e2e-fips.yaml

name: FIPS conformance tests
on:
  workflow_dispatch:
    inputs:
      version:
        description: 'Flux version'
        required: false
  schedule:
    - cron: '00 8 * * 1'
  push:
    branches:
      - 'release-*'
      - 'test-*'
    tags-ignore:
      - '*'

permissions:
  contents: read

jobs:
  kind:
    strategy:
      fail-fast: false
      matrix:
        variant:
          - distroless
        kubernetes:
          - v1.24.17
          - v1.25.16
          - v1.26.15
          - v1.27.15
          - v1.28.11
          - v1.29.6
          - v1.30.2
          - v1.31.0
          - v1.32.0
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Latest release
        id: release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          VERSION=$(gh release view --json tagName -q '.tagName')
          
          branch=${{ github.ref_name }}
          prefix="release-"
          if [[ "${branch}" =~ ^$prefix.*  ]]; then
            VERSION=${branch#"$prefix"}
          fi
          
          if [ "${{ github.event.inputs.version }}" != "" ]; then
            VERSION="${{ github.event.inputs.version }}"
          fi
          
          echo "version=${VERSION}" >> $GITHUB_OUTPUT
      - name: Setup Flux
        uses: fluxcd/flux2/action@5350425cdcd5fa015337e09fa502153c0275bd4b #v2.4.0
        with:
          version: ${{ steps.release.outputs.version }}
      - name: Setup Kubernetes
        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
        with:
          cluster_name: flux
          version: v0.23.0
          node_image: ghcr.io/fluxcd/kindest/node:${{ matrix.kubernetes }}-amd64
      - name: Install Flux
        shell: bash
        run: |
          kubectl create ns flux-system
          
          flux create secret oci flux-enterprise-auth \
          --url=ghcr.io \
          --username=${{ github.actor }} \
          --password=${{ secrets.GHCR_READONLY }}
          
          flux install \
          --components-extra="image-reflector-controller,image-automation-controller" \
          --registry=ghcr.io/controlplaneio-fluxcd/${{ matrix.variant }} \
          --image-pull-secret=flux-enterprise-auth
      - name: Verify images
        run: kubectl -n flux-system get deployments.apps -o yaml | grep ${{ matrix.variant }}
      - name: Setup cluster reconciliation
        env:
          FLUX_VERSION: ${{ steps.release.outputs.version }}
        shell: bash
        run: |
          flux create source git flux-system \
          --url=${{ github.event.repository.html_url }} \
          --branch=${{ github.ref_name }} \
          --username=${GITHUB_ACTOR} \
          --password=${{ secrets.GITHUB_TOKEN }} \
          --ignore-paths="clusters/**/flux-system/"
          flux create kustomization flux-system \
          --source=flux-system \
          --path=./tests/${FLUX_VERSION:0:4}/clusters/kind
      - name: Verify cluster reconciliation
        run: |
          kubectl -n flux-system wait kustomization/sources --for=condition=ready --timeout=2m
          kubectl -n flux-system wait kustomization/appliers --for=condition=ready --timeout=2m
      - name: Verify managed resources
        run: |
          flux tree kustomization flux-system
      - name: Debug failure
        if: failure()
        run: |
          kubectl -n flux-system get all
          kubectl -n flux-system logs deploy/source-controller
          kubectl -n flux-system logs deploy/kustomize-controller
          kubectl -n flux-system logs deploy/helm-controller
          flux get all --all-namespaces