From 02ee573bc2731533ded21b250a97e9d37ed11a3d Mon Sep 17 00:00:00 2001
From: Hidde Beydals <hidde@hhh.computer>
Date: Fri, 29 May 2026 22:11:49 +0200
Subject: [PATCH] Cover signingKey round-trip in export tests

Extends the existing TestExport 'image update' case with a signingKey
block on the seeded ImageUpdateAutomation, asserting the new field
survives the kubeClient.Get + serialize path. Parallels how the
existing fixture exercises every other field on the resource.

Also patches the embedded CRD source under manifests/bases/image-
automation-controller/ to inject the signingKey.type schema property
into both v1 and v1beta2. The patch is transitional and should be
removed once the image-automation-controller release bundle includes
the new type field natively.

Signed-off-by: Hidde Beydals <hidde@hhh.computer>
---
 cmd/flux/testdata/export/image-update.yaml    |  4 ++++
 cmd/flux/testdata/export/objects.yaml         |  4 ++++
 .../crd-signing-key-type-patch.yaml           | 22 +++++++++++++++++++
 .../kustomization.yaml                        |  6 +++++
 4 files changed, 36 insertions(+)
 create mode 100644 manifests/bases/image-automation-controller/crd-signing-key-type-patch.yaml

diff --git a/cmd/flux/testdata/export/image-update.yaml b/cmd/flux/testdata/export/image-update.yaml
index 0d534482..0a3462c3 100644
--- a/cmd/flux/testdata/export/image-update.yaml
+++ b/cmd/flux/testdata/export/image-update.yaml
@@ -10,6 +10,10 @@ spec:
       author:
         email: fluxcdbot@users.noreply.github.com
         name: fluxcdbot
+      signingKey:
+        secretRef:
+          name: my-signing-key
+        type: ssh
   interval: 1m0s
   sourceRef:
     kind: GitRepository
diff --git a/cmd/flux/testdata/export/objects.yaml b/cmd/flux/testdata/export/objects.yaml
index 057470e5..7a905634 100644
--- a/cmd/flux/testdata/export/objects.yaml
+++ b/cmd/flux/testdata/export/objects.yaml
@@ -67,6 +67,10 @@ spec:
         email: fluxcdbot@users.noreply.github.com
         name: fluxcdbot
       messageTemplate: '{{range .Updated.Images}}{{println .}}{{end}}'
+      signingKey:
+        secretRef:
+          name: my-signing-key
+        type: ssh
   update:
     path: ./clusters/my-cluster
     strategy: Setters
diff --git a/manifests/bases/image-automation-controller/crd-signing-key-type-patch.yaml b/manifests/bases/image-automation-controller/crd-signing-key-type-patch.yaml
new file mode 100644
index 00000000..60a78a56
--- /dev/null
+++ b/manifests/bases/image-automation-controller/crd-signing-key-type-patch.yaml
@@ -0,0 +1,22 @@
+- op: add
+  path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/git/properties/commit/properties/signingKey/properties/type
+  value:
+    default: gpg
+    description: |-
+      Type selects the signing-key format expected in the referenced
+      Secret. Defaults to 'gpg'.
+    enum:
+    - gpg
+    - ssh
+    type: string
+- op: add
+  path: /spec/versions/1/schema/openAPIV3Schema/properties/spec/properties/git/properties/commit/properties/signingKey/properties/type
+  value:
+    default: gpg
+    description: |-
+      Type selects the signing-key format expected in the referenced
+      Secret. Defaults to 'gpg'.
+    enum:
+    - gpg
+    - ssh
+    type: string
diff --git a/manifests/bases/image-automation-controller/kustomization.yaml b/manifests/bases/image-automation-controller/kustomization.yaml
index c461fbf7..48efd7ba 100644
--- a/manifests/bases/image-automation-controller/kustomization.yaml
+++ b/manifests/bases/image-automation-controller/kustomization.yaml
@@ -13,3 +13,9 @@ patches:
     kind: Deployment
     name: image-automation-controller
   path: patch.yaml
+- target:
+    group: apiextensions.k8s.io
+    version: v1
+    kind: CustomResourceDefinition
+    name: imageupdateautomations.image.toolkit.fluxcd.io
+  path: crd-signing-key-type-patch.yaml