Hybrid cloud cluster monorepo with Ansible, K8s, NixOS, and Terraform.
cute.haus
ansible
terraform
nix
k8s
k8s: scaffold flux gitops
Aly Raffauf
(Jul 1, 2026, 3:02 PM EDT)
41e7ef70
3f3075f0
+7045
-2
+23
.github/workflows/check-config.yml
+23
.github/workflows/check-config.yml
···
44
44
echo "::endgroup::"
45
45
done
46
46
47
+
flux-kustomize:
48
+
name: flux kustomize build
49
+
runs-on: ubuntu-latest
50
+
steps:
51
+
- uses: actions/checkout@v7
52
+
with: { fetch-depth: 1 }
53
+
- uses: azure/setup-kubectl@v4
54
+
- name: kubectl kustomize each flux layer
55
+
run: |
56
+
set -e
57
+
for dir in \
58
+
k8s/flux/system \
59
+
k8s/flux/sources \
60
+
k8s/flux/infra-crds \
61
+
k8s/flux/infra-core \
62
+
k8s/flux/platform \
63
+
k8s/flux/apps \
64
+
k8s/flux/external-routes; do
65
+
echo "::group::$dir"
66
+
kubectl kustomize "$dir" >/dev/null
67
+
echo "::endgroup::"
68
+
done
69
+
47
70
ansible-syntax:
48
71
name: ansible playbook syntax
49
72
runs-on: ubuntu-latest
+71
-2
.justfile
+71
-2
.justfile
···
95
95
shopt -s nullglob
96
96
user_pubs=(keys/aly_*.pub)
97
97
host_pubs=(keys/root_*.pub)
98
+
flux_pubs=(keys/flux_*.pub)
98
99
{
99
100
cat <<'EOF'
100
101
# Auto-generated by `just sops-rekey` from keys/*.pub.
101
-
# Every recipient can decrypt every secret. To add or remove a
102
-
# machine, add or remove its .pub file and re-run `just sops-rekey`.
102
+
# User and host keys decrypt legacy secrets/*.yaml. Flux keys decrypt
103
+
# only k8s/flux/secrets/*.sops.yaml.
103
104
keys:
104
105
# === user keys (aly@<host>) ===
105
106
EOF
···
114
115
age=$(ssh-to-age -i "$f")
115
116
printf ' - &host_%s %s\n' "$host" "$age"
116
117
done
118
+
if ((${#flux_pubs[@]} > 0)); then
119
+
echo " # === flux keys ==="
120
+
for f in "${flux_pubs[@]}"; do
121
+
name=$(basename "$f" .pub); name=${name#flux_}
122
+
age=$(<"$f")
123
+
printf ' - &flux_%s %s\n' "$name" "$age"
124
+
done
125
+
fi
117
126
cat <<'EOF'
118
127
119
128
creation_rules:
129
+
- path_regex: ^k8s/flux/secrets/.*\.sops\.ya?ml$
130
+
key_groups:
131
+
- age:
132
+
EOF
133
+
for f in "${user_pubs[@]}"; do
134
+
host=$(basename "$f" .pub); host=${host#aly_}
135
+
printf ' - *user_aly_%s\n' "$host"
136
+
done
137
+
for f in "${host_pubs[@]}"; do
138
+
host=$(basename "$f" .pub); host=${host#root_}
139
+
printf ' - *host_%s\n' "$host"
140
+
done
141
+
for f in "${flux_pubs[@]}"; do
142
+
name=$(basename "$f" .pub); name=${name#flux_}
143
+
printf ' - *flux_%s\n' "$name"
144
+
done
145
+
cat <<'EOF'
146
+
120
147
- path_regex: ^secrets/.*\.ya?ml$
121
148
key_groups:
122
149
- age:
···
151
178
[group('kubes')]
152
179
check:
153
180
bun scripts/check.ts
181
+
for dir in k8s/flux/system k8s/flux/sources k8s/flux/infra-crds k8s/flux/infra-core k8s/flux/platform k8s/flux/apps k8s/flux/external-routes; do kubectl kustomize "$dir" >/dev/null; done
154
182
nix flake check --impure
155
183
156
184
# Bump a digest-pinned chart image to its current upstream digest.
···
158
186
[group('kubes')]
159
187
bump TARGET:
160
188
bun scripts/bump-image.ts {{ TARGET }}
189
+
190
+
# Same-namespace real-release helper for local in-tree charts only.
191
+
# Usage: just k8s {apply|diff|suspend|resume|reconcile} <release> [namespace]
192
+
[group('kubes')]
193
+
k8s action release namespace='default':
194
+
#!/usr/bin/env bash
195
+
set -euo pipefail
196
+
chart="k8s/charts/{{release}}"
197
+
198
+
case "{{action}}" in
199
+
apply)
200
+
if [[ ! -f "$chart/Chart.yaml" ]]; then
201
+
echo "just k8s apply supports local charts only: $chart/Chart.yaml not found" >&2
202
+
exit 2
203
+
fi
204
+
flux suspend helmrelease "{{release}}" -n "{{namespace}}" || true
205
+
helm upgrade --install "{{release}}" "$chart" \
206
+
-n "{{namespace}}" -f k8s/values/global.yaml
207
+
;;
208
+
diff)
209
+
if [[ ! -f "$chart/Chart.yaml" ]]; then
210
+
echo "just k8s diff supports local charts only: $chart/Chart.yaml not found" >&2
211
+
exit 2
212
+
fi
213
+
helm diff upgrade --allow-unreleased "{{release}}" "$chart" \
214
+
-n "{{namespace}}" -f k8s/values/global.yaml
215
+
;;
216
+
suspend)
217
+
flux suspend helmrelease "{{release}}" -n "{{namespace}}"
218
+
;;
219
+
resume)
220
+
flux resume helmrelease "{{release}}" -n "{{namespace}}"
221
+
;;
222
+
reconcile)
223
+
flux reconcile helmrelease "{{release}}" -n "{{namespace}}" --with-source
224
+
;;
225
+
*)
226
+
echo "usage: just k8s {apply|diff|suspend|resume|reconcile} <release> [namespace]" >&2
227
+
exit 2
228
+
;;
229
+
esac
161
230
162
231
# Bump tranquil-pds to its current atcr.io digest. Separate from `just bump`
163
232
# because atcr.io is private — `skopeo --no-creds` can't reach it.
+208
PLAN.md
+208
PLAN.md
···
1
+
# Flux GitOps Migration Plan
2
+
3
+
## Final Step-By-Step Plan
4
+
5
+
1. **Bootstrap Flux With Option B**
6
+
- Use `flux bootstrap github` now.
7
+
- Bootstrap path: `k8s/flux/system`.
8
+
- Do not change NixOS during this migration.
9
+
- Treat future NixOS/k3s auto-deploy bootstrap as optional hardening later.
10
+
- Ensure there is one root model: `k8s/flux/system` owns the Flux root and references child Flux `Kustomization`s.
11
+
12
+
2. **Add Flux SOPS Key**
13
+
- Generate a dedicated Flux age keypair.
14
+
- Commit only the public key as `keys/flux_k8s.pub`.
15
+
- Store the private key out-of-band.
16
+
- Create `flux-system/sops-age` manually as a bootstrap artifact.
17
+
- Do not rely on Flux to decrypt/manage its own decryption key.
18
+
- Disaster recovery procedure will be: rebuild k3s, bootstrap Flux, apply `sops-age`, then Flux reconciles encrypted resources.
19
+
20
+
3. **Update SOPS Policy**
21
+
- Extend `.sops.yaml` generation so `k8s/flux/secrets/*.sops.yaml` encrypts to:
22
+
- existing user keys
23
+
- existing host keys
24
+
- new `flux_k8s` key
25
+
- Keep existing `secrets/*.yaml` encrypted only to user/host keys.
26
+
- Flux must not be able to decrypt host/Terraform/local secrets.
27
+
- Run `just sops-rekey` after updating recipients.
28
+
29
+
4. **Create Flux Directory Layout**
30
+
- Create:
31
+
32
+
```text
33
+
k8s/flux/
34
+
├── system/
35
+
├── sources/
36
+
├── infra-crds/
37
+
├── infra-core/
38
+
├── platform/
39
+
├── apps/
40
+
├── external-routes/
41
+
└── secrets/
42
+
```
43
+
44
+
- Keep all first-class k8s Secret manifests in flat `k8s/flux/secrets/`.
45
+
46
+
5. **Define Flux Layer Graph**
47
+
- Use Flux `Kustomization.dependsOn` between layers:
48
+
49
+
```text
50
+
system -> sources -> infra-crds -> infra-core -> platform -> apps -> external-routes
51
+
```
52
+
53
+
- Use `HelmRelease.dependsOn` only for same-layer release ordering.
54
+
- Set all Flux intervals to `15m`.
55
+
- Use explicit `flux reconcile ...` for immediate deploys.
56
+
- Empty layers carry temporary placeholder ConfigMaps so Flux/Kustomize can
57
+
reconcile them before real resources are migrated. Remove each placeholder
58
+
when that layer gets its first real resource.
59
+
60
+
6. **Create Flux Sources**
61
+
- Add `GitRepository cute-haus` pointing at the monorepo.
62
+
- Add `HelmRepository` resources for:
63
+
- `grafana`
64
+
- `prometheus-community`
65
+
- `traefik`
66
+
- `longhorn`
67
+
- `cnpg`
68
+
- `tailscale`
69
+
- `jetstack`
70
+
- `nfd`
71
+
- `intel`
72
+
73
+
7. **Convert Global Values**
74
+
- Convert `k8s/values/global.yaml` into non-secret `ConfigMap cute-haus-global`.
75
+
- Reference it from HelmReleases with `valuesFrom`.
76
+
- Document that this ConfigMap must stay non-secret.
77
+
- Any secret-like value must go into `k8s/flux/secrets/*.sops.yaml`.
78
+
79
+
8. **Migrate Secrets To First-Class Manifests**
80
+
- For charts that currently render Secrets, create equivalent SOPS-encrypted Kubernetes Secret manifests in `k8s/flux/secrets/`.
81
+
- Delete chart secret templates after the first-class Secret exists.
82
+
- Ensure each Secret is applied in the same or earlier Flux `Kustomization` than its consuming `HelmRelease`.
83
+
84
+
9. **Apply Secret-Specific Migrations**
85
+
- `longhorn-creds`: move `longhorn-b2` to first-class Secret; keep chart for recurring job, UI ingress, and proxy class.
86
+
- `cert-manager-issuers`: move `cloudflare-api-token` to first-class Secret.
87
+
- `cluster-tls`: move TLS material to first-class `kubernetes.io/tls` Secrets.
88
+
- `pg-shared`: move `pg-shared-b2` and `<role>-pg-creds` to first-class Secrets.
89
+
- `tranquil-pds`: move `tranquil-pds-env` and `atcr-pull` to first-class Secrets.
90
+
- `forward-auth`: move per-app `forward-auth-<app>-env` Secrets to first-class Secrets.
91
+
- App env Secrets: move `<app>-env` Secrets to first-class Secrets.
92
+
- `tailscale-operator`: use `valuesFrom: Secret` because the upstream chart consumes secret values directly.
93
+
94
+
10. **Preserve Forward-Auth Check**
95
+
- Keep the forward-auth `apps:` declaration plaintext.
96
+
- Move only signing secrets into first-class encrypted Secret manifests.
97
+
- Keep `check-forward-auth.ts` conceptually unchanged.
98
+
99
+
11. **Convert Helmfile Releases To Flux HelmReleases**
100
+
- Convert releases layer-by-layer.
101
+
- External charts use `HelmRepository`.
102
+
- In-tree charts use `GitRepository` and `chart: ./k8s/charts/<name>`.
103
+
- Inline non-secret values in `spec.values`.
104
+
- Use `valuesFrom` for `cute-haus-global` and the `tailscale-operator` secret values.
105
+
- Do not let Helmfile and Flux manage the same release at the same time.
106
+
107
+
12. **Smoke Test First**
108
+
- Migrate `watsup` first.
109
+
- Since `cluster-tls` is still Helmfile-managed at that point, omit temporary Flux `dependsOn` for `cluster-tls`.
110
+
- Validate:
111
+
- Flux source reconciliation
112
+
- local chart HelmRelease
113
+
- `helm-controller`
114
+
- manual `just k8s` workflow
115
+
- rollback path
116
+
117
+
13. **Migrate Layer-By-Layer**
118
+
- After `watsup`, migrate:
119
+
1. `infra-crds`: `cert-manager`, `cnpg`
120
+
2. `infra-core`: `traefik`, `longhorn-creds`, `longhorn`, `tailscale-operator`, NFD, Intel device plugins, `cert-manager-issuers`
121
+
3. `platform`: `pg-shared`, `valkey`, `tika`, `gotenberg`, `cluster-tls`, monitoring
122
+
4. `apps`: app releases, env-only first, multi-secret apps later
123
+
5. `external-routes`: last
124
+
125
+
14. **Per-Release Cutover Checklist**
126
+
- Create required first-class SOPS Secret manifests.
127
+
- Add or update the `HelmRelease`.
128
+
- Remove the release from `k8s/helmfile.yaml`.
129
+
- Remove obsolete `k8s/values/secrets/<release>.yaml`.
130
+
- Push.
131
+
- Run:
132
+
133
+
```bash
134
+
flux reconcile source git cute-haus -n flux-system
135
+
flux reconcile kustomization <layer> -n flux-system
136
+
```
137
+
138
+
- Verify:
139
+
140
+
```bash
141
+
flux get kustomizations -A
142
+
flux get helmreleases -A
143
+
helm list -A
144
+
kubectl get all -n <namespace>
145
+
```
146
+
147
+
15. **Add `just k8s` Manual Workflow**
148
+
- Add one short helper:
149
+
150
+
```bash
151
+
just k8s apply <release>
152
+
just k8s diff <release>
153
+
just k8s suspend <release>
154
+
just k8s resume <release>
155
+
just k8s reconcile <release>
156
+
```
157
+
158
+
- Scope: local in-tree charts only where release name equals `k8s/charts/<release>`.
159
+
- `apply` suspends Flux first, then runs `helm upgrade --install`.
160
+
- `diff` uses `helm diff upgrade --allow-unreleased`.
161
+
- External charts are managed through Flux only.
162
+
163
+
16. **Update CI And Checks**
164
+
- Keep existing chart render checks.
165
+
- Update `check-release-names.ts` to read Flux `HelmRelease` resources instead of `helmfile.yaml`.
166
+
- Update `check-pinned-images.ts` to derive deployed local charts from Flux `HelmRelease`s.
167
+
- Keep `check-forward-auth.ts` reading plaintext forward-auth app declarations.
168
+
- Add Flux/Kustomize validation:
169
+
170
+
```bash
171
+
kustomize build k8s/flux/system
172
+
kustomize build k8s/flux/sources
173
+
kustomize build k8s/flux/infra-crds
174
+
kustomize build k8s/flux/infra-core
175
+
kustomize build k8s/flux/platform
176
+
kustomize build k8s/flux/apps
177
+
kustomize build k8s/flux/external-routes
178
+
```
179
+
180
+
17. **Rollback Strategy**
181
+
- Keep `helmfile.yaml` usable until the final cleanup.
182
+
- If one release fails:
183
+
184
+
```bash
185
+
flux suspend helmrelease <release> -n <namespace>
186
+
```
187
+
188
+
- Re-add the release to Helmfile if needed and apply it manually.
189
+
- For a bad Flux commit, revert the commit and reconcile Flux.
190
+
- Do not delete Helmfile until all releases have been verified under Flux.
191
+
192
+
18. **Final Cleanup**
193
+
- Delete `k8s/helmfile.yaml`.
194
+
- Delete obsolete `k8s/values/secrets/*.yaml`.
195
+
- Audit for `vals` and `ref+sops://`.
196
+
- Remove `vals` from the devShell if unused.
197
+
- Update docs:
198
+
- `AGENTS.md`
199
+
- `README.md`
200
+
- `k8s/charts/README.md`
201
+
- Clarify that `longhorn-creds` no longer owns credential material despite retaining the release name.
202
+
203
+
19. **Post-Migration Hardening**
204
+
- Rotate duplicated shared credentials toward one credential per consumer.
205
+
- Optionally migrate Flux bootstrap from Option B to Option A:
206
+
- NixOS writes Flux controller manifests into k3s auto-deploy dir.
207
+
- Flux continues managing app/platform resources from Git.
208
+
- Optionally reorganize legacy `secrets/` later, outside this migration.
+4
k8s/flux/apps/kustomization.yaml
+4
k8s/flux/apps/kustomization.yaml
+9
k8s/flux/apps/placeholder.yaml
+9
k8s/flux/apps/placeholder.yaml
+4
k8s/flux/external-routes/kustomization.yaml
+4
k8s/flux/external-routes/kustomization.yaml
+9
k8s/flux/external-routes/placeholder.yaml
+9
k8s/flux/external-routes/placeholder.yaml
+4
k8s/flux/infra-core/kustomization.yaml
+4
k8s/flux/infra-core/kustomization.yaml
+9
k8s/flux/infra-core/placeholder.yaml
+9
k8s/flux/infra-core/placeholder.yaml
+4
k8s/flux/infra-crds/kustomization.yaml
+4
k8s/flux/infra-crds/kustomization.yaml
+9
k8s/flux/infra-crds/placeholder.yaml
+9
k8s/flux/infra-crds/placeholder.yaml
+4
k8s/flux/platform/kustomization.yaml
+4
k8s/flux/platform/kustomization.yaml
+9
k8s/flux/platform/placeholder.yaml
+9
k8s/flux/platform/placeholder.yaml
+8
k8s/flux/secrets/README.md
+8
k8s/flux/secrets/README.md
···
1
+
# Flux Secrets
2
+
3
+
First-class Kubernetes Secret manifests managed by Flux live here as
4
+
SOPS-encrypted `*.sops.yaml` files. The Flux age recipient may decrypt this
5
+
directory only; legacy `secrets/*.yaml` remain host/user-only.
6
+
7
+
The `flux-system/sops-age` private key Secret is a bootstrap artifact. Do not
8
+
store that private key in this repository.
+9
k8s/flux/sources/gitrepository.yaml
+9
k8s/flux/sources/gitrepository.yaml
+19
k8s/flux/sources/global-configmap.yaml
+19
k8s/flux/sources/global-configmap.yaml
···
1
+
apiVersion: v1
2
+
kind: ConfigMap
3
+
metadata:
4
+
name: cute-haus-global
5
+
annotations:
6
+
cute.haus/secret-policy: non-secret-values-only
7
+
data:
8
+
values.yaml: |
9
+
# Shared operational constants and OCI image pins. Secret-like values must
10
+
# live in k8s/flux/secrets/*.sops.yaml, not this ConfigMap.
11
+
global:
12
+
images:
13
+
alpine: docker.io/library/alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
14
+
rclone: rclone/rclone:1.74@sha256:623378ad0ff3ebd5cebf77720843c0e02edfe46e2d5b5ac6bed54c6371780dfb
15
+
16
+
failover:
17
+
# Fast eviction when a node goes NotReady/Unreachable. Mirrors the
18
+
# app-pod toleration so CNPG and stateful workloads fail over quickly.
19
+
fastTolerationSeconds: 60
+71
k8s/flux/sources/helmrepositories.yaml
+71
k8s/flux/sources/helmrepositories.yaml
···
1
+
apiVersion: source.toolkit.fluxcd.io/v1
2
+
kind: HelmRepository
3
+
metadata:
4
+
name: grafana
5
+
spec:
6
+
interval: 15m
7
+
url: https://grafana.github.io/helm-charts
8
+
---
9
+
apiVersion: source.toolkit.fluxcd.io/v1
10
+
kind: HelmRepository
11
+
metadata:
12
+
name: prometheus-community
13
+
spec:
14
+
interval: 15m
15
+
url: https://prometheus-community.github.io/helm-charts
16
+
---
17
+
apiVersion: source.toolkit.fluxcd.io/v1
18
+
kind: HelmRepository
19
+
metadata:
20
+
name: traefik
21
+
spec:
22
+
interval: 15m
23
+
url: https://traefik.github.io/charts
24
+
---
25
+
apiVersion: source.toolkit.fluxcd.io/v1
26
+
kind: HelmRepository
27
+
metadata:
28
+
name: longhorn
29
+
spec:
30
+
interval: 15m
31
+
url: https://charts.longhorn.io
32
+
---
33
+
apiVersion: source.toolkit.fluxcd.io/v1
34
+
kind: HelmRepository
35
+
metadata:
36
+
name: cnpg
37
+
spec:
38
+
interval: 15m
39
+
url: https://cloudnative-pg.github.io/charts
40
+
---
41
+
apiVersion: source.toolkit.fluxcd.io/v1
42
+
kind: HelmRepository
43
+
metadata:
44
+
name: tailscale
45
+
spec:
46
+
interval: 15m
47
+
url: https://pkgs.tailscale.com/helmcharts
48
+
---
49
+
apiVersion: source.toolkit.fluxcd.io/v1
50
+
kind: HelmRepository
51
+
metadata:
52
+
name: jetstack
53
+
spec:
54
+
interval: 15m
55
+
url: https://charts.jetstack.io
56
+
---
57
+
apiVersion: source.toolkit.fluxcd.io/v1
58
+
kind: HelmRepository
59
+
metadata:
60
+
name: nfd
61
+
spec:
62
+
interval: 15m
63
+
url: https://kubernetes-sigs.github.io/node-feature-discovery/charts
64
+
---
65
+
apiVersion: source.toolkit.fluxcd.io/v1
66
+
kind: HelmRepository
67
+
metadata:
68
+
name: intel
69
+
spec:
70
+
interval: 15m
71
+
url: https://intel.github.io/helm-charts/
+7
k8s/flux/sources/kustomization.yaml
+7
k8s/flux/sources/kustomization.yaml
+9
k8s/flux/system/README.md
+9
k8s/flux/system/README.md
···
1
+
# Flux System
2
+
3
+
`flux bootstrap github --path=k8s/flux/system` installs Flux and may generate
4
+
or update files in this directory. Preserve `layers.yaml` and keep it included
5
+
from `kustomization.yaml`; it wires the child reconciliation layers for this
6
+
repo.
7
+
8
+
Under the current bootstrap model, `flux-system/sops-age` is a bootstrap
9
+
artifact applied out-of-band, not an encrypted Flux-managed Secret.
