[ci] Fix systemtests CRB creation and bump Java for testsuite

debezium-testing/debezium-testing-system/README.md

@@ -66,6 +66,8 @@ Prepare namespace and pull secret for the testsuite
     --from-file=.dockercfg=<path/to/.dockercfg> \
     --type=kubernetes.io/dockercfg \
     -n debezium-testsuite
+    oc secrets link default <secret_name> --for=pull
+    oc secrets link builder <secret_name> --for=pull
 ```
 
 Edit Pod template

debezium-testing/debezium-testing-system/src/test/java/io/debezium/testing/system/listeners/NamespacePreparationListener.java

@@ -13,6 +13,9 @@
 import java.util.List;
 import java.util.concurrent.TimeUnit;
 
+import io.fabric8.kubernetes.client.dsl.Listable;
+import io.fabric8.openshift.api.model.ClusterRoleBinding;
+import io.fabric8.openshift.api.model.ClusterRoleBindingList;
 import org.junit.platform.launcher.TestExecutionListener;
 import org.junit.platform.launcher.TestPlan;
 import org.slf4j.Logger;
@@ -74,8 +77,22 @@ private void prepareNamespaces() {
         }
 
         waitForDefaultServiceAccount();
-        client.clusterRoleBindings().createOrReplace(anyUidBindingBuilder.build());
+        ClusterRoleBindingList clusterRoleBindings = client.clusterRoleBindings().list();
-        client.clusterRoleBindings().createOrReplace(privilegedBindingBuilder.build());
+        ClusterRoleBinding anyuid = anyUidBindingBuilder.build();
+        ClusterRoleBinding priviledged = privilegedBindingBuilder.build();
+        if (clusterRoleBindings.getItems().stream().anyMatch(clr ->
+                clr.getMetadata().getName().equals(anyuid.getMetadata().getName()))) {
+            client.resource(anyuid).update();
+        } else {
+            client.resource(anyuid).create();
+        }
+
+        if (clusterRoleBindings.getItems().stream().anyMatch(clr ->
+                clr.getMetadata().getName().equals(priviledged.getMetadata().getName()))) {
+            client.resource(priviledged).update();
+        } else {
+            client.resource(priviledged).create();
+        }
     }
 
     private void waitForDefaultServiceAccount() {
@@ -99,12 +116,11 @@ private void processNamespace(String namespace, ClusterRoleBindingBuilder anyuid
     }
 
     private void addServiceAccountToClusterRoleBinding(String saNamespace, ClusterRoleBindingBuilder bindingBuilder) {
-        bindingBuilder.addNewSubjectLike(new ObjectReferenceBuilder()
+        bindingBuilder.addToSubjects(new ObjectReferenceBuilder()
-                .withKind("SystemUser")
+                .withKind("ServiceAccount")
                 .withName("default")
                 .withNamespace(saNamespace)
                 .build());
-        bindingBuilder.withUserNames("system:serviceaccount:" + saNamespace + ":default");
     }
 
     /**

debezium-testing/debezium-testing-system/src/test/resources/docker/Dockerfile

@@ -1,4 +1,4 @@
-FROM fedora:35 AS base
+FROM fedora:40 AS base
 
 RUN dnf -y install git unzip zip findutils rsync
 
@@ -10,8 +10,10 @@ ARG sdkman_init="/root/.sdkman/bin/sdkman-init.sh"
 
 RUN curl -s "https://get.sdkman.io" | bash
 RUN source $sdkman_init &&\
-    sdk install java 17.0.2-open &&\
+    sdk install java 21.0.3-tem
-    sdk install maven
+
+RUN source $sdkman_init &&\
+    sdk install java 21.0.3-tem
 
 RUN mkdir /root/testsuite
 COPY testsuite.sh /root/testsuite/testsuite.sh