chore: First small step to HA

.devcontainer/Dockerfile

@@ -1,6 +1,6 @@
 # Multi-stage Dockerfile for GitOps Reverser
 # Stage 1: CI base image with essential build tools
-FROM golang:1.26.0-bookworm AS ci
+FROM golang:1.26.1-bookworm AS ci
 
 # Avoid warnings by switching to noninteractive
 ENV DEBIAN_FRONTEND=noninteractive
@@ -32,12 +32,18 @@ RUN apt-get update \
     && rm -rf /var/lib/apt/lists/*
 
 # Tool versions - centralized for easy updates
+# This devcontainer currently supports amd64 tool downloads only.
 ENV KUBECTL_VERSION=v1.35.0 \
     KUSTOMIZE_VERSION=5.8.1 \
     KUBEBUILDER_VERSION=4.11.1 \
     GOLANGCI_LINT_VERSION=v2.10.1 \
     HELM_VERSION=v4.0.0 \
-    K3D_VERSION=v5.8.3
+    K3D_VERSION=v5.8.3 \
+    FLUX_VERSION=2.8.0
+
+# Fail early on unsupported architectures instead of producing a partial image.
+RUN test "$(dpkg --print-architecture)" = "amd64" \
+    || (echo "This devcontainer currently supports amd64 only." && exit 1)
 
 # Install kubectl
 RUN curl -LO "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl" \
@@ -67,6 +73,11 @@ RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/i
 RUN curl -fsSL -o /usr/local/bin/k3d "https://github.com/k3d-io/k3d/releases/download/${K3D_VERSION}/k3d-linux-amd64" \
     && chmod +x /usr/local/bin/k3d
 
+# Install Flux CLI
+RUN curl -fsSL "https://github.com/fluxcd/flux2/releases/download/v${FLUX_VERSION}/flux_${FLUX_VERSION}_linux_amd64.tar.gz" \
+    | tar -xzO flux > /usr/local/bin/flux \
+    && chmod +x /usr/local/bin/flux
+
 # Set working directory
 WORKDIR /workspaces
 

.devcontainer/README.md

@@ -12,7 +12,7 @@ Quick-start development environment with all tools pre-installed.
 
