e2e.yaml

name: e2e
on:
  pull_request:
  push:
    branches:
      - 'main'
      - 'release/**'
jobs:
  kind:
    runs-on: ubuntu-latest
    permissions:
      contents: read # for reading the repository code.
    steps:
      - name: Test suite setup
        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.11.0
        with:
          go-version: 1.26.x
      - name: Enable integration tests
        # Only run integration tests for main branch
        if: github.ref == 'refs/heads/main'
        run: |
          echo 'GO_TEST_ARGS=-tags integration' >> $GITHUB_ENV
      - name: Run controller tests
        env:
          TEST_AZURE_CLIENT_ID: ${{ secrets.TEST_AZURE_CLIENT_ID }}
          TEST_AZURE_TENANT_ID: ${{ secrets.TEST_AZURE_TENANT_ID }}
          TEST_AZURE_CLIENT_SECRET: ${{ secrets.TEST_AZURE_CLIENT_SECRET }}
          TEST_AZURE_VAULT_URL: ${{ secrets.TEST_AZURE_VAULT_URL }}
          TEST_AZURE_VAULT_KEY_NAME: ${{ secrets.TEST_AZURE_VAULT_KEY_NAME }}
          TEST_AZURE_VAULT_KEY_VERSION: ${{ secrets.TEST_AZURE_VAULT_KEY_VERSION }}
        run: make test
      - name: Check if working tree is dirty
        run: make verify
      - name: Build container image
        run: |
          make docker-build IMG=test/kustomize-controller:latest \
            BUILD_PLATFORMS=linux/amd64 \
            BUILD_ARGS="--load"
      - name: Load test image
        run: kind load docker-image test/kustomize-controller:latest
      - name: Install CRDs
        run: make install
      - name: Run default status test
        run: |
          kubectl apply -f config/testdata/status-defaults
          RESULT=$(kubectl get kustomization status-defaults -o go-template={{.status}})
          EXPECTED='map[observedGeneration:-1]'
          if [ "${RESULT}" != "${EXPECTED}" ] ; then
            echo -e "${RESULT}\n\ndoes not equal\n\n${EXPECTED}"
            exit 1
          fi
          kubectl delete -f config/testdata/status-defaults
      - name: Deploy controllers
        run: |
          make dev-deploy IMG=test/kustomize-controller:latest
          kubectl -n kustomize-system rollout status deploy/source-controller --timeout=1m
          kubectl -n kustomize-system rollout status deploy/kustomize-controller --timeout=1m
      - name: Run tests for removing kubectl managed fields
        run: |
          kubectl create ns managed-fields
          kustomize build github.com/stefanprodan/podinfo//kustomize?ref=6.3.5 > /tmp/podinfo.yaml
          kubectl -n managed-fields apply -f /tmp/podinfo.yaml
          kubectl -n managed-fields apply -f ./config/testdata/managed-fields
          kubectl -n managed-fields wait kustomization/podinfo --for=condition=ready --timeout=4m
          OUTDATA=$(kubectl -n managed-fields get deploy podinfo --show-managed-fields -oyaml)
          if echo "$OUTDATA" | grep -q "kubectl";then
            echo "kubectl client-side manager not removed"
            exit 1
          fi
          kubectl -n managed-fields apply --server-side --force-conflicts -f /tmp/podinfo.yaml
          kubectl -n managed-fields annotate --overwrite kustomization/podinfo reconcile.fluxcd.io/requestedAt="$(date +%s)"
          kubectl -n managed-fields wait kustomization/podinfo --for=condition=ready --timeout=4m
          OUTDATA=$(kubectl -n managed-fields get deploy podinfo --show-managed-fields -oyaml)
          if echo "$OUTDATA" | grep -q "kubectl";then
            echo "kubectl server-side manager not removed"
            exit 1
          fi
          kubectl delete ns managed-fields
      - name: Run overlays tests
        run: |
          kubectl -n kustomize-system apply -k ./config/testdata/overlays
          kubectl -n kustomize-system wait kustomizations/webapp-staging --for=condition=ready --timeout=4m
          kubectl -n kustomize-system wait kustomizations/webapp-production --for=condition=ready --timeout=4m
      - name: Run dependencies tests
        run: |
          kubectl -n kustomize-system apply -k ./config/testdata/dependencies
          kubectl -n kustomize-system wait kustomizations/common --for=condition=ready --timeout=4m
          kubectl -n kustomize-system wait kustomizations/backend --for=condition=ready --timeout=4m
          kubectl -n kustomize-system wait kustomizations/frontend --for=condition=ready --timeout=4m
      - name: Run impersonation tests
        run: |
          kubectl -n impersonation apply -f ./config/testdata/impersonation
          kubectl -n impersonation wait kustomizations/podinfo --for=condition=ready --timeout=4m
          kubectl -n impersonation delete kustomizations/podinfo
          until kubectl -n impersonation get deploy/podinfo 2>&1 | grep NotFound ; do sleep 2; done
      - name: Run OCI tests
        run: |
          kubectl create ns oci
          kubectl -n oci apply -f ./config/testdata/oci
          kubectl -n oci wait kustomizations/oci --for=condition=ready --timeout=4m
      - name: Logs
        if: always()
        continue-on-error: true
        run: |
          kubectl -n kustomize-system logs deploy/source-controller
          kubectl -n kustomize-system logs deploy/kustomize-controller
      - name: Debug failure
        if: failure()
        run: |
          kubectl -n kustomize-system get gitrepositories -oyaml
          kubectl -n kustomize-system get kustomizations -oyaml
          kubectl -n kustomize-system get all
          kubectl -n oci get ocirepository/oci -oyaml
          kubectl -n oci get kustomization/oci -oyaml
  sops-openbao:
    runs-on: ubuntu-latest
    permissions:
      contents: read # for reading the repository code.
    steps:
      - name: Test suite setup
        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.11.0
        with:
          go-version: 1.26.x
      - name: Setup SOPS
        uses: fluxcd/pkg/actions/sops@main
      - name: Setup Flux CLI
        uses: fluxcd/flux2/action@main
      - name: Build container image
        run: |
          make docker-build IMG=test/kustomize-controller:latest \
            BUILD_PLATFORMS=linux/amd64 \
            BUILD_ARGS="--load"
      - name: Run SOPS OpenBao/Vault multi-cluster e2e
        # Reuses the "kind" cluster the setup action created and adds a second one.
        run: hack/ci/sops-openbao-e2e.sh
        env:
          IMG: test/kustomize-controller:latest