Increase pod replicas for each deployment to 2 (ACM)

[tobiscr]

Description

To ensure HA, we have to configure for each deployment at least 2 replicas

AC:

• Review the deployment(s) used by application connector module and configure at least 2 replicas for it.
• Ensure that the replicated nodes are distributed over 2 zones (configurable via Node-Anti-Affinity using zones as condition, see https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity)

[Disper]

Before making the new release, we want to merge library bumps, which was not done in a long time.
Following problematic PRs should be merged first:

• Update module istio.io/client-go to v1.25.1 #437
  • Integration tests are failing
    • Error: 56.24 /go/pkg/mod/sigs.k8s.io/[email protected]/pkg/metrics/leaderelection.go:26:71: undefined: leaderelection.SwitchMetric
    • I'm unable to run the integration tests locally with make -C hack/ci run-without-lifecycle-manager because of Makefile:209: *** Error: unsuported platform OS_TYPE: Darwin, OS_ARCH: arm64; to mitigate this problem set variable KYMA with absolute path to kyma-cli binary compatible with your operating system and architecture. Stop.
  • ACM build image is failing
  • security-checks / govuln
  • utils / golangci-lint
• Update module sigs.k8s.io/controller-runtime to v0.20.4 #438

Edit: we decided to skip those two Renovate PRs for now.

[Disper]

While working on this I've discovered that our pipelines are porting false positives in CRA/Gateway/Validator components:

• https://github.com/kyma-project/application-connector-manager/actions/runs/13958114755/job/39073973589?pr=462
• https://github.com/kyma-project/application-connector-manager/actions/runs/13958114758/job/39073972777?pr=462
• https://github.com/kyma-project/application-connector-manager/actions/runs/13958114757/job/39073972751?pr=462

I've confirmed that the issue can be reproduced locally with a simple make test in those components directories.

I checked some older commits

• git checkout 62ccf1f51506d90deeb6ecc970c8d1c0d7452417 (from Wed Nov 13 16:54:52 2024 +0100) - Failing 🔴
• git checkout dd78f57(fromThu Aug 15 18:26:54 2024 +0200`) - OK 🟢

[Disper]

I was bisecting the failing tests in validator and it seems that they're failing since September 2024 and this commit...

[Disper]

The Validator test failures are connected with following test cases.

• Removing those test cases makes the tests green
• Moving those test cases, makes other tests fail

		{
			caseDescription: "Application not managed by Compass Runtime Agent without group and tenant",
			certInfoHeader: `Hash=f4cf22fb633d4df500e371daf703d4b4d14a0ea9d69cd631f95f9e6ba840f8ad;Subject="CN=test-application,OU=OrgUnit,O=Organization,L=Waldorf,ST=Waldorf,C=DE";` +
				`URI=,By=spiffe://cluster.local/ns/kyma-system/sa/default;` +
				`Hash=6d1f9f3a6ac94ff925841aeb9c15bb3323014e3da2c224ea7697698acf413226;Subject="";` +
				`URI=spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account`,
			expectedStatus: http.StatusOK,
			application:    applicationNotManagedByCompass,
		},
		{
			caseDescription: "Application not managed by Compass Runtime Agent with group and tenant",
			certInfoHeader: `Hash=f4cf22fb633d4df500e371daf703d4b4d14a0ea9d69cd631f95f9e6ba840f8ad;Subject="CN=test-application,OU=group,O=tenant,L=Waldorf,ST=Waldorf,C=DE";` +
				`URI=,By=spiffe://cluster.local/ns/kyma-system/sa/default;` +
				`Hash=6d1f9f3a6ac94ff925841aeb9c15bb3323014e3da2c224ea7697698acf413226;Subject="";` +
				`URI=spiffe://cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account`,
			expectedStatus: http.StatusOK,
			application:    applicationNotManagedByCompass,
		},