 ### Verify
 ```bash
-go version        # 1.26.0
+go version        # 1.26.1
 kind version      # v0.30.0
 kubectl version   # v1.32.3
 golangci-lint version  # v2.4.0

.github/workflows/ci.yml

@@ -8,7 +8,7 @@ on:
     branches: [main, develop]
 
 env:
-  GO_VERSION: "1.26.0"
+  GO_VERSION: "1.26.1"
   REGISTRY: ghcr.io
   IMAGE_NAME: configbutler/gitops-reverser
   IMAGE_TAG: ci-${{ github.sha }}

Dockerfile

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM golang:1.26.0 AS builder
+FROM golang:1.26.1 AS builder
 
 # Automatic platform arguments provided by Docker BuildKit
 ARG TARGETOS

Makefile

@@ -269,6 +269,7 @@ dist/install.yaml: $(HELM_SYNC_OUTPUTS) $$(CHART_INPUTS) | dist ## Generate cons
 KUBECTL ?= kubectl
 K3D ?= k3d
 HELM ?= helm
+FLUX ?= flux
 KUSTOMIZE ?= kustomize
 CONTROLLER_GEN ?= controller-gen
 ENVTEST ?= setup-envtest
@@ -282,28 +283,17 @@ ENVTEST_K8S_VERSION ?= $(shell \
 )
 
 # Gitea E2E Configuration
-GITEA_NAMESPACE ?= gitea-e2e
-GITEA_RELEASE_NAME ?= gitea
-GITEA_HELM_REPO_NAME ?= gitea-charts
-GITEA_HELM_REPO_URL ?= https://dl.gitea.com/charts/
-GITEA_CHART_NAME ?= gitea
-# https://gitea.com/gitea/helm-gitea
-GITEA_CHART_VERSION ?= 12.5.0
-GITEA_WAIT_TIMEOUT ?= 300s
 GITEA_PORT ?= 13000
 PROMETHEUS_PORT ?= 19090
 
 # Valkey E2E Configuration
-VALKEY_NAMESPACE ?= valkey-e2e
-VALKEY_RELEASE_NAME ?= valkey
-VALKEY_HELM_REPO_NAME ?= valkey
-VALKEY_HELM_REPO_URL ?= https://valkey.io/valkey-helm
-VALKEY_CHART_NAME ?= valkey
-# https://valkey.io/valkey-helm/index.yaml
-VALKEY_CHART_VERSION ?= 0.9.3
-VALKEY_WAIT_TIMEOUT ?= 120s
 VALKEY_PORT ?= 16379
 
+FLUX_NAMESPACE ?= flux-system
+FLUX_WAIT_TIMEOUT ?= 300s
+FLUX_SERVICES_WAIT_TIMEOUT ?= 600s
+FLUX_SERVICES_DIR ?= test/e2e/setup/flux
+
 ENVTEST_STAMP = .stamps/envtest-$(ENVTEST_K8S_VERSION).ready
 
 .PHONY: setup-envtest
@@ -328,74 +318,53 @@ $(CS)/ready: test/e2e/cluster/start-cluster.sh | $(CS)
 	kubectl --context $(CTX) get ns >/dev/null
 	touch $@
 
-CERT_MANAGER_WAIT_TIMEOUT ?= 300s
-CERT_MANAGER_VERSION ?= v1.19.4
-CERT_MANAGER_MANIFEST_URL ?= https://github.com/cert-manager/cert-manager/releases/download/$(CERT_MANAGER_VERSION)/cert-manager.yaml
-$(CS)/cert-manager.installed: $(CS)/ready | $(CS)
-	kubectl --context $(CTX) apply -f $(CERT_MANAGER_MANIFEST_URL) | grep -v unchanged
-	kubectl --context $(CTX) -n cert-manager rollout status \
-		deploy/cert-manager \
-		--timeout=$(CERT_MANAGER_WAIT_TIMEOUT)
-	kubectl --context $(CTX) -n cert-manager rollout status \
-		deploy/cert-manager-webhook \
-		--timeout=$(CERT_MANAGER_WAIT_TIMEOUT)
-	kubectl --context $(CTX) -n cert-manager rollout status \
-		deploy/cert-manager-cainjector \
-		--timeout=$(CERT_MANAGER_WAIT_TIMEOUT)
-	echo $(CERT_MANAGER_VERSION) > $@
-
-$(CS)/gitea.installed: $(CS)/ready test/e2e/gitea-values.yaml | $(CS)
-	$(HELM) repo add $(GITEA_HELM_REPO_NAME) $(GITEA_HELM_REPO_URL) 2>/dev/null || true
-	$(HELM) repo update $(GITEA_HELM_REPO_NAME)
-	kubectl --context $(CTX) create namespace $(GITEA_NAMESPACE) --dry-run=client -o yaml \
-		| kubectl --context $(CTX) apply -f -
-	$(HELM) --kube-context $(CTX) upgrade --install $(GITEA_RELEASE_NAME) \
-		$(GITEA_HELM_REPO_NAME)/$(GITEA_CHART_NAME) \
-		--namespace $(GITEA_NAMESPACE) \
-		--version $(GITEA_CHART_VERSION) \
-		--values test/e2e/gitea-values.yaml
-	kubectl --context $(CTX) -n $(GITEA_NAMESPACE) rollout status \
-		deploy/$(GITEA_RELEASE_NAME) \
-		--timeout=$(GITEA_WAIT_TIMEOUT)
-	echo $(GITEA_CHART_VERSION) > $@
-
-PROMETHEUS_SETUP_MANIFESTS = $(shell find test/e2e/setup/prometheus -type f -name '*.yaml')
-$(CS)/prometheus.installed: $(CS)/ready hack/e2e/ensure-prometheus-operator.sh $$(PROMETHEUS_SETUP_MANIFESTS) | $(CS)
-	export KUBECONTEXT=$(CTX)
-	bash hack/e2e/ensure-prometheus-operator.sh
+FLUX_SERVICES_INPUTS = $(shell find $(FLUX_SERVICES_DIR) -type f)
+LAST_STEP_MANIFESTS_DIR = test/e2e/setup/manifests
+LAST_STEP_MANIFESTS = $(shell find $(LAST_STEP_MANIFESTS_DIR) -type f -name '*.yaml')
+FLUX_SETUP_READY_INPUTS = $(CS)/flux.installed $$(FLUX_SERVICES_INPUTS)
+SERVICES_READY_INPUTS = $(CS)/flux-setup.ready $$(LAST_STEP_MANIFESTS)
+$(CS)/flux.installed: $(CS)/ready | $(CS)
