FIPS conformance tests #61
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: FIPS conformance tests | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'Flux version' | |
| required: false | |
| schedule: | |
| - cron: '00 8 * * 1' | |
| push: | |
| branches: | |
| - 'release-*' | |
| - 'test-*' | |
| tags-ignore: | |
| - '*' | |
| permissions: | |
| contents: read | |
| jobs: | |
| kind: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| variant: | |
| - distroless | |
| kubernetes: | |
| - v1.24.17 | |
| - v1.25.16 | |
| - v1.26.15 | |
| - v1.27.15 | |
| - v1.28.11 | |
| - v1.29.6 | |
| - v1.30.2 | |
| - v1.31.0 | |
| - v1.32.0 | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Latest release | |
| id: release | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| VERSION=$(gh release view --json tagName -q '.tagName') | |
| branch=${{ github.ref_name }} | |
| prefix="release-" | |
| if [[ "${branch}" =~ ^$prefix.* ]]; then | |
| VERSION=${branch#"$prefix"} | |
| fi | |
| if [ "${{ github.event.inputs.version }}" != "" ]; then | |
| VERSION="${{ github.event.inputs.version }}" | |
| fi | |
| echo "version=${VERSION}" >> $GITHUB_OUTPUT | |
| - name: Setup Flux | |
| uses: fluxcd/flux2/action@5350425cdcd5fa015337e09fa502153c0275bd4b #v2.4.0 | |
| with: | |
| version: ${{ steps.release.outputs.version }} | |
| - name: Setup Kubernetes | |
| uses: helm/kind-action@ae94020eaf628e9b9b9f341a10cc0cdcf5c018fb # v1.11.0 | |
| with: | |
| cluster_name: flux | |
| version: v0.23.0 | |
| node_image: ghcr.io/fluxcd/kindest/node:${{ matrix.kubernetes }}-amd64 | |
| - name: Install Flux | |
| shell: bash | |
| run: | | |
| kubectl create ns flux-system | |
| flux create secret oci flux-enterprise-auth \ | |
| --url=ghcr.io \ | |
| --username=${{ github.actor }} \ | |
| --password=${{ secrets.GHCR_READONLY }} | |
| flux install \ | |
| --components-extra="image-reflector-controller,image-automation-controller" \ | |
| --registry=ghcr.io/controlplaneio-fluxcd/${{ matrix.variant }} \ | |
| --image-pull-secret=flux-enterprise-auth | |
| - name: Verify images | |
| run: kubectl -n flux-system get deployments.apps -o yaml | grep ${{ matrix.variant }} | |
| - name: Setup cluster reconciliation | |
| env: | |
| FLUX_VERSION: ${{ steps.release.outputs.version }} | |
| shell: bash | |
| run: | | |
| flux create source git flux-system \ | |
| --url=${{ github.event.repository.html_url }} \ | |
| --branch=${{ github.ref_name }} \ | |
| --username=${GITHUB_ACTOR} \ | |
| --password=${{ secrets.GITHUB_TOKEN }} \ | |
| --ignore-paths="clusters/**/flux-system/" | |
| flux create kustomization flux-system \ | |
| --source=flux-system \ | |
| --path=./tests/${FLUX_VERSION:0:4}/clusters/kind | |
| - name: Verify cluster reconciliation | |
| run: | | |
| kubectl -n flux-system wait kustomization/sources --for=condition=ready --timeout=2m | |
| kubectl -n flux-system wait kustomization/appliers --for=condition=ready --timeout=2m | |
| - name: Verify managed resources | |
| run: | | |
| flux tree kustomization flux-system | |
| - name: Debug failure | |
| if: failure() | |
| run: | | |
| kubectl -n flux-system get all | |
| kubectl -n flux-system logs deploy/source-controller | |
| kubectl -n flux-system logs deploy/kustomize-controller | |
| kubectl -n flux-system logs deploy/helm-controller | |
| flux get all --all-namespaces |