+6437
k8s/flux/system/gotk-components.yaml
+6437
k8s/flux/system/gotk-components.yaml
···
1
+
---
2
+
# This manifest was generated by flux. DO NOT EDIT.
3
+
# Flux Version: v2.8.8
4
+
# Components: source-controller,kustomize-controller,helm-controller,notification-controller
5
+
apiVersion: v1
6
+
kind: Namespace
7
+
metadata:
8
+
labels:
9
+
app.kubernetes.io/instance: flux-system
10
+
app.kubernetes.io/part-of: flux
11
+
app.kubernetes.io/version: v2.8.8
12
+
pod-security.kubernetes.io/warn: restricted
13
+
pod-security.kubernetes.io/warn-version: latest
14
+
name: flux-system
15
+
---
16
+
apiVersion: networking.k8s.io/v1
17
+
kind: NetworkPolicy
18
+
metadata:
19
+
labels:
20
+
app.kubernetes.io/instance: flux-system
21
+
app.kubernetes.io/part-of: flux
22
+
app.kubernetes.io/version: v2.8.8
23
+
name: allow-egress
24
+
namespace: flux-system
25
+
spec:
26
+
egress:
27
+
- {}
28
+
ingress:
29
+
- from:
30
+
- podSelector: {}
31
+
podSelector: {}
32
+
policyTypes:
33
+
- Ingress
34
+
- Egress
35
+
---
36
+
apiVersion: networking.k8s.io/v1
37
+
kind: NetworkPolicy
38
+
metadata:
39
+
labels:
40
+
app.kubernetes.io/instance: flux-system
41
+
app.kubernetes.io/part-of: flux
42
+
app.kubernetes.io/version: v2.8.8
43
+
name: allow-scraping
44
+
namespace: flux-system
45
+
spec:
46
+
ingress:
47
+
- from:
48
+
- namespaceSelector: {}
49
+
ports:
50
+
- port: 8080
51
+
protocol: TCP
52
+
podSelector: {}
53
+
policyTypes:
54
+
- Ingress
55
+
---
56
+
apiVersion: networking.k8s.io/v1
57
+
kind: NetworkPolicy
58
+
metadata:
59
+
labels:
60
+
app.kubernetes.io/instance: flux-system
61
+
app.kubernetes.io/part-of: flux
62
+
app.kubernetes.io/version: v2.8.8
63
+
name: allow-webhooks
64
+
namespace: flux-system
65
+
spec:
66
+
ingress:
67
+
- from:
68
+
- namespaceSelector: {}
69
+
podSelector:
70
+
matchLabels:
71
+
app: notification-controller
72
+
policyTypes:
73
+
- Ingress
74
+
---
75
+
apiVersion: v1
76
+
kind: ResourceQuota
77
+
metadata:
78
+
labels:
79
+
app.kubernetes.io/instance: flux-system
80
+
app.kubernetes.io/part-of: flux
81
+
app.kubernetes.io/version: v2.8.8
82
+
name: critical-pods-flux-system
83
+
namespace: flux-system
84
+
spec:
85
+
hard:
86
+
pods: "1000"
87
+
scopeSelector:
88
+
matchExpressions:
89
+
- operator: In
90
+
scopeName: PriorityClass
91
+
values:
92
+
- system-node-critical
93
+
- system-cluster-critical
94
+
---
95
+
apiVersion: rbac.authorization.k8s.io/v1
96
+
kind: ClusterRole
97
+
metadata:
98
+
labels:
99
+
app.kubernetes.io/instance: flux-system
100
+
app.kubernetes.io/part-of: flux
101
+
app.kubernetes.io/version: v2.8.8
102
+
name: crd-controller-flux-system
103
+
rules:
104
+
- apiGroups:
105
+
- source.toolkit.fluxcd.io
106
+
resources:
107
+
- '*'
108
+
verbs:
109
+
- '*'
110
+
- apiGroups:
111
+
- kustomize.toolkit.fluxcd.io
112
+
resources:
113
+
- '*'
114
+
verbs:
115
+
- '*'
116
+
- apiGroups:
117
+
- helm.toolkit.fluxcd.io
118
+
resources:
119
+
- '*'
120
+
verbs:
121
+
- '*'
122
+
- apiGroups:
123
+
- notification.toolkit.fluxcd.io
124
+
resources:
125
+
- '*'
126
+
verbs:
127
+
- '*'
128
+
- apiGroups:
129
+
- image.toolkit.fluxcd.io
130
+
resources:
131
+
- '*'
132
+
verbs:
133
+
- '*'
134
+
- apiGroups:
135
+
- source.extensions.fluxcd.io
136
+
resources:
137
+
- '*'
138
+
verbs:
139
+
- '*'
140
+
- apiGroups:
141
+
- ""
142
+
resources:
143
+
- namespaces
144
+
- secrets
145
+
- configmaps
146
+
- serviceaccounts
147
+
verbs:
148
+
- get
149
+
- list
150
+
- watch
151
+
- apiGroups:
152
+
- ""
153
+
resources:
154
+
- events
155
+
verbs:
156
+
- create
157
+
- patch
158
+
- apiGroups:
159
+
- ""
160
+
resources:
161
+
- configmaps
162
+
verbs:
163
+
- get
164
+
- list
165
+
- watch
166
+
- create
167
+
- update
168
+
- patch
169
+
- delete
170
+
- apiGroups:
171
+
- ""
172
+
resources:
173
+
- configmaps/status
174
+
verbs:
175
+
- get
176
+
- update
177
+
- patch
178
+
- apiGroups:
179
+
- coordination.k8s.io
180
+
resources:
181
+
- leases
182
+
verbs:
183
+
- get
184
+
- list
185
+
- watch
186
+
- create
187
+
- update
188
+
- patch
189
+
- delete
190
+
- apiGroups:
191
+
- ""
192
+
resources:
193
+
- serviceaccounts/token
194
+
verbs:
195
+
- create
196
+
- nonResourceURLs:
197
+
- /livez/ping
198
+
verbs:
199
+
- head
200
+
---
201
+
apiVersion: rbac.authorization.k8s.io/v1
202
+
kind: ClusterRole
203
+
metadata:
204
+
labels:
205
+
app.kubernetes.io/instance: flux-system
206
+
app.kubernetes.io/part-of: flux
207
+
app.kubernetes.io/version: v2.8.8
208
+
rbac.authorization.k8s.io/aggregate-to-admin: "true"
209
+
rbac.authorization.k8s.io/aggregate-to-edit: "true"
210
+
name: flux-edit-flux-system
211
+
rules:
212
+
- apiGroups:
213
+
- notification.toolkit.fluxcd.io
214
+
- source.toolkit.fluxcd.io
215
+
- source.extensions.fluxcd.io
216
+
- helm.toolkit.fluxcd.io
217
+
- image.toolkit.fluxcd.io
218
+
- kustomize.toolkit.fluxcd.io
219
+
resources:
220
+
- '*'
221
+
verbs:
222
+
- create
223
+
- delete
224
+
- deletecollection
225
+
- patch
226
+
- update
227
+
---
228
+
apiVersion: rbac.authorization.k8s.io/v1
229
+
kind: ClusterRole
230
+
metadata:
231
+
labels:
232
+
app.kubernetes.io/instance: flux-system
233
+
app.kubernetes.io/part-of: flux
234
+
app.kubernetes.io/version: v2.8.8
235
+
rbac.authorization.k8s.io/aggregate-to-admin: "true"
236
+
rbac.authorization.k8s.io/aggregate-to-edit: "true"
237
+
rbac.authorization.k8s.io/aggregate-to-view: "true"
238
+
name: flux-view-flux-system
239
+
rules:
240
+
- apiGroups:
241
+
- notification.toolkit.fluxcd.io
242
+
- source.toolkit.fluxcd.io
243
+
- source.extensions.fluxcd.io
244
+
- helm.toolkit.fluxcd.io
245
+
- image.toolkit.fluxcd.io
246
+
- kustomize.toolkit.fluxcd.io
247
+
resources:
248
+
- '*'
249
+
verbs:
250
+
- get
251
+
- list
252
+
- watch
253
+
---
254
+
apiVersion: rbac.authorization.k8s.io/v1
255
+
kind: ClusterRoleBinding
256
+
metadata:
257
+
labels:
258
+
app.kubernetes.io/instance: flux-system
259
+
app.kubernetes.io/part-of: flux
260
+
app.kubernetes.io/version: v2.8.8
261
+
name: cluster-reconciler-flux-system
262
+
roleRef:
263
+
apiGroup: rbac.authorization.k8s.io
264
+
kind: ClusterRole
265
+
name: cluster-admin
266
+
subjects:
267
+
- kind: ServiceAccount
268
+
name: kustomize-controller
269
+
namespace: flux-system
270
+
- kind: ServiceAccount
271
+
name: helm-controller
272
+
namespace: flux-system
273
+
---
274
+
apiVersion: rbac.authorization.k8s.io/v1
275
+
kind: ClusterRoleBinding
276
+
metadata:
277
+
labels:
278
+
app.kubernetes.io/instance: flux-system
279
+
app.kubernetes.io/part-of: flux
280
+
app.kubernetes.io/version: v2.8.8
281
+
name: crd-controller-flux-system
282
+
roleRef:
283
+
apiGroup: rbac.authorization.k8s.io
284
+
kind: ClusterRole
285
+
name: crd-controller-flux-system
286
+
subjects:
287
+
- kind: ServiceAccount
288
+
name: kustomize-controller
289
+
namespace: flux-system
290
+
- kind: ServiceAccount
291
+
name: helm-controller
292
+
namespace: flux-system
293
+
- kind: ServiceAccount
294
+
name: source-controller
295
+
namespace: flux-system
296
+
- kind: ServiceAccount
297
+
name: notification-controller
298
+
namespace: flux-system
299
+
- kind: ServiceAccount
300
+
name: image-reflector-controller
301
+
namespace: flux-system
302
+
- kind: ServiceAccount
303
+
name: image-automation-controller
304
+
namespace: flux-system
305
+
- kind: ServiceAccount
306
+
name: source-watcher
307
+
namespace: flux-system
308
+
---
309
+
apiVersion: apiextensions.k8s.io/v1
310
+
kind: CustomResourceDefinition
311
+
metadata:
312
+
annotations:
313
+
controller-gen.kubebuilder.io/version: v0.19.0
314
+
labels:
315
+
app.kubernetes.io/component: source-controller
316
+
app.kubernetes.io/instance: flux-system
317
+
app.kubernetes.io/part-of: flux
318
+
app.kubernetes.io/version: v2.8.8
319
+
name: buckets.source.toolkit.fluxcd.io
320
+
spec:
321
+
group: source.toolkit.fluxcd.io
322
+
names:
323
+
kind: Bucket
324
+
listKind: BucketList
325
+
plural: buckets
326
+
singular: bucket
327
+
scope: Namespaced
328
+
versions:
329
+
- additionalPrinterColumns:
330
+
- jsonPath: .spec.endpoint
331
+
name: Endpoint
332
+
type: string
333
+
- jsonPath: .metadata.creationTimestamp
334
+
name: Age
335
+
type: date
336
+
- jsonPath: .status.conditions[?(@.type=="Ready")].status
337
+
name: Ready
338
+
type: string
339
+
- jsonPath: .status.conditions[?(@.type=="Ready")].message
340
+
name: Status
341
+
type: string
342
+
name: v1
343
+
schema:
344
+
openAPIV3Schema:
345
+
description: Bucket is the Schema for the buckets API.
346
+
properties:
347
+
apiVersion:
348
+
description: |-
349
+
APIVersion defines the versioned schema of this representation of an object.
350
+
Servers should convert recognized schemas to the latest internal value, and
351
+
may reject unrecognized values.
352
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
353
+
type: string
354
+
kind:
355
+
description: |-
356
+
Kind is a string value representing the REST resource this object represents.
357
+
Servers may infer this from the endpoint the client submits requests to.
358
+
Cannot be updated.
359
+
In CamelCase.
360
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
361
+
type: string
362
+
metadata:
363
+
type: object
364
+
spec:
365
+
description: |-
366
+
BucketSpec specifies the required configuration to produce an Artifact for
367
+
an object storage bucket.
368
+
properties:
369
+
bucketName:
370
+
description: BucketName is the name of the object storage bucket.
371
+
type: string
372
+
certSecretRef:
373
+
description: |-
374
+
CertSecretRef can be given the name of a Secret containing
375
+
either or both of
376
+
377
+
- a PEM-encoded client certificate (`tls.crt`) and private
378
+
key (`tls.key`);
379
+
- a PEM-encoded CA certificate (`ca.crt`)
380
+
381
+
and whichever are supplied, will be used for connecting to the
382
+
bucket. The client cert and key are useful if you are
383
+
authenticating with a certificate; the CA cert is useful if
384
+
you are using a self-signed server certificate. The Secret must
385
+
be of type `Opaque` or `kubernetes.io/tls`.
386
+
387
+
This field is only supported for the `generic` provider.
388
+
properties:
389
+
name:
390
+
description: Name of the referent.
391
+
type: string
392
+
required:
393
+
- name
394
+
type: object
395
+
endpoint:
396
+
description: Endpoint is the object storage address the BucketName
397
+
is located at.
398
+
type: string
399
+
ignore:
400
+
description: |-
401
+
Ignore overrides the set of excluded patterns in the .sourceignore format
402
+
(which is the same as .gitignore). If not provided, a default will be used,
403
+
consult the documentation for your version to find out what those are.
404
+
type: string
405
+
insecure:
406
+
description: Insecure allows connecting to a non-TLS HTTP Endpoint.
407
+
type: boolean
408
+
interval:
409
+
description: |-
410
+
Interval at which the Bucket Endpoint is checked for updates.
411
+
This interval is approximate and may be subject to jitter to ensure
412
+
efficient use of resources.
413
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
414
+
type: string
415
+
prefix:
416
+
description: Prefix to use for server-side filtering of files in the
417
+
Bucket.
418
+
type: string
419
+
provider:
420
+
default: generic
421
+
description: |-
422
+
Provider of the object storage bucket.
423
+
Defaults to 'generic', which expects an S3 (API) compatible object
424
+
storage.
425
+
enum:
426
+
- generic
427
+
- aws
428
+
- gcp
429
+
- azure
430
+
type: string
431
+
proxySecretRef:
432
+
description: |-
433
+
ProxySecretRef specifies the Secret containing the proxy configuration
434
+
to use while communicating with the Bucket server.
435
+
properties:
436
+
name:
437
+
description: Name of the referent.
438
+
type: string
439
+
required:
440
+
- name
441
+
type: object
442
+
region:
443
+
description: Region of the Endpoint where the BucketName is located
444
+
in.
445
+
type: string
446
+
secretRef:
447
+
description: |-
448
+
SecretRef specifies the Secret containing authentication credentials
449
+
for the Bucket.
450
+
properties:
451
+
name:
452
+
description: Name of the referent.
453
+
type: string
454
+
required:
455
+
- name
456
+
type: object
457
+
serviceAccountName:
458
+
description: |-
459
+
ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
460
+
the bucket. This field is only supported for the 'gcp' and 'aws' providers.
461
+
For more information about workload identity:
462
+
https://fluxcd.io/flux/components/source/buckets/#workload-identity
463
+
type: string
464
+
sts:
465
+
description: |-
466
+
STS specifies the required configuration to use a Security Token
467
+
Service for fetching temporary credentials to authenticate in a
468
+
Bucket provider.
469
+
470
+
This field is only supported for the `aws` and `generic` providers.
471
+
properties:
472
+
certSecretRef:
473
+
description: |-
474
+
CertSecretRef can be given the name of a Secret containing
475
+
either or both of
476
+
477
+
- a PEM-encoded client certificate (`tls.crt`) and private
478
+
key (`tls.key`);
479
+
- a PEM-encoded CA certificate (`ca.crt`)
480
+
481
+
and whichever are supplied, will be used for connecting to the
482
+
STS endpoint. The client cert and key are useful if you are
483
+
authenticating with a certificate; the CA cert is useful if
484
+
you are using a self-signed server certificate. The Secret must
485
+
be of type `Opaque` or `kubernetes.io/tls`.
486
+
487
+
This field is only supported for the `ldap` provider.
488
+
properties:
489
+
name:
490
+
description: Name of the referent.
491
+
type: string
492
+
required:
493
+
- name
494
+
type: object
495
+
endpoint:
496
+
description: |-
497
+
Endpoint is the HTTP/S endpoint of the Security Token Service from
498
+
where temporary credentials will be fetched.
499
+
pattern: ^(http|https)://.*$
500
+
type: string
501
+
provider:
502
+
description: Provider of the Security Token Service.
503
+
enum:
504
+
- aws
505
+
- ldap
506
+
type: string
507
+
secretRef:
508
+
description: |-
509
+
SecretRef specifies the Secret containing authentication credentials
510
+
for the STS endpoint. This Secret must contain the fields `username`
511
+
and `password` and is supported only for the `ldap` provider.
512
+
properties:
513
+
name:
514
+
description: Name of the referent.
515
+
type: string
516
+
required:
517
+
- name
518
+
type: object
519
+
required:
520
+
- endpoint
521
+
- provider
522
+
type: object
523
+
suspend:
524
+
description: |-
525
+
Suspend tells the controller to suspend the reconciliation of this
526
+
Bucket.
527
+
type: boolean
528
+
timeout:
529
+
default: 60s
530
+
description: Timeout for fetch operations, defaults to 60s.
531
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$
532
+
type: string
533
+
required:
534
+
- bucketName
535
+
- endpoint
536
+
- interval
537
+
type: object
538
+
x-kubernetes-validations:
539
+
- message: STS configuration is only supported for the 'aws' and 'generic'
540
+
Bucket providers
541
+
rule: self.provider == 'aws' || self.provider == 'generic' || !has(self.sts)
542
+
- message: '''aws'' is the only supported STS provider for the ''aws''
543
+
Bucket provider'
544
+
rule: self.provider != 'aws' || !has(self.sts) || self.sts.provider
545
+
== 'aws'
546
+
- message: '''ldap'' is the only supported STS provider for the ''generic''
547
+
Bucket provider'
548
+
rule: self.provider != 'generic' || !has(self.sts) || self.sts.provider
549
+
== 'ldap'
550
+
- message: spec.sts.secretRef is not required for the 'aws' STS provider
551
+
rule: '!has(self.sts) || self.sts.provider != ''aws'' || !has(self.sts.secretRef)'
552
+
- message: spec.sts.certSecretRef is not required for the 'aws' STS provider
553
+
rule: '!has(self.sts) || self.sts.provider != ''aws'' || !has(self.sts.certSecretRef)'
554
+
- message: ServiceAccountName is not supported for the 'generic' Bucket
555
+
provider
556
+
rule: self.provider != 'generic' || !has(self.serviceAccountName)
557
+
- message: cannot set both .spec.secretRef and .spec.serviceAccountName
558
+
rule: '!has(self.secretRef) || !has(self.serviceAccountName)'
559
+
status:
560
+
default:
561
+
observedGeneration: -1
562
+
description: BucketStatus records the observed state of a Bucket.
563
+
properties:
564
+
artifact:
565
+
description: Artifact represents the last successful Bucket reconciliation.
566
+
properties:
567
+
digest:
568
+
description: Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
569
+
pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$
570
+
type: string
571
+
lastUpdateTime:
572
+
description: |-
573
+
LastUpdateTime is the timestamp corresponding to the last update of the
574
+
Artifact.
575
+
format: date-time
576
+
type: string
577
+
metadata:
578
+
additionalProperties:
579
+
type: string
580
+
description: Metadata holds upstream information such as OCI annotations.
581
+
type: object
582
+
path:
583
+
description: |-
584
+
Path is the relative file path of the Artifact. It can be used to locate
585
+
the file in the root of the Artifact storage on the local file system of
586
+
the controller managing the Source.
587
+
type: string
588
+
revision:
589
+
description: |-
590
+
Revision is a human-readable identifier traceable in the origin source
591
+
system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
592
+
type: string
593
+
size:
594
+
description: Size is the number of bytes in the file.
595
+
format: int64
596
+
type: integer
597
+
url:
598
+
description: |-
599
+
URL is the HTTP address of the Artifact as exposed by the controller
600
+
managing the Source. It can be used to retrieve the Artifact for
601
+
consumption, e.g. by another controller applying the Artifact contents.
602
+
type: string
603
+
required:
604
+
- digest
605
+
- lastUpdateTime
606
+
- path
607
+
- revision
608
+
- url
609
+
type: object
610
+
conditions:
611
+
description: Conditions holds the conditions for the Bucket.
612
+
items:
613
+
description: Condition contains details for one aspect of the current
614
+
state of this API Resource.
615
+
properties:
616
+
lastTransitionTime:
617
+
description: |-
618
+
lastTransitionTime is the last time the condition transitioned from one status to another.
619
+
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
620
+
format: date-time
621
+
type: string
622
+
message:
623
+
description: |-
624
+
message is a human readable message indicating details about the transition.
625
+
This may be an empty string.
626
+
maxLength: 32768
627
+
type: string
628
+
observedGeneration:
629
+
description: |-
630
+
observedGeneration represents the .metadata.generation that the condition was set based upon.
631
+
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
632
+
with respect to the current state of the instance.
633
+
format: int64
634
+
minimum: 0
635
+
type: integer
636
+
reason:
637
+
description: |-
638
+
reason contains a programmatic identifier indicating the reason for the condition's last transition.
639
+
Producers of specific condition types may define expected values and meanings for this field,
640
+
and whether the values are considered a guaranteed API.
641
+
The value should be a CamelCase string.
642
+
This field may not be empty.
643
+
maxLength: 1024
644
+
minLength: 1
645
+
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
646
+
type: string
647
+
status:
648
+
description: status of the condition, one of True, False, Unknown.
649
+
enum:
650
+
- "True"
651
+
- "False"
652
+
- Unknown
653
+
type: string
654
+
type:
655
+
description: type of condition in CamelCase or in foo.example.com/CamelCase.
656
+
maxLength: 316
657
+
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
658
+
type: string
659
+
required:
660
+
- lastTransitionTime
661
+
- message
662
+
- reason
663
+
- status
664
+
- type
665
+
type: object
666
+
type: array
667
+
lastHandledReconcileAt:
668
+
description: |-
669
+
LastHandledReconcileAt holds the value of the most recent
670
+
reconcile request value, so a change of the annotation value
671
+
can be detected.
672
+
type: string
673
+
observedGeneration:
674
+
description: ObservedGeneration is the last observed generation of
675
+
the Bucket object.
676
+
format: int64
677
+
type: integer
678
+
observedIgnore:
679
+
description: |-
680
+
ObservedIgnore is the observed exclusion patterns used for constructing
681
+
the source artifact.
682
+
type: string
683
+
url:
684
+
description: |-
685
+
URL is the dynamic fetch link for the latest Artifact.
686
+
It is provided on a "best effort" basis, and using the precise
687
+
BucketStatus.Artifact data is recommended.
688
+
type: string
689
+
type: object
690
+
type: object
691
+
served: true
692
+
storage: true
693
+
subresources:
694
+
status: {}
695
+
---
696
+
apiVersion: apiextensions.k8s.io/v1
697
+
kind: CustomResourceDefinition
698
+
metadata:
699
+
annotations:
700
+
controller-gen.kubebuilder.io/version: v0.19.0
701
+
labels:
702
+
app.kubernetes.io/component: source-controller
703
+
app.kubernetes.io/instance: flux-system
704
+
app.kubernetes.io/part-of: flux
705
+
app.kubernetes.io/version: v2.8.8
706
+
name: externalartifacts.source.toolkit.fluxcd.io
707
+
spec:
708
+
group: source.toolkit.fluxcd.io
709
+
names:
710
+
kind: ExternalArtifact
711
+
listKind: ExternalArtifactList
712
+
plural: externalartifacts
713
+
singular: externalartifact
714
+
scope: Namespaced
715
+
versions:
716
+
- additionalPrinterColumns:
717
+
- jsonPath: .metadata.creationTimestamp
718
+
name: Age
719
+
type: date
720
+
- jsonPath: .status.conditions[?(@.type=="Ready")].status
721
+
name: Ready
722
+
type: string
723
+
- jsonPath: .status.conditions[?(@.type=="Ready")].message
724
+
name: Status
725
+
type: string
726
+
- jsonPath: .spec.sourceRef.name
727
+
name: Source
728
+
type: string
729
+
name: v1
730
+
schema:
731
+
openAPIV3Schema:
732
+
description: ExternalArtifact is the Schema for the external artifacts API
733
+
properties:
734
+
apiVersion:
735
+
description: |-
736
+
APIVersion defines the versioned schema of this representation of an object.
737
+
Servers should convert recognized schemas to the latest internal value, and
738
+
may reject unrecognized values.
739
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
740
+
type: string
741
+
kind:
742
+
description: |-
743
+
Kind is a string value representing the REST resource this object represents.
744
+
Servers may infer this from the endpoint the client submits requests to.
745
+
Cannot be updated.
746
+
In CamelCase.
747
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
748
+
type: string
749
+
metadata:
750
+
type: object
751
+
spec:
752
+
description: ExternalArtifactSpec defines the desired state of ExternalArtifact
753
+
properties:
754
+
sourceRef:
755
+
description: |-
756
+
SourceRef points to the Kubernetes custom resource for
757
+
which the artifact is generated.
758
+
properties:
759
+
apiVersion:
760
+
description: API version of the referent, if not specified the
761
+
Kubernetes preferred version will be used.
762
+
type: string
763
+
kind:
764
+
description: Kind of the referent.
765
+
type: string
766
+
name:
767
+
description: Name of the referent.
768
+
type: string
769
+
namespace:
770
+
description: Namespace of the referent, when not specified it
771
+
acts as LocalObjectReference.
772
+
type: string
773
+
required:
774
+
- kind
775
+
- name
776
+
type: object
777
+
type: object
778
+
status:
779
+
description: ExternalArtifactStatus defines the observed state of ExternalArtifact
780
+
properties:
781
+
artifact:
782
+
description: Artifact represents the output of an ExternalArtifact
783
+
reconciliation.
784
+
properties:
785
+
digest:
786
+
description: Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
787
+
pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$
788
+
type: string
789
+
lastUpdateTime:
790
+
description: |-
791
+
LastUpdateTime is the timestamp corresponding to the last update of the
792
+
Artifact.
793
+
format: date-time
794
+
type: string
795
+
metadata:
796
+
additionalProperties:
797
+
type: string
798
+
description: Metadata holds upstream information such as OCI annotations.
799
+
type: object
800
+
path:
801
+
description: |-
802
+
Path is the relative file path of the Artifact. It can be used to locate
803
+
the file in the root of the Artifact storage on the local file system of
804
+
the controller managing the Source.
805
+
type: string
806
+
revision:
807
+
description: |-
808
+
Revision is a human-readable identifier traceable in the origin source
809
+
system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
810
+
type: string
811
+
size:
812
+
description: Size is the number of bytes in the file.
813
+
format: int64
814
+
type: integer
815
+
url:
816
+
description: |-
817
+
URL is the HTTP address of the Artifact as exposed by the controller
818
+
managing the Source. It can be used to retrieve the Artifact for
819
+
consumption, e.g. by another controller applying the Artifact contents.
