Support using separate Pulsar cluster as package service

.ci/tests/integration-oauth2/cases/java-download-function-with-package-service/manifests.yaml

@@ -0,0 +1,92 @@
+apiVersion: compute.functionmesh.io/v1alpha1
+kind: Function
+metadata:
+  name: function-download-sample-package-service
+  namespace: default
+spec:
+  image: streamnative/pulsar-functions-pulsarctl-java-runner:3.2.2.1
+  className: org.apache.pulsar.functions.api.examples.ExclamationFunction
+  forwardSourceMessageProperty: true
+  maxPendingAsyncRequests: 1000
+  replicas: 1
+  logTopic: persistent://public/default/logging-function-logs-package-service
+  logTopicAgent: sidecar
+  input:
+    topics:
+    - persistent://public/default/input-download-java-package-service-topic
+    typeClassName: java.lang.String
+  output:
+    topic: persistent://public/default/output-download-java-package-service-topic
+    typeClassName: java.lang.String
+  resources:
+    requests:
+      cpu: 50m
+      memory: 1G
+    limits:
+      cpu: "0.2"
+      memory: 1.1G
+  secretsMap:
+    "name":
+      path: "test-secret"
+      key: "username"
+    "pwd":
+      path: "test-secret"
+      key: "password"
+  pulsar:
+    pulsarConfig: "test-pulsar-runtime"
+    tlsConfig:
+      enabled: false
+      allowInsecure: false
+      hostnameVerification: true
+      certSecretName: sn-platform-tls-broker
+      certSecretKey: ""
+    authConfig:
+      oauth2Config:
+        audience: urn:sn:pulsar:sndev:test
+        issuerUrl: https://auth.sncloud-stg.dev/
+        keySecretName: sn-platform-oauth2-private-key
+        keySecretKey: auth.json
+  packageService:
+    pulsarConfig: "test-pulsar-package-service"
+    tlsConfig:
+      enabled: false
+      allowInsecure: false
+      hostnameVerification: true
+      certSecretName: sn-platform-tls-broker
+      certSecretKey: ""
+    authConfig:
+      oauth2Config:
+        audience: urn:sn:pulsar:sndev:test
+        issuerUrl: https://auth.sncloud-stg.dev/
+        keySecretName: sn-platform-oauth2-private-key
+        keySecretKey: auth.json
+  java:
+    jar: pulsar-functions-api-examples.jar
+    jarLocation: function://public/default/test-java-function
+  clusterName: test
+  autoAck: true
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-pulsar-runtime
+data:
+  webServiceURL: http://invalid-runtime-admin.default.svc.cluster.local:8080
+  brokerServiceURL: pulsar://sn-platform-pulsar-broker.default.svc.cluster.local:6650
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: test-pulsar-package-service
+data:
+  webServiceURL: http://sn-platform-pulsar-broker.default.svc.cluster.local:8080
+  brokerServiceURL: pulsar://sn-platform-pulsar-broker.default.svc.cluster.local:6650
+---
+apiVersion: v1
+data:
+  username: YWRtaW4=
+  password: MWYyZDFlMmU2N2Rm
+kind: Secret
+metadata:
+  name: test-secret
+type: Opaque

