Fail when package architecture doesn't match cluster architecture

src/config/lang/english.go

@@ -215,12 +215,13 @@ zarf init --git-push-password={PASSWORD} --git-push-username={USERNAME} --git-ur
 	CmdPackageCreateFlagSigningKey         = "Path to private key file for signing packages"
 	CmdPackageCreateFlagSigningKeyPassword = "Password to the private key file used for signing packages"
 
-	CmdPackageDeployFlagConfirm    = "Confirms package deployment without prompting. ONLY use with packages you trust. Skips prompts to review SBOM, configure variables, select optional components and review potential breaking changes."
-	CmdPackageDeployFlagSet        = "Specify deployment variables to set on the command line (KEY=value)"
-	CmdPackageDeployFlagComponents = "Comma-separated list of components to install.  Adding this flag will skip the init prompts for which components to install"
-	CmdPackageDeployFlagShasum     = "Shasum of the package to deploy. Required if deploying a remote package and \"--insecure\" is not provided"
-	CmdPackageDeployFlagSget       = "Path to public sget key file for remote packages signed via cosign"
-	CmdPackageDeployFlagPublicKey  = "Path to public key file for validating signed packages"
+	CmdPackageDeployFlagConfirm             = "Confirms package deployment without prompting. ONLY use with packages you trust. Skips prompts to review SBOM, configure variables, select optional components and review potential breaking changes."
+	CmdPackageDeployFlagSet                 = "Specify deployment variables to set on the command line (KEY=value)"
+	CmdPackageDeployFlagComponents          = "Comma-separated list of components to install.  Adding this flag will skip the init prompts for which components to install"
+	CmdPackageDeployFlagShasum              = "Shasum of the package to deploy. Required if deploying a remote package and \"--insecure\" is not provided"
+	CmdPackageDeployFlagSget                = "Path to public sget key file for remote packages signed via cosign"
+	CmdPackageDeployFlagPublicKey           = "Path to public key file for validating signed packages"
+	CmdPackageDeployValidateArchitectureErr = "this package architecture is %s, but the target cluster has the %s architecture. These architectures must be the same"
 
 	CmdPackageInspectFlagSbom      = "View SBOM contents while inspecting the package"
 	CmdPackageInspectFlagSbomOut   = "Specify an output directory for the SBOMs from the inspected Zarf package"

src/internal/cluster/common.go

@@ -18,7 +18,7 @@ type Cluster struct {
 }
 
 const (
-	defaultTimeout = 30 * time.Second
+	DefaultTimeout = 30 * time.Second
 	agentLabel     = "zarf.dev/agent"
 )
 
@@ -28,7 +28,7 @@ var labels = k8s.Labels{
 
 // NewClusterOrDie creates a new cluster instance and waits up to 30 seconds for the cluster to be ready or throws a fatal error.
 func NewClusterOrDie() *Cluster {
-	c, err := NewClusterWithWait(defaultTimeout, true)
+	c, err := NewClusterWithWait(DefaultTimeout, true)
 	if err != nil {
 		message.Fatalf(err, "Failed to connect to cluster")
 	}

src/internal/cluster/tunnel.go

@@ -124,7 +124,7 @@ func ServiceInfoFromNodePortURL(nodePortURL string) (*ServiceInfo, error) {
 		return nil, fmt.Errorf("node port services should use the port range 30000-32767")
 	}
 
-	kube, err := k8s.NewWithWait(message.Debugf, labels, defaultTimeout)
+	kube, err := k8s.NewWithWait(message.Debugf, labels, DefaultTimeout)
 	if err != nil {
 		return nil, err
 	}
@@ -187,7 +187,7 @@ func ServiceInfoFromServiceURL(serviceURL string) (*ServiceInfo, error) {
 func NewTunnel(namespace, resourceType, resourceName string, local, remote int) (*Tunnel, error) {
 	message.Debugf("tunnel.NewTunnel(%s, %s, %s, %d, %d)", namespace, resourceType, resourceName, local, remote)
 