820
+
type: string
821
+
required:
822
+
- digest
823
+
- lastUpdateTime
824
+
- path
825
+
- revision
826
+
- url
827
+
type: object
828
+
conditions:
829
+
description: Conditions holds the conditions for the ExternalArtifact.
830
+
items:
831
+
description: Condition contains details for one aspect of the current
832
+
state of this API Resource.
833
+
properties:
834
+
lastTransitionTime:
835
+
description: |-
836
+
lastTransitionTime is the last time the condition transitioned from one status to another.
837
+
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
838
+
format: date-time
839
+
type: string
840
+
message:
841
+
description: |-
842
+
message is a human readable message indicating details about the transition.
843
+
This may be an empty string.
844
+
maxLength: 32768
845
+
type: string
846
+
observedGeneration:
847
+
description: |-
848
+
observedGeneration represents the .metadata.generation that the condition was set based upon.
849
+
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
850
+
with respect to the current state of the instance.
851
+
format: int64
852
+
minimum: 0
853
+
type: integer
854
+
reason:
855
+
description: |-
856
+
reason contains a programmatic identifier indicating the reason for the condition's last transition.
857
+
Producers of specific condition types may define expected values and meanings for this field,
858
+
and whether the values are considered a guaranteed API.
859
+
The value should be a CamelCase string.
860
+
This field may not be empty.
861
+
maxLength: 1024
862
+
minLength: 1
863
+
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
864
+
type: string
865
+
status:
866
+
description: status of the condition, one of True, False, Unknown.
867
+
enum:
868
+
- "True"
869
+
- "False"
870
+
- Unknown
871
+
type: string
872
+
type:
873
+
description: type of condition in CamelCase or in foo.example.com/CamelCase.
874
+
maxLength: 316
875
+
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
876
+
type: string
877
+
required:
878
+
- lastTransitionTime
879
+
- message
880
+
- reason
881
+
- status
882
+
- type
883
+
type: object
884
+
type: array
885
+
type: object
886
+
type: object
887
+
served: true
888
+
storage: true
889
+
subresources:
890
+
status: {}
891
+
---
892
+
apiVersion: apiextensions.k8s.io/v1
893
+
kind: CustomResourceDefinition
894
+
metadata:
895
+
annotations:
896
+
controller-gen.kubebuilder.io/version: v0.19.0
897
+
labels:
898
+
app.kubernetes.io/component: source-controller
899
+
app.kubernetes.io/instance: flux-system
900
+
app.kubernetes.io/part-of: flux
901
+
app.kubernetes.io/version: v2.8.8
902
+
name: gitrepositories.source.toolkit.fluxcd.io
903
+
spec:
904
+
group: source.toolkit.fluxcd.io
905
+
names:
906
+
kind: GitRepository
907
+
listKind: GitRepositoryList
908
+
plural: gitrepositories
909
+
shortNames:
910
+
- gitrepo
911
+
singular: gitrepository
912
+
scope: Namespaced
913
+
versions:
914
+
- additionalPrinterColumns:
915
+
- jsonPath: .spec.url
916
+
name: URL
917
+
type: string
918
+
- jsonPath: .metadata.creationTimestamp
919
+
name: Age
920
+
type: date
921
+
- jsonPath: .status.conditions[?(@.type=="Ready")].status
922
+
name: Ready
923
+
type: string
924
+
- jsonPath: .status.conditions[?(@.type=="Ready")].message
925
+
name: Status
926
+
type: string
927
+
name: v1
928
+
schema:
929
+
openAPIV3Schema:
930
+
description: GitRepository is the Schema for the gitrepositories API.
931
+
properties:
932
+
apiVersion:
933
+
description: |-
934
+
APIVersion defines the versioned schema of this representation of an object.
935
+
Servers should convert recognized schemas to the latest internal value, and
936
+
may reject unrecognized values.
937
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
938
+
type: string
939
+
kind:
940
+
description: |-
941
+
Kind is a string value representing the REST resource this object represents.
942
+
Servers may infer this from the endpoint the client submits requests to.
943
+
Cannot be updated.
944
+
In CamelCase.
945
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
946
+
type: string
947
+
metadata:
948
+
type: object
949
+
spec:
950
+
description: |-
951
+
GitRepositorySpec specifies the required configuration to produce an
952
+
Artifact for a Git repository.
953
+
properties:
954
+
ignore:
955
+
description: |-
956
+
Ignore overrides the set of excluded patterns in the .sourceignore format
957
+
(which is the same as .gitignore). If not provided, a default will be used,
958
+
consult the documentation for your version to find out what those are.
959
+
type: string
960
+
include:
961
+
description: |-
962
+
Include specifies a list of GitRepository resources which Artifacts
963
+
should be included in the Artifact produced for this GitRepository.
964
+
items:
965
+
description: |-
966
+
GitRepositoryInclude specifies a local reference to a GitRepository which
967
+
Artifact (sub-)contents must be included, and where they should be placed.
968
+
properties:
969
+
fromPath:
970
+
description: |-
971
+
FromPath specifies the path to copy contents from, defaults to the root
972
+
of the Artifact.
973
+
type: string
974
+
repository:
975
+
description: |-
976
+
GitRepositoryRef specifies the GitRepository which Artifact contents
977
+
must be included.
978
+
properties:
979
+
name:
980
+
description: Name of the referent.
981
+
type: string
982
+
required:
983
+
- name
984
+
type: object
985
+
toPath:
986
+
description: |-
987
+
ToPath specifies the path to copy contents to, defaults to the name of
988
+
the GitRepositoryRef.
989
+
type: string
990
+
required:
991
+
- repository
992
+
type: object
993
+
type: array
994
+
interval:
995
+
description: |-
996
+
Interval at which the GitRepository URL is checked for updates.
997
+
This interval is approximate and may be subject to jitter to ensure
998
+
efficient use of resources.
999
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
1000
+
type: string
1001
+
provider:
1002
+
description: |-
1003
+
Provider used for authentication, can be 'azure', 'github', 'generic'.
1004
+
When not specified, defaults to 'generic'.
1005
+
enum:
1006
+
- generic
1007
+
- azure
1008
+
- github
1009
+
type: string
1010
+
proxySecretRef:
1011
+
description: |-
1012
+
ProxySecretRef specifies the Secret containing the proxy configuration
1013
+
to use while communicating with the Git server.
1014
+
properties:
1015
+
name:
1016
+
description: Name of the referent.
1017
+
type: string
1018
+
required:
1019
+
- name
1020
+
type: object
1021
+
recurseSubmodules:
1022
+
description: |-
1023
+
RecurseSubmodules enables the initialization of all submodules within
1024
+
the GitRepository as cloned from the URL, using their default settings.
1025
+
type: boolean
1026
+
ref:
1027
+
description: |-
1028
+
Reference specifies the Git reference to resolve and monitor for
1029
+
changes, defaults to the 'master' branch.
1030
+
properties:
1031
+
branch:
1032
+
description: Branch to check out, defaults to 'master' if no other
1033
+
field is defined.
1034
+
type: string
1035
+
commit:
1036
+
description: |-
1037
+
Commit SHA to check out, takes precedence over all reference fields.
1038
+
1039
+
This can be combined with Branch to shallow clone the branch, in which
1040
+
the commit is expected to exist.
1041
+
type: string
1042
+
name:
1043
+
description: |-
1044
+
Name of the reference to check out; takes precedence over Branch, Tag and SemVer.
1045
+
1046
+
It must be a valid Git reference: https://git-scm.com/docs/git-check-ref-format#_description
1047
+
Examples: "refs/heads/main", "refs/tags/v0.1.0", "refs/pull/420/head", "refs/merge-requests/1/head"
1048
+
type: string
1049
+
semver:
1050
+
description: SemVer tag expression to check out, takes precedence
1051
+
over Tag.
1052
+
type: string
1053
+
tag:
1054
+
description: Tag to check out, takes precedence over Branch.
1055
+
type: string
1056
+
type: object
1057
+
secretRef:
1058
+
description: |-
1059
+
SecretRef specifies the Secret containing authentication credentials for
1060
+
the GitRepository.
1061
+
For HTTPS repositories the Secret must contain 'username' and 'password'
1062
+
fields for basic auth or 'bearerToken' field for token auth.
1063
+
For SSH repositories the Secret must contain 'identity'
1064
+
and 'known_hosts' fields.
1065
+
properties:
1066
+
name:
1067
+
description: Name of the referent.
1068
+
type: string
1069
+
required:
1070
+
- name
1071
+
type: object
1072
+
serviceAccountName:
1073
+
description: |-
1074
+
ServiceAccountName is the name of the Kubernetes ServiceAccount used to
1075
+
authenticate to the GitRepository. This field is only supported for 'azure' provider.
1076
+
type: string
1077
+
sparseCheckout:
1078
+
description: |-
1079
+
SparseCheckout specifies a list of directories to checkout when cloning
1080
+
the repository. If specified, only these directories are included in the
1081
+
Artifact produced for this GitRepository.
1082
+
items:
1083
+
type: string
1084
+
type: array
1085
+
suspend:
1086
+
description: |-
1087
+
Suspend tells the controller to suspend the reconciliation of this
1088
+
GitRepository.
1089
+
type: boolean
1090
+
timeout:
1091
+
default: 60s
1092
+
description: Timeout for Git operations like cloning, defaults to
1093
+
60s.
1094
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$
1095
+
type: string
1096
+
url:
1097
+
description: URL specifies the Git repository URL, it can be an HTTP/S
1098
+
or SSH address.
1099
+
pattern: ^(http|https|ssh)://.*$
1100
+
type: string
1101
+
verify:
1102
+
description: |-
1103
+
Verification specifies the configuration to verify the Git commit
1104
+
signature(s).
1105
+
properties:
1106
+
mode:
1107
+
default: HEAD
1108
+
description: |-
1109
+
Mode specifies which Git object(s) should be verified.
1110
+
1111
+
The variants "head" and "HEAD" both imply the same thing, i.e. verify
1112
+
the commit that the HEAD of the Git repository points to. The variant
1113
+
"head" solely exists to ensure backwards compatibility.
1114
+
enum:
1115
+
- head
1116
+
- HEAD
1117
+
- Tag
1118
+
- TagAndHEAD
1119
+
type: string
1120
+
secretRef:
1121
+
description: |-
1122
+
SecretRef specifies the Secret containing the public keys of trusted Git
1123
+
authors.
1124
+
properties:
1125
+
name:
1126
+
description: Name of the referent.
1127
+
type: string
1128
+
required:
1129
+
- name
1130
+
type: object
1131
+
required:
1132
+
- secretRef
1133
+
type: object
1134
+
required:
1135
+
- interval
1136
+
- url
1137
+
type: object
1138
+
x-kubernetes-validations:
1139
+
- message: serviceAccountName can only be set when provider is 'azure'
1140
+
rule: '!has(self.serviceAccountName) || (has(self.provider) && self.provider
1141
+
== ''azure'')'
1142
+
status:
1143
+
default:
1144
+
observedGeneration: -1
1145
+
description: GitRepositoryStatus records the observed state of a Git repository.
1146
+
properties:
1147
+
artifact:
1148
+
description: Artifact represents the last successful GitRepository
1149
+
reconciliation.
1150
+
properties:
1151
+
digest:
1152
+
description: Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
1153
+
pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$
1154
+
type: string
1155
+
lastUpdateTime:
1156
+
description: |-
1157
+
LastUpdateTime is the timestamp corresponding to the last update of the
1158
+
Artifact.
1159
+
format: date-time
1160
+
type: string
1161
+
metadata:
1162
+
additionalProperties:
1163
+
type: string
1164
+
description: Metadata holds upstream information such as OCI annotations.
1165
+
type: object
1166
+
path:
1167
+
description: |-
1168
+
Path is the relative file path of the Artifact. It can be used to locate
1169
+
the file in the root of the Artifact storage on the local file system of
1170
+
the controller managing the Source.
1171
+
type: string
1172
+
revision:
1173
+
description: |-
1174
+
Revision is a human-readable identifier traceable in the origin source
1175
+
system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
1176
+
type: string
1177
+
size:
1178
+
description: Size is the number of bytes in the file.
1179
+
format: int64
1180
+
type: integer
1181
+
url:
1182
+
description: |-
1183
+
URL is the HTTP address of the Artifact as exposed by the controller
1184
+
managing the Source. It can be used to retrieve the Artifact for
1185
+
consumption, e.g. by another controller applying the Artifact contents.
1186
+
type: string
1187
+
required:
1188
+
- digest
1189
+
- lastUpdateTime
1190
+
- path
1191
+
- revision
1192
+
- url
1193
+
type: object
1194
+
conditions:
1195
+
description: Conditions holds the conditions for the GitRepository.
1196
+
items:
1197
+
description: Condition contains details for one aspect of the current
1198
+
state of this API Resource.
1199
+
properties:
1200
+
lastTransitionTime:
1201
+
description: |-
1202
+
lastTransitionTime is the last time the condition transitioned from one status to another.
1203
+
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
1204
+
format: date-time
1205
+
type: string
1206
+
message:
1207
+
description: |-
1208
+
message is a human readable message indicating details about the transition.
1209
+
This may be an empty string.
1210
+
maxLength: 32768
1211
+
type: string
1212
+
observedGeneration:
1213
+
description: |-
1214
+
observedGeneration represents the .metadata.generation that the condition was set based upon.
1215
+
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
1216
+
with respect to the current state of the instance.
1217
+
format: int64
1218
+
minimum: 0
1219
+
type: integer
1220
+
reason:
1221
+
description: |-
1222
+
reason contains a programmatic identifier indicating the reason for the condition's last transition.
1223
+
Producers of specific condition types may define expected values and meanings for this field,
1224
+
and whether the values are considered a guaranteed API.
1225
+
The value should be a CamelCase string.
1226
+
This field may not be empty.
1227
+
maxLength: 1024
1228
+
minLength: 1
1229
+
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
1230
+
type: string
1231
+
status:
1232
+
description: status of the condition, one of True, False, Unknown.
1233
+
enum:
1234
+
- "True"
1235
+
- "False"
1236
+
- Unknown
1237
+
type: string
1238
+
type:
1239
+
description: type of condition in CamelCase or in foo.example.com/CamelCase.
1240
+
maxLength: 316
1241
+
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
1242
+
type: string
1243
+
required:
1244
+
- lastTransitionTime
1245
+
- message
1246
+
- reason
1247
+
- status
1248
+
- type
1249
+
type: object
1250
+
type: array
1251
+
includedArtifacts:
1252
+
description: |-
1253
+
IncludedArtifacts contains a list of the last successfully included
1254
+
Artifacts as instructed by GitRepositorySpec.Include.
1255
+
items:
1256
+
description: Artifact represents the output of a Source reconciliation.
1257
+
properties:
1258
+
digest:
1259
+
description: Digest is the digest of the file in the form of
1260
+
'<algorithm>:<checksum>'.
1261
+
pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$
1262
+
type: string
1263
+
lastUpdateTime:
1264
+
description: |-
1265
+
LastUpdateTime is the timestamp corresponding to the last update of the
1266
+
Artifact.
1267
+
format: date-time
1268
+
type: string
1269
+
metadata:
1270
+
additionalProperties:
1271
+
type: string
1272
+
description: Metadata holds upstream information such as OCI
1273
+
annotations.
1274
+
type: object
1275
+
path:
1276
+
description: |-
1277
+
Path is the relative file path of the Artifact. It can be used to locate
1278
+
the file in the root of the Artifact storage on the local file system of
1279
+
the controller managing the Source.
1280
+
type: string
1281
+
revision:
1282
+
description: |-
1283
+
Revision is a human-readable identifier traceable in the origin source
1284
+
system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
1285
+
type: string
1286
+
size:
1287
+
description: Size is the number of bytes in the file.
1288
+
format: int64
1289
+
type: integer
1290
+
url:
1291
+
description: |-
1292
+
URL is the HTTP address of the Artifact as exposed by the controller
1293
+
managing the Source. It can be used to retrieve the Artifact for
1294
+
consumption, e.g. by another controller applying the Artifact contents.
1295
+
type: string
1296
+
required:
1297
+
- digest
1298
+
- lastUpdateTime
1299
+
- path
1300
+
- revision
1301
+
- url
1302
+
type: object
1303
+
type: array
1304
+
lastHandledReconcileAt:
1305
+
description: |-
1306
+
LastHandledReconcileAt holds the value of the most recent
1307
+
reconcile request value, so a change of the annotation value
1308
+
can be detected.
1309
+
type: string
1310
+
observedGeneration:
1311
+
description: |-
1312
+
ObservedGeneration is the last observed generation of the GitRepository
1313
+
object.
1314
+
format: int64
1315
+
type: integer
1316
+
observedIgnore:
1317
+
description: |-
1318
+
ObservedIgnore is the observed exclusion patterns used for constructing
1319
+
the source artifact.
1320
+
type: string
1321
+
observedInclude:
1322
+
description: |-
1323
+
ObservedInclude is the observed list of GitRepository resources used to
1324
+
produce the current Artifact.
1325
+
items:
1326
+
description: |-
1327
+
GitRepositoryInclude specifies a local reference to a GitRepository which
1328
+
Artifact (sub-)contents must be included, and where they should be placed.
1329
+
properties:
1330
+
fromPath:
1331
+
description: |-
1332
+
FromPath specifies the path to copy contents from, defaults to the root
1333
+
of the Artifact.
1334
+
type: string
1335
+
repository:
1336
+
description: |-
1337
+
GitRepositoryRef specifies the GitRepository which Artifact contents
1338
+
must be included.
1339
+
properties:
1340
+
name:
1341
+
description: Name of the referent.
1342
+
type: string
1343
+
required:
1344
+
- name
1345
+
type: object
1346
+
toPath:
1347
+
description: |-
1348
+
ToPath specifies the path to copy contents to, defaults to the name of
1349
+
the GitRepositoryRef.
1350
+
type: string
1351
+
required:
1352
+
- repository
1353
+
type: object
1354
+
type: array
1355
+
observedRecurseSubmodules:
1356
+
description: |-
1357
+
ObservedRecurseSubmodules is the observed resource submodules
1358
+
configuration used to produce the current Artifact.
1359
+
type: boolean
1360
+
observedSparseCheckout:
1361
+
description: |-
1362
+
ObservedSparseCheckout is the observed list of directories used to
1363
+
produce the current Artifact.
1364
+
items:
1365
+
type: string
1366
+
type: array
1367
+
sourceVerificationMode:
1368
+
description: |-
1369
+
SourceVerificationMode is the last used verification mode indicating
1370
+
which Git object(s) have been verified.
1371
+
type: string
1372
+
type: object
1373
+
type: object
1374
+
served: true
1375
+
storage: true
1376
+
subresources:
1377
+
status: {}
1378
+
---
1379
+
apiVersion: apiextensions.k8s.io/v1
1380
+
kind: CustomResourceDefinition
1381
+
metadata:
1382
+
annotations:
1383
+
controller-gen.kubebuilder.io/version: v0.19.0
1384
+
labels:
1385
+
app.kubernetes.io/component: source-controller
1386
+
app.kubernetes.io/instance: flux-system
1387
+
app.kubernetes.io/part-of: flux
1388
+
app.kubernetes.io/version: v2.8.8
1389
+
name: helmcharts.source.toolkit.fluxcd.io
1390
+
spec:
1391
+
group: source.toolkit.fluxcd.io
1392
+
names:
1393
+
kind: HelmChart
1394
+
listKind: HelmChartList
1395
+
plural: helmcharts
1396
+
shortNames:
1397
+
- hc
1398
+
singular: helmchart
1399
+
scope: Namespaced
1400
+
versions:
1401
+
- additionalPrinterColumns:
1402
+
- jsonPath: .spec.chart
1403
+
name: Chart
1404
+
type: string
1405
+
- jsonPath: .spec.version
1406
+
name: Version
1407
+
type: string
1408
+
- jsonPath: .spec.sourceRef.kind
1409
+
name: Source Kind
1410
+
type: string
1411
+
- jsonPath: .spec.sourceRef.name
1412
+
name: Source Name
1413
+
type: string
1414
+
- jsonPath: .metadata.creationTimestamp
1415
+
name: Age
1416
+
type: date
1417
+
- jsonPath: .status.conditions[?(@.type=="Ready")].status
1418
+
name: Ready
1419
+
type: string
1420
+
- jsonPath: .status.conditions[?(@.type=="Ready")].message
1421
+
name: Status
1422
+
type: string
1423
+
name: v1
1424
+
schema:
1425
+
openAPIV3Schema:
1426
+
description: HelmChart is the Schema for the helmcharts API.
1427
+
properties:
1428
+
apiVersion:
1429
+
description: |-
1430
+
APIVersion defines the versioned schema of this representation of an object.
1431
+
Servers should convert recognized schemas to the latest internal value, and
1432
+
may reject unrecognized values.
1433
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
1434
+
type: string
1435
+
kind:
1436
+
description: |-
1437
+
Kind is a string value representing the REST resource this object represents.
1438
+
Servers may infer this from the endpoint the client submits requests to.
1439
+
Cannot be updated.
1440
+
In CamelCase.
1441
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
1442
+
type: string
1443
+
metadata:
1444
+
type: object
1445
+
spec:
1446
+
description: HelmChartSpec specifies the desired state of a Helm chart.
1447
+
properties:
1448
+
chart:
1449
+
description: |-
1450
+
Chart is the name or path the Helm chart is available at in the
1451
+
SourceRef.
1452
+
type: string
1453
+
ignoreMissingValuesFiles:
1454
+
description: |-
1455
+
IgnoreMissingValuesFiles controls whether to silently ignore missing values
1456
+
files rather than failing.
1457
+
type: boolean
1458
+
interval:
1459
+
description: |-
1460
+
Interval at which the HelmChart SourceRef is checked for updates.
1461
+
This interval is approximate and may be subject to jitter to ensure
1462
+
efficient use of resources.
1463
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
1464
+
type: string
1465
+
reconcileStrategy:
1466
+
default: ChartVersion
1467
+
description: |-
1468
+
ReconcileStrategy determines what enables the creation of a new artifact.
1469
+
Valid values are ('ChartVersion', 'Revision').
1470
+
See the documentation of the values for an explanation on their behavior.
1471
+
Defaults to ChartVersion when omitted.
1472
+
enum:
1473
+
- ChartVersion
1474
+
- Revision
1475
+
type: string
1476
+
sourceRef:
1477
+
description: SourceRef is the reference to the Source the chart is
1478
+
available at.
1479
+
properties:
1480
+
apiVersion:
1481
+
description: APIVersion of the referent.
1482
+
type: string
1483
+
kind:
1484
+
description: |-
1485
+
Kind of the referent, valid values are ('HelmRepository', 'GitRepository',
1486
+
'Bucket').
1487
+
enum:
1488
+
- HelmRepository
1489
+
- GitRepository
1490
+
- Bucket
1491
+
type: string
1492
+
name:
1493
+
description: Name of the referent.
1494
+
type: string
1495
+
required:
1496
+
- kind
1497
+
- name
1498
+
type: object
1499
+
suspend:
1500
+
description: |-
1501
+
Suspend tells the controller to suspend the reconciliation of this
1502
+
source.
1503
+
type: boolean
1504
+
valuesFiles:
1505
+
description: |-
1506
+
ValuesFiles is an alternative list of values files to use as the chart
1507
+
values (values.yaml is not included by default), expected to be a
1508
+
relative path in the SourceRef.
1509
+
Values files are merged in the order of this list with the last file
1510
+
overriding the first. Ignored when omitted.
1511
+
items:
1512
+
type: string
1513
+
type: array
1514
+
verify:
1515
+
description: |-
1516
+
Verify contains the secret name containing the trusted public keys
1517
+
used to verify the signature and specifies which provider to use to check
1518
+
whether OCI image is authentic.
1519
+
This field is only supported when using HelmRepository source with spec.type 'oci'.
1520
+
Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified.
1521
+
properties:
1522
+
matchOIDCIdentity:
1523
+
description: |-
1524
+
MatchOIDCIdentity specifies the identity matching criteria to use
1525
+
while verifying an OCI artifact which was signed using Cosign keyless
1526
+
signing. The artifact's identity is deemed to be verified if any of the
1527
+
specified matchers match against the identity.
1528
+
items:
1529
+
description: |-
1530
+
OIDCIdentityMatch specifies options for verifying the certificate identity,
1531
+
i.e. the issuer and the subject of the certificate.
1532
+
properties:
1533
+
issuer:
1534
+
description: |-
1535
+
Issuer specifies the regex pattern to match against to verify
1536
+
the OIDC issuer in the Fulcio certificate. The pattern must be a
1537
+
valid Go regular expression.
