build: update the Kubernetes client - #178

Summary

Updates io.kubernetes:client-java from 11.0.4 to 28.0.0 (Kubernetes 1.37), still on Spring Boot 2.7 and Java 21, and moves to SnakeYAML 2.

• Dependencies (pom.xml): the client, plus the libraries it needs in newer versions than Spring Boot 2.7 manages, set to those of the client's parent POM: SnakeYAML 2.7, OkHttp 5.5.0, Kotlin 2.1.21, Gson 2.14.0, Commons Lang 3.21.0, Commons Codec 1.23.0. The pins of protobuf-java, commons-io and commons-compress are dropped: the client resolves to the same versions (4.36.2, 2.22.0, 1.28.0). With refactor: use Spring Security's resource server #175 merged, spring-security-jwt and its Bouncy Castle *-jdk15on 1.70 jars are gone, so only the client's *-jdk18on 1.86 jars are on the classpath (no exclusion needed).
• Code: KubernetesClientWrapper and KubernetesObjectsSupplier use the client's request-builder API. The models use java.time instead of Joda-Time. ServiceInfoService passes LoaderOptions, which SnakeYAML 2 needs.
• Unknown fields (KubernetesJson): since version 20, the client's models refuse JSON with fields they don't know, so any object that a newer Kubernetes version extends would fail to read (kubernetes-client/java#4941). KubernetesClientConfig installs a Gson that ignores unknown fields, as client 11 and client-go do. TESK API only reads objects and creates or patches its own, so it loses nothing.
• Empty collections: the new models start with empty lists and maps. The executors' jobs in the taskmaster's input are written without them (GSON_WITHOUT_EMPTY_COLLECTIONS), as before. This matters because the taskmaster copies the requests to the limits only when limits is missing, so with limits: {} a task with ram_gb but no cpu_cores would have run without a memory limit (caught in review; regression test ramOnlyExecutorHasNoLimits). Objects that TESK API sends to Kubernetes directly do list empty fields, which Kubernetes treats as unset.
• Fix: the merge-patch client now keeps the Bearer prefix of a kubeconfig token. Before, patches (cancelling tasks) failed when TESK API ran outside a cluster with a token in its kubeconfig (regression test KubernetesClientConfigTest, which fails on 11.0.4).
• Creation time: a job without creationTimestamp (Kubernetes always sets one) now gives a task without creation_time. Joda printed the current time instead.
• Scan and Dependabot: the Trivy entry for CVE-2022-1471 (SnakeYAML 1.33) is gone, and so is the Dependabot hold on major versions of the client.
• Docs: deployment (client version, Kubernetes compatibility, empty fields), development (library versions to update with the client, KubernetesJson), upgrade notes.

Spring Boot stays on 2.7 (#168/#169 are separate). dev with #175 is merged in (no rebase): the pom.xml conflict is resolved by keeping neither the removed pins nor the spring-security-oauth2 pin, and the Bouncy Castle exclusion and its note in the development docs went with spring-security-oauth2-autoconfigure.

Closes #164

Verification

• ./mvnw verify on Java 21, after merging dev (refactor: use Spring Security's resource server #175): 18492 unit tests and 109 integration tests pass, and the JaCoCo coverage checks are met.

• ./mvnw spotless:check checkstyle:check on Java 8 passes.

• New tests:

  • KubernetesClientWrapperHttpTest runs the wrapper through a real client against WireMock and checks the query parameters, merge-patch bodies, pod logs, LimitRanges and errors.
  • KubernetesClientConfigTest covers the patch client's content type and token prefix.
  • KubernetesJsonTest covers unknown fields, missing required fields, times, Base64 data, the leaving out of empty collections, and the install.
  • TesKubernetesConverterMinimalTest adds ramOnlyExecutorHasNoLimits and fromK8sToTask_noCreationTime.
  • The converter tests keep their strict JSON assertions from dev.

• docker build succeeds. The image starts and answers GET /service-info. The fat jar holds snakeyaml-2.7.jar and no SnakeYAML 1.x, and only the *-jdk18on Bouncy Castle jars.

• CI: all checks pass (CI passed), including Test, Lint, Docs, Smoke test, and Scan image without the Trivy entry for SnakeYAML. CodeQL also passes.

• End to end on kind (v0.33.0, Kubernetes node image of that release), after merging dev: the PR image with the tesk-core 0.11.0 taskmaster and filer, in its own namespace, with the edit role for the API's and the taskmaster's service accounts. All three checks pass:

  1. A simple task (echo) reaches COMPLETE, and its stdout is in the FULL view.
  2. A ram-only task (ram_gb: 0.25, no cpu_cores): the executor pod has limits.memory = requests.memory = 268435456, and the task completes. This is the case of the review finding fixed above.
  3. Cancelling a running task: state CANCELED, the taskmaster job is labelled Cancelled, and the executor stops.

  The script is outside the repository (it has no end-to-end suite yet): tesk-api-e2e-kind.sh in the maintainer's work folder; it builds the image, creates a throwaway cluster with its own kubeconfig, and deletes the cluster at the end. The cluster is deleted.

• codecov/patch was at 98.76%: the read side of the new Gson adapter had no test; withoutEmptyCollectionsReads covers it now.

Declined review findings

• Quality review, low: the hard-coded "Kubernetes 1.37" claim in docs/deployment.md. Kept: the v28.0.0 release notes of the client state it, and the docs name version 28 next to it.

Open questions

None.

🤖 Generated with Claude Code

Summary by Sourcery

Upgrade the Kubernetes client and its supporting dependencies while preserving TESK’s Kubernetes compatibility and correcting authentication and serialization edge cases.

Bug Fixes:

• Preserve kubeconfig bearer-token prefixes for Kubernetes merge-patch requests.
• Avoid generating incorrect task limits and creation times when Kubernetes data is missing.

Enhancements:

• Upgrade the Kubernetes Java client to version 28 and align its required dependencies, including SnakeYAML 2.
• Support Kubernetes objects with unknown fields and maintain compatible handling of empty collections and Java time values.
• Update Kubernetes API integrations to the client’s request-builder interface.

Build:

• Update dependency management for the Kubernetes client and its required library versions, including removal of obsolete version overrides.

Documentation:

• Document Kubernetes client compatibility, serialization behavior, dependency maintenance, and upgrade impacts.

Tests:

• Add coverage for Kubernetes client HTTP requests, authentication, JSON handling, serialization compatibility, and conversion edge cases.

Chores:

• Remove the obsolete Dependabot hold for major Kubernetes client updates and the SnakeYAML vulnerability exception.