.github: regenerate the integration test matrix

Author: kradalby

.github/workflows/gh-action-integration-generator.go

@@ -39,6 +39,27 @@ var testsToSplit = map[string][]string{
 	},
 }
 
+// testsExcludedFromMatrix are tests that must NOT be added to the shared
+// sqlite/postgres matrices because they have special runner requirements and
+// run in their own dedicated job. TestK8sOperator needs a runner that permits
+// privileged cgroup-v2 containers (it runs a real k3s cluster), which the
+// shared integration-test-template job is not guaranteed to provide.
+var testsExcludedFromMatrix = map[string]bool{
+	"TestK8sOperator": true,
+}
+
+// filterExcluded drops tests that run in their own dedicated job.
+func filterExcluded(tests []string) []string {
+	var kept []string
+	for _, test := range tests {
+		if testsExcludedFromMatrix[test] {
+			continue
+		}
+		kept = append(kept, test)
+	}
+	return kept
+}
+
 // expandTests takes a list of test names and expands any that need splitting
 // into multiple subtest patterns.
 func expandTests(tests []string) []string {
@@ -117,6 +138,9 @@ func updateYAML(tests []string, jobName string, testPath string) {
 func main() {
 	tests := findTests()
 
+	// Drop tests that run in their own dedicated job (special runner needs).
+	tests = filterExcluded(tests)
+
 	// Expand tests that should be split into multiple jobs
 	expandedTests := expandTests(tests)
 

.github/workflows/test-integration.yaml

@@ -275,6 +275,8 @@ jobs:
           - TestNodeTagCommand
           - TestNodeRouteCommands
           - TestNodeBackfillIPsCommand
+          - TestOAuthClientCommand
+          - TestOAuthClientCommandValidation
           - TestPolicyCheckCommand
           - TestSSHTestsRejectFailingPolicy
           - TestPolicyCommand
@@ -401,3 +403,25 @@ jobs:
       test: ${{ matrix.test }}
       postgres_flag: "--postgres=1"
       database_name: "postgres"
+  # k8s-operator: TestK8sOperator stands up a real k3s cluster (rancher/k3s) as
+  # a privileged sibling container and installs the Tailscale Kubernetes
+  # operator via Helm against an in-test Headscale.
+  #
+  # PRIVILEGED-CI REQUIREMENT: this job MUST run on a runner that permits
+  # privileged containers with a writable cgroup-v2 hierarchy (k3s runs
+  # containerd, manages iptables/ipvs and mounts /sys/fs/cgroup). The standard
+  # GitHub-hosted ubuntu-24.04-arm runner used by the shared template supports
+  # this; self-hosted or hardened runners that disallow --privileged or remount
+  # /sys/fs/cgroup read-only will fail this test. It is kept out of the
+  # generator-managed sqlite/postgres matrices (see
+  # .github/workflows/gh-action-integration-generator.go) precisely because of
+  # this special requirement.
+  k8s-operator:
+    needs: [build, build-tailscale-released]
+    if: needs.build.outputs.files-changed == 'true'
+    uses: ./.github/workflows/integration-test-template.yml
+    secrets: inherit
+    with:
+      test: "TestK8sOperator"
+      postgres_flag: "--postgres=0"
+      database_name: "sqlite"