1538
+
type: string
1539
+
subject:
1540
+
description: |-
1541
+
Subject specifies the regex pattern to match against to verify
1542
+
the identity subject in the Fulcio certificate. The pattern must
1543
+
be a valid Go regular expression.
1544
+
type: string
1545
+
required:
1546
+
- issuer
1547
+
- subject
1548
+
type: object
1549
+
type: array
1550
+
provider:
1551
+
default: cosign
1552
+
description: Provider specifies the technology used to sign the
1553
+
OCI Artifact.
1554
+
enum:
1555
+
- cosign
1556
+
- notation
1557
+
type: string
1558
+
secretRef:
1559
+
description: |-
1560
+
SecretRef specifies the Kubernetes Secret containing the
1561
+
trusted public keys.
1562
+
properties:
1563
+
name:
1564
+
description: Name of the referent.
1565
+
type: string
1566
+
required:
1567
+
- name
1568
+
type: object
1569
+
required:
1570
+
- provider
1571
+
type: object
1572
+
version:
1573
+
default: '*'
1574
+
description: |-
1575
+
Version is the chart version semver expression, ignored for charts from
1576
+
GitRepository and Bucket sources. Defaults to latest when omitted.
1577
+
type: string
1578
+
required:
1579
+
- chart
1580
+
- interval
1581
+
- sourceRef
1582
+
type: object
1583
+
x-kubernetes-validations:
1584
+
- message: spec.verify is only supported when spec.sourceRef.kind is 'HelmRepository'
1585
+
rule: '!has(self.verify) || self.sourceRef.kind == ''HelmRepository'''
1586
+
status:
1587
+
default:
1588
+
observedGeneration: -1
1589
+
description: HelmChartStatus records the observed state of the HelmChart.
1590
+
properties:
1591
+
artifact:
1592
+
description: Artifact represents the output of the last successful
1593
+
reconciliation.
1594
+
properties:
1595
+
digest:
1596
+
description: Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
1597
+
pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$
1598
+
type: string
1599
+
lastUpdateTime:
1600
+
description: |-
1601
+
LastUpdateTime is the timestamp corresponding to the last update of the
1602
+
Artifact.
1603
+
format: date-time
1604
+
type: string
1605
+
metadata:
1606
+
additionalProperties:
1607
+
type: string
1608
+
description: Metadata holds upstream information such as OCI annotations.
1609
+
type: object
1610
+
path:
1611
+
description: |-
1612
+
Path is the relative file path of the Artifact. It can be used to locate
1613
+
the file in the root of the Artifact storage on the local file system of
1614
+
the controller managing the Source.
1615
+
type: string
1616
+
revision:
1617
+
description: |-
1618
+
Revision is a human-readable identifier traceable in the origin source
1619
+
system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
1620
+
type: string
1621
+
size:
1622
+
description: Size is the number of bytes in the file.
1623
+
format: int64
1624
+
type: integer
1625
+
url:
1626
+
description: |-
1627
+
URL is the HTTP address of the Artifact as exposed by the controller
1628
+
managing the Source. It can be used to retrieve the Artifact for
1629
+
consumption, e.g. by another controller applying the Artifact contents.
1630
+
type: string
1631
+
required:
1632
+
- digest
1633
+
- lastUpdateTime
1634
+
- path
1635
+
- revision
1636
+
- url
1637
+
type: object
1638
+
conditions:
1639
+
description: Conditions holds the conditions for the HelmChart.
1640
+
items:
1641
+
description: Condition contains details for one aspect of the current
1642
+
state of this API Resource.
1643
+
properties:
1644
+
lastTransitionTime:
1645
+
description: |-
1646
+
lastTransitionTime is the last time the condition transitioned from one status to another.
1647
+
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
1648
+
format: date-time
1649
+
type: string
1650
+
message:
1651
+
description: |-
1652
+
message is a human readable message indicating details about the transition.
1653
+
This may be an empty string.
1654
+
maxLength: 32768
1655
+
type: string
1656
+
observedGeneration:
1657
+
description: |-
1658
+
observedGeneration represents the .metadata.generation that the condition was set based upon.
1659
+
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
1660
+
with respect to the current state of the instance.
1661
+
format: int64
1662
+
minimum: 0
1663
+
type: integer
1664
+
reason:
1665
+
description: |-
1666
+
reason contains a programmatic identifier indicating the reason for the condition's last transition.
1667
+
Producers of specific condition types may define expected values and meanings for this field,
1668
+
and whether the values are considered a guaranteed API.
1669
+
The value should be a CamelCase string.
1670
+
This field may not be empty.
1671
+
maxLength: 1024
1672
+
minLength: 1
1673
+
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
1674
+
type: string
1675
+
status:
1676
+
description: status of the condition, one of True, False, Unknown.
1677
+
enum:
1678
+
- "True"
1679
+
- "False"
1680
+
- Unknown
1681
+
type: string
1682
+
type:
1683
+
description: type of condition in CamelCase or in foo.example.com/CamelCase.
1684
+
maxLength: 316
1685
+
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
1686
+
type: string
1687
+
required:
1688
+
- lastTransitionTime
1689
+
- message
1690
+
- reason
1691
+
- status
1692
+
- type
1693
+
type: object
1694
+
type: array
1695
+
lastHandledReconcileAt:
1696
+
description: |-
1697
+
LastHandledReconcileAt holds the value of the most recent
1698
+
reconcile request value, so a change of the annotation value
1699
+
can be detected.
1700
+
type: string
1701
+
observedChartName:
1702
+
description: |-
1703
+
ObservedChartName is the last observed chart name as specified by the
1704
+
resolved chart reference.
1705
+
type: string
1706
+
observedGeneration:
1707
+
description: |-
1708
+
ObservedGeneration is the last observed generation of the HelmChart
1709
+
object.
1710
+
format: int64
1711
+
type: integer
1712
+
observedSourceArtifactRevision:
1713
+
description: |-
1714
+
ObservedSourceArtifactRevision is the last observed Artifact.Revision
1715
+
of the HelmChartSpec.SourceRef.
1716
+
type: string
1717
+
observedValuesFiles:
1718
+
description: |-
1719
+
ObservedValuesFiles are the observed value files of the last successful
1720
+
reconciliation.
1721
+
It matches the chart in the last successfully reconciled artifact.
1722
+
items:
1723
+
type: string
1724
+
type: array
1725
+
url:
1726
+
description: |-
1727
+
URL is the dynamic fetch link for the latest Artifact.
1728
+
It is provided on a "best effort" basis, and using the precise
1729
+
BucketStatus.Artifact data is recommended.
1730
+
type: string
1731
+
type: object
1732
+
type: object
1733
+
served: true
1734
+
storage: true
1735
+
subresources:
1736
+
status: {}
1737
+
---
1738
+
apiVersion: apiextensions.k8s.io/v1
1739
+
kind: CustomResourceDefinition
1740
+
metadata:
1741
+
annotations:
1742
+
controller-gen.kubebuilder.io/version: v0.19.0
1743
+
labels:
1744
+
app.kubernetes.io/component: source-controller
1745
+
app.kubernetes.io/instance: flux-system
1746
+
app.kubernetes.io/part-of: flux
1747
+
app.kubernetes.io/version: v2.8.8
1748
+
name: helmrepositories.source.toolkit.fluxcd.io
1749
+
spec:
1750
+
group: source.toolkit.fluxcd.io
1751
+
names:
1752
+
kind: HelmRepository
1753
+
listKind: HelmRepositoryList
1754
+
plural: helmrepositories
1755
+
shortNames:
1756
+
- helmrepo
1757
+
singular: helmrepository
1758
+
scope: Namespaced
1759
+
versions:
1760
+
- additionalPrinterColumns:
1761
+
- jsonPath: .spec.url
1762
+
name: URL
1763
+
type: string
1764
+
- jsonPath: .metadata.creationTimestamp
1765
+
name: Age
1766
+
type: date
1767
+
- jsonPath: .status.conditions[?(@.type=="Ready")].status
1768
+
name: Ready
1769
+
type: string
1770
+
- jsonPath: .status.conditions[?(@.type=="Ready")].message
1771
+
name: Status
1772
+
type: string
1773
+
name: v1
1774
+
schema:
1775
+
openAPIV3Schema:
1776
+
description: HelmRepository is the Schema for the helmrepositories API.
1777
+
properties:
1778
+
apiVersion:
1779
+
description: |-
1780
+
APIVersion defines the versioned schema of this representation of an object.
1781
+
Servers should convert recognized schemas to the latest internal value, and
1782
+
may reject unrecognized values.
1783
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
1784
+
type: string
1785
+
kind:
1786
+
description: |-
1787
+
Kind is a string value representing the REST resource this object represents.
1788
+
Servers may infer this from the endpoint the client submits requests to.
1789
+
Cannot be updated.
1790
+
In CamelCase.
1791
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
1792
+
type: string
1793
+
metadata:
1794
+
type: object
1795
+
spec:
1796
+
description: |-
1797
+
HelmRepositorySpec specifies the required configuration to produce an
1798
+
Artifact for a Helm repository index YAML.
1799
+
properties:
1800
+
accessFrom:
1801
+
description: |-
1802
+
AccessFrom specifies an Access Control List for allowing cross-namespace
1803
+
references to this object.
1804
+
NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092
1805
+
properties:
1806
+
namespaceSelectors:
1807
+
description: |-
1808
+
NamespaceSelectors is the list of namespace selectors to which this ACL applies.
1809
+
Items in this list are evaluated using a logical OR operation.
1810
+
items:
1811
+
description: |-
1812
+
NamespaceSelector selects the namespaces to which this ACL applies.
1813
+
An empty map of MatchLabels matches all namespaces in a cluster.
1814
+
properties:
1815
+
matchLabels:
1816
+
additionalProperties:
1817
+
type: string
1818
+
description: |-
1819
+
MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
1820
+
map is equivalent to an element of matchExpressions, whose key field is "key", the
1821
+
operator is "In", and the values array contains only "value". The requirements are ANDed.
1822
+
type: object
1823
+
type: object
1824
+
type: array
1825
+
required:
1826
+
- namespaceSelectors
1827
+
type: object
1828
+
certSecretRef:
1829
+
description: |-
1830
+
CertSecretRef can be given the name of a Secret containing
1831
+
either or both of
1832
+
1833
+
- a PEM-encoded client certificate (`tls.crt`) and private
1834
+
key (`tls.key`);
1835
+
- a PEM-encoded CA certificate (`ca.crt`)
1836
+
1837
+
and whichever are supplied, will be used for connecting to the
1838
+
registry. The client cert and key are useful if you are
1839
+
authenticating with a certificate; the CA cert is useful if
1840
+
you are using a self-signed server certificate. The Secret must
1841
+
be of type `Opaque` or `kubernetes.io/tls`.
1842
+
1843
+
It takes precedence over the values specified in the Secret referred
1844
+
to by `.spec.secretRef`.
1845
+
properties:
1846
+
name:
1847
+
description: Name of the referent.
1848
+
type: string
1849
+
required:
1850
+
- name
1851
+
type: object
1852
+
insecure:
1853
+
description: |-
1854
+
Insecure allows connecting to a non-TLS HTTP container registry.
1855
+
This field is only taken into account if the .spec.type field is set to 'oci'.
1856
+
type: boolean
1857
+
interval:
1858
+
description: |-
1859
+
Interval at which the HelmRepository URL is checked for updates.
1860
+
This interval is approximate and may be subject to jitter to ensure
1861
+
efficient use of resources.
1862
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
1863
+
type: string
1864
+
passCredentials:
1865
+
description: |-
1866
+
PassCredentials allows the credentials from the SecretRef to be passed
1867
+
on to a host that does not match the host as defined in URL.
1868
+
This may be required if the host of the advertised chart URLs in the
1869
+
index differ from the defined URL.
1870
+
Enabling this should be done with caution, as it can potentially result
1871
+
in credentials getting stolen in a MITM-attack.
1872
+
type: boolean
1873
+
provider:
1874
+
default: generic
1875
+
description: |-
1876
+
Provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.
1877
+
This field is optional, and only taken into account if the .spec.type field is set to 'oci'.
1878
+
When not specified, defaults to 'generic'.
1879
+
enum:
1880
+
- generic
1881
+
- aws
1882
+
- azure
1883
+
- gcp
1884
+
type: string
1885
+
secretRef:
1886
+
description: |-
1887
+
SecretRef specifies the Secret containing authentication credentials
1888
+
for the HelmRepository.
1889
+
For HTTP/S basic auth the secret must contain 'username' and 'password'
1890
+
fields.
1891
+
Support for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile'
1892
+
keys is deprecated. Please use `.spec.certSecretRef` instead.
1893
+
properties:
1894
+
name:
1895
+
description: Name of the referent.
1896
+
type: string
1897
+
required:
1898
+
- name
1899
+
type: object
1900
+
suspend:
1901
+
description: |-
1902
+
Suspend tells the controller to suspend the reconciliation of this
1903
+
HelmRepository.
1904
+
type: boolean
1905
+
timeout:
1906
+
description: |-
1907
+
Timeout is used for the index fetch operation for an HTTPS helm repository,
1908
+
and for remote OCI Repository operations like pulling for an OCI helm
1909
+
chart by the associated HelmChart.
1910
+
Its default value is 60s.
1911
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$
1912
+
type: string
1913
+
type:
1914
+
description: |-
1915
+
Type of the HelmRepository.
1916
+
When this field is set to "oci", the URL field value must be prefixed with "oci://".
1917
+
enum:
1918
+
- default
1919
+
- oci
1920
+
type: string
1921
+
url:
1922
+
description: |-
1923
+
URL of the Helm repository, a valid URL contains at least a protocol and
1924
+
host.
1925
+
pattern: ^(http|https|oci)://.*$
1926
+
type: string
1927
+
required:
1928
+
- url
1929
+
type: object
1930
+
status:
1931
+
default:
1932
+
observedGeneration: -1
1933
+
description: HelmRepositoryStatus records the observed state of the HelmRepository.
1934
+
properties:
1935
+
artifact:
1936
+
description: Artifact represents the last successful HelmRepository
1937
+
reconciliation.
1938
+
properties:
1939
+
digest:
1940
+
description: Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
1941
+
pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$
1942
+
type: string
1943
+
lastUpdateTime:
1944
+
description: |-
1945
+
LastUpdateTime is the timestamp corresponding to the last update of the
1946
+
Artifact.
1947
+
format: date-time
1948
+
type: string
1949
+
metadata:
1950
+
additionalProperties:
1951
+
type: string
1952
+
description: Metadata holds upstream information such as OCI annotations.
1953
+
type: object
1954
+
path:
1955
+
description: |-
1956
+
Path is the relative file path of the Artifact. It can be used to locate
1957
+
the file in the root of the Artifact storage on the local file system of
1958
+
the controller managing the Source.
1959
+
type: string
1960
+
revision:
1961
+
description: |-
1962
+
Revision is a human-readable identifier traceable in the origin source
1963
+
system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
1964
+
type: string
1965
+
size:
1966
+
description: Size is the number of bytes in the file.
1967
+
format: int64
1968
+
type: integer
1969
+
url:
1970
+
description: |-
1971
+
URL is the HTTP address of the Artifact as exposed by the controller
1972
+
managing the Source. It can be used to retrieve the Artifact for
1973
+
consumption, e.g. by another controller applying the Artifact contents.
1974
+
type: string
1975
+
required:
1976
+
- digest
1977
+
- lastUpdateTime
1978
+
- path
1979
+
- revision
1980
+
- url
1981
+
type: object
1982
+
conditions:
1983
+
description: Conditions holds the conditions for the HelmRepository.
1984
+
items:
1985
+
description: Condition contains details for one aspect of the current
1986
+
state of this API Resource.
1987
+
properties:
1988
+
lastTransitionTime:
1989
+
description: |-
1990
+
lastTransitionTime is the last time the condition transitioned from one status to another.
1991
+
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
1992
+
format: date-time
1993
+
type: string
1994
+
message:
1995
+
description: |-
1996
+
message is a human readable message indicating details about the transition.
1997
+
This may be an empty string.
1998
+
maxLength: 32768
1999
+
type: string
2000
+
observedGeneration:
2001
+
description: |-
2002
+
observedGeneration represents the .metadata.generation that the condition was set based upon.
2003
+
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
2004
+
with respect to the current state of the instance.
2005
+
format: int64
2006
+
minimum: 0
2007
+
type: integer
2008
+
reason:
2009
+
description: |-
2010
+
reason contains a programmatic identifier indicating the reason for the condition's last transition.
2011
+
Producers of specific condition types may define expected values and meanings for this field,
2012
+
and whether the values are considered a guaranteed API.
2013
+
The value should be a CamelCase string.
2014
+
This field may not be empty.
2015
+
maxLength: 1024
2016
+
minLength: 1
2017
+
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
2018
+
type: string
2019
+
status:
2020
+
description: status of the condition, one of True, False, Unknown.
2021
+
enum:
2022
+
- "True"
2023
+
- "False"
2024
+
- Unknown
2025
+
type: string
2026
+
type:
2027
+
description: type of condition in CamelCase or in foo.example.com/CamelCase.
2028
+
maxLength: 316
2029
+
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
2030
+
type: string
2031
+
required:
2032
+
- lastTransitionTime
2033
+
- message
2034
+
- reason
2035
+
- status
2036
+
- type
2037
+
type: object
2038
+
type: array
2039
+
lastHandledReconcileAt:
2040
+
description: |-
2041
+
LastHandledReconcileAt holds the value of the most recent
2042
+
reconcile request value, so a change of the annotation value
2043
+
can be detected.
2044
+
type: string
2045
+
observedGeneration:
2046
+
description: |-
2047
+
ObservedGeneration is the last observed generation of the HelmRepository
2048
+
object.
2049
+
format: int64
2050
+
type: integer
2051
+
url:
2052
+
description: |-
2053
+
URL is the dynamic fetch link for the latest Artifact.
2054
+
It is provided on a "best effort" basis, and using the precise
2055
+
HelmRepositoryStatus.Artifact data is recommended.
2056
+
type: string
2057
+
type: object
2058
+
type: object
2059
+
served: true
2060
+
storage: true
2061
+
subresources:
2062
+
status: {}
2063
+
---
2064
+
apiVersion: apiextensions.k8s.io/v1
2065
+
kind: CustomResourceDefinition
2066
+
metadata:
2067
+
annotations:
2068
+
controller-gen.kubebuilder.io/version: v0.19.0
2069
+
labels:
2070
+
app.kubernetes.io/component: source-controller
2071
+
app.kubernetes.io/instance: flux-system
2072
+
app.kubernetes.io/part-of: flux
2073
+
app.kubernetes.io/version: v2.8.8
2074
+
name: ocirepositories.source.toolkit.fluxcd.io
2075
+
spec:
2076
+
group: source.toolkit.fluxcd.io
2077
+
names:
2078
+
kind: OCIRepository
2079
+
listKind: OCIRepositoryList
2080
+
plural: ocirepositories
2081
+
shortNames:
2082
+
- ocirepo
2083
+
singular: ocirepository
2084
+
scope: Namespaced
2085
+
versions:
2086
+
- additionalPrinterColumns:
2087
+
- jsonPath: .spec.url
2088
+
name: URL
2089
+
type: string
2090
+
- jsonPath: .status.conditions[?(@.type=="Ready")].status
2091
+
name: Ready
2092
+
type: string
2093
+
- jsonPath: .status.conditions[?(@.type=="Ready")].message
2094
+
name: Status
2095
+
type: string
2096
+
- jsonPath: .metadata.creationTimestamp
2097
+
name: Age
2098
+
type: date
2099
+
name: v1
2100
+
schema:
2101
+
openAPIV3Schema:
2102
+
description: OCIRepository is the Schema for the ocirepositories API
2103
+
properties:
2104
+
apiVersion:
2105
+
description: |-
2106
+
APIVersion defines the versioned schema of this representation of an object.
2107
+
Servers should convert recognized schemas to the latest internal value, and
2108
+
may reject unrecognized values.
2109
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
2110
+
type: string
2111
+
kind:
2112
+
description: |-
2113
+
Kind is a string value representing the REST resource this object represents.
2114
+
Servers may infer this from the endpoint the client submits requests to.
2115
+
Cannot be updated.
2116
+
In CamelCase.
2117
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
2118
+
type: string
2119
+
metadata:
2120
+
type: object
2121
+
spec:
2122
+
description: OCIRepositorySpec defines the desired state of OCIRepository
2123
+
properties:
2124
+
certSecretRef:
2125
+
description: |-
2126
+
CertSecretRef can be given the name of a Secret containing
2127
+
either or both of
2128
+
2129
+
- a PEM-encoded client certificate (`tls.crt`) and private
2130
+
key (`tls.key`);
2131
+
- a PEM-encoded CA certificate (`ca.crt`)
2132
+
2133
+
and whichever are supplied, will be used for connecting to the
2134
+
registry. The client cert and key are useful if you are
2135
+
authenticating with a certificate; the CA cert is useful if
2136
+
you are using a self-signed server certificate. The Secret must
2137
+
be of type `Opaque` or `kubernetes.io/tls`.
2138
+
properties:
2139
+
name:
2140
+
description: Name of the referent.
2141
+
type: string
2142
+
required:
2143
+
- name
2144
+
type: object
2145
+
ignore:
2146
+
description: |-
2147
+
Ignore overrides the set of excluded patterns in the .sourceignore format
2148
+
(which is the same as .gitignore). If not provided, a default will be used,
2149
+
consult the documentation for your version to find out what those are.
2150
+
type: string
2151
+
insecure:
2152
+
description: Insecure allows connecting to a non-TLS HTTP container
2153
+
registry.
2154
+
type: boolean
2155
+
interval:
2156
+
description: |-
2157
+
Interval at which the OCIRepository URL is checked for updates.
2158
+
This interval is approximate and may be subject to jitter to ensure
2159
+
efficient use of resources.
2160
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
2161
+
type: string
2162
+
layerSelector:
2163
+
description: |-
2164
+
LayerSelector specifies which layer should be extracted from the OCI artifact.
2165
+
When not specified, the first layer found in the artifact is selected.
2166
+
properties:
2167
+
mediaType:
2168
+
description: |-
2169
+
MediaType specifies the OCI media type of the layer
2170
+
which should be extracted from the OCI Artifact. The
2171
+
first layer matching this type is selected.
2172
+
type: string
2173
+
operation:
2174
+
description: |-
2175
+
Operation specifies how the selected layer should be processed.
2176
+
By default, the layer compressed content is extracted to storage.
2177
+
When the operation is set to 'copy', the layer compressed content
2178
+
is persisted to storage as it is.
2179
+
enum:
2180
+
- extract
2181
+
- copy
2182
+
type: string
2183
+
type: object
2184
+
provider:
2185
+
default: generic
2186
+
description: |-
2187
+
The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.
2188
+
When not specified, defaults to 'generic'.
2189
+
enum:
2190
+
- generic
2191
+
- aws
2192
+
- azure
2193
+
- gcp
2194
+
type: string
2195
+
proxySecretRef:
2196
+
description: |-
2197
+
ProxySecretRef specifies the Secret containing the proxy configuration
2198
+
to use while communicating with the container registry.
2199
+
properties:
2200
+
name:
2201
+
description: Name of the referent.
2202
+
type: string
2203
+
required:
2204
+
- name
2205
+
type: object
2206
+
ref:
2207
+
description: |-
2208
+
The OCI reference to pull and monitor for changes,
2209
+
defaults to the latest tag.
2210
+
properties:
2211
+
digest:
2212
+
description: |-
2213
+
Digest is the image digest to pull, takes precedence over SemVer.
2214
+
The value should be in the format 'sha256:<HASH>'.
2215
+
type: string
2216
+
semver:
2217
+
description: |-
2218
+
SemVer is the range of tags to pull selecting the latest within
2219
+
the range, takes precedence over Tag.
2220
+
type: string
2221
+
semverFilter:
2222
+
description: SemverFilter is a regex pattern to filter the tags
2223
+
within the SemVer range.
2224
+
type: string
2225
+
tag:
2226
+
description: Tag is the image tag to pull, defaults to latest.
2227
+
type: string
2228
+
type: object
2229
+
secretRef:
2230
+
description: |-
2231
+
SecretRef contains the secret name containing the registry login
2232
+
credentials to resolve image metadata.
2233
+
The secret must be of type kubernetes.io/dockerconfigjson.
2234
+
properties:
2235
+
name:
2236
+
description: Name of the referent.
2237
+
type: string
2238
+
required:
2239
+
- name
2240
+
type: object
2241
+
serviceAccountName:
2242
+
description: |-
2243
+
ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
2244
+
the image pull if the service account has attached pull secrets. For more information:
2245
+
https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account
2246
+
type: string
2247
+
suspend:
2248
+
description: This flag tells the controller to suspend the reconciliation
2249
+
of this source.
