feat(ci): add Kubernetes compatibility matrix by slaskawi · Pull Request #2948 · defenseunicorns/uds-core

slaskawi · 2026-09-09T07:27:47Z

Description

Adds the initial K3s compatibility matrix for exact K3s releases v1.34.4+k3s1 and v1.35.8+k3s1 across all supported flavors. The workflow runs nightly, on release-please and matrix changes, and supports manual version/flavor subsets.

Related Issue

Relates to #675

Type of change

New feature (non-breaking change which adds functionality)

Steps to Validate

yamllint .github/kubernetes-test-matrix.yaml .github/workflows/test-kubernetes-matrix.yaml .github/workflows/test.yaml tasks/setup.yaml tasks/test.yaml tasks/lint.yaml -c .yamllint --no-warnings
git diff --check
Verify the PR-triggered six-cell Kubernetes Compatibility matrix, followed by one-cell and selected-subset manual dispatches.

Checklist before merging

Test, docs, adr added or updated as needed
Contributor Guide followed

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com>

slaskawi · 2026-09-09T09:15:37Z

@codex review

slaskawi · 2026-09-09T09:15:43Z

@greptileai review

chatgpt-codex-connector · 2026-09-09T09:15:53Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-09T09:20:08.688839Z	`65e9c61`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

greptile-apps · 2026-09-09T09:18:44Z

Confidence Score: 4/5

The PR appears safe to merge after considering one non-blocking least-privilege hardening opportunity around reusable-workflow secrets.

Findings

Secrets are inherited broadly ▶

Summary

Threads exact K3s versions through the reusable test workflow and UDS task hierarchy.
Validates requested versions, flavors, image architectures, and deployed server versions.
Keeps the documented compatibility table aligned with CI configuration.
Adds Renovate configuration for same-minor K3s matrix updates.
Introduces an avoidable broad secret boundary between the matrix and reusable test workflows.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Schedule, PR, or manual dispatch] --> B[Prepare matrix]
  B --> C[Validate K3s versions and flavors]
  C --> D[Verify amd64 and arm64 image manifests]
  D --> E{Version × flavor matrix}
  E --> F[Reusable test workflow]
  F --> G[Build UDS Core package]
  G --> H[Deploy requested uds-k3d image]
  H --> I[Verify K3s server version]
  I --> J[Run values-equivalency tests]
  J --> K[Aggregate matrix results]
  K -->|Scheduled failure| L[Slack notification]

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 65e9c61575

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot

🟡 Changes recommended

The current changes include a failing lint-script bug (flavor parsing whitespace) and an invalid Renovate allowedVersions pattern that will likely block updates.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a new CI workflow that exercises a K3s × flavor compatibility matrix, wiring a k3s_version input through the existing test workflow/task stack and updating lint/docs/renovate to keep versions aligned.

Changes:

Introduces a new test-kubernetes-matrix GitHub Actions workflow that runs a K3s version × flavor test matrix (nightly + PR triggers + manual subset inputs).
Plumbs an optional k3s_version input through UDS tasks/workflows so values E2E tests can run against exact K3s releases.
Updates linting and documentation to reflect/validate the matrix and the documented supported distribution minors.

File summaries

File	Description
`tasks/test.yaml`	Adds a `k3s_version` input to the values E2E task and forwards it into cluster setup.
`tasks/setup.yaml`	Adds optional K3s version selection for k3d cluster creation and validates the server version when requested.
`tasks/lint.yaml`	Extends the k8s version check to validate documented K3s minors against the new matrix workflow.
`renovate.json`	Adds Renovate rules intended to constrain/update K3s versions in the matrix workflow.
`docs/concepts/platform/supported-distributions.mdx`	Updates supported distributions page to reflect K3s minors and the new workflow coverage.
`.github/workflows/test.yaml`	Adds `k3s_version` input and passes it through to the values E2E task; updates log suffix.
`.github/workflows/test-kubernetes-matrix.yaml`	New workflow to run the K3s compatibility matrix and aggregate results.

