FIPS Port Report: Flux CLI (fluxcd/flux2)

Summary

Application: Flux CLI — the command-line interface for Flux, the GitOps toolkit for Kubernetes. It is a pure CLI tool (no server/daemon) that communicates with a Kubernetes cluster via kubeconfig and manages Flux controllers, sources, and reconciliation resources.

Triage results:

• Language: Go (go 1.26.0)
• Build pattern: D — generate Dockerfile from scratch (the upstream Dockerfile expects a pre-built binary from goreleaser; we build from source)
• FIPS mechanism: ENV GODEBUG=fips140=only (standard Go FIPS mode)
• User at runtime: 65534 (nobody — always present in gardenlinux, no useradd needed)
• Exposed ports: none (pure CLI)
• Key complexity: //go:embed manifests/*.yaml — must run kustomize build via bundle.sh inside the builder stage before go build

Application metadata:

• Version: 2.9.6
• License: Apache-2.0
• Git commit SHA: b9c17924adb533d3617ec7de97a7b0f4acc07b39 (tag v2.9.6)

FIPS cryptographic library: Go standard library FIPS mode via GODEBUG=fips140=only. No native crypto library linking needed (CGO_ENABLED=0, pure Go binary).

Docker image built:

• gl-fips-fluxcd:2.9.6-amd64 (56.5 MB)

Steps taken

Triage

• Confirmed Go project (go.mod, go 1.26.0).
• Upstream Dockerfile (alpine-based, expects pre-built binary from goreleaser CI) is not suitable for reuse — chose Pattern D (generate Dockerfile from scratch).
• Identified //go:embed manifests/*.yaml in cmd/flux/manifests.embed.go: the manifests directory (containing YAML for 6 controllers + rbac + policies) is generated by kustomize and must exist before go build runs. Installed kustomize inside the builder via go install (no external download, no curl).
• Runtime user: 65534 (nobody), matching the upstream Dockerfile's USER 65534:65534.
• No ports to expose; this is a pure CLI tool.

Script generation

• Generated a Pattern D Dockerfile.fips heredoc with:
  • golang:1.26-bookworm builder stage (FROM --platform=$BUILDPLATFORM for correct cross-compile)
  • kustomize installed via go install, bundle.sh run, then go build with -X main.VERSION
  • gardenlinux/fips:1877.22 final stage, GODEBUG=fips140=only, USER 65534:65534, OCI labels

First run — failure

• kustomize v5.8.3 requires Go ≥ 1.27; builder has Go 1.26.9. Error: "sigs.k8s.io/kustomize/kustomize/v5@v5.8.3 requires go >= 1.27.0"
• ARG UPSTREAM_GIT_SHA was not declared before the LABEL that references it in the final stage, causing an "UndefinedVar" warning and empty label value.
• ARG defaults in FROM lines triggered "InvalidDefaultArgInFrom" warnings.

Fixes applied

1. Pinned KUSTOMIZE_VERSION to 5.6.0 (requires only Go 1.23, compatible with Go 1.26).
2. Added GOTOOLCHAIN=auto to the kustomize install RUN so Go can select the right toolchain.
3. Added ARG UPSTREAM_GIT_SHA in both builder and final stages before it is referenced.
4. Gave explicit default values to the GO_IMAGE and BASE_IMAGE ARGs to silence the Dockerfile linter warnings.

Second run — success

• kustomize v5.6.0 installed and ran bundle.sh, generating 9 YAML files (7 controllers + rbac + policies).
• go build compiled the flux binary in ~19 minutes (large dep tree: k8s, AWS, Azure, GCP SDKs).
• Image gl-fips-fluxcd:2.9.6-amd64 loaded successfully (56.5 MB).

Test script output (step 8)

*** Checking if gl-fips-fluxcd:2.9.6-amd64 docker image is available *** PASS — image found

*** Checking if gl-fips-fluxcd:2.9.6-amd64 is based on gardenlinux *** PASS — NAME="Garden Linux"

*** Checking if gl-fips-fluxcd:2.9.6-amd64 is using FIPS-enabled gardenlinux image *** PASS — VARIANT_ID=container-sslfips-amd64

*** Checking that gl-fips-fluxcd:2.9.6-amd64 starts under a non-root user *** PASS — effective user: nobody (65534)

*** Checking if gl-fips-fluxcd:2.9.6-amd64 has GO FIPS mode enabled *** PASS — GODEBUG=fips140=only

*** Checking if gl-fips-fluxcd:2.9.6-amd64 contains org.opencontainers.image.description label *** PASS — "A FIPS-enabled Flux CLI image"

*** Checking if gl-fips-fluxcd:2.9.6-amd64 contains org.opencontainers.image.licenses label *** PASS — "Apache-2.0"

*** Checking if gl-fips-fluxcd:2.9.6-amd64 contains org.opencontainers.image.revision label *** PASS — "b9c17924adb533d3617ec7de97a7b0f4acc07b39"

All test checks passed.

Kubernetes test run (step 10)

Cluster: k3d fips-test (k3d v5.9.0, k3s v1.35.5-k3s1) Image imported via: k3d image import gl-fips-fluxcd:2.9.6-amd64 --cluster fips-test

Pod manifest: .build/fips-port-fluxcd-pod.yaml args: ["version", "--client"]

Pod status after 30s: NAME READY STATUS RESTARTS AGE fips-port-fluxcd-pod 0/1 Completed 0 4m51s

Pod logs: flux: v2.9.6

Result: PASS — binary ran to completion under UID 65534, printed correct version, exited 0.

Image tag	Pod status	Pass/Fail
gl-fips-fluxcd:2.9.6-amd64	Completed	PASS