2250
+
type: boolean
2251
+
timeout:
2252
+
default: 60s
2253
+
description: The timeout for remote OCI Repository operations like
2254
+
pulling, defaults to 60s.
2255
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$
2256
+
type: string
2257
+
url:
2258
+
description: |-
2259
+
URL is a reference to an OCI artifact repository hosted
2260
+
on a remote container registry.
2261
+
pattern: ^oci://.*$
2262
+
type: string
2263
+
verify:
2264
+
description: |-
2265
+
Verify contains the secret name containing the trusted public keys
2266
+
used to verify the signature and specifies which provider to use to check
2267
+
whether OCI image is authentic.
2268
+
properties:
2269
+
matchOIDCIdentity:
2270
+
description: |-
2271
+
MatchOIDCIdentity specifies the identity matching criteria to use
2272
+
while verifying an OCI artifact which was signed using Cosign keyless
2273
+
signing. The artifact's identity is deemed to be verified if any of the
2274
+
specified matchers match against the identity.
2275
+
items:
2276
+
description: |-
2277
+
OIDCIdentityMatch specifies options for verifying the certificate identity,
2278
+
i.e. the issuer and the subject of the certificate.
2279
+
properties:
2280
+
issuer:
2281
+
description: |-
2282
+
Issuer specifies the regex pattern to match against to verify
2283
+
the OIDC issuer in the Fulcio certificate. The pattern must be a
2284
+
valid Go regular expression.
2285
+
type: string
2286
+
subject:
2287
+
description: |-
2288
+
Subject specifies the regex pattern to match against to verify
2289
+
the identity subject in the Fulcio certificate. The pattern must
2290
+
be a valid Go regular expression.
2291
+
type: string
2292
+
required:
2293
+
- issuer
2294
+
- subject
2295
+
type: object
2296
+
type: array
2297
+
provider:
2298
+
default: cosign
2299
+
description: Provider specifies the technology used to sign the
2300
+
OCI Artifact.
2301
+
enum:
2302
+
- cosign
2303
+
- notation
2304
+
type: string
2305
+
secretRef:
2306
+
description: |-
2307
+
SecretRef specifies the Kubernetes Secret containing the
2308
+
trusted public keys.
2309
+
properties:
2310
+
name:
2311
+
description: Name of the referent.
2312
+
type: string
2313
+
required:
2314
+
- name
2315
+
type: object
2316
+
required:
2317
+
- provider
2318
+
type: object
2319
+
required:
2320
+
- interval
2321
+
- url
2322
+
type: object
2323
+
status:
2324
+
default:
2325
+
observedGeneration: -1
2326
+
description: OCIRepositoryStatus defines the observed state of OCIRepository
2327
+
properties:
2328
+
artifact:
2329
+
description: Artifact represents the output of the last successful
2330
+
OCI Repository sync.
2331
+
properties:
2332
+
digest:
2333
+
description: Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
2334
+
pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$
2335
+
type: string
2336
+
lastUpdateTime:
2337
+
description: |-
2338
+
LastUpdateTime is the timestamp corresponding to the last update of the
2339
+
Artifact.
2340
+
format: date-time
2341
+
type: string
2342
+
metadata:
2343
+
additionalProperties:
2344
+
type: string
2345
+
description: Metadata holds upstream information such as OCI annotations.
2346
+
type: object
2347
+
path:
2348
+
description: |-
2349
+
Path is the relative file path of the Artifact. It can be used to locate
2350
+
the file in the root of the Artifact storage on the local file system of
2351
+
the controller managing the Source.
2352
+
type: string
2353
+
revision:
2354
+
description: |-
2355
+
Revision is a human-readable identifier traceable in the origin source
2356
+
system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
2357
+
type: string
2358
+
size:
2359
+
description: Size is the number of bytes in the file.
2360
+
format: int64
2361
+
type: integer
2362
+
url:
2363
+
description: |-
2364
+
URL is the HTTP address of the Artifact as exposed by the controller
2365
+
managing the Source. It can be used to retrieve the Artifact for
2366
+
consumption, e.g. by another controller applying the Artifact contents.
2367
+
type: string
2368
+
required:
2369
+
- digest
2370
+
- lastUpdateTime
2371
+
- path
2372
+
- revision
2373
+
- url
2374
+
type: object
2375
+
conditions:
2376
+
description: Conditions holds the conditions for the OCIRepository.
2377
+
items:
2378
+
description: Condition contains details for one aspect of the current
2379
+
state of this API Resource.
2380
+
properties:
2381
+
lastTransitionTime:
2382
+
description: |-
2383
+
lastTransitionTime is the last time the condition transitioned from one status to another.
2384
+
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
2385
+
format: date-time
2386
+
type: string
2387
+
message:
2388
+
description: |-
2389
+
message is a human readable message indicating details about the transition.
2390
+
This may be an empty string.
2391
+
maxLength: 32768
2392
+
type: string
2393
+
observedGeneration:
2394
+
description: |-
2395
+
observedGeneration represents the .metadata.generation that the condition was set based upon.
2396
+
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
2397
+
with respect to the current state of the instance.
2398
+
format: int64
2399
+
minimum: 0
2400
+
type: integer
2401
+
reason:
2402
+
description: |-
2403
+
reason contains a programmatic identifier indicating the reason for the condition's last transition.
2404
+
Producers of specific condition types may define expected values and meanings for this field,
2405
+
and whether the values are considered a guaranteed API.
2406
+
The value should be a CamelCase string.
2407
+
This field may not be empty.
2408
+
maxLength: 1024
2409
+
minLength: 1
2410
+
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
2411
+
type: string
2412
+
status:
2413
+
description: status of the condition, one of True, False, Unknown.
2414
+
enum:
2415
+
- "True"
2416
+
- "False"
2417
+
- Unknown
2418
+
type: string
2419
+
type:
2420
+
description: type of condition in CamelCase or in foo.example.com/CamelCase.
2421
+
maxLength: 316
2422
+
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
2423
+
type: string
2424
+
required:
2425
+
- lastTransitionTime
2426
+
- message
2427
+
- reason
2428
+
- status
2429
+
- type
2430
+
type: object
2431
+
type: array
2432
+
lastHandledReconcileAt:
2433
+
description: |-
2434
+
LastHandledReconcileAt holds the value of the most recent
2435
+
reconcile request value, so a change of the annotation value
2436
+
can be detected.
2437
+
type: string
2438
+
observedGeneration:
2439
+
description: ObservedGeneration is the last observed generation.
2440
+
format: int64
2441
+
type: integer
2442
+
observedIgnore:
2443
+
description: |-
2444
+
ObservedIgnore is the observed exclusion patterns used for constructing
2445
+
the source artifact.
2446
+
type: string
2447
+
observedLayerSelector:
2448
+
description: |-
2449
+
ObservedLayerSelector is the observed layer selector used for constructing
2450
+
the source artifact.
2451
+
properties:
2452
+
mediaType:
2453
+
description: |-
2454
+
MediaType specifies the OCI media type of the layer
2455
+
which should be extracted from the OCI Artifact. The
2456
+
first layer matching this type is selected.
2457
+
type: string
2458
+
operation:
2459
+
description: |-
2460
+
Operation specifies how the selected layer should be processed.
2461
+
By default, the layer compressed content is extracted to storage.
2462
+
When the operation is set to 'copy', the layer compressed content
2463
+
is persisted to storage as it is.
2464
+
enum:
2465
+
- extract
2466
+
- copy
2467
+
type: string
2468
+
type: object
2469
+
url:
2470
+
description: URL is the download link for the artifact output of the
2471
+
last OCI Repository sync.
2472
+
type: string
2473
+
type: object
2474
+
type: object
2475
+
served: true
2476
+
storage: true
2477
+
subresources:
2478
+
status: {}
2479
+
---
2480
+
apiVersion: v1
2481
+
kind: ServiceAccount
2482
+
metadata:
2483
+
labels:
2484
+
app.kubernetes.io/component: source-controller
2485
+
app.kubernetes.io/instance: flux-system
2486
+
app.kubernetes.io/part-of: flux
2487
+
app.kubernetes.io/version: v2.8.8
2488
+
name: source-controller
2489
+
namespace: flux-system
2490
+
---
2491
+
apiVersion: v1
2492
+
kind: Service
2493
+
metadata:
2494
+
labels:
2495
+
app.kubernetes.io/component: source-controller
2496
+
app.kubernetes.io/instance: flux-system
2497
+
app.kubernetes.io/part-of: flux
2498
+
app.kubernetes.io/version: v2.8.8
2499
+
control-plane: controller
2500
+
name: source-controller
2501
+
namespace: flux-system
2502
+
spec:
2503
+
ports:
2504
+
- name: http
2505
+
port: 80
2506
+
protocol: TCP
2507
+
targetPort: http
2508
+
selector:
2509
+
app: source-controller
2510
+
type: ClusterIP
2511
+
---
2512
+
apiVersion: apps/v1
2513
+
kind: Deployment
2514
+
metadata:
2515
+
labels:
2516
+
app.kubernetes.io/component: source-controller
2517
+
app.kubernetes.io/instance: flux-system
2518
+
app.kubernetes.io/part-of: flux
2519
+
app.kubernetes.io/version: v2.8.8
2520
+
control-plane: controller
2521
+
name: source-controller
2522
+
namespace: flux-system
2523
+
spec:
2524
+
replicas: 1
2525
+
selector:
2526
+
matchLabels:
2527
+
app: source-controller
2528
+
strategy:
2529
+
type: Recreate
2530
+
template:
2531
+
metadata:
2532
+
annotations:
2533
+
prometheus.io/port: "8080"
2534
+
prometheus.io/scrape: "true"
2535
+
labels:
2536
+
app: source-controller
2537
+
app.kubernetes.io/component: source-controller
2538
+
app.kubernetes.io/instance: flux-system
2539
+
app.kubernetes.io/part-of: flux
2540
+
app.kubernetes.io/version: v2.8.8
2541
+
spec:
2542
+
containers:
2543
+
- args:
2544
+
- --events-addr=http://notification-controller.$(RUNTIME_NAMESPACE).svc.cluster.local./
2545
+
- --watch-all-namespaces=true
2546
+
- --log-level=info
2547
+
- --log-encoding=json
2548
+
- --enable-leader-election
2549
+
- --storage-path=/data
2550
+
- --storage-adv-addr=source-controller.$(RUNTIME_NAMESPACE).svc.cluster.local.
2551
+
env:
2552
+
- name: RUNTIME_NAMESPACE
2553
+
valueFrom:
2554
+
fieldRef:
2555
+
fieldPath: metadata.namespace
2556
+
- name: TUF_ROOT
2557
+
value: /tmp/.sigstore
2558
+
- name: GOMEMLIMIT
2559
+
valueFrom:
2560
+
resourceFieldRef:
2561
+
containerName: manager
2562
+
resource: limits.memory
2563
+
image: ghcr.io/fluxcd/source-controller:v1.8.5
2564
+
imagePullPolicy: IfNotPresent
2565
+
livenessProbe:
2566
+
httpGet:
2567
+
path: /healthz
2568
+
port: healthz
2569
+
name: manager
2570
+
ports:
2571
+
- containerPort: 9090
2572
+
name: http
2573
+
protocol: TCP
2574
+
- containerPort: 8080
2575
+
name: http-prom
2576
+
protocol: TCP
2577
+
- containerPort: 9440
2578
+
name: healthz
2579
+
protocol: TCP
2580
+
readinessProbe:
2581
+
httpGet:
2582
+
path: /
2583
+
port: http
2584
+
resources:
2585
+
limits:
2586
+
cpu: 1000m
2587
+
memory: 1Gi
2588
+
requests:
2589
+
cpu: 50m
2590
+
memory: 64Mi
2591
+
securityContext:
2592
+
allowPrivilegeEscalation: false
2593
+
capabilities:
2594
+
drop:
2595
+
- ALL
2596
+
readOnlyRootFilesystem: true
2597
+
runAsNonRoot: true
2598
+
seccompProfile:
2599
+
type: RuntimeDefault
2600
+
volumeMounts:
2601
+
- mountPath: /data
2602
+
name: data
2603
+
- mountPath: /tmp
2604
+
name: tmp
2605
+
nodeSelector:
2606
+
kubernetes.io/os: linux
2607
+
priorityClassName: system-cluster-critical
2608
+
securityContext:
2609
+
fsGroup: 1337
2610
+
serviceAccountName: source-controller
2611
+
terminationGracePeriodSeconds: 10
2612
+
volumes:
2613
+
- emptyDir: {}
2614
+
name: data
2615
+
- emptyDir: {}
2616
+
name: tmp
2617
+
---
2618
+
apiVersion: apiextensions.k8s.io/v1
2619
+
kind: CustomResourceDefinition
2620
+
metadata:
2621
+
annotations:
2622
+
controller-gen.kubebuilder.io/version: v0.19.0
2623
+
labels:
2624
+
app.kubernetes.io/component: kustomize-controller
2625
+
app.kubernetes.io/instance: flux-system
2626
+
app.kubernetes.io/part-of: flux
2627
+
app.kubernetes.io/version: v2.8.8
2628
+
name: kustomizations.kustomize.toolkit.fluxcd.io
2629
+
spec:
2630
+
group: kustomize.toolkit.fluxcd.io
2631
+
names:
2632
+
kind: Kustomization
2633
+
listKind: KustomizationList
2634
+
plural: kustomizations
2635
+
shortNames:
2636
+
- ks
2637
+
singular: kustomization
2638
+
scope: Namespaced
2639
+
versions:
2640
+
- additionalPrinterColumns:
2641
+
- jsonPath: .metadata.creationTimestamp
2642
+
name: Age
2643
+
type: date
2644
+
- jsonPath: .status.conditions[?(@.type=="Ready")].status
2645
+
name: Ready
2646
+
type: string
2647
+
- jsonPath: .status.conditions[?(@.type=="Ready")].message
2648
+
name: Status
2649
+
type: string
2650
+
name: v1
2651
+
schema:
2652
+
openAPIV3Schema:
2653
+
description: Kustomization is the Schema for the kustomizations API.
2654
+
properties:
2655
+
apiVersion:
2656
+
description: |-
2657
+
APIVersion defines the versioned schema of this representation of an object.
2658
+
Servers should convert recognized schemas to the latest internal value, and
2659
+
may reject unrecognized values.
2660
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
2661
+
type: string
2662
+
kind:
2663
+
description: |-
2664
+
Kind is a string value representing the REST resource this object represents.
2665
+
Servers may infer this from the endpoint the client submits requests to.
2666
+
Cannot be updated.
2667
+
In CamelCase.
2668
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
2669
+
type: string
2670
+
metadata:
2671
+
type: object
2672
+
spec:
2673
+
description: |-
2674
+
KustomizationSpec defines the configuration to calculate the desired state
2675
+
from a Source using Kustomize.
2676
+
properties:
2677
+
commonMetadata:
2678
+
description: |-
2679
+
CommonMetadata specifies the common labels and annotations that are
2680
+
applied to all resources. Any existing label or annotation will be
2681
+
overridden if its key matches a common one.
2682
+
properties:
2683
+
annotations:
2684
+
additionalProperties:
2685
+
type: string
2686
+
description: Annotations to be added to the object's metadata.
2687
+
type: object
2688
+
labels:
2689
+
additionalProperties:
2690
+
type: string
2691
+
description: Labels to be added to the object's metadata.
2692
+
type: object
2693
+
type: object
2694
+
components:
2695
+
description: Components specifies relative paths to kustomize Components.
2696
+
items:
2697
+
type: string
2698
+
type: array
2699
+
decryption:
2700
+
description: Decrypt Kubernetes secrets before applying them on the
2701
+
cluster.
2702
+
properties:
2703
+
provider:
2704
+
description: Provider is the name of the decryption engine.
2705
+
enum:
2706
+
- sops
2707
+
type: string
2708
+
secretRef:
2709
+
description: |-
2710
+
The secret name containing the private OpenPGP keys used for decryption.
2711
+
A static credential for a cloud provider defined inside the Secret
2712
+
takes priority to secret-less authentication with the ServiceAccountName
2713
+
field.
2714
+
properties:
2715
+
name:
2716
+
description: Name of the referent.
2717
+
type: string
2718
+
required:
2719
+
- name
2720
+
type: object
2721
+
serviceAccountName:
2722
+
description: |-
2723
+
ServiceAccountName is the name of the service account used to
2724
+
authenticate with KMS services from cloud providers. If a
2725
+
static credential for a given cloud provider is defined
2726
+
inside the Secret referenced by SecretRef, that static
2727
+
credential takes priority.
2728
+
type: string
2729
+
required:
2730
+
- provider
2731
+
type: object
2732
+
deletionPolicy:
2733
+
description: |-
2734
+
DeletionPolicy can be used to control garbage collection when this
2735
+
Kustomization is deleted. Valid values are ('MirrorPrune', 'Delete',
2736
+
'WaitForTermination', 'Orphan'). 'MirrorPrune' mirrors the Prune field
2737
+
(orphan if false, delete if true). Defaults to 'MirrorPrune'.
2738
+
enum:
2739
+
- MirrorPrune
2740
+
- Delete
2741
+
- WaitForTermination
2742
+
- Orphan
2743
+
type: string
2744
+
dependsOn:
2745
+
description: |-
2746
+
DependsOn may contain a DependencyReference slice
2747
+
with references to Kustomization resources that must be ready before this
2748
+
Kustomization can be reconciled.
2749
+
items:
2750
+
description: DependencyReference defines a Kustomization dependency
2751
+
on another Kustomization resource.
2752
+
properties:
2753
+
name:
2754
+
description: Name of the referent.
2755
+
type: string
2756
+
namespace:
2757
+
description: |-
2758
+
Namespace of the referent, defaults to the namespace of the Kustomization
2759
+
resource object that contains the reference.
2760
+
type: string
2761
+
readyExpr:
2762
+
description: |-
2763
+
ReadyExpr is a CEL expression that can be used to assess the readiness
2764
+
of a dependency. When specified, the built-in readiness check
2765
+
is replaced by the logic defined in the CEL expression.
2766
+
To make the CEL expression additive to the built-in readiness check,
2767
+
the feature gate `AdditiveCELDependencyCheck` must be set to `true`.
2768
+
type: string
2769
+
required:
2770
+
- name
2771
+
type: object
2772
+
type: array
2773
+
force:
2774
+
default: false
2775
+
description: |-
2776
+
Force instructs the controller to recreate resources
2777
+
when patching fails due to an immutable field change.
2778
+
type: boolean
2779
+
healthCheckExprs:
2780
+
description: |-
2781
+
HealthCheckExprs is a list of healthcheck expressions for evaluating the
2782
+
health of custom resources using Common Expression Language (CEL).
2783
+
The expressions are evaluated only when Wait or HealthChecks are specified.
2784
+
items:
2785
+
description: CustomHealthCheck defines the health check for custom
2786
+
resources.
2787
+
properties:
2788
+
apiVersion:
2789
+
description: APIVersion of the custom resource under evaluation.
2790
+
type: string
2791
+
current:
2792
+
description: |-
2793
+
Current is the CEL expression that determines if the status
2794
+
of the custom resource has reached the desired state.
2795
+
type: string
2796
+
failed:
2797
+
description: |-
2798
+
Failed is the CEL expression that determines if the status
2799
+
of the custom resource has failed to reach the desired state.
2800
+
type: string
2801
+
inProgress:
2802
+
description: |-
2803
+
InProgress is the CEL expression that determines if the status
2804
+
of the custom resource has not yet reached the desired state.
2805
+
type: string
2806
+
kind:
2807
+
description: Kind of the custom resource under evaluation.
2808
+
type: string
2809
+
required:
2810
+
- apiVersion
2811
+
- current
2812
+
- kind
2813
+
type: object
2814
+
type: array
2815
+
healthChecks:
2816
+
description: A list of resources to be included in the health assessment.
2817
+
items:
2818
+
description: |-
2819
+
NamespacedObjectKindReference contains enough information to locate the typed referenced Kubernetes resource object
2820
+
in any namespace.
2821
+
properties:
2822
+
apiVersion:
2823
+
description: API version of the referent, if not specified the
2824
+
Kubernetes preferred version will be used.
2825
+
type: string
2826
+
kind:
2827
+
description: Kind of the referent.
2828
+
type: string
2829
+
name:
2830
+
description: Name of the referent.
2831
+
type: string
2832
+
namespace:
2833
+
description: Namespace of the referent, when not specified it
2834
+
acts as LocalObjectReference.
2835
+
type: string
2836
+
required:
2837
+
- kind
2838
+
- name
2839
+
type: object
2840
+
type: array
2841
+
ignoreMissingComponents:
2842
+
description: |-
2843
+
IgnoreMissingComponents instructs the controller to ignore Components paths
2844
+
not found in source by removing them from the generated kustomization.yaml
2845
+
before running kustomize build.
2846
+
type: boolean
2847
+
images:
2848
+
description: |-
2849
+
Images is a list of (image name, new name, new tag or digest)
2850
+
for changing image names, tags or digests. This can also be achieved with a
2851
+
patch, but this operator is simpler to specify.
2852
+
items:
2853
+
description: Image contains an image name, a new name, a new tag
2854
+
or digest, which will replace the original name and tag.
2855
+
properties:
2856
+
digest:
2857
+
description: |-
2858
+
Digest is the value used to replace the original image tag.
2859
+
If digest is present NewTag value is ignored.
2860
+
type: string
2861
+
name:
2862
+
description: Name is a tag-less image name.
2863
+
type: string
2864
+
newName:
2865
+
description: NewName is the value used to replace the original
2866
+
name.
2867
+
type: string
2868
+
newTag:
2869
+
description: NewTag is the value used to replace the original
2870
+
tag.
2871
+
type: string
2872
+
required:
2873
+
- name
2874
+
type: object
2875
+
type: array
2876
+
interval:
2877
+
description: |-
2878
+
The interval at which to reconcile the Kustomization.
2879
+
This interval is approximate and may be subject to jitter to ensure
2880
+
efficient use of resources.
2881
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
2882
+
type: string
2883
+
kubeConfig:
2884
+
description: |-
2885
+
The KubeConfig for reconciling the Kustomization on a remote cluster.
2886
+
When used in combination with KustomizationSpec.ServiceAccountName,
2887
+
forces the controller to act on behalf of that Service Account at the
2888
+
target cluster.
2889
+
If the --default-service-account flag is set, its value will be used as
2890
+
a controller level fallback for when KustomizationSpec.ServiceAccountName
2891
+
is empty.
2892
+
properties:
2893
+
configMapRef:
2894
+
description: |-
2895
+
ConfigMapRef holds an optional name of a ConfigMap that contains
2896
+
the following keys:
2897
+
2898
+
- `provider`: the provider to use. One of `aws`, `azure`, `gcp`, or
2899
+
`generic`. Required.
2900
+
- `cluster`: the fully qualified resource name of the Kubernetes
2901
+
cluster in the cloud provider API. Not used by the `generic`
2902
+
provider. Required when one of `address` or `ca.crt` is not set.
2903
+
- `address`: the address of the Kubernetes API server. Required
2904
+
for `generic`. For the other providers, if not specified, the
2905
+
first address in the cluster resource will be used, and if
2906
+
specified, it must match one of the addresses in the cluster
2907
+
resource.
2908
+
If audiences is not set, will be used as the audience for the
2909
+
`generic` provider.
2910
+
- `ca.crt`: the optional PEM-encoded CA certificate for the
2911
+
Kubernetes API server. If not set, the controller will use the
2912
+
CA certificate from the cluster resource.
2913
+
- `audiences`: the optional audiences as a list of
2914
+
line-break-separated strings for the Kubernetes ServiceAccount
2915
+
token. Defaults to the `address` for the `generic` provider, or
2916
+
to specific values for the other providers depending on the
2917
+
provider.
2918
+
- `serviceAccountName`: the optional name of the Kubernetes
2919
+
ServiceAccount in the same namespace that should be used
2920
+
for authentication. If not specified, the controller
2921
+
ServiceAccount will be used.
2922
+
2923
+
Mutually exclusive with SecretRef.
2924
+
properties:
2925
+
name:
2926
+
description: Name of the referent.
2927
+
type: string
2928
+
required:
2929
+
- name
2930
+
type: object
2931
+
secretRef:
2932
+
description: |-
2933
+
SecretRef holds an optional name of a secret that contains a key with
2934
+
the kubeconfig file as the value. If no key is set, the key will default
2935
+
to 'value'. Mutually exclusive with ConfigMapRef.
2936
+
It is recommended that the kubeconfig is self-contained, and the secret
2937
+
is regularly updated if credentials such as a cloud-access-token expire.