+	$(FLUX) install --context $(CTX) --namespace $(FLUX_NAMESPACE)
+	kubectl --context $(CTX) -n $(FLUX_NAMESPACE) wait \
+		deployment \
+		-l app.kubernetes.io/part-of=flux \
+		--for=condition=Available \
+		--timeout=$(FLUX_WAIT_TIMEOUT)
 	kubectl --context $(CTX) wait --for=condition=Established \
-		crd/prometheuses.monitoring.coreos.com \
-		crd/servicemonitors.monitoring.coreos.com \
-		--timeout=180s
-	kubectl --context $(CTX) apply -n prometheus-operator -f test/e2e/setup/prometheus
-	kubectl --context $(CTX) wait --for=condition=Available \
-		prometheus/prometheus-shared-e2e \
-		-n prometheus-operator \
-		--timeout=180s
-	kubectl --context $(CTX) wait --for=condition=ready \
-		pod \
-		-l prometheus=prometheus-shared-e2e \
-		-n prometheus-operator \
-		--timeout=180s
+		crd/helmrepositories.source.toolkit.fluxcd.io \
+		crd/helmreleases.helm.toolkit.fluxcd.io \
+		--timeout=$(FLUX_WAIT_TIMEOUT)
+	$(FLUX) version --client > $@
+
+# Aggregate stamp for Flux-managed external E2E services required by tests.
+.SILENT: $(CS)/flux-setup.ready $(CS)/services.ready
+$(CS)/flux-setup.ready: $(FLUX_SETUP_READY_INPUTS) | $(CS)
+	kubectl --context $(CTX) apply -k $(FLUX_SERVICES_DIR)
+	flux_ready_count=0
+	echo "⏳ Waiting for Flux-managed installations to become ready..."
+	for kind in \
+		helmreleases.helm.toolkit.fluxcd.io \
+		kustomizations.kustomize.toolkit.fluxcd.io
+	do
+		resources="$$(kubectl --context $(CTX) get $$kind --all-namespaces -o jsonpath='{range .items[*]}{.metadata.namespace}{" "}{.metadata.name}{"\n"}{end}' 2>/dev/null)"
+		[ -z "$$resources" ] && continue
+
+		resource_count="$$(printf '%s\n' "$$resources" | sed '/^$$/d' | wc -l | tr -d ' ')"
+		flux_ready_count="$$(($$flux_ready_count + $$resource_count))"
+
+		printf '%s\n' "$$resources" | while read -r namespace name; do
+			[ -n "$$namespace" ] || continue
+			kubectl --context $(CTX) -n "$$namespace" wait "$$kind/$$name" --for=condition=Ready --timeout=$(FLUX_SERVICES_WAIT_TIMEOUT)
+		done
+	done
+	[ "$$flux_ready_count" -gt 0 ] || { echo "ERROR: no Flux-managed e2e ready-check resources found" >&2; exit 1; }
+	echo "✓ Flux-managed installations ready: $$flux_ready_count"
 	touch $@
 
-$(CS)/valkey.installed: $(CS)/ready test/e2e/valkey-values.yaml | $(CS)
-	$(HELM) repo add $(VALKEY_HELM_REPO_NAME) $(VALKEY_HELM_REPO_URL) 2>/dev/null || true
-	$(HELM) repo update $(VALKEY_HELM_REPO_NAME)
-	kubectl --context $(CTX) create namespace $(VALKEY_NAMESPACE) --dry-run=client -o yaml \
-		| kubectl --context $(CTX) apply -f -
-	$(HELM) --kube-context $(CTX) upgrade --install $(VALKEY_RELEASE_NAME) \
-		$(VALKEY_HELM_REPO_NAME)/$(VALKEY_CHART_NAME) \
-		--namespace $(VALKEY_NAMESPACE) \
-		--version $(VALKEY_CHART_VERSION) \
-		--values test/e2e/valkey-values.yaml
-	kubectl --context $(CTX) -n $(VALKEY_NAMESPACE) rollout status \
-		deploy/$(VALKEY_RELEASE_NAME) \
-		--timeout=$(VALKEY_WAIT_TIMEOUT)
-	echo $(VALKEY_CHART_VERSION) > $@
-
 # Aggregate stamp for external E2E services required by tests.
-$(CS)/services.ready: $(CS)/cert-manager.installed $(CS)/prometheus.installed $(CS)/gitea.installed $(CS)/valkey.installed
+$(CS)/services.ready: $(SERVICES_READY_INPUTS) | $(CS)
+	kubectl --context $(CTX) wait --for=condition=Established crd/prometheuses.monitoring.coreos.com crd/servicemonitors.monitoring.coreos.com --timeout=180s
+	kubectl --context $(CTX) apply -R -f $(LAST_STEP_MANIFESTS_DIR)
 	touch $@
 
 # Step 1: Generate age key file — no cluster/namespace dependency; safe to run before installation.
@@ -584,6 +553,14 @@ test-e2e-quickstart-helm: ## Run quickstart smoke test (Helm install)
 	export E2E_AGE_KEY_FILE=$(CS)/age-key.txt
 	go test ./test/e2e/ -v -ginkgo.v -ginkgo.label-filter=quickstart-framework
 
+.PHONY: test-e2e-audit-redis
+test-e2e-audit-redis: ## Run dedicated audit->Redis enqueue e2e scenario
+	export CTX=$(CTX)
+	export INSTALL_MODE=$(INSTALL_MODE)
+	export NAMESPACE=$(NAMESPACE)
+	export E2E_AGE_KEY_FILE=$(CS)/age-key.txt
+	go test ./test/e2e/ -v -ginkgo.v -ginkgo.label-filter=audit-redis
+
 .PHONY: test-e2e-quickstart-manifest
 test-e2e-quickstart-manifest: ## Run quickstart smoke test (manifest install)
 	export CTX=$(CTX)