-	kube, err := k8s.NewWithWait(message.Debugf, labels, defaultTimeout)
+	kube, err := k8s.NewWithWait(message.Debugf, labels, DefaultTimeout)
 	if err != nil {
 		return &Tunnel{}, err
 	}
@@ -405,7 +405,7 @@ func (tunnel *Tunnel) establish() (string, error) {
 		message.Debug(spinnerMessage)
 	}
 
-	kube, err := k8s.NewWithWait(message.Debugf, labels, defaultTimeout)
+	kube, err := k8s.NewWithWait(message.Debugf, labels, DefaultTimeout)
 	if err != nil {
 		return "", fmt.Errorf("unable to connect to the cluster: %w", err)
 	}

src/pkg/packager/common.go

@@ -12,16 +12,19 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"runtime"
 	"sort"
 	"strings"
 
 	"github.com/AlecAivazis/survey/v2"
+	"github.com/defenseunicorns/zarf/src/config/lang"
 	"github.com/defenseunicorns/zarf/src/internal/cluster"
 	"github.com/defenseunicorns/zarf/src/internal/packager/sbom"
 	"github.com/defenseunicorns/zarf/src/types"
 	"github.com/mholt/archiver/v3"
 
 	"github.com/defenseunicorns/zarf/src/config"
+	"github.com/defenseunicorns/zarf/src/pkg/k8s"
 	"github.com/defenseunicorns/zarf/src/pkg/message"
 	"github.com/defenseunicorns/zarf/src/pkg/packager/deprecated"
 	"github.com/defenseunicorns/zarf/src/pkg/utils"
@@ -440,6 +443,75 @@ func (p *Packager) validatePackageChecksums() error {
 	return nil
 }
 
+// validatePackageArchitecture validates that the package architecture matches the target cluster architecture.
+func (p *Packager) validatePackageArchitecture() error {
+	var (
+		applianceMode bool
+		clusterArch   string
+		err           error
+		k8sTarget     bool
+	)
+
+	// Iterate over the package components.
+	components := p.getValidComponents()
+	for _, component := range components {
+		// Determine whether we are working with an appliance mode init package.
+		if component.Name == k8s.DistroIsK3s && p.cfg.Pkg.Kind == "ZarfInitConfig" {
+			applianceMode = true
+		}
+
+		// Determine whether we are deploying k8s resources.
+		if component.Images != nil {
+			k8sTarget = true
+		}
+	}
+
+	// If we're working with an init package deploying k3s(appliance mode),
+	// set the clusterArch to the machine we're running on.
+	if applianceMode {
+		clusterArch = runtime.GOARCH
+
+		if p.arch != clusterArch {
+			return fmt.Errorf(lang.CmdPackageDeployValidateArchitectureErr, p.arch, clusterArch)
+		}
+
+		return nil
+	}
+
+	/*
+		If we're already connected to a cluster, query the cluster for the architecture.
+
+		If we're not already connected to a cluster and we're deploying k8s resources,
+		attempt to establish a new k8s client connection and query the cluster for the architecture.
+	*/
+	if p.cluster != nil {
+		clusterArch, err = p.cluster.Kube.GetArchitecture()
+		if err != nil {
+			return err
+		}
+
+		if p.arch != clusterArch {
+			return fmt.Errorf(lang.CmdPackageDeployValidateArchitectureErr, p.arch, clusterArch)
+		}
+	} else if k8sTarget {
+		client, err := cluster.NewClusterWithWait(cluster.DefaultTimeout, false)
+		if err != nil {
+			return err
+		}
+
+		clusterArch, err = client.Kube.GetArchitecture()
+		if err != nil {
+			return err
+		}
+
+		if p.arch != clusterArch {
+			return fmt.Errorf(lang.CmdPackageDeployValidateArchitectureErr, p.arch, clusterArch)
+		}
+	}
+
+	return nil
+}
+
 func (p *Packager) validatePackageSignature(publicKeyPath string) error {
 