.ci/tests/integration-oauth2/cases/java-download-function-with-package-service/verify.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+set -e
+
+E2E_DIR=$(dirname "$0")
+BASE_DIR=$(cd "${E2E_DIR}"/../../../../..;pwd)
+PULSAR_NAMESPACE=${PULSAR_NAMESPACE:-"default"}
+PULSAR_RELEASE_NAME=${PULSAR_RELEASE_NAME:-"sn-platform"}
+E2E_KUBECONFIG=${E2E_KUBECONFIG:-"/tmp/e2e-k8s.config"}
+MANIFESTS_FILE="${BASE_DIR}"/.ci/tests/integration-oauth2/cases/java-download-function-with-package-service/manifests.yaml
+
+source "${BASE_DIR}"/.ci/helm.sh
+
+FUNCTION_NAME=function-download-sample-package-service
+STS_NAME=${FUNCTION_NAME}-function
+
+if [ ! "$KUBECONFIG" ]; then
+  export KUBECONFIG=${E2E_KUBECONFIG}
+fi
+
+kubectl apply -f "${MANIFESTS_FILE}" > /dev/null 2>&1
+
+verify_fm_result=$(ci::verify_function_mesh ${FUNCTION_NAME} 2>&1)
+if [ $? -ne 0 ]; then
+  echo "$verify_fm_result"
+  kubectl delete -f "${MANIFESTS_FILE}" > /dev/null 2>&1 || true
+  exit 1
+fi
+
+sts_yaml=$(kubectl get statefulset "${STS_NAME}" -o yaml 2>&1)
+echo "${sts_yaml}" | grep "prefix: PACKAGE_" > /dev/null 2>&1 || {
+  echo "packageService env prefix is not injected"
+  kubectl delete -f "${MANIFESTS_FILE}" > /dev/null 2>&1 || true
+  exit 1
+}
+echo "${sts_yaml}" | grep "name: test-pulsar-package-service" > /dev/null 2>&1 || {
+  echo "packageService configmap is not injected"
+  kubectl delete -f "${MANIFESTS_FILE}" > /dev/null 2>&1 || true
+  exit 1
+}
+echo "${sts_yaml}" | grep "/etc/oauth2-package-service" > /dev/null 2>&1 || {
+  echo "packageService oauth2 volume mount is not injected"
+  kubectl delete -f "${MANIFESTS_FILE}" > /dev/null 2>&1 || true
+  exit 1
+}
+
+verify_java_result=$(NAMESPACE=${PULSAR_NAMESPACE} CLUSTER=${PULSAR_RELEASE_NAME} ci::verify_exclamation_function_with_auth \
+  persistent://public/default/input-download-java-package-service-topic \
+  persistent://public/default/output-download-java-package-service-topic \
+  test-message test-message! 10 2>&1)
+if [ $? -ne 0 ]; then
+  echo "$verify_java_result"
+  kubectl delete -f "${MANIFESTS_FILE}" > /dev/null 2>&1 || true
+  exit 1
+fi
+
+verify_log_topic=$(ci::verify_log_topic_with_auth persistent://public/default/logging-function-logs-package-service "it is not a NAR file" 10 2>&1)
+if [ $? -ne 0 ]; then
+  echo "$verify_log_topic"
+  kubectl delete -f "${MANIFESTS_FILE}" > /dev/null 2>&1 || true
+  exit 1
+fi
+
+kubectl delete -f "${MANIFESTS_FILE}" > /dev/null 2>&1 || true
+echo "e2e-test: ok" | yq eval -

.ci/tests/integration-oauth2/e2e.yaml

@@ -131,6 +131,8 @@ verify:
       expected: expected.data.yaml
     - query: timeout 5m bash .ci/tests/integration-oauth2/cases/java-download-function/verify.sh
       expected: expected.data.yaml
+    - query: timeout 5m bash .ci/tests/integration-oauth2/cases/java-download-function-with-package-service/verify.sh
+      expected: expected.data.yaml
     - query: timeout 5m bash .ci/tests/integration-oauth2/cases/java-download-function-generic-auth/verify.sh
       expected: expected.data.yaml
     - query: timeout 5m bash .ci/tests/integration-oauth2/cases/py-download-function/verify.sh

.ci/tests/integration-oauth2/e2e_with_downloader.yaml

@@ -125,6 +125,8 @@ verify:
       expected: expected.data.yaml
     - query: timeout 5m bash .ci/tests/integration-oauth2/cases/java-download-function/verify.sh
       expected: expected.data.yaml
+    - query: timeout 5m bash .ci/tests/integration-oauth2/cases/java-download-function-with-package-service/verify.sh
+      expected: expected.data.yaml
     - query: timeout 5m bash .ci/tests/integration-oauth2/cases/java-download-function-generic-auth/verify.sh
       expected: expected.data.yaml
     - query: timeout 5m bash .ci/tests/integration-oauth2/cases/py-download-function/verify.sh

.github/workflows/bundle-release.yml

@@ -49,10 +49,10 @@ jobs:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Set up GO 1.24.11
+      - name: Set up GO 1.24.13
         uses: actions/setup-go@v5
         with:
-          go-version: 1.24.11
+          go-version: 1.24.13
         id: go
 
       - name: InstallKubebuilder
@@ -180,10 +180,10 @@ jobs:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Set up GO 1.24.11
+      - name: Set up GO 1.24.13
         uses: actions/setup-go@v5
         with:
-          go-version: 1.24.11
+          go-version: 1.24.13
         id: go
 
