Add default anti affinity

.ci/tests/integration/cases/python-function/manifests.yaml

@@ -8,8 +8,7 @@ spec:
   className: exclamation_function.ExclamationFunction
   forwardSourceMessageProperty: true
   maxPendingAsyncRequests: 1000
-  replicas: 1
-  maxReplicas: 1
+  replicas: 3
   logTopic: persistent://public/default/py-function-logs
   input:
     topics:

.ci/tests/integration/e2e_with_tls.yaml

@@ -31,7 +31,7 @@ setup:
         image="function-mesh-operator:latest"
         IMG=${image} make docker-build-skip-test
         kind load docker-image ${image}
-        helm install ${FUNCTION_MESH_RELEASE_NAME} -n ${FUNCTION_MESH_NAMESPACE} --set operatorImage=${image} --set controllerManager.globalBackendConfig=global-backend-config --set controllerManager.globalBackendConfigNamespace=${FUNCTION_MESH_NAMESPACE} --set controllerManager.namespacedBackendConfig=backend-config --create-namespace charts/function-mesh-operator
+        helm install ${FUNCTION_MESH_RELEASE_NAME} -n ${FUNCTION_MESH_NAMESPACE} --set operatorImage=${image} --set controllerManager.globalBackendConfig=global-backend-config --set controllerManager.globalBackendConfigNamespace=${FUNCTION_MESH_NAMESPACE} --set controllerManager.namespacedBackendConfig=backend-config --set controllerManager.addDefaultAffinity=false --create-namespace charts/function-mesh-operator
       wait:
         - namespace: function-mesh
           resource: pod

.ci/tests/kind.yaml

@@ -31,4 +31,10 @@ nodes:
         listenAddress: "127.0.0.1"
         # optional: set the protocol to one of TCP, UDP, SCTP.
         # TCP is the default
-        protocol: TCP
+        protocol: TCP
+
+  - role: worker
+    image: kindest/node:v1.23.17
+
+  - role: worker
+    image: kindest/node:v1.23.17

.github/workflows/bundle-release.yml

@@ -49,10 +49,10 @@ jobs:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Set up GO 1.24.2
+      - name: Set up GO 1.24.4
         uses: actions/setup-go@v1
         with:
-          go-version: 1.24.2
+          go-version: 1.24.4
         id: go
 
       - name: InstallKubebuilder
@@ -180,10 +180,10 @@ jobs:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Set up GO 1.24.2
+      - name: Set up GO 1.24.4
         uses: actions/setup-go@v1
         with:
-          go-version: 1.24.2
+          go-version: 1.24.4
         id: go
 
       - name: InstallKubebuilder

.github/workflows/olm-verify.yml

@@ -34,10 +34,10 @@ jobs:
       - name: checkout
         uses: actions/checkout@v2
 
-      - name: Set up GO 1.24.2
+      - name: Set up GO 1.24.4
         uses: actions/setup-go@v1
         with:
-          go-version: 1.24.2
+          go-version: 1.24.4
         id: go
 
       - name: InstallKubebuilder

.github/workflows/project.yml

@@ -18,7 +18,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go-version: [1.22.12, 1.24.2]
+        go-version: [1.22.12, 1.24.4]
     steps:
       - name: Free Disk Space (Ubuntu)
         uses: jlumbroso/free-disk-space@v1.3.0

.github/workflows/release.yml

@@ -37,10 +37,10 @@ jobs:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Set up GO 1.24.2
+      - name: Set up GO 1.24.4
         uses: actions/setup-go@v1
         with:
-          go-version: 1.24.2
+          go-version: 1.24.4
         id: go
 
       - name: InstallKubebuilder

.github/workflows/test-helm-charts.yml

@@ -83,11 +83,11 @@ jobs:
         run: hack/kind-cluster-build.sh --name chart-testing -c 1 -v 10 --k8sVersion v1.23.17
         if: steps.list-changed.outputs.changed == 'true'
 
-      - name: Set up GO 1.24.2
+      - name: Set up GO 1.24.4
         if: steps.list-changed.outputs.changed == 'true'
         uses: actions/setup-go@v1
         with:
-          go-version: 1.24.2
+          go-version: 1.24.4
         id: go
 
       - name: setup kubebuilder 3.6.0

.github/workflows/trivy.yml

@@ -34,10 +34,10 @@ jobs:
           repository: ${{github.event.pull_request.head.repo.full_name}}
           ref: ${{ github.event.pull_request.head.sha }}
 
-      - name: Set up GO 1.24.2
+      - name: Set up GO 1.24.4
         uses: actions/setup-go@v1
         with:
-          go-version: 1.24.2
+          go-version: 1.24.4
         id: go
 