 	// If the insecure flag was provided, ignore the signature validation

src/pkg/packager/deploy.go

@@ -42,6 +42,10 @@ func (p *Packager) Deploy() error {
 		return fmt.Errorf("unable to load the Zarf Package: %w", err)
 	}
 
+	if err := p.validatePackageArchitecture(); err != nil {
+		return err
+	}
+
 	if err := p.validatePackageSignature(p.cfg.DeployOpts.PublicKeyPath); err != nil {
 		return err
 	}

src/test/e2e/29_mismatched_architectures_test.go

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2021-Present The Zarf Authors
+
+// Package test provides e2e tests for Zarf.
+package test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestMismatchedArchitectures ensures that zarf produces an error
+// when the package architecture doesn't match the target cluster architecture.
+func TestMismatchedArchitectures(t *testing.T) {
+	t.Log("E2E: Mismatched architectures")
+	e2e.SetupWithCluster(t)
+	defer e2e.Teardown(t)
+
+	// Determine what test runner architecture we're running on,
+	// and set mismatchedArch to the opposite architecture.
+	var mismatchedArch string
+	if e2e.Arch == "amd64" {
+		mismatchedArch = "arm64"
+	}
+	if e2e.Arch == "arm64" {
+		mismatchedArch = "amd64"
+	}
+
+	var (
+		initPackageVersion               = "UnknownVersion"
+		mismatchedComponentChoicePackage = fmt.Sprintf("zarf-package-component-choice-%s.tar.zst", mismatchedArch)
+		mismatchedGamesPackage           = fmt.Sprintf("zarf-package-dos-games-%s.tar.zst", mismatchedArch)
+		mismatchedInitPackage            = fmt.Sprintf("zarf-init-%s-%s.tar.zst", mismatchedArch, initPackageVersion)
+		expectedErrorMessage             = fmt.Sprintf("this package architecture is %s", mismatchedArch)
+	)
+
+	// Build init package with different arch than the cluster arch.
+	stdOut, stdErr, err := e2e.ExecZarfCommand("package", "create", ".", "--architecture", mismatchedArch, "--confirm")
+	require.NoError(t, err, stdOut, stdErr)
+	defer e2e.CleanFiles(mismatchedInitPackage)
+
+	// Build dos-games package with different arch than the cluster arch.
+	stdOut, stdErr, err = e2e.ExecZarfCommand("package", "create", "examples/dos-games/", "--architecture", mismatchedArch, "--confirm")
+	require.NoError(t, err, stdOut, stdErr)
+	defer e2e.CleanFiles(mismatchedGamesPackage)
+
+	// Build component-choice package with different arch than the cluster arch.
+	stdOut, stdErr, err = e2e.ExecZarfCommand("package", "create", "examples/component-choice/", "--architecture", mismatchedArch, "--confirm")
+	require.NoError(t, err, stdOut, stdErr)
+	defer e2e.CleanFiles(mismatchedComponentChoicePackage)
+
+	// Ensure zarf init returns an error because of the mismatched architectures.
+	// We need to use the --architecture flag here to force zarf to find the package.
+	_, stdErr, err = e2e.ExecZarfCommand("init", "--architecture", mismatchedArch, "--confirm")
+	require.Error(t, err, stdErr)
+	require.Contains(t, stdErr, expectedErrorMessage)
+
+	// Ensure zarf package deploy returns an error because of the mismatched architectures.
+	_, stdErr, err = e2e.ExecZarfCommand("package", "deploy", mismatchedGamesPackage, "--confirm")
+	require.Error(t, err, stdErr)
+	require.Contains(t, stdErr, expectedErrorMessage)
+
+	// Ensure zarf package deploy is successful when a package has a mismatched architecture,
+	// but isn't deploying any k8s resources.
+	stdOut, stdErr, err = e2e.ExecZarfCommand("package", "deploy", mismatchedComponentChoicePackage, "--confirm")
+	require.NoError(t, err, stdOut, stdErr)
+}