test: use bridge IP for WireGuard in CI

.dockerignore

@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-09-30T16:42:42Z by kres bc281a9.
+# Generated on 2025-10-17T13:27:48Z by kres 46e133d.
 
 *
 !frontend/src

.github/workflows/ci.yaml

@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-10-17T10:42:53Z by kres 46e133d.
+# Generated on 2025-10-17T13:27:48Z by kres 46e133d.
 
 concurrency:
   group: ${{ github.head_ref || github.run_id }}

Dockerfile

@@ -2,7 +2,7 @@
 
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-10-17T10:27:59Z by kres 46e133d.
+# Generated on 2025-10-17T13:27:48Z by kres 46e133d.
 
 ARG JS_TOOLCHAIN
 ARG TOOLCHAIN

hack/test/integration.sh

@@ -67,14 +67,19 @@ chown -R ${SUDO_USER:-$(whoami)} ${ARTIFACTS}
 
 # Determine the local IP SideroLink API will listen on
 LOCAL_IP=$(ip -o route get to 8.8.8.8 | sed -n 's/.*src \([0-9.]\+\).*/\1/p')
+WIREGUARD_IP=$LOCAL_IP
+
+if [[ "${CI:-false}" == "true" ]]; then
+  WIREGUARD_IP=172.20.0.1
+fi
 
 # Prepare schematic with kernel args
 KERNEL_ARGS_SCHEMATIC=$(
   cat <<EOF
 customization:
   extraKernelArgs:
-    - siderolink.api=grpc://$LOCAL_IP:8090?jointoken=${JOIN_TOKEN}
-    - talos.events.sink=[fdae:41e4:649b:9303::1]:8090
+    - siderolink.api=grpc://${WIREGUARD_IP}:8090?jointoken=${JOIN_TOKEN}
+    - talos.events.sink=[fdae:41e4:649b:9303::1]:8091
     - talos.logging.kernel=tcp://[fdae:41e4:649b:9303::1]:8092
   systemExtensions:
     officialExtensions:
@@ -181,8 +186,9 @@ services:
       endpoint: ${LOCAL_IP}:50180
       advertisedEndpoint: ${LOCAL_IP}:50180
     joinTokensMode: strict
+    eventSinkPort: 8091
   machineAPI:
-    endpoint: ${LOCAL_IP}:8090
+    endpoint: 0.0.0.0:8090
     advertisedURL: grpc://${LOCAL_IP}:8090
   workloadProxy:
     enabled: true
@@ -281,7 +287,7 @@ function prepare_partial_config() {
     cat <<EOF
 apiVersion: v1alpha1
 kind: SideroLinkConfig
-apiUrl: grpc://$LOCAL_IP:8090?jointoken=${JOIN_TOKEN}
+apiUrl: grpc://${LOCAL_IP}:8090?jointoken=${JOIN_TOKEN}
 ---
 apiVersion: v1alpha1
 kind: EventSinkConfig
@@ -299,15 +305,15 @@ EOF
   echo "${partial_config}" >"${partial_config_dir}/config.yaml"
 
   # Start a simple HTTP server to serve the partial config
-  python3 -m http.server $port --bind "$LOCAL_IP" --directory "$partial_config_dir" >/dev/null 2>&1 &
+  python3 -m http.server $port --bind "0.0.0.0" --directory "$partial_config_dir" >/dev/null 2>&1 &
   PARTIAL_CONFIG_SERVER_PID=$! # capture the PID to kill it in cleanup
 
   local schematic
   schematic=$(
     cat <<EOF
 customization:
   extraKernelArgs:
-    - talos.config=http://$LOCAL_IP:$port/config.yaml
+    - talos.config=http://${WIREGUARD_IP}:$port/config.yaml
   systemExtensions:
     officialExtensions:
       - siderolabs/hello-world-service
@@ -552,6 +558,7 @@ if [ "${INTEGRATION_RUN_E2E_TEST:-true}" == "true" ]; then
     nice -n 10 ${ARTIFACTS}/omni-linux-amd64 --config-path ${TEST_OUTPUTS_DIR}/e2e-config.yaml \
     --siderolink-wireguard-advertised-addr $LOCAL_IP:50180 \
     --siderolink-api-advertised-url "grpc://$LOCAL_IP:8090" \
+    --event-sink-port 8091 \
     --auth-auth0-enabled true \
     --auth-auth0-client-id "${AUTH0_CLIENT_ID}" \
     --auth-auth0-domain "${AUTH0_DOMAIN}" \