       - name: InstallKubebuilder

.github/workflows/trivy_scheduled_master.yml

@@ -45,10 +45,10 @@ jobs:
           repository: ${{github.event.pull_request.head.repo.full_name}}
           ref: ${{ github.event.pull_request.head.sha }}
 
-      - name: Set up GO 1.24.2
+      - name: Set up GO 1.24.4
         uses: actions/setup-go@v1
         with:
-          go-version: 1.24.2
+          go-version: 1.24.4
         id: go
 
       - name: InstallKubebuilder

Dockerfile

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM golang:1.24.2-bullseye as builder
+FROM golang:1.24.4-bullseye as builder
 
 WORKDIR /workspace/api
 COPY api/ .

Makefile

@@ -72,7 +72,7 @@ test-ginkgo: generate fmt vet manifests envtest
 
 .PHONY: envtest
 envtest:
-	test -s $(LOCALBIN)/setup-envtest || GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.0.0-20240320141353-395cfc7486e6
+	test -s $(LOCALBIN)/setup-envtest || GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.0.0-20250630142431-4c2e9cec2954
 
 # Build manager binary
 manager: generate fmt vet

api/go.mod

@@ -1,6 +1,6 @@
 module github.com/streamnative/function-mesh/api
 
-go 1.24.2
+go 1.24.4
 
 require (
 	k8s.io/api v0.30.9

charts/function-mesh-operator/templates/controller-manager-deployment.yaml

@@ -65,6 +65,7 @@ spec:
           - --global-backend-config={{ .Values.controllerManager.globalBackendConfig }}
           - --global-backend-config-namespace={{ .Values.controllerManager.globalBackendConfigNamespace }}
           - --namespaced-backend-config={{ .Values.controllerManager.namespacedBackendConfig }}
+          - --add-default-affinity={{ .Values.controllerManager.addDefaultAffinity }}
         env:
           - name: NAMESPACE
             valueFrom:

charts/function-mesh-operator/values.yaml

@@ -73,6 +73,7 @@ controllerManager:
   globalBackendConfig: global-backend-config
   globalBackendConfigNamespace: default
   namespacedBackendConfig: backend-config
+  addDefaultAffinity: true
 
 admissionWebhook:
   enabled: true

controllers/spec/common.go

@@ -463,9 +463,10 @@ func makePodTemplate(container *corev1.Container, filebeatContainer *corev1.Cont
 	if filebeatContainer != nil {
 		containers = append(containers, *filebeatContainer)
 	}
+	mergedLabels := mergeMaps(labels, Configs.ResourceLabels, policy.Labels)
 	return &corev1.PodTemplateSpec{
 		ObjectMeta: metav1.ObjectMeta{
-			Labels:      mergeMaps(labels, Configs.ResourceLabels, policy.Labels),
+			Labels:      mergedLabels,
 			Annotations: generateAnnotations(Configs.ResourceAnnotations, policy.Annotations),
 		},
 		Spec: corev1.PodSpec{
@@ -474,7 +475,7 @@ func makePodTemplate(container *corev1.Container, filebeatContainer *corev1.Cont
 			TerminationGracePeriodSeconds: policy.TerminationGracePeriodSeconds,
 			Volumes:                       volumes,
 			NodeSelector:                  policy.NodeSelector,
-			Affinity:                      policy.Affinity,
+			Affinity:                      GenerateAffinity(policy.Affinity, mergedLabels),
 			Tolerations:                   policy.Tolerations,
 			SecurityContext:               podSecurityContext,
 			ImagePullSecrets:              policy.ImagePullSecrets,
@@ -483,6 +484,50 @@ func makePodTemplate(container *corev1.Container, filebeatContainer *corev1.Cont
 	}
 }
 
