametrize IntegrationSink type * [e2e-tests] add test for AWS S3 IntegrationSink * [e2e-tests] add test for AWS SQS IntegrationSink * [e2e-tests] add test for AWS SNS IntegrationSink * [e2e-tests] use long polling to eliminate empty receiveMessage calls for SQS * [e2e-tests] move AWS related code to single place * [e2e-tests] run AWS tests only with e2e_aws tag * [e2e-tests] update README for e2e rekt tests * [e2e-tests] use UUID as primary key for DynamoDB table * [e2e-tests] workaround delayed readiness of ddbstreams source * update-codegen * [e2e-tests] remove workaround for SRVKE-1834 fixed in knative#8867 * [e2e-tests] move sink/source code to reusable Feature Steps, improve setup and teardown cleanups Co-authored-by: Christoph Stäbler <cstabler@redhat.com>

creydr requested review from matzew and simkam January 30, 2026 12:53

knative-prow bot added approved Indicates a PR has been approved by an approver from all required OWNERS files. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jan 30, 2026

knative-prow bot requested review from Leo6Leo and aslom January 30, 2026 12:53

creydr changed the title ~~Add probes to IntegrationSource deployments~~ Add probes to IntegrationSource & -Sink deployments Jan 30, 2026

knative-prow bot assigned simkam Feb 2, 2026

knative-prow bot added the lgtm Indicates that a PR is ready to be merged. label Feb 2, 2026

simkam approved these changes Feb 2, 2026

View reviewed changes

knative-prow bot added do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. area/test-and-release Test infrastructure, tests or release and removed lgtm Indicates that a PR is ready to be merged. labels Feb 2, 2026

creydr mentioned this pull request Feb 3, 2026

Make auth-proxy query EventPolicies dynamically #8870

Merged

creydr force-pushed the add-probes-to-integrationsink-and-source-deployments branch from 4738e72 to bab60ce Compare February 3, 2026 11:56

knative-prow bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Feb 3, 2026

simkam added a commit to simkam/eventing that referenced this pull request Feb 3, 2026

[e2e-tests] remove workaround for SRVKE-1834

978b55f

fixed in knative#8867

simkam mentioned this pull request Feb 4, 2026

integrationsource/integrationsink AWS e2e tests #8849

Merged

creydr added 2 commits February 5, 2026 09:03

Add probes to IntegrationSource deployments

7faa6d3

creydr added 2 commits February 5, 2026 09:05

Add readiness check to auth-proxy

57b80be

Fix unit tests

633ae0b

creydr force-pushed the add-probes-to-integrationsink-and-source-deployments branch from bab60ce to 633ae0b Compare February 5, 2026 08:26

knative-prow bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Feb 5, 2026

Use same timings for auth-proxy probes

b5f7814

knative-prow bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Feb 5, 2026

knative-prow bot added the lgtm Indicates that a PR is ready to be merged. label Feb 5, 2026

knative-prow bot merged commit 8f777f5 into knative:main Feb 5, 2026
39 of 40 checks passed

simkam added a commit to simkam/eventing that referenced this pull request Feb 5, 2026

[e2e-tests] remove workaround for SRVKE-1834

e5fd9b4

fixed in knative#8867

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add probes to IntegrationSource & -Sink deployments#8867

Add probes to IntegrationSource & -Sink deployments#8867
knative-prow[bot] merged 5 commits intoknative:mainfrom
creydr:add-probes-to-integrationsink-and-source-deployments

creydr commented Jan 30, 2026

Uh oh!

creydr commented Jan 30, 2026

Uh oh!

codecov bot commented Jan 30, 2026 •

edited

Loading

Uh oh!

creydr commented Jan 31, 2026

Uh oh!

simkam commented Feb 2, 2026

Uh oh!

knative-prow bot commented Feb 2, 2026

Uh oh!

creydr commented Feb 2, 2026

Uh oh!

creydr commented Feb 3, 2026

Uh oh!

creydr commented Feb 3, 2026

Uh oh!

creydr commented Feb 3, 2026

Uh oh!

creydr commented Feb 5, 2026

Uh oh!

creydr commented Feb 5, 2026

Uh oh!

simkam commented Feb 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

creydr commented Jan 30, 2026

Uh oh!

creydr commented Jan 30, 2026

Uh oh!

codecov bot commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

creydr commented Jan 31, 2026

Uh oh!

simkam commented Feb 2, 2026

Uh oh!

knative-prow bot commented Feb 2, 2026

Uh oh!

creydr commented Feb 2, 2026

Uh oh!

creydr commented Feb 3, 2026

Uh oh!

creydr commented Feb 3, 2026

Uh oh!

creydr commented Feb 3, 2026

Uh oh!

creydr commented Feb 5, 2026

Uh oh!

creydr commented Feb 5, 2026

Uh oh!

simkam commented Feb 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov bot commented Jan 30, 2026 •

edited

Loading