Review details

Files reviewed: 7/7 changed files
Comments generated: 3
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+      "matchDepNames": [
+        "k3s-io/k3s"
+      ],
+      "allowedVersions": "/^v{{major}}\\.{{minor}}\\.\\d+\\+k3s\\d+$/",


Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com>

Copilot

🟡 Changes recommended

The new matrix workflow’s input parsing can produce empty matrix entries and the updated lint task adds an unguarded jq dependency, both of which can cause avoidable CI/manual-run failures.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Files reviewed: 8/8 changed files
Comments generated: 2
Review effort level: Lite

slaskawi · 2026-09-09T11:37:59Z

+        default: ""
+        description: "Exact K3s version for the test cluster"
    actions:
+      - description: "Exclude Portal from registry1 values tests"


This should be moved to tasks.yaml rather than here in the pipeline.

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com>

joelmccoy

A couple initial comments that might effect the shape of this pr

joelmccoy · 2026-09-09T18:56:06Z

+        "v1.34.4+k3s1",
+        "v1.35.8+k3s1"


we should be adding 1.35 and 1.37 to this instead... 1.37 is current. we should test normally on 1.36 (need to bump uds-k3d). This matrix should test n-2 and n

going to bump this here: defenseunicorns/uds-k3d#382

joelmccoy · 2026-09-09T18:59:06Z

+      - ".github/workflows/test.yaml"
+      - "tasks/setup.yaml"
+      - "tasks/test.yaml"


I think it is overkill to include these. These will trigger on way more prs than we intend. And we are generally more conservative. I am ok trigger in the .github/workflows/test-kubernetes-matrix.yaml but i think everything else is not necessary.

joelmccoy · 2026-09-09T19:00:50Z

+    name: Prepare matrix
+    runs-on: ubuntu-latest
+    outputs:
+      k3s_versions: ${{ steps.matrix.outputs.k3s_versions }}
+      flavors: ${{ steps.matrix.outputs.flavors }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Convert matrix inputs
+        id: matrix
+        env:
+          K3S_MATRIX: ${{ env.K3S_MATRIX }}
+          K3S_VERSIONS_INPUT: ${{ inputs.k3s_versions }}
+          FLAVORS_INPUT: ${{ inputs.flavors }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          k3s_versions=$(printf '%s' "$K3S_MATRIX" | jq -c '.versions')
+          flavors=$(printf '%s' "$K3S_MATRIX" | jq -c '.flavors')
+
+          input_to_json() {
+            printf '%s' "$1" | jq -Rc 'split(",") | map(gsub("^\\s+|\\s+$"; "")) | map(select(length > 0))'
+          }
+
+          if [ -n "$K3S_VERSIONS_INPUT" ]; then
+            k3s_versions=$(input_to_json "$K3S_VERSIONS_INPUT")
+          fi
+          if [ -n "$FLAVORS_INPUT" ]; then
+            flavors=$(input_to_json "$FLAVORS_INPUT")
+          fi
+          {
+            echo "k3s_versions<<EOF"
+            echo "$k3s_versions"
+            echo "EOF"
+            echo "flavors<<EOF"
+            echo "$flavors"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+


can't we get ride of this whole prepare step?? i feel like it is overkill if we can just use a native github matrix like so:

jobs: test: name: Kubernetes compatibility (${{ matrix.k3s_version }}, ${{ matrix.flavor }}) strategy: fail-fast: false matrix: k3s_version: - v1.34.4+k3s1 - v1.35.8+k3s1 flavor: - upstream - registry1 - unicorn uses: ./.github/workflows/test.yaml

slaskawi · 2026-09-10T05:59:03Z

      package: ${{ matrix.package }}
      flavor: ${{ matrix.flavor }}
      test_type: ${{ matrix.test_type }}
-    secrets: inherit # Inherits all secrets from the parent workflow.