       - name: InstallKubebuilder

.github/workflows/olm-verify.yml

@@ -34,10 +34,10 @@ jobs:
       - name: checkout
         uses: actions/checkout@v2
 
-      - name: Set up GO 1.24.11
+      - name: Set up GO 1.24.13
         uses: actions/setup-go@v5
         with:
-          go-version: 1.24.11
+          go-version: 1.24.13
         id: go
 
       - name: InstallKubebuilder

.github/workflows/project.yml

@@ -18,7 +18,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go-version: [1.22.12, 1.24.11]
+        go-version: [1.22.12, 1.24.13]
     steps:
       - name: Free Disk Space (Ubuntu)
         uses: jlumbroso/free-disk-space@v1.3.0

.github/workflows/release.yml

@@ -37,10 +37,10 @@ jobs:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Set up GO 1.24.11
+      - name: Set up GO 1.24.13
         uses: actions/setup-go@v5
         with:
-          go-version: 1.24.11
+          go-version: 1.24.13
         id: go
 
       - name: InstallKubebuilder

.github/workflows/test-helm-charts.yml

@@ -83,11 +83,11 @@ jobs:
         run: hack/kind-cluster-build.sh --name chart-testing -c 1 -v 10 --k8sVersion v1.23.17
         if: steps.list-changed.outputs.changed == 'true'
 
-      - name: Set up GO 1.24.11
+      - name: Set up GO 1.24.13
         if: steps.list-changed.outputs.changed == 'true'
         uses: actions/setup-go@v5
         with:
-          go-version: 1.24.11
+          go-version: 1.24.13
         id: go
 
       - name: setup kubebuilder 3.6.0

.github/workflows/trivy.yml

@@ -57,10 +57,10 @@ jobs:
           repository: ${{github.event.pull_request.head.repo.full_name}}
           ref: ${{ github.event.pull_request.head.sha }}
 
-      - name: Set up GO 1.24.11
+      - name: Set up GO 1.24.13
         uses: actions/setup-go@v5
         with:
-          go-version: 1.24.11
+          go-version: 1.24.13
         id: go
 
       - name: InstallKubebuilder

.github/workflows/trivy_scheduled_master.yml

@@ -67,10 +67,10 @@ jobs:
           repository: ${{github.event.pull_request.head.repo.full_name}}
           ref: ${{ github.event.pull_request.head.sha }}
 
-      - name: Set up GO 1.24.11
+      - name: Set up GO 1.24.13
         uses: actions/setup-go@v5
         with:
-          go-version: 1.24.11
+          go-version: 1.24.13
         id: go
 
       - name: InstallKubebuilder

Dockerfile

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM golang:1.24.11-trixie as builder
+FROM golang:1.24.13-trixie as builder
 
 WORKDIR /workspace/api
 COPY api/ .

api/compute/v1alpha1/function_types.go

@@ -93,6 +93,9 @@ type FunctionSpec struct {
 
 	// +kubebuilder:validation:Required
 	Messaging `json:",inline"`
+	// PackageService is used for package download when specified.
+	// If empty, the package download falls back to Messaging.Pulsar.
+	PackageService *PulsarMessaging `json:"packageService,omitempty"`
 
 	// +kubebuilder:validation:Required
 	Runtime `json:",inline"`

api/compute/v1alpha1/sink_types.go

@@ -86,6 +86,9 @@ type SinkSpec struct {
 
 	// +kubebuilder:validation:Required
 	Messaging `json:",inline"`
+	// PackageService is used for package download when specified.
+	// If empty, the package download falls back to Messaging.Pulsar.
+	PackageService *PulsarMessaging `json:"packageService,omitempty"`
 	// +kubebuilder:validation:Required
 	Runtime `json:",inline"`
 

api/compute/v1alpha1/source_types.go

@@ -82,6 +82,9 @@ type SourceSpec struct {
 
 	// +kubebuilder:validation:Required
 	Messaging `json:",inline"`
+	// PackageService is used for package download when specified.
+	// If empty, the package download falls back to Messaging.Pulsar.
+	PackageService *PulsarMessaging `json:"packageService,omitempty"`
 
 	// +kubebuilder:validation:Required
 	Runtime `json:",inline"`

api/go.mod

@@ -1,6 +1,6 @@
 module github.com/streamnative/function-mesh/api
 
-go 1.24.11
+go 1.24.13
 
 require (
 	k8s.io/api v0.30.9