2938
+
Cloud specific `cmd-path` auth helpers will not function without adding
2939
+
binaries and credentials to the Pod that is responsible for reconciling
2940
+
Kubernetes resources. Supported only for the generic provider.
2941
+
properties:
2942
+
key:
2943
+
description: Key in the Secret, when not specified an implementation-specific
2944
+
default key is used.
2945
+
type: string
2946
+
name:
2947
+
description: Name of the Secret.
2948
+
type: string
2949
+
required:
2950
+
- name
2951
+
type: object
2952
+
type: object
2953
+
x-kubernetes-validations:
2954
+
- message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef
2955
+
must be specified
2956
+
rule: has(self.configMapRef) || has(self.secretRef)
2957
+
- message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef
2958
+
must be specified
2959
+
rule: '!has(self.configMapRef) || !has(self.secretRef)'
2960
+
namePrefix:
2961
+
description: NamePrefix will prefix the names of all managed resources.
2962
+
maxLength: 200
2963
+
minLength: 1
2964
+
type: string
2965
+
nameSuffix:
2966
+
description: NameSuffix will suffix the names of all managed resources.
2967
+
maxLength: 200
2968
+
minLength: 1
2969
+
type: string
2970
+
patches:
2971
+
description: |-
2972
+
Strategic merge and JSON patches, defined as inline YAML objects,
2973
+
capable of targeting objects based on kind, label and annotation selectors.
2974
+
items:
2975
+
description: |-
2976
+
Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should
2977
+
be applied to.
2978
+
properties:
2979
+
patch:
2980
+
description: |-
2981
+
Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with
2982
+
an array of operation objects.
2983
+
type: string
2984
+
target:
2985
+
description: Target points to the resources that the patch document
2986
+
should be applied to.
2987
+
properties:
2988
+
annotationSelector:
2989
+
description: |-
2990
+
AnnotationSelector is a string that follows the label selection expression
2991
+
https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
2992
+
It matches with the resource annotations.
2993
+
type: string
2994
+
group:
2995
+
description: |-
2996
+
Group is the API group to select resources from.
2997
+
Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.
2998
+
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
2999
+
type: string
3000
+
kind:
3001
+
description: |-
3002
+
Kind of the API Group to select resources from.
3003
+
Together with Group and Version it is capable of unambiguously
3004
+
identifying and/or selecting resources.
3005
+
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
3006
+
type: string
3007
+
labelSelector:
3008
+
description: |-
3009
+
LabelSelector is a string that follows the label selection expression
3010
+
https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
3011
+
It matches with the resource labels.
3012
+
type: string
3013
+
name:
3014
+
description: Name to match resources with.
3015
+
type: string
3016
+
namespace:
3017
+
description: Namespace to select resources from.
3018
+
type: string
3019
+
version:
3020
+
description: |-
3021
+
Version of the API Group to select resources from.
3022
+
Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.
3023
+
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
3024
+
type: string
3025
+
type: object
3026
+
required:
3027
+
- patch
3028
+
type: object
3029
+
type: array
3030
+
path:
3031
+
description: |-
3032
+
Path to the directory containing the kustomization.yaml file, or the
3033
+
set of plain YAMLs a kustomization.yaml should be generated for.
3034
+
Defaults to 'None', which translates to the root path of the SourceRef.
3035
+
type: string
3036
+
postBuild:
3037
+
description: |-
3038
+
PostBuild describes which actions to perform on the YAML manifest
3039
+
generated by building the kustomize overlay.
3040
+
properties:
3041
+
substitute:
3042
+
additionalProperties:
3043
+
type: string
3044
+
description: |-
3045
+
Substitute holds a map of key/value pairs.
3046
+
The variables defined in your YAML manifests that match any of the keys
3047
+
defined in the map will be substituted with the set value.
3048
+
Includes support for bash string replacement functions
3049
+
e.g. ${var:=default}, ${var:position} and ${var/substring/replacement}.
3050
+
type: object
3051
+
substituteFrom:
3052
+
description: |-
3053
+
SubstituteFrom holds references to ConfigMaps and Secrets containing
3054
+
the variables and their values to be substituted in the YAML manifests.
3055
+
The ConfigMap and the Secret data keys represent the var names, and they
3056
+
must match the vars declared in the manifests for the substitution to
3057
+
happen.
3058
+
items:
3059
+
description: |-
3060
+
SubstituteReference contains a reference to a resource containing
3061
+
the variables name and value.
3062
+
properties:
3063
+
kind:
3064
+
description: Kind of the values referent, valid values are
3065
+
('Secret', 'ConfigMap').
3066
+
enum:
3067
+
- Secret
3068
+
- ConfigMap
3069
+
type: string
3070
+
name:
3071
+
description: |-
3072
+
Name of the values referent. Should reside in the same namespace as the
3073
+
referring resource.
3074
+
maxLength: 253
3075
+
minLength: 1
3076
+
type: string
3077
+
optional:
3078
+
default: false
3079
+
description: |-
3080
+
Optional indicates whether the referenced resource must exist, or whether to
3081
+
tolerate its absence. If true and the referenced resource is absent, proceed
3082
+
as if the resource was present but empty, without any variables defined.
3083
+
type: boolean
3084
+
required:
3085
+
- kind
3086
+
- name
3087
+
type: object
3088
+
type: array
3089
+
type: object
3090
+
prune:
3091
+
description: Prune enables garbage collection.
3092
+
type: boolean
3093
+
retryInterval:
3094
+
description: |-
3095
+
The interval at which to retry a previously failed reconciliation.
3096
+
When not specified, the controller uses the KustomizationSpec.Interval
3097
+
value to retry failures.
3098
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
3099
+
type: string
3100
+
serviceAccountName:
3101
+
description: |-
3102
+
The name of the Kubernetes service account to impersonate
3103
+
when reconciling this Kustomization.
3104
+
type: string
3105
+
sourceRef:
3106
+
description: Reference of the source where the kustomization file
3107
+
is.
3108
+
properties:
3109
+
apiVersion:
3110
+
description: API version of the referent.
3111
+
type: string
3112
+
kind:
3113
+
description: Kind of the referent.
3114
+
enum:
3115
+
- OCIRepository
3116
+
- GitRepository
3117
+
- Bucket
3118
+
- ExternalArtifact
3119
+
type: string
3120
+
name:
3121
+
description: Name of the referent.
3122
+
type: string
3123
+
namespace:
3124
+
description: |-
3125
+
Namespace of the referent, defaults to the namespace of the Kubernetes
3126
+
resource object that contains the reference.
3127
+
type: string
3128
+
required:
3129
+
- kind
3130
+
- name
3131
+
type: object
3132
+
suspend:
3133
+
description: |-
3134
+
This flag tells the controller to suspend subsequent kustomize executions,
3135
+
it does not apply to already started executions. Defaults to false.
3136
+
type: boolean
3137
+
targetNamespace:
3138
+
description: |-
3139
+
TargetNamespace sets or overrides the namespace in the
3140
+
kustomization.yaml file.
3141
+
maxLength: 63
3142
+
minLength: 1
3143
+
type: string
3144
+
timeout:
3145
+
description: |-
3146
+
Timeout for validation, apply and health checking operations.
3147
+
Defaults to 'Interval' duration.
3148
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
3149
+
type: string
3150
+
wait:
3151
+
description: |-
3152
+
Wait instructs the controller to check the health of all the reconciled
3153
+
resources. When enabled, the HealthChecks are ignored. Defaults to false.
3154
+
type: boolean
3155
+
required:
3156
+
- interval
3157
+
- prune
3158
+
- sourceRef
3159
+
type: object
3160
+
status:
3161
+
default:
3162
+
observedGeneration: -1
3163
+
description: KustomizationStatus defines the observed state of a kustomization.
3164
+
properties:
3165
+
conditions:
3166
+
items:
3167
+
description: Condition contains details for one aspect of the current
3168
+
state of this API Resource.
3169
+
properties:
3170
+
lastTransitionTime:
3171
+
description: |-
3172
+
lastTransitionTime is the last time the condition transitioned from one status to another.
3173
+
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
3174
+
format: date-time
3175
+
type: string
3176
+
message:
3177
+
description: |-
3178
+
message is a human readable message indicating details about the transition.
3179
+
This may be an empty string.
3180
+
maxLength: 32768
3181
+
type: string
3182
+
observedGeneration:
3183
+
description: |-
3184
+
observedGeneration represents the .metadata.generation that the condition was set based upon.
3185
+
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
3186
+
with respect to the current state of the instance.
3187
+
format: int64
3188
+
minimum: 0
3189
+
type: integer
3190
+
reason:
3191
+
description: |-
3192
+
reason contains a programmatic identifier indicating the reason for the condition's last transition.
3193
+
Producers of specific condition types may define expected values and meanings for this field,
3194
+
and whether the values are considered a guaranteed API.
3195
+
The value should be a CamelCase string.
3196
+
This field may not be empty.
3197
+
maxLength: 1024
3198
+
minLength: 1
3199
+
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
3200
+
type: string
3201
+
status:
3202
+
description: status of the condition, one of True, False, Unknown.
3203
+
enum:
3204
+
- "True"
3205
+
- "False"
3206
+
- Unknown
3207
+
type: string
3208
+
type:
3209
+
description: type of condition in CamelCase or in foo.example.com/CamelCase.
3210
+
maxLength: 316
3211
+
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
3212
+
type: string
3213
+
required:
3214
+
- lastTransitionTime
3215
+
- message
3216
+
- reason
3217
+
- status
3218
+
- type
3219
+
type: object
3220
+
type: array
3221
+
history:
3222
+
description: |-
3223
+
History contains a set of snapshots of the last reconciliation attempts
3224
+
tracking the revision, the state and the duration of each attempt.
3225
+
items:
3226
+
description: |-
3227
+
Snapshot represents a point-in-time record of a group of resources reconciliation,
3228
+
including timing information, status, and a unique digest identifier.
3229
+
properties:
3230
+
digest:
3231
+
description: Digest is the checksum in the format `<algo>:<hex>`
3232
+
of the resources in this snapshot.
3233
+
type: string
3234
+
firstReconciled:
3235
+
description: FirstReconciled is the time when this revision
3236
+
was first reconciled to the cluster.
3237
+
format: date-time
3238
+
type: string
3239
+
lastReconciled:
3240
+
description: LastReconciled is the time when this revision was
3241
+
last reconciled to the cluster.
3242
+
format: date-time
3243
+
type: string
3244
+
lastReconciledDuration:
3245
+
description: LastReconciledDuration is time it took to reconcile
3246
+
the resources in this revision.
3247
+
type: string
3248
+
lastReconciledStatus:
3249
+
description: LastReconciledStatus is the status of the last
3250
+
reconciliation.
3251
+
type: string
3252
+
metadata:
3253
+
additionalProperties:
3254
+
type: string
3255
+
description: Metadata contains additional information about
3256
+
the snapshot.
3257
+
type: object
3258
+
totalReconciliations:
3259
+
description: TotalReconciliations is the total number of reconciliations
3260
+
that have occurred for this snapshot.
3261
+
format: int64
3262
+
type: integer
3263
+
required:
3264
+
- digest
3265
+
- firstReconciled
3266
+
- lastReconciled
3267
+
- lastReconciledDuration
3268
+
- lastReconciledStatus
3269
+
- totalReconciliations
3270
+
type: object
3271
+
type: array
3272
+
inventory:
3273
+
description: |-
3274
+
Inventory contains the list of Kubernetes resource object references that
3275
+
have been successfully applied.
3276
+
properties:
3277
+
entries:
3278
+
description: Entries of Kubernetes resource object references.
3279
+
items:
3280
+
description: ResourceRef contains the information necessary
3281
+
to locate a resource within a cluster.
3282
+
properties:
3283
+
id:
3284
+
description: |-
3285
+
ID is the string representation of the Kubernetes resource object's metadata,
3286
+
in the format '<namespace>_<name>_<group>_<kind>'.
3287
+
type: string
3288
+
v:
3289
+
description: Version is the API version of the Kubernetes
3290
+
resource object's kind.
3291
+
type: string
3292
+
required:
3293
+
- id
3294
+
- v
3295
+
type: object
3296
+
type: array
3297
+
required:
3298
+
- entries
3299
+
type: object
3300
+
lastAppliedOriginRevision:
3301
+
description: |-
3302
+
The last successfully applied origin revision.
3303
+
Equals the origin revision of the applied Artifact from the referenced Source.
3304
+
Usually present on the Metadata of the applied Artifact and depends on the
3305
+
Source type, e.g. for OCI it's the value associated with the key
3306
+
"org.opencontainers.image.revision".
3307
+
type: string
3308
+
lastAppliedRevision:
3309
+
description: |-
3310
+
The last successfully applied revision.
3311
+
Equals the Revision of the applied Artifact from the referenced Source.
3312
+
type: string
3313
+
lastAttemptedRevision:
3314
+
description: LastAttemptedRevision is the revision of the last reconciliation
3315
+
attempt.
3316
+
type: string
3317
+
lastHandledReconcileAt:
3318
+
description: |-
3319
+
LastHandledReconcileAt holds the value of the most recent
3320
+
reconcile request value, so a change of the annotation value
3321
+
can be detected.
3322
+
type: string
3323
+
observedGeneration:
3324
+
description: ObservedGeneration is the last reconciled generation.
3325
+
format: int64
3326
+
type: integer
3327
+
type: object
3328
+
type: object
3329
+
served: true
3330
+
storage: true
3331
+
subresources:
3332
+
status: {}
3333
+
---
3334
+
apiVersion: v1
3335
+
kind: ServiceAccount
3336
+
metadata:
3337
+
labels:
3338
+
app.kubernetes.io/component: kustomize-controller
3339
+
app.kubernetes.io/instance: flux-system
3340
+
app.kubernetes.io/part-of: flux
3341
+
app.kubernetes.io/version: v2.8.8
3342
+
name: kustomize-controller
3343
+
namespace: flux-system
3344
+
---
3345
+
apiVersion: apps/v1
3346
+
kind: Deployment
3347
+
metadata:
3348
+
labels:
3349
+
app.kubernetes.io/component: kustomize-controller
3350
+
app.kubernetes.io/instance: flux-system
3351
+
app.kubernetes.io/part-of: flux
3352
+
app.kubernetes.io/version: v2.8.8
3353
+
control-plane: controller
3354
+
name: kustomize-controller
3355
+
namespace: flux-system
3356
+
spec:
3357
+
replicas: 1
3358
+
selector:
3359
+
matchLabels:
3360
+
app: kustomize-controller
3361
+
template:
3362
+
metadata:
3363
+
annotations:
3364
+
prometheus.io/port: "8080"
3365
+
prometheus.io/scrape: "true"
3366
+
labels:
3367
+
app: kustomize-controller
3368
+
app.kubernetes.io/component: kustomize-controller
3369
+
app.kubernetes.io/instance: flux-system
3370
+
app.kubernetes.io/part-of: flux
3371
+
app.kubernetes.io/version: v2.8.8
3372
+
spec:
3373
+
containers:
3374
+
- args:
3375
+
- --events-addr=http://notification-controller.$(RUNTIME_NAMESPACE).svc.cluster.local./
3376
+
- --watch-all-namespaces=true
3377
+
- --log-level=info
3378
+
- --log-encoding=json
3379
+
- --enable-leader-election
3380
+
env:
3381
+
- name: RUNTIME_NAMESPACE
3382
+
valueFrom:
3383
+
fieldRef:
3384
+
fieldPath: metadata.namespace
3385
+
- name: GOMEMLIMIT
3386
+
valueFrom:
3387
+
resourceFieldRef:
3388
+
containerName: manager
3389
+
resource: limits.memory
3390
+
image: ghcr.io/fluxcd/kustomize-controller:v1.8.5
3391
+
imagePullPolicy: IfNotPresent
3392
+
livenessProbe:
3393
+
httpGet:
3394
+
path: /healthz
3395
+
port: healthz
3396
+
name: manager
3397
+
ports:
3398
+
- containerPort: 8080
3399
+
name: http-prom
3400
+
protocol: TCP
3401
+
- containerPort: 9440
3402
+
name: healthz
3403
+
protocol: TCP
3404
+
readinessProbe:
3405
+
httpGet:
3406
+
path: /readyz
3407
+
port: healthz
3408
+
resources:
3409
+
limits:
3410
+
cpu: 1000m
3411
+
memory: 1Gi
3412
+
requests:
3413
+
cpu: 100m
3414
+
memory: 64Mi
3415
+
securityContext:
3416
+
allowPrivilegeEscalation: false
3417
+
capabilities:
3418
+
drop:
3419
+
- ALL
3420
+
readOnlyRootFilesystem: true
3421
+
runAsNonRoot: true
3422
+
seccompProfile:
3423
+
type: RuntimeDefault
3424
+
volumeMounts:
3425
+
- mountPath: /tmp
3426
+
name: temp
3427
+
nodeSelector:
3428
+
kubernetes.io/os: linux
3429
+
priorityClassName: system-cluster-critical
3430
+
securityContext:
3431
+
fsGroup: 1337
3432
+
serviceAccountName: kustomize-controller
3433
+
terminationGracePeriodSeconds: 60
3434
+
volumes:
3435
+
- emptyDir: {}
3436
+
name: temp
3437
+
---
3438
+
apiVersion: apiextensions.k8s.io/v1
3439
+
kind: CustomResourceDefinition
3440
+
metadata:
3441
+
annotations:
3442
+
controller-gen.kubebuilder.io/version: v0.19.0
3443
+
labels:
3444
+
app.kubernetes.io/component: helm-controller
3445
+
app.kubernetes.io/instance: flux-system
3446
+
app.kubernetes.io/part-of: flux
3447
+
app.kubernetes.io/version: v2.8.8
3448
+
name: helmreleases.helm.toolkit.fluxcd.io
3449
+
spec:
3450
+
group: helm.toolkit.fluxcd.io
3451
+
names:
3452
+
kind: HelmRelease
3453
+
listKind: HelmReleaseList
3454
+
plural: helmreleases
3455
+
shortNames:
3456
+
- hr
3457
+
singular: helmrelease
3458
+
scope: Namespaced
3459
+
versions:
3460
+
- additionalPrinterColumns:
3461
+
- jsonPath: .metadata.creationTimestamp
3462
+
name: Age
3463
+
type: date
3464
+
- jsonPath: .status.conditions[?(@.type=="Ready")].status
3465
+
name: Ready
3466
+
type: string
3467
+
- jsonPath: .status.conditions[?(@.type=="Ready")].message
3468
+
name: Status
3469
+
type: string
3470
+
name: v2
3471
+
schema:
3472
+
openAPIV3Schema:
3473
+
description: HelmRelease is the Schema for the helmreleases API
3474
+
properties:
3475
+
apiVersion:
3476
+
description: |-
3477
+
APIVersion defines the versioned schema of this representation of an object.
3478
+
Servers should convert recognized schemas to the latest internal value, and
3479
+
may reject unrecognized values.
3480
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
3481
+
type: string
3482
+
kind:
3483
+
description: |-
3484
+
Kind is a string value representing the REST resource this object represents.
3485
+
Servers may infer this from the endpoint the client submits requests to.
3486
+
Cannot be updated.
3487
+
In CamelCase.
3488
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
3489
+
type: string
3490
+
metadata:
3491
+
type: object
3492
+
spec:
3493
+
description: HelmReleaseSpec defines the desired state of a Helm release.
3494
+
properties:
3495
+
chart:
3496
+
description: |-
3497
+
Chart defines the template of the v1.HelmChart that should be created
3498
+
for this HelmRelease.
3499
+
properties:
3500
+
metadata:
3501
+
description: ObjectMeta holds the template for metadata like labels
3502
+
and annotations.
3503
+
properties:
3504
+
annotations:
3505
+
additionalProperties:
3506
+
type: string
3507
+
description: |-
3508
+
Annotations is an unstructured key value map stored with a resource that may be
3509
+
set by external tools to store and retrieve arbitrary metadata. They are not
3510
+
queryable and should be preserved when modifying objects.
3511
+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
3512
+
type: object
3513
+
labels:
3514
+
additionalProperties:
3515
+
type: string
3516
+
description: |-
3517
+
Map of string keys and values that can be used to organize and categorize
3518
+
(scope and select) objects.
3519
+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
3520
+
type: object
3521
+
type: object
3522
+
spec:
3523
+
description: Spec holds the template for the v1.HelmChartSpec
3524
+
for this HelmRelease.
3525
+
properties:
3526
+
chart:
3527
+
description: The name or path the Helm chart is available
3528
+
at in the SourceRef.
3529
+
maxLength: 2048
3530
+
minLength: 1
3531
+
type: string
3532
+
ignoreMissingValuesFiles:
3533
+
description: IgnoreMissingValuesFiles controls whether to
3534
+
silently ignore missing values files rather than failing.
3535
+
type: boolean
3536
+
interval:
3537
+
description: |-
3538
+
Interval at which to check the v1.Source for updates. Defaults to
3539
+
'HelmReleaseSpec.Interval'.
3540
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
3541
+
type: string
3542
+
reconcileStrategy:
3543
+
default: ChartVersion
3544
+
description: |-
3545
+
Determines what enables the creation of a new artifact. Valid values are
3546
+
('ChartVersion', 'Revision').
3547
+
See the documentation of the values for an explanation on their behavior.
3548
+
Defaults to ChartVersion when omitted.
3549
+
enum:
3550
+
- ChartVersion
3551
+
- Revision
3552
+
type: string
3553
+
sourceRef:
3554
+
description: The name and namespace of the v1.Source the chart
3555
+
is available at.
3556
+
properties:
3557
+
apiVersion:
3558
+
description: APIVersion of the referent.
3559
+
type: string
3560
+
kind:
3561
+
description: Kind of the referent.
3562
+
enum:
3563
+
- HelmRepository
3564
+
- GitRepository
3565
+
- Bucket
3566
+
type: string
3567
+
name:
3568
+
description: Name of the referent.
3569
+
maxLength: 253
3570
+
minLength: 1
3571
+
type: string
3572
+
namespace:
3573
+
description: Namespace of the referent.
3574
+
maxLength: 63
3575
+
minLength: 1
3576
+
type: string
3577
+
required:
3578
+
- kind
3579
+
- name
3580
+
type: object
3581
+
valuesFiles:
3582
+
description: |-
3583
+
Alternative list of values files to use as the chart values (values.yaml
3584
+
is not included by default), expected to be a relative path in the SourceRef.
3585
+
Values files are merged in the order of this list with the last file overriding
3586
+
the first. Ignored when omitted.
3587
+
items:
3588
+
type: string
3589
+
type: array
3590
+
verify:
3591
+
description: |-
3592
+
Verify contains the secret name containing the trusted public keys
3593
+
used to verify the signature and specifies which provider to use to check
3594
+
whether OCI image is authentic.
3595
+
This field is only supported for OCI sources.
3596
+
Chart dependencies, which are not bundled in the umbrella chart artifact,
3597
+
are not verified.
3598
+
properties:
3599
+
provider:
3600
+
default: cosign
3601
+
description: Provider specifies the technology used to
3602
+
sign the OCI Helm chart.
3603
+
enum:
3604
+
- cosign
3605
+
- notation
3606
+
type: string
3607
+
secretRef:
3608
+
description: |-
3609
+
SecretRef specifies the Kubernetes Secret containing the
3610
+
trusted public keys.
3611
+
properties:
3612
+
name:
3613
+
description: Name of the referent.
3614
+
type: string
3615
+
required:
3616
+
- name
3617
+
type: object
3618
+
required:
3619
+
- provider
3620
+
type: object
3621
+
version:
3622
+
default: '*'
3623
+
description: |-
3624
+
Version semver expression, ignored for charts from v1.GitRepository and
3625
+
v1beta2.Bucket sources. Defaults to latest when omitted.
3626
+
type: string
3627
+
required:
3628
+
- chart
3629
+
- sourceRef
3630
+
type: object
3631
+
required:
3632
+
- spec
3633
+
type: object
3634
+
chartRef:
3635
+
description: |-
3636
+
ChartRef holds a reference to a source controller resource containing the
3637
+
Helm chart artifact.
3638
+
properties:
3639
+
apiVersion:
3640
+
description: APIVersion of the referent.
3641
+
type: string
3642
+
kind:
3643
+
description: Kind of the referent.
3644
+
enum:
3645
+
- OCIRepository
3646
+
- HelmChart
3647
+
- ExternalArtifact
3648
+
type: string
3649
+
name:
3650
+
description: Name of the referent.
3651
+
maxLength: 253
3652
+
minLength: 1
3653
+
type: string
3654
+
namespace:
3655
+
description: |-
3656
+
Namespace of the referent, defaults to the namespace of the Kubernetes
3657
+
resource object that contains the reference.