This should be reverted to the origin/main

slaskawi · 2026-09-10T06:00:24Z

+        type: string
+        description: "Exact K3s version for values tests"
+        required: false
+        default: ""


It's very hard to track what is the default Kubernetes version we're testing with. We need to use one default (for the non-matrix jobs) explicitly somewhere. It must be easy to spot.

slaskawi added 5 commits September 9, 2026 09:27

feat(ci): add Kubernetes compatibility matrix

9e3d9ad

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com>

fix(ci): use installed UDS CLI in matrix setup

517404c

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com>

fix(ci): emit multiline matrix outputs

8df446d

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com>

refactor(ci): inline Kubernetes test matrix

8ba35b9

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com>

fix(ci): exclude portal from registry values tests

65e9c61

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com>

slaskawi marked this pull request as ready for review September 9, 2026 09:15

slaskawi requested a review from a team as a code owner September 9, 2026 09:15

Copilot AI lite review requested due to automatic review settings September 9, 2026 09:15

Copilot started reviewing on behalf of slaskawi September 9, 2026 09:16 View session

greptile-apps Bot reviewed Sep 9, 2026

View reviewed changes

Comment thread .github/workflows/test-kubernetes-matrix.yaml Outdated

chatgpt-codex-connector Bot reviewed Sep 9, 2026

View reviewed changes

Comment thread renovate.json

Copilot AI reviewed Sep 9, 2026

View reviewed changes

Comment thread tasks/lint.yaml Outdated

Comment thread renovate.json

"matchDepNames": [

"k3s-io/k3s"

],

"allowedVersions": "/^v{{major}}\\.{{minor}}\\.\\d+\\+k3s\\d+$/",

Comment thread docs/concepts/platform/supported-distributions.mdx

slaskawi commented Sep 9, 2026

View reviewed changes

Comment thread .github/workflows/test-kubernetes-matrix.yaml Outdated

Comment thread .github/workflows/test-kubernetes-matrix.yaml

Comment thread .github/workflows/test.yaml Outdated

Comment thread tasks/setup.yaml

slaskawi force-pushed the sebastianlaskawiec/core-675 branch from 2aef05e to ddbe7b7 Compare September 9, 2026 10:27

fix(ci): address compatibility matrix feedback

859b83e

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com>

slaskawi force-pushed the sebastianlaskawiec/core-675 branch from ddbe7b7 to 859b83e Compare September 9, 2026 10:32

slaskawi requested a lite review from Copilot September 9, 2026 11:31

Copilot started reviewing on behalf of slaskawi September 9, 2026 11:31 View session

slaskawi commented Sep 9, 2026

View reviewed changes

Comment thread .github/workflows/pull-request-conditionals.yaml Outdated

Copilot AI reviewed Sep 9, 2026

View reviewed changes

Comment thread .github/workflows/test-kubernetes-matrix.yaml

Comment thread tasks/lint.yaml

slaskawi commented Sep 9, 2026

View reviewed changes

fix(ci): address review comments

21aea68

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com>

joelmccoy reviewed Sep 9, 2026

View reviewed changes

slaskawi commented Sep 10, 2026

View reviewed changes

Uh oh!

Conversation

slaskawi commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issue

Type of change

Steps to Validate

Checklist before merging

Uh oh!

slaskawi commented Sep 9, 2026

Uh oh!

slaskawi commented Sep 9, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

greptile-apps Bot commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 4/5

Findings

Summary

Diagram

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

slaskawi Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

joelmccoy left a comment

Choose a reason for hiding this comment

Uh oh!

joelmccoy Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

joelmccoy Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

joelmccoy Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

joelmccoy Sep 9, 2026

Choose a reason for hiding this comment

Uh oh!

slaskawi Sep 10, 2026

Choose a reason for hiding this comment

Uh oh!

slaskawi Sep 10, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

slaskawi commented Sep 9, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Sep 9, 2026 •

edited

Loading

greptile-apps Bot commented Sep 9, 2026 •

edited

Loading