update-kubernetes-versions.yml

name: Update Kubernetes Versions

on:
  schedule:
    # Run once daily at 6am UTC
    - cron: "0 6 * * *"

  workflow_dispatch: # Leaving this empty allows manual triggering without fields

permissions: {}

jobs:
  update-k8s-versions:
    timeout-minutes: 30
    name: Check for new Kubernetes version
    runs-on: ubuntu-latest
    permissions:
      id-token: write # Required for OIDC token from GitHub
    environment:
      name: main
    env:
      AWS_ACCOUNT_ID: ${{ vars.AWS_ACCOUNT_ID }}
      ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY }}
      ECR_REGION: ${{ vars.ECR_REGION }}
    steps:
      - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
        id: octo-sts
        with:
          scope: DataDog/datadog-agent
          policy: self.update-kubernetes-versions.create-pr

      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: true
          token: ${{ steps.octo-sts.outputs.token }}

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: '3.14'

      - name: Install dda
        uses: ./.github/actions/install-dda
        with:
          features: legacy-tasks

      - name: Install Python dependencies
        run: pip install requests==2.33.1 pyyaml==6.0.3 semver==3.0.4

      - name: Install kind
        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
        with:
          install_only: true

      - name: Fetch latest Kubernetes version
        id: fetch-versions
        run: |
          dda inv k8s-versions.fetch-versions

      - name: Build new Kubernetes images
        if: steps.fetch-versions.outputs.has_new_versions == 'true'
        id: build-images
        run: |
          dda inv kind-node-image.build-images --versions='${{ steps.fetch-versions.outputs.new_versions }}'

      - name: Configure AWS credentials
        if: steps.fetch-versions.outputs.has_new_versions == 'true' && steps.build-images.outputs.built_count > 0
        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
        with:
          role-to-assume: arn:aws:iam::${{ env.AWS_ACCOUNT_ID }}:role/datadog-agent-kind-image-publisher-oidc
          aws-region: us-east-1

      - name: Log in to AWS ECR
        if: steps.fetch-versions.outputs.has_new_versions == 'true' && steps.build-images.outputs.built_count > 0
        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
        with:
          registry: ${{ env.AWS_ACCOUNT_ID }}.dkr.ecr.${{ env.ECR_REGION }}.amazonaws.com

      - name: Tag and push new Kubernetes images to ECR
        if: steps.fetch-versions.outputs.has_new_versions == 'true' && steps.build-images.outputs.built_count > 0
        id: push-images
        env:
          ECR_REGISTRY: ${{ env.AWS_ACCOUNT_ID }}.dkr.ecr.${{ env.ECR_REGION }}.amazonaws.com
        run: |
          set -euo pipefail

          new_versions='${{ steps.fetch-versions.outputs.new_versions }}'

          # Capture the kind version used to build these images
          kind_version=$(kind version | awk '{print $2}')

          for image in ${{ steps.build-images.outputs.built_images }}; do
            tag="${image##*:}"
            ecr_image="$ECR_REGISTRY/$ECR_REPOSITORY:$tag"

            docker tag "$image" "$ecr_image"
            docker push "$ecr_image"

            # Get digest from local image after push
            digest=$(docker inspect --format='{{index .RepoDigests 0}}' "$ecr_image" | cut -d@ -f2)

            [ -n "$digest" ] || { echo "Error: Could not get digest for $tag"; exit 1; }

            # Append digest and kind_version into the new versions JSON
            # Must use the -c option (compact) to keep the jq output to a single-line
            new_versions=$(jq -c --arg tag "$tag" --arg digest "$digest" --arg kind_version "$kind_version" \
              '.[$tag].digest = $digest | .[$tag].kind_version = $kind_version' <<< "$new_versions")
          done

          echo "new_versions=$new_versions" >> "$GITHUB_OUTPUT"

      - name: Save new versions to file
        if: steps.push-images.conclusion == 'success'
        run: |
          VERSIONS='${{ steps.push-images.outputs.new_versions }}'
          dda inv k8s-versions.save-versions --versions="$VERSIONS"

      - name: Update kind_versions.json
        if: steps.push-images.conclusion == 'success'
        run: dda inv k8s-versions.update-kind-versions-file

      - name: Update e2e.yml with new version
        id: update-yaml
        if: steps.push-images.conclusion == 'success'
        run: |
          dda inv k8s-versions.update-e2e-yaml

      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        name: Create pull request
        if: steps.update-yaml.outputs.updated == 'true'
        with:
          commit-message: "chore(e2e): add new Kubernetes version to e2e tests"
          branch: update-k8s-versions-automated
          token: ${{ steps.octo-sts.outputs.token }}
          sign-commits: true
          title: "[automated] Update Kubernetes latest version in e2e tests"
          body: |
            ### What does this PR do?
            Updates the Kubernetes version used by the `new-e2e-containers-k8s-latest` job in `.gitlab/test/e2e/e2e.yml` to the latest stable release from `kindest/node`.

            ### Motivation
            Keep e2e tests running against the latest Kubernetes version to ensure compatibility.

            ### New version added:
            ${{ steps.update-yaml.outputs.new_versions }}

            ### Describe how you validated your changes
            CI will validate the new versions work correctly.
          team-reviewers: container-integrations
          labels: team/container-integrations,qa/done,changelog/no-changelog,ask-review