3658
+
maxLength: 63
3659
+
minLength: 1
3660
+
type: string
3661
+
required:
3662
+
- kind
3663
+
- name
3664
+
type: object
3665
+
commonMetadata:
3666
+
description: |-
3667
+
CommonMetadata specifies the common labels and annotations that are
3668
+
applied to all resources. Any existing label or annotation will be
3669
+
overridden if its key matches a common one.
3670
+
properties:
3671
+
annotations:
3672
+
additionalProperties:
3673
+
type: string
3674
+
description: Annotations to be added to the object's metadata.
3675
+
type: object
3676
+
labels:
3677
+
additionalProperties:
3678
+
type: string
3679
+
description: Labels to be added to the object's metadata.
3680
+
type: object
3681
+
type: object
3682
+
dependsOn:
3683
+
description: |-
3684
+
DependsOn may contain a DependencyReference slice with
3685
+
references to HelmRelease resources that must be ready before this HelmRelease
3686
+
can be reconciled.
3687
+
items:
3688
+
description: DependencyReference defines a HelmRelease dependency
3689
+
on another HelmRelease resource.
3690
+
properties:
3691
+
name:
3692
+
description: Name of the referent.
3693
+
type: string
3694
+
namespace:
3695
+
description: |-
3696
+
Namespace of the referent, defaults to the namespace of the HelmRelease
3697
+
resource object that contains the reference.
3698
+
type: string
3699
+
readyExpr:
3700
+
description: |-
3701
+
ReadyExpr is a CEL expression that can be used to assess the readiness
3702
+
of a dependency. When specified, the built-in readiness check
3703
+
is replaced by the logic defined in the CEL expression.
3704
+
To make the CEL expression additive to the built-in readiness check,
3705
+
the feature gate `AdditiveCELDependencyCheck` must be set to `true`.
3706
+
type: string
3707
+
required:
3708
+
- name
3709
+
type: object
3710
+
type: array
3711
+
driftDetection:
3712
+
description: |-
3713
+
DriftDetection holds the configuration for detecting and handling
3714
+
differences between the manifest in the Helm storage and the resources
3715
+
currently existing in the cluster.
3716
+
properties:
3717
+
ignore:
3718
+
description: |-
3719
+
Ignore contains a list of rules for specifying which changes to ignore
3720
+
during diffing.
3721
+
items:
3722
+
description: |-
3723
+
IgnoreRule defines a rule to selectively disregard specific changes during
3724
+
the drift detection process.
3725
+
properties:
3726
+
paths:
3727
+
description: |-
3728
+
Paths is a list of JSON Pointer (RFC 6901) paths to be excluded from
3729
+
consideration in a Kubernetes object.
3730
+
items:
3731
+
type: string
3732
+
type: array
3733
+
target:
3734
+
description: |-
3735
+
Target is a selector for specifying Kubernetes objects to which this
3736
+
rule applies.
3737
+
If Target is not set, the Paths will be ignored for all Kubernetes
3738
+
objects within the manifest of the Helm release.
3739
+
properties:
3740
+
annotationSelector:
3741
+
description: |-
3742
+
AnnotationSelector is a string that follows the label selection expression
3743
+
https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
3744
+
It matches with the resource annotations.
3745
+
type: string
3746
+
group:
3747
+
description: |-
3748
+
Group is the API group to select resources from.
3749
+
Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.
3750
+
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
3751
+
type: string
3752
+
kind:
3753
+
description: |-
3754
+
Kind of the API Group to select resources from.
3755
+
Together with Group and Version it is capable of unambiguously
3756
+
identifying and/or selecting resources.
3757
+
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
3758
+
type: string
3759
+
labelSelector:
3760
+
description: |-
3761
+
LabelSelector is a string that follows the label selection expression
3762
+
https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
3763
+
It matches with the resource labels.
3764
+
type: string
3765
+
name:
3766
+
description: Name to match resources with.
3767
+
type: string
3768
+
namespace:
3769
+
description: Namespace to select resources from.
3770
+
type: string
3771
+
version:
3772
+
description: |-
3773
+
Version of the API Group to select resources from.
3774
+
Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.
3775
+
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
3776
+
type: string
3777
+
type: object
3778
+
required:
3779
+
- paths
3780
+
type: object
3781
+
type: array
3782
+
mode:
3783
+
description: |-
3784
+
Mode defines how differences should be handled between the Helm manifest
3785
+
and the manifest currently applied to the cluster.
3786
+
If not explicitly set, it defaults to DiffModeDisabled.
3787
+
enum:
3788
+
- enabled
3789
+
- warn
3790
+
- disabled
3791
+
type: string
3792
+
type: object
3793
+
healthCheckExprs:
3794
+
description: |-
3795
+
HealthCheckExprs is a list of healthcheck expressions for evaluating the
3796
+
health of custom resources using Common Expression Language (CEL).
3797
+
The expressions are evaluated only when the specific Helm action
3798
+
taking place has wait enabled, i.e. DisableWait is false, and the
3799
+
'poller' WaitStrategy is used.
3800
+
items:
3801
+
description: CustomHealthCheck defines the health check for custom
3802
+
resources.
3803
+
properties:
3804
+
apiVersion:
3805
+
description: APIVersion of the custom resource under evaluation.
3806
+
type: string
3807
+
current:
3808
+
description: |-
3809
+
Current is the CEL expression that determines if the status
3810
+
of the custom resource has reached the desired state.
3811
+
type: string
3812
+
failed:
3813
+
description: |-
3814
+
Failed is the CEL expression that determines if the status
3815
+
of the custom resource has failed to reach the desired state.
3816
+
type: string
3817
+
inProgress:
3818
+
description: |-
3819
+
InProgress is the CEL expression that determines if the status
3820
+
of the custom resource has not yet reached the desired state.
3821
+
type: string
3822
+
kind:
3823
+
description: Kind of the custom resource under evaluation.
3824
+
type: string
3825
+
required:
3826
+
- apiVersion
3827
+
- current
3828
+
- kind
3829
+
type: object
3830
+
type: array
3831
+
install:
3832
+
description: Install holds the configuration for Helm install actions
3833
+
for this HelmRelease.
3834
+
properties:
3835
+
crds:
3836
+
description: |-
3837
+
CRDs upgrade CRDs from the Helm Chart's crds directory according
3838
+
to the CRD upgrade policy provided here. Valid values are `Skip`,
3839
+
`Create` or `CreateReplace`. Default is `Create` and if omitted
3840
+
CRDs are installed but not updated.
3841
+
3842
+
Skip: do neither install nor replace (update) any CRDs.
3843
+
3844
+
Create: new CRDs are created, existing CRDs are neither updated nor deleted.
3845
+
3846
+
CreateReplace: new CRDs are created, existing CRDs are updated (replaced)
3847
+
but not deleted.
3848
+
3849
+
By default, CRDs are applied (installed) during Helm install action.
3850
+
With this option users can opt in to CRD replace existing CRDs on Helm
3851
+
install actions, which is not (yet) natively supported by Helm.
3852
+
https://helm.sh/docs/chart_best_practices/custom_resource_definitions.
3853
+
enum:
3854
+
- Skip
3855
+
- Create
3856
+
- CreateReplace
3857
+
type: string
3858
+
createNamespace:
3859
+
description: |-
3860
+
CreateNamespace tells the Helm install action to create the
3861
+
HelmReleaseSpec.TargetNamespace if it does not exist yet.
3862
+
On uninstall, the namespace will not be garbage collected.
3863
+
type: boolean
3864
+
disableHooks:
3865
+
description: DisableHooks prevents hooks from running during the
3866
+
Helm install action.
3867
+
type: boolean
3868
+
disableOpenAPIValidation:
3869
+
description: |-
3870
+
DisableOpenAPIValidation prevents the Helm install action from validating
3871
+
rendered templates against the Kubernetes OpenAPI Schema.
3872
+
type: boolean
3873
+
disableSchemaValidation:
3874
+
description: |-
3875
+
DisableSchemaValidation prevents the Helm install action from validating
3876
+
the values against the JSON Schema.
3877
+
type: boolean
3878
+
disableTakeOwnership:
3879
+
description: |-
3880
+
DisableTakeOwnership disables taking ownership of existing resources
3881
+
during the Helm install action. Defaults to false.
3882
+
type: boolean
3883
+
disableWait:
3884
+
description: |-
3885
+
DisableWait disables the waiting for resources to be ready after a Helm
3886
+
install has been performed.
3887
+
type: boolean
3888
+
disableWaitForJobs:
3889
+
description: |-
3890
+
DisableWaitForJobs disables waiting for jobs to complete after a Helm
3891
+
install has been performed.
3892
+
type: boolean
3893
+
remediation:
3894
+
description: |-
3895
+
Remediation holds the remediation configuration for when the Helm install
3896
+
action for the HelmRelease fails. The default is to not perform any action.
3897
+
properties:
3898
+
ignoreTestFailures:
3899
+
description: |-
3900
+
IgnoreTestFailures tells the controller to skip remediation when the Helm
3901
+
tests are run after an install action but fail. Defaults to
3902
+
'Test.IgnoreFailures'.
3903
+
type: boolean
3904
+
remediateLastFailure:
3905
+
description: |-
3906
+
RemediateLastFailure tells the controller to remediate the last failure, when
3907
+
no retries remain. Defaults to 'false'.
3908
+
type: boolean
3909
+
retries:
3910
+
description: |-
3911
+
Retries is the number of retries that should be attempted on failures before
3912
+
bailing. Remediation, using an uninstall, is performed between each attempt.
3913
+
Defaults to '0', a negative integer equals to unlimited retries.
3914
+
type: integer
3915
+
type: object
3916
+
replace:
3917
+
description: |-
3918
+
Replace tells the Helm install action to re-use the 'ReleaseName', but only
3919
+
if that name is a deleted release which remains in the history.
3920
+
type: boolean
3921
+
serverSideApply:
3922
+
description: |-
3923
+
ServerSideApply enables server-side apply for resources during install.
3924
+
Defaults to true (or false when UseHelm3Defaults feature gate is enabled).
3925
+
type: boolean
3926
+
skipCRDs:
3927
+
description: |-
3928
+
SkipCRDs tells the Helm install action to not install any CRDs. By default,
3929
+
CRDs are installed if not already present.
3930
+
3931
+
Deprecated use CRD policy (`crds`) attribute with value `Skip` instead.
3932
+
type: boolean
3933
+
strategy:
3934
+
description: |-
3935
+
Strategy defines the install strategy to use for this HelmRelease.
3936
+
Defaults to 'RemediateOnFailure', or 'RetryOnFailure' when the
3937
+
DefaultToRetryOnFailure feature gate is enabled.
3938
+
properties:
3939
+
name:
3940
+
description: Name of the install strategy.
3941
+
enum:
3942
+
- RemediateOnFailure
3943
+
- RetryOnFailure
3944
+
type: string
3945
+
retryInterval:
3946
+
description: |-
3947
+
RetryInterval is the interval at which to retry a failed install.
3948
+
Can be used only when Name is set to RetryOnFailure.
3949
+
Defaults to '5m'.
3950
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
3951
+
type: string
3952
+
required:
3953
+
- name
3954
+
type: object
3955
+
x-kubernetes-validations:
3956
+
- message: .retryInterval cannot be set when .name is 'RemediateOnFailure'
3957
+
rule: '!has(self.retryInterval) || self.name != ''RemediateOnFailure'''
3958
+
timeout:
3959
+
description: |-
3960
+
Timeout is the time to wait for any individual Kubernetes operation (like
3961
+
Jobs for hooks) during the performance of a Helm install action. Defaults to
3962
+
'HelmReleaseSpec.Timeout'.
3963
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
3964
+
type: string
3965
+
type: object
3966
+
interval:
3967
+
description: Interval at which to reconcile the Helm release.
3968
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
3969
+
type: string
3970
+
kubeConfig:
3971
+
description: |-
3972
+
KubeConfig for reconciling the HelmRelease on a remote cluster.
3973
+
When used in combination with HelmReleaseSpec.ServiceAccountName,
3974
+
forces the controller to act on behalf of that Service Account at the
3975
+
target cluster.
3976
+
If the --default-service-account flag is set, its value will be used as
3977
+
a controller level fallback for when HelmReleaseSpec.ServiceAccountName
3978
+
is empty.
3979
+
properties:
3980
+
configMapRef:
3981
+
description: |-
3982
+
ConfigMapRef holds an optional name of a ConfigMap that contains
3983
+
the following keys:
3984
+
3985
+
- `provider`: the provider to use. One of `aws`, `azure`, `gcp`, or
3986
+
`generic`. Required.
3987
+
- `cluster`: the fully qualified resource name of the Kubernetes
3988
+
cluster in the cloud provider API. Not used by the `generic`
3989
+
provider. Required when one of `address` or `ca.crt` is not set.
3990
+
- `address`: the address of the Kubernetes API server. Required
3991
+
for `generic`. For the other providers, if not specified, the
3992
+
first address in the cluster resource will be used, and if
3993
+
specified, it must match one of the addresses in the cluster
3994
+
resource.
3995
+
If audiences is not set, will be used as the audience for the
3996
+
`generic` provider.
3997
+
- `ca.crt`: the optional PEM-encoded CA certificate for the
3998
+
Kubernetes API server. If not set, the controller will use the
3999
+
CA certificate from the cluster resource.
4000
+
- `audiences`: the optional audiences as a list of
4001
+
line-break-separated strings for the Kubernetes ServiceAccount
4002
+
token. Defaults to the `address` for the `generic` provider, or
4003
+
to specific values for the other providers depending on the
4004
+
provider.
4005
+
- `serviceAccountName`: the optional name of the Kubernetes
4006
+
ServiceAccount in the same namespace that should be used
4007
+
for authentication. If not specified, the controller
4008
+
ServiceAccount will be used.
4009
+
4010
+
Mutually exclusive with SecretRef.
4011
+
properties:
4012
+
name:
4013
+
description: Name of the referent.
4014
+
type: string
4015
+
required:
4016
+
- name
4017
+
type: object
4018
+
secretRef:
4019
+
description: |-
4020
+
SecretRef holds an optional name of a secret that contains a key with
4021
+
the kubeconfig file as the value. If no key is set, the key will default
4022
+
to 'value'. Mutually exclusive with ConfigMapRef.
4023
+
It is recommended that the kubeconfig is self-contained, and the secret
4024
+
is regularly updated if credentials such as a cloud-access-token expire.
4025
+
Cloud specific `cmd-path` auth helpers will not function without adding
4026
+
binaries and credentials to the Pod that is responsible for reconciling
4027
+
Kubernetes resources. Supported only for the generic provider.
4028
+
properties:
4029
+
key:
4030
+
description: Key in the Secret, when not specified an implementation-specific
4031
+
default key is used.
4032
+
type: string
4033
+
name:
4034
+
description: Name of the Secret.
4035
+
type: string
4036
+
required:
4037
+
- name
4038
+
type: object
4039
+
type: object
4040
+
x-kubernetes-validations:
4041
+
- message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef
4042
+
must be specified
4043
+
rule: has(self.configMapRef) || has(self.secretRef)
4044
+
- message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef
4045
+
must be specified
4046
+
rule: '!has(self.configMapRef) || !has(self.secretRef)'
4047
+
maxHistory:
4048
+
description: |-
4049
+
MaxHistory is the number of revisions saved by Helm for this HelmRelease.
4050
+
Use '0' for an unlimited number of revisions; defaults to '5'.
4051
+
type: integer
4052
+
persistentClient:
4053
+
description: |-
4054
+
PersistentClient tells the controller to use a persistent Kubernetes
4055
+
client for this release. When enabled, the client will be reused for the
4056
+
duration of the reconciliation, instead of being created and destroyed
4057
+
for each (step of a) Helm action.
4058
+
4059
+
This can improve performance, but may cause issues with some Helm charts
4060
+
that for example do create Custom Resource Definitions during installation
4061
+
outside Helm's CRD lifecycle hooks, which are then not observed to be
4062
+
available by e.g. post-install hooks.
4063
+
4064
+
If not set, it defaults to true.
4065
+
type: boolean
4066
+
postRenderers:
4067
+
description: |-
4068
+
PostRenderers holds an array of Helm PostRenderers, which will be applied in order
4069
+
of their definition.
4070
+
items:
4071
+
description: PostRenderer contains a Helm PostRenderer specification.
4072
+
properties:
4073
+
kustomize:
4074
+
description: Kustomization to apply as PostRenderer.
4075
+
properties:
4076
+
images:
4077
+
description: |-
4078
+
Images is a list of (image name, new name, new tag or digest)
4079
+
for changing image names, tags or digests. This can also be achieved with a
4080
+
patch, but this operator is simpler to specify.
4081
+
items:
4082
+
description: Image contains an image name, a new name,
4083
+
a new tag or digest, which will replace the original
4084
+
name and tag.
4085
+
properties:
4086
+
digest:
4087
+
description: |-
4088
+
Digest is the value used to replace the original image tag.
4089
+
If digest is present NewTag value is ignored.
4090
+
type: string
4091
+
name:
4092
+
description: Name is a tag-less image name.
4093
+
type: string
4094
+
newName:
4095
+
description: NewName is the value used to replace
4096
+
the original name.
4097
+
type: string
4098
+
newTag:
4099
+
description: NewTag is the value used to replace the
4100
+
original tag.
4101
+
type: string
4102
+
required:
4103
+
- name
4104
+
type: object
4105
+
type: array
4106
+
patches:
4107
+
description: |-
4108
+
Strategic merge and JSON patches, defined as inline YAML objects,
4109
+
capable of targeting objects based on kind, label and annotation selectors.
4110
+
items:
4111
+
description: |-
4112
+
Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should
4113
+
be applied to.
4114
+
properties:
4115
+
patch:
4116
+
description: |-
4117
+
Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with
4118
+
an array of operation objects.
4119
+
type: string
4120
+
target:
4121
+
description: Target points to the resources that the
4122
+
patch document should be applied to.
4123
+
properties:
4124
+
annotationSelector:
4125
+
description: |-
4126
+
AnnotationSelector is a string that follows the label selection expression
4127
+
https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
4128
+
It matches with the resource annotations.
4129
+
type: string
4130
+
group:
4131
+
description: |-
4132
+
Group is the API group to select resources from.
4133
+
Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.
4134
+
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
4135
+
type: string
4136
+
kind:
4137
+
description: |-
4138
+
Kind of the API Group to select resources from.
4139
+
Together with Group and Version it is capable of unambiguously
4140
+
identifying and/or selecting resources.
4141
+
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
4142
+
type: string
4143
+
labelSelector:
4144
+
description: |-
4145
+
LabelSelector is a string that follows the label selection expression
4146
+
https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
4147
+
It matches with the resource labels.
4148
+
type: string
4149
+
name:
4150
+
description: Name to match resources with.
4151
+
type: string
4152
+
namespace:
4153
+
description: Namespace to select resources from.
4154
+
type: string
4155
+
version:
4156
+
description: |-
4157
+
Version of the API Group to select resources from.
4158
+
Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.
4159
+
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
4160
+
type: string
4161
+
type: object
4162
+
required:
4163
+
- patch
4164
+
type: object
4165
+
type: array
4166
+
type: object
4167
+
type: object
4168
+
type: array
4169
+
releaseName:
4170
+
description: |-
4171
+
ReleaseName used for the Helm release. Defaults to a composition of
4172
+
'[TargetNamespace-]Name'.
4173
+
maxLength: 53
4174
+
minLength: 1
4175
+
type: string
4176
+
rollback:
4177
+
description: Rollback holds the configuration for Helm rollback actions
4178
+
for this HelmRelease.
4179
+
properties:
4180
+
cleanupOnFail:
4181
+
description: |-
4182
+
CleanupOnFail allows deletion of new resources created during the Helm
4183
+
rollback action when it fails.
4184
+
type: boolean
4185
+
disableHooks:
4186
+
description: DisableHooks prevents hooks from running during the
4187
+
Helm rollback action.
4188
+
type: boolean
4189
+
disableWait:
4190
+
description: |-
4191
+
DisableWait disables the waiting for resources to be ready after a Helm
4192
+
rollback has been performed.
4193
+
type: boolean
4194
+
disableWaitForJobs:
4195
+
description: |-
4196
+
DisableWaitForJobs disables waiting for jobs to complete after a Helm
4197
+
rollback has been performed.
4198
+
type: boolean
4199
+
force:
4200
+
description: |-
4201
+
Force forces resource updates through a replacement strategy
4202
+
that avoids 3-way merge conflicts on client-side apply.
4203
+
This field is ignored for server-side apply (which always
4204
+
forces conflicts with other field managers).
4205
+
type: boolean
4206
+
recreate:
4207
+
description: |-
4208
+
Recreate performs pod restarts for any managed workloads.
4209
+
4210
+
Deprecated: This behavior was deprecated in Helm 3:
4211
+
- Deprecation: https://github.com/helm/helm/pull/6463
4212
+
- Removal: https://github.com/helm/helm/pull/31023
4213
+
After helm-controller was upgraded to the Helm 4 SDK,
4214
+
this field is no longer functional and will print a
4215
+
warning if set to true. It will also be removed in a
4216
+
future release.
4217
+
type: boolean
4218
+
serverSideApply:
4219
+
description: |-
4220
+
ServerSideApply enables server-side apply for resources during rollback.
4221
+
Can be "enabled", "disabled", or "auto".
4222
+
When "auto", server-side apply usage will be based on the release's previous usage.
4223
+
Defaults to "auto".
4224
+
enum:
4225
+
- enabled
4226
+
- disabled
4227
+
- auto
4228
+
type: string
4229
+
timeout:
4230
+
description: |-
4231
+
Timeout is the time to wait for any individual Kubernetes operation (like
4232
+
Jobs for hooks) during the performance of a Helm rollback action. Defaults to
4233
+
'HelmReleaseSpec.Timeout'.
4234
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
4235
+
type: string
4236
+
type: object
4237
+
serviceAccountName:
4238
+
description: |-
4239
+
The name of the Kubernetes service account to impersonate
4240
+
when reconciling this HelmRelease.
4241
+
maxLength: 253
4242
+
minLength: 1
4243
+
type: string
4244
+
storageNamespace:
4245
+
description: |-
4246
+
StorageNamespace used for the Helm storage.
4247
+
Defaults to the namespace of the HelmRelease.
4248
+
maxLength: 63
4249
+
minLength: 1
4250
+
type: string
4251
+
suspend:
4252
+
description: |-
4253
+
Suspend tells the controller to suspend reconciliation for this HelmRelease,
4254
+
it does not apply to already started reconciliations. Defaults to false.
4255
+
type: boolean
4256
+
targetNamespace:
4257
+
description: |-
4258
+
TargetNamespace to target when performing operations for the HelmRelease.
4259
+
Defaults to the namespace of the HelmRelease.
4260
+
maxLength: 63
4261
+
minLength: 1
4262
+
type: string
4263
+
test:
4264
+
description: Test holds the configuration for Helm test actions for
4265
+
this HelmRelease.
4266
+
properties:
4267
+
enable:
4268
+
description: |-
4269
+
Enable enables Helm test actions for this HelmRelease after an Helm install
4270
+
or upgrade action has been performed.
4271
+
type: boolean
4272
+
filters:
4273
+
description: Filters is a list of tests to run or exclude from
4274
+
running.
4275
+
items:
4276
+
description: Filter holds the configuration for individual Helm
4277
+
test filters.
4278
+
properties:
4279
+
exclude:
4280
+
description: Exclude specifies whether the named test should
4281
+
be excluded.
4282
+
type: boolean
4283
+
name:
4284
+
description: Name is the name of the test.
4285
+
maxLength: 253
4286
+
minLength: 1
4287
+
type: string
4288
+
required:
4289
+
- name
4290
+
type: object
4291
+
type: array
4292
+
ignoreFailures:
4293
+
description: |-
4294
+
IgnoreFailures tells the controller to skip remediation when the Helm tests
4295
+
are run but fail. Can be overwritten for tests run after install or upgrade
4296
+
actions in 'Install.IgnoreTestFailures' and 'Upgrade.IgnoreTestFailures'.
4297
+
type: boolean
4298
+
timeout:
4299
+
description: |-
4300
+
Timeout is the time to wait for any individual Kubernetes operation during
4301
+
the performance of a Helm test action. Defaults to 'HelmReleaseSpec.Timeout'.
4302
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
4303
+
type: string
4304
+
type: object
4305
+
timeout:
4306
+
description: |-
4307
+
Timeout is the time to wait for any individual Kubernetes operation (like Jobs
4308
+
for hooks) during the performance of a Helm action. Defaults to '5m0s'.
4309
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
4310
+
type: string
4311
+
uninstall:
4312
+
description: Uninstall holds the configuration for Helm uninstall
4313
+
actions for this HelmRelease.