internal/backend/grpc/support.go

@@ -189,7 +189,7 @@ func (s *managementServer) collectLogs(machineID string) *collectors.Collector {
 		r, err := s.logHandler.GetReader(slink.MachineID(machineID), false, optional.None[int32]())
 		if err != nil {
 			if slink.IsBufferNotFoundError(err) {
-				return nil, nil
+				return []byte{}, nil
 			}
 
 			return nil, err

internal/backend/runtime/omni/controllers/omni/machine_request_set_status_test.go

@@ -260,24 +260,15 @@ func (suite *MachineRequestSetStatusSuite) reconcileLabels(ctx context.Context)
 
 				res := system.NewResourceLabels[*omni.MachineStatus](status.TypedSpec().Value.Id)
 
-				res.Metadata().Labels().Set(omni.LabelMachineRequest, status.Metadata().ID())
+				err = safe.StateModify(ctx, suite.state, res, func(r *system.ResourceLabels[*omni.MachineStatus]) error {
+					res.Metadata().Labels().Set(omni.LabelMachineRequest, status.Metadata().ID())
 
-				helpers.CopyAllLabels(status, res)
+					helpers.CopyAllLabels(status, r)
 
-				err = suite.state.Create(ctx, res)
+					return nil
+				})
 				if err != nil {
-					if !state.IsConflictError(err) {
-						return err
-					}
-
-					_, err = safe.StateUpdateWithConflicts(ctx, suite.state, res.Metadata(), func(r *system.ResourceLabels[*omni.MachineStatus]) error {
-						helpers.CopyAllLabels(status, r)
-
-						return nil
-					})
-					if err != nil {
-						return err
-					}
+					return err
 				}
 			}
 		}

internal/integration/maintenance_test.go

@@ -24,7 +24,7 @@ import (
 
 const testPatch = `apiVersion: v1alpha1
 kind: EventSinkConfig
-endpoint: '[fdae:41e4:649b:9303::1]:8090'`
+endpoint: '[fdae:41e4:649b:9303::1]:8091'`
 
 // AssertMaintenanceTestConfigIsPresent asserts that the test configuration is present on a machine in maintenance mode.
 func AssertMaintenanceTestConfigIsPresent(ctx context.Context, omniState state.State, cluster resource.ID, machineIndex int) TestFunc {

internal/integration/talos_test.go

@@ -852,11 +852,15 @@ func AssertTalosServiceIsRestarted(testCtx context.Context, cli *client.Client,
 // AssertSupportBundleContents tries to upgrade get Talos/Omni support bundle, and verifies that it has some contents.
 func AssertSupportBundleContents(testCtx context.Context, cli *client.Client, clusterName string) TestFunc {
 	return func(t *testing.T) {
-		ctx, cancel := context.WithTimeout(testCtx, 10*time.Second)
+		ctx, cancel := context.WithTimeout(testCtx, 30*time.Second)
 		defer cancel()
 
 		require := require.New(t)
 
+		// check that all machines have logs using Omni API
+		machines, err := safe.ReaderListAll[*omni.ClusterMachine](ctx, cli.Omni().State(), state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName)))
+		require.NoError(err)
+
 		progress := make(chan *management.GetSupportBundleResponse_Progress)
 
 		var eg errgroup.Group
@@ -906,10 +910,6 @@ func AssertSupportBundleContents(testCtx context.Context, cli *client.Client, cl
 		// check some resource that always exists
 		require.NotEmpty(readArchiveFile(fmt.Sprintf("omni/resources/Clusters.omni.sidero.dev-%s.yaml", clusterName)))
 
-		// check that all machines have logs
-		machines, err := safe.ReaderListAll[*omni.ClusterMachine](ctx, cli.Omni().State(), state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName)))
-		require.NoError(err)
-
 		machines.ForEach(func(cm *omni.ClusterMachine) {
 			require.NotEmpty(readArchiveFile(fmt.Sprintf("omni/machine-logs/%s.log", cm.Metadata().ID())))
 		})