+func GenerateAffinity(affinity *corev1.Affinity, labels map[string]string) *corev1.Affinity {
+	if !utils.AddDefaultAffinity {
+		return affinity
+	}
+	if affinity == nil {
+		affinity = &corev1.Affinity{}
+	}
+	if affinity.PodAntiAffinity == nil {
+		affinity.PodAntiAffinity = &corev1.PodAntiAffinity{}
+	}
+
+	// add default pod anti-affinity rules to ensure replica pods doesn't run on the same node
+	if affinity.PodAntiAffinity.RequiredDuringSchedulingIgnoredDuringExecution == nil {
+		affinity.PodAntiAffinity.RequiredDuringSchedulingIgnoredDuringExecution = []corev1.PodAffinityTerm{}
+	}
+	affinity.PodAntiAffinity.RequiredDuringSchedulingIgnoredDuringExecution = append(
+		affinity.PodAntiAffinity.RequiredDuringSchedulingIgnoredDuringExecution,
+		corev1.PodAffinityTerm{
+			LabelSelector: &metav1.LabelSelector{
+				MatchLabels: labels,
+			},
+			TopologyKey: "kubernetes.io/hostname",
+		},
+	)
+
+	// add default pod anti-affinity rules to ensure replica pods prefer running in different zones
+	if affinity.PodAntiAffinity.PreferredDuringSchedulingIgnoredDuringExecution == nil {
+		affinity.PodAntiAffinity.PreferredDuringSchedulingIgnoredDuringExecution = []corev1.WeightedPodAffinityTerm{}
+	}
+	affinity.PodAntiAffinity.PreferredDuringSchedulingIgnoredDuringExecution = append(
+		affinity.PodAntiAffinity.PreferredDuringSchedulingIgnoredDuringExecution,
+		corev1.WeightedPodAffinityTerm{
+			Weight: 100,
+			PodAffinityTerm: corev1.PodAffinityTerm{
+				LabelSelector: &metav1.LabelSelector{
+					MatchLabels: labels,
+				},
+				TopologyKey: "topology.kubernetes.io/zone",
+			},
+		},
+	)
+	return affinity
+}
+
 func MakeJavaFunctionCommand(downloadPath, packageFile, name, clusterName, generateLogConfigCommand, logLevel, details, extraDependenciesDir, uid string,
 	memory *resource.Quantity, javaOpts []string, hasPulsarctl, hasWget, authProvided, tlsProvided bool, secretMaps map[string]v1alpha1.SecretRef,
 	state *v1alpha1.Stateful,

go.mod

@@ -1,6 +1,6 @@
 module github.com/streamnative/function-mesh
 
-go 1.24.2
+go 1.24.4
 
 require (
 	github.com/apache/pulsar-client-go v0.9.1-0.20230816081803-fbee610ddcbf

images/samples/go-function-samples/Dockerfile

@@ -1,5 +1,5 @@
 ARG PULSAR_IMAGE_TAG
-FROM golang:1.24.2-bullseye as builder
+FROM golang:1.24.4-bullseye as builder
 
 WORKDIR /workspace
 # Copy the Go Modules manifests

images/samples/go-function-samples/func/go.mod

@@ -1,6 +1,6 @@
 module github.com/apache/pulsar/pulsar-function-go/examples
 
-go 1.24.2
+go 1.24.4
 
 require github.com/apache/pulsar/pulsar-function-go v0.0.0-20250430085326-611dc3f360b5
 

main.go

@@ -79,6 +79,7 @@ func main() {
 	var globalBackendConfigNamespace string
 	var namespacedBackendConfig string
 	var secureMetrics bool
+	var addDefaultAffinity bool
 	flag.StringVar(&metricsAddr, "metrics-addr", lookupEnvOrString("METRICS_ADDR", ":8443"),
 		"The address the metric endpoint binds to.")
 	flag.StringVar(&leaderElectionID, "leader-election-id",
@@ -112,13 +113,16 @@ func main() {
 		"The backend config name used for functions&sinks&sources in the same namespace")
 	flag.BoolVar(&secureMetrics, "metrics-secure", true, "If set, the metrics endpoint is served securely via HTTPS."+
 		" Use --metrics-secure=false to use HTTP instead.")
+	flag.BoolVar(&addDefaultAffinity, "add-default-affinity", lookupEnvOrBool("ADD_DEFAULT_AFFINITY", true), "If set, the generated pod will add two default podAntiAffinities:"+
+		" one is make pods prefer to be in different zones (soft rule), and one is make pods must not be scheduled on the same node (hard rule).")
 	flag.Parse()
 
 	ctrl.SetLogger(zap.New(zap.UseDevMode(true)))
 	utils.EnableInitContainers = enableInitContainers
 	utils.GlobalBackendConfig = globalBackendConfig
 	utils.GlobalBackendConfigNamespace = globalBackendConfigNamespace
 	utils.NamespacedBackendConfig = namespacedBackendConfig
+	utils.AddDefaultAffinity = addDefaultAffinity
 
 	// enable pprof
 	if enablePprof {

redhat.Dockerfile

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM golang:1.24.2-bullseye as builder
+FROM golang:1.24.4-bullseye as builder
 
 WORKDIR /workspace/api
 COPY api/ .

utils/configs.go

@@ -22,3 +22,4 @@ var EnableInitContainers = false
 var GlobalBackendConfig = ""
 var GlobalBackendConfigNamespace = "default"
 var NamespacedBackendConfig = ""
+var AddDefaultAffinity = true