4314
+
properties:
4315
+
deletionPropagation:
4316
+
default: background
4317
+
description: |-
4318
+
DeletionPropagation specifies the deletion propagation policy when
4319
+
a Helm uninstall is performed.
4320
+
enum:
4321
+
- background
4322
+
- foreground
4323
+
- orphan
4324
+
type: string
4325
+
disableHooks:
4326
+
description: DisableHooks prevents hooks from running during the
4327
+
Helm rollback action.
4328
+
type: boolean
4329
+
disableWait:
4330
+
description: |-
4331
+
DisableWait disables waiting for all the resources to be deleted after
4332
+
a Helm uninstall is performed.
4333
+
type: boolean
4334
+
keepHistory:
4335
+
description: |-
4336
+
KeepHistory tells Helm to remove all associated resources and mark the
4337
+
release as deleted, but retain the release history.
4338
+
type: boolean
4339
+
timeout:
4340
+
description: |-
4341
+
Timeout is the time to wait for any individual Kubernetes operation (like
4342
+
Jobs for hooks) during the performance of a Helm uninstall action. Defaults
4343
+
to 'HelmReleaseSpec.Timeout'.
4344
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
4345
+
type: string
4346
+
type: object
4347
+
upgrade:
4348
+
description: Upgrade holds the configuration for Helm upgrade actions
4349
+
for this HelmRelease.
4350
+
properties:
4351
+
cleanupOnFail:
4352
+
description: |-
4353
+
CleanupOnFail allows deletion of new resources created during the Helm
4354
+
upgrade action when it fails.
4355
+
type: boolean
4356
+
crds:
4357
+
description: |-
4358
+
CRDs upgrade CRDs from the Helm Chart's crds directory according
4359
+
to the CRD upgrade policy provided here. Valid values are `Skip`,
4360
+
`Create` or `CreateReplace`. Default is `Skip` and if omitted
4361
+
CRDs are neither installed nor upgraded.
4362
+
4363
+
Skip: do neither install nor replace (update) any CRDs.
4364
+
4365
+
Create: new CRDs are created, existing CRDs are neither updated nor deleted.
4366
+
4367
+
CreateReplace: new CRDs are created, existing CRDs are updated (replaced)
4368
+
but not deleted.
4369
+
4370
+
By default, CRDs are not applied during Helm upgrade action. With this
4371
+
option users can opt-in to CRD upgrade, which is not (yet) natively supported by Helm.
4372
+
https://helm.sh/docs/chart_best_practices/custom_resource_definitions.
4373
+
enum:
4374
+
- Skip
4375
+
- Create
4376
+
- CreateReplace
4377
+
type: string
4378
+
disableHooks:
4379
+
description: DisableHooks prevents hooks from running during the
4380
+
Helm upgrade action.
4381
+
type: boolean
4382
+
disableOpenAPIValidation:
4383
+
description: |-
4384
+
DisableOpenAPIValidation prevents the Helm upgrade action from validating
4385
+
rendered templates against the Kubernetes OpenAPI Schema.
4386
+
type: boolean
4387
+
disableSchemaValidation:
4388
+
description: |-
4389
+
DisableSchemaValidation prevents the Helm upgrade action from validating
4390
+
the values against the JSON Schema.
4391
+
type: boolean
4392
+
disableTakeOwnership:
4393
+
description: |-
4394
+
DisableTakeOwnership disables taking ownership of existing resources
4395
+
during the Helm upgrade action. Defaults to false.
4396
+
type: boolean
4397
+
disableWait:
4398
+
description: |-
4399
+
DisableWait disables the waiting for resources to be ready after a Helm
4400
+
upgrade has been performed.
4401
+
type: boolean
4402
+
disableWaitForJobs:
4403
+
description: |-
4404
+
DisableWaitForJobs disables waiting for jobs to complete after a Helm
4405
+
upgrade has been performed.
4406
+
type: boolean
4407
+
force:
4408
+
description: |-
4409
+
Force forces resource updates through a replacement strategy
4410
+
that avoids 3-way merge conflicts on client-side apply.
4411
+
This field is ignored for server-side apply (which always
4412
+
forces conflicts with other field managers).
4413
+
type: boolean
4414
+
preserveValues:
4415
+
description: |-
4416
+
PreserveValues will make Helm reuse the last release's values and merge in
4417
+
overrides from 'Values'. Setting this flag makes the HelmRelease
4418
+
non-declarative.
4419
+
type: boolean
4420
+
remediation:
4421
+
description: |-
4422
+
Remediation holds the remediation configuration for when the Helm upgrade
4423
+
action for the HelmRelease fails. The default is to not perform any action.
4424
+
properties:
4425
+
ignoreTestFailures:
4426
+
description: |-
4427
+
IgnoreTestFailures tells the controller to skip remediation when the Helm
4428
+
tests are run after an upgrade action but fail.
4429
+
Defaults to 'Test.IgnoreFailures'.
4430
+
type: boolean
4431
+
remediateLastFailure:
4432
+
description: |-
4433
+
RemediateLastFailure tells the controller to remediate the last failure, when
4434
+
no retries remain. Defaults to 'false' unless 'Retries' is greater than 0.
4435
+
type: boolean
4436
+
retries:
4437
+
description: |-
4438
+
Retries is the number of retries that should be attempted on failures before
4439
+
bailing. Remediation, using 'Strategy', is performed between each attempt.
4440
+
Defaults to '0', a negative integer equals to unlimited retries.
4441
+
type: integer
4442
+
strategy:
4443
+
description: Strategy to use for failure remediation. Defaults
4444
+
to 'rollback'.
4445
+
enum:
4446
+
- rollback
4447
+
- uninstall
4448
+
type: string
4449
+
type: object
4450
+
serverSideApply:
4451
+
description: |-
4452
+
ServerSideApply enables server-side apply for resources during upgrade.
4453
+
Can be "enabled", "disabled", or "auto".
4454
+
When "auto", server-side apply usage will be based on the release's previous usage.
4455
+
Defaults to "auto".
4456
+
enum:
4457
+
- enabled
4458
+
- disabled
4459
+
- auto
4460
+
type: string
4461
+
strategy:
4462
+
description: |-
4463
+
Strategy defines the upgrade strategy to use for this HelmRelease.
4464
+
Defaults to 'RemediateOnFailure', or 'RetryOnFailure' when the
4465
+
DefaultToRetryOnFailure feature gate is enabled.
4466
+
properties:
4467
+
name:
4468
+
description: Name of the upgrade strategy.
4469
+
enum:
4470
+
- RemediateOnFailure
4471
+
- RetryOnFailure
4472
+
type: string
4473
+
retryInterval:
4474
+
description: |-
4475
+
RetryInterval is the interval at which to retry a failed upgrade.
4476
+
Can be used only when Name is set to RetryOnFailure.
4477
+
Defaults to '5m'.
4478
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
4479
+
type: string
4480
+
required:
4481
+
- name
4482
+
type: object
4483
+
x-kubernetes-validations:
4484
+
- message: .retryInterval can only be set when .name is 'RetryOnFailure'
4485
+
rule: '!has(self.retryInterval) || self.name == ''RetryOnFailure'''
4486
+
timeout:
4487
+
description: |-
4488
+
Timeout is the time to wait for any individual Kubernetes operation (like
4489
+
Jobs for hooks) during the performance of a Helm upgrade action. Defaults to
4490
+
'HelmReleaseSpec.Timeout'.
4491
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
4492
+
type: string
4493
+
type: object
4494
+
values:
4495
+
description: Values holds the values for this Helm release.
4496
+
x-kubernetes-preserve-unknown-fields: true
4497
+
valuesFrom:
4498
+
description: |-
4499
+
ValuesFrom holds references to resources containing Helm values for this HelmRelease,
4500
+
and information about how they should be merged.
4501
+
items:
4502
+
description: |-
4503
+
ValuesReference contains a reference to a resource containing Helm values,
4504
+
and optionally the key they can be found at.
4505
+
properties:
4506
+
kind:
4507
+
description: Kind of the values referent, valid values are ('Secret',
4508
+
'ConfigMap').
4509
+
enum:
4510
+
- Secret
4511
+
- ConfigMap
4512
+
type: string
4513
+
name:
4514
+
description: |-
4515
+
Name of the values referent. Should reside in the same namespace as the
4516
+
referring resource.
4517
+
maxLength: 253
4518
+
minLength: 1
4519
+
type: string
4520
+
optional:
4521
+
description: |-
4522
+
Optional marks this ValuesReference as optional. When set, a not found error
4523
+
for the values reference is ignored, but any ValuesKey, TargetPath or
4524
+
transient error will still result in a reconciliation failure.
4525
+
type: boolean
4526
+
targetPath:
4527
+
description: |-
4528
+
TargetPath is the YAML dot notation path the value should be merged at. When
4529
+
set, the ValuesKey is expected to be a single flat value. Defaults to 'None',
4530
+
which results in the values getting merged at the root.
4531
+
maxLength: 250
4532
+
pattern: ^([a-zA-Z0-9_\-.\\\/]|\[[0-9]{1,5}\])+$
4533
+
type: string
4534
+
valuesKey:
4535
+
description: |-
4536
+
ValuesKey is the data key where the values.yaml or a specific value can be
4537
+
found at. Defaults to 'values.yaml'.
4538
+
maxLength: 253
4539
+
pattern: ^[\-._a-zA-Z0-9]+$
4540
+
type: string
4541
+
required:
4542
+
- kind
4543
+
- name
4544
+
type: object
4545
+
type: array
4546
+
waitStrategy:
4547
+
description: |-
4548
+
WaitStrategy defines Helm's wait strategy for waiting for applied
4549
+
resources to become ready.
4550
+
properties:
4551
+
name:
4552
+
description: |-
4553
+
Name is Helm's wait strategy for waiting for applied resources to
4554
+
become ready. One of 'poller' or 'legacy'. The 'poller' strategy uses
4555
+
kstatus to poll resource statuses, while the 'legacy' strategy uses
4556
+
Helm v3's waiting logic.
4557
+
Defaults to 'poller', or to 'legacy' when UseHelm3Defaults feature
4558
+
gate is enabled.
4559
+
enum:
4560
+
- poller
4561
+
- legacy
4562
+
type: string
4563
+
required:
4564
+
- name
4565
+
type: object
4566
+
required:
4567
+
- interval
4568
+
type: object
4569
+
x-kubernetes-validations:
4570
+
- message: either chart or chartRef must be set
4571
+
rule: (has(self.chart) && !has(self.chartRef)) || (!has(self.chart)
4572
+
&& has(self.chartRef))
4573
+
status:
4574
+
default:
4575
+
observedGeneration: -1
4576
+
description: HelmReleaseStatus defines the observed state of a HelmRelease.
4577
+
properties:
4578
+
conditions:
4579
+
description: Conditions holds the conditions for the HelmRelease.
4580
+
items:
4581
+
description: Condition contains details for one aspect of the current
4582
+
state of this API Resource.
4583
+
properties:
4584
+
lastTransitionTime:
4585
+
description: |-
4586
+
lastTransitionTime is the last time the condition transitioned from one status to another.
4587
+
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
4588
+
format: date-time
4589
+
type: string
4590
+
message:
4591
+
description: |-
4592
+
message is a human readable message indicating details about the transition.
4593
+
This may be an empty string.
4594
+
maxLength: 32768
4595
+
type: string
4596
+
observedGeneration:
4597
+
description: |-
4598
+
observedGeneration represents the .metadata.generation that the condition was set based upon.
4599
+
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
4600
+
with respect to the current state of the instance.
4601
+
format: int64
4602
+
minimum: 0
4603
+
type: integer
4604
+
reason:
4605
+
description: |-
4606
+
reason contains a programmatic identifier indicating the reason for the condition's last transition.
4607
+
Producers of specific condition types may define expected values and meanings for this field,
4608
+
and whether the values are considered a guaranteed API.
4609
+
The value should be a CamelCase string.
4610
+
This field may not be empty.
4611
+
maxLength: 1024
4612
+
minLength: 1
4613
+
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
4614
+
type: string
4615
+
status:
4616
+
description: status of the condition, one of True, False, Unknown.
4617
+
enum:
4618
+
- "True"
4619
+
- "False"
4620
+
- Unknown
4621
+
type: string
4622
+
type:
4623
+
description: type of condition in CamelCase or in foo.example.com/CamelCase.
4624
+
maxLength: 316
4625
+
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
4626
+
type: string
4627
+
required:
4628
+
- lastTransitionTime
4629
+
- message
4630
+
- reason
4631
+
- status
4632
+
- type
4633
+
type: object
4634
+
type: array
4635
+
failures:
4636
+
description: |-
4637
+
Failures is the reconciliation failure count against the latest desired
4638
+
state. It is reset after a successful reconciliation.
4639
+
format: int64
4640
+
type: integer
4641
+
helmChart:
4642
+
description: |-
4643
+
HelmChart is the namespaced name of the HelmChart resource created by
4644
+
the controller for the HelmRelease.
4645
+
type: string
4646
+
history:
4647
+
description: |-
4648
+
History holds the history of Helm releases performed for this HelmRelease
4649
+
up to the last successfully completed release.
4650
+
items:
4651
+
description: |-
4652
+
Snapshot captures a point-in-time copy of the status information for a Helm release,
4653
+
as managed by the controller.
4654
+
properties:
4655
+
action:
4656
+
description: Action is the action that resulted in this snapshot
4657
+
being created.
4658
+
type: string
4659
+
apiVersion:
4660
+
description: |-
4661
+
APIVersion is the API version of the Snapshot.
4662
+
When the calculation method of the Digest field is changed, this
4663
+
field will be used to distinguish between the old and new methods.
4664
+
type: string
4665
+
appVersion:
4666
+
description: AppVersion is the chart app version of the release
4667
+
object in storage.
4668
+
type: string
4669
+
chartName:
4670
+
description: ChartName is the chart name of the release object
4671
+
in storage.
4672
+
type: string
4673
+
chartVersion:
4674
+
description: |-
4675
+
ChartVersion is the chart version of the release object in
4676
+
storage.
4677
+
type: string
4678
+
configDigest:
4679
+
description: |-
4680
+
ConfigDigest is the checksum of the config (better known as
4681
+
"values") of the release object in storage.
4682
+
It has the format of `<algo>:<checksum>`.
4683
+
type: string
4684
+
deleted:
4685
+
description: Deleted is when the release was deleted.
4686
+
format: date-time
4687
+
type: string
4688
+
digest:
4689
+
description: |-
4690
+
Digest is the checksum of the release object in storage.
4691
+
It has the format of `<algo>:<checksum>`.
4692
+
type: string
4693
+
firstDeployed:
4694
+
description: FirstDeployed is when the release was first deployed.
4695
+
format: date-time
4696
+
type: string
4697
+
lastDeployed:
4698
+
description: LastDeployed is when the release was last deployed.
4699
+
format: date-time
4700
+
type: string
4701
+
name:
4702
+
description: Name is the name of the release.
4703
+
type: string
4704
+
namespace:
4705
+
description: Namespace is the namespace the release is deployed
4706
+
to.
4707
+
type: string
4708
+
ociDigest:
4709
+
description: OCIDigest is the digest of the OCI artifact associated
4710
+
with the release.
4711
+
type: string
4712
+
status:
4713
+
description: Status is the current state of the release.
4714
+
type: string
4715
+
testHooks:
4716
+
additionalProperties:
4717
+
description: |-
4718
+
TestHookStatus holds the status information for a test hook as observed
4719
+
to be run by the controller.
4720
+
properties:
4721
+
lastCompleted:
4722
+
description: LastCompleted is the time the test hook last
4723
+
completed.
4724
+
format: date-time
4725
+
type: string
4726
+
lastStarted:
4727
+
description: LastStarted is the time the test hook was
4728
+
last started.
4729
+
format: date-time
4730
+
type: string
4731
+
phase:
4732
+
description: Phase the test hook was observed to be in.
4733
+
type: string
4734
+
type: object
4735
+
description: |-
4736
+
TestHooks is the list of test hooks for the release as observed to be
4737
+
run by the controller.
4738
+
type: object
4739
+
version:
4740
+
description: Version is the version of the release object in
4741
+
storage.
4742
+
type: integer
4743
+
required:
4744
+
- chartName
4745
+
- chartVersion
4746
+
- configDigest
4747
+
- digest
4748
+
- firstDeployed
4749
+
- lastDeployed
4750
+
- name
4751
+
- namespace
4752
+
- status
4753
+
- version
4754
+
type: object
4755
+
type: array
4756
+
installFailures:
4757
+
description: |-
4758
+
InstallFailures is the install failure count against the latest desired
4759
+
state. It is reset after a successful reconciliation.
4760
+
format: int64
4761
+
type: integer
4762
+
inventory:
4763
+
description: |-
4764
+
Inventory contains the list of Kubernetes resource object references
4765
+
that have been applied for this release.
4766
+
properties:
4767
+
entries:
4768
+
description: Entries of Kubernetes resource object references.
4769
+
items:
4770
+
description: ResourceRef contains the information necessary
4771
+
to locate a resource within a cluster.
4772
+
properties:
4773
+
id:
4774
+
description: |-
4775
+
ID is the string representation of the Kubernetes resource object's metadata,
4776
+
in the format '<namespace>_<name>_<group>_<kind>'.
4777
+
type: string
4778
+
v:
4779
+
description: Version is the API version of the Kubernetes
4780
+
resource object's kind.
4781
+
type: string
4782
+
required:
4783
+
- id
4784
+
- v
4785
+
type: object
4786
+
type: array
4787
+
required:
4788
+
- entries
4789
+
type: object
4790
+
lastAttemptedConfigDigest:
4791
+
description: |-
4792
+
LastAttemptedConfigDigest is the digest for the config (better known as
4793
+
"values") of the last reconciliation attempt.
4794
+
type: string
4795
+
lastAttemptedGeneration:
4796
+
description: |-
4797
+
LastAttemptedGeneration is the last generation the controller attempted
4798
+
to reconcile.
4799
+
format: int64
4800
+
type: integer
4801
+
lastAttemptedReleaseAction:
4802
+
description: |-
4803
+
LastAttemptedReleaseAction is the last release action performed for this
4804
+
HelmRelease. It is used to determine the active retry or remediation
4805
+
strategy.
4806
+
enum:
4807
+
- install
4808
+
- upgrade
4809
+
type: string
4810
+
lastAttemptedReleaseActionDuration:
4811
+
description: |-
4812
+
LastAttemptedReleaseActionDuration is the duration of the last
4813
+
release action performed for this HelmRelease.
4814
+
type: string
4815
+
lastAttemptedRevision:
4816
+
description: |-
4817
+
LastAttemptedRevision is the Source revision of the last reconciliation
4818
+
attempt. For OCIRepository sources, the 12 first characters of the digest are
4819
+
appended to the chart version e.g. "1.2.3+1234567890ab".
4820
+
type: string
4821
+
lastAttemptedRevisionDigest:
4822
+
description: |-
4823
+
LastAttemptedRevisionDigest is the digest of the last reconciliation attempt.
4824
+
This is only set for OCIRepository sources.
4825
+
type: string
4826
+
lastAttemptedValuesChecksum:
4827
+
description: |-
4828
+
LastAttemptedValuesChecksum is the SHA1 checksum for the values of the last
4829
+
reconciliation attempt.
4830
+
4831
+
Deprecated: Use LastAttemptedConfigDigest instead.
4832
+
type: string
4833
+
lastHandledForceAt:
4834
+
description: |-
4835
+
LastHandledForceAt holds the value of the most recent
4836
+
force request value, so a change of the annotation value
4837
+
can be detected.
4838
+
type: string
4839
+
lastHandledReconcileAt:
4840
+
description: |-
4841
+
LastHandledReconcileAt holds the value of the most recent
4842
+
reconcile request value, so a change of the annotation value
4843
+
can be detected.
4844
+
type: string
4845
+
lastHandledResetAt:
4846
+
description: |-
4847
+
LastHandledResetAt holds the value of the most recent reset request
4848
+
value, so a change of the annotation value can be detected.
4849
+
type: string
4850
+
lastReleaseRevision:
4851
+
description: |-
4852
+
LastReleaseRevision is the revision of the last successful Helm release.
4853
+
4854
+
Deprecated: Use History instead.
4855
+
type: integer
4856
+
observedCommonMetadataDigest:
4857
+
description: |-
4858
+
ObservedCommonMetadataDigest is the digest for the common metadata of
4859
+
the last successful reconciliation attempt.
4860
+
type: string
4861
+
observedGeneration:
4862
+
description: ObservedGeneration is the last observed generation.
4863
+
format: int64
4864
+
type: integer
4865
+
observedPostRenderersDigest:
4866
+
description: |-
4867
+
ObservedPostRenderersDigest is the digest for the post-renderers of
4868
+
the last successful reconciliation attempt.
4869
+
type: string
4870
+
storageNamespace:
4871
+
description: |-
4872
+
StorageNamespace is the namespace of the Helm release storage for the
4873
+
current release.
4874
+
maxLength: 63
4875
+
minLength: 1
4876
+
type: string
4877
+
upgradeFailures:
4878
+
description: |-
4879
+
UpgradeFailures is the upgrade failure count against the latest desired
4880
+
state. It is reset after a successful reconciliation.
4881
+
format: int64
4882
+
type: integer
4883
+
type: object
4884
+
type: object
4885
+
served: true
4886
+
storage: true
4887
+
subresources:
4888
+
status: {}
4889
+
---
4890
+
apiVersion: v1
4891
+
kind: ServiceAccount
4892
+
metadata:
4893
+
labels:
4894
+
app.kubernetes.io/component: helm-controller
4895
+
app.kubernetes.io/instance: flux-system
4896
+
app.kubernetes.io/part-of: flux
4897
+
app.kubernetes.io/version: v2.8.8
4898
+
name: helm-controller
4899
+
namespace: flux-system
4900
+
---
4901
+
apiVersion: apps/v1
4902
+
kind: Deployment
4903
+
metadata:
4904
+
labels:
4905
+
app.kubernetes.io/component: helm-controller
4906
+
app.kubernetes.io/instance: flux-system
4907
+
app.kubernetes.io/part-of: flux
4908
+
app.kubernetes.io/version: v2.8.8
4909
+
control-plane: controller
4910
+
name: helm-controller
4911
+
namespace: flux-system
4912
+
spec:
4913
+
replicas: 1
4914
+
selector:
4915
+
matchLabels:
4916
+
app: helm-controller
4917
+
template:
4918
+
metadata:
4919
+
annotations:
4920
+
prometheus.io/port: "8080"
4921
+
prometheus.io/scrape: "true"
4922
+
labels:
4923
+
app: helm-controller
4924
+
app.kubernetes.io/component: helm-controller
4925
+
app.kubernetes.io/instance: flux-system
4926
+
app.kubernetes.io/part-of: flux
4927
+
app.kubernetes.io/version: v2.8.8
4928
+
spec:
4929
+
containers:
4930
+
- args:
4931
+
- --events-addr=http://notification-controller.$(RUNTIME_NAMESPACE).svc.cluster.local./
4932
+
- --watch-all-namespaces=true
4933
+
- --log-level=info
4934
+
- --log-encoding=json
4935
+
- --enable-leader-election
4936
+
env:
4937
+
- name: RUNTIME_NAMESPACE
4938
+
valueFrom:
4939
+
fieldRef:
4940
+
fieldPath: metadata.namespace
4941
+
- name: GOMEMLIMIT
4942
+
valueFrom:
4943
+
resourceFieldRef:
4944
+
containerName: manager
4945
+
resource: limits.memory
4946
+
image: ghcr.io/fluxcd/helm-controller:v1.5.5
4947
+
imagePullPolicy: IfNotPresent
4948
+
livenessProbe:
4949
+
httpGet:
4950
+
path: /healthz
4951
+
port: healthz
4952
+
name: manager
4953
+
ports:
4954
+
- containerPort: 8080
4955
+
name: http-prom
4956
+
protocol: TCP
4957
+
- containerPort: 9440
4958
+
name: healthz
4959
+
protocol: TCP
4960
+
readinessProbe:
4961
+
httpGet:
4962
+
path: /readyz
4963
+
port: healthz
4964
+
resources:
4965
+
limits:
4966
+
cpu: 1000m
4967
+
memory: 1Gi
4968
+
requests:
4969
+
cpu: 100m
4970
+
memory: 64Mi
4971
+
securityContext:
4972
+
allowPrivilegeEscalation: false
4973
+
capabilities:
4974
+
drop:
4975
+
- ALL
4976
+
readOnlyRootFilesystem: true
4977
+
runAsNonRoot: true
4978
+
seccompProfile:
4979
+
type: RuntimeDefault
4980
+
volumeMounts:
4981
+
- mountPath: /tmp
4982
+
name: temp
4983
+
nodeSelector:
4984
+
kubernetes.io/os: linux
4985
+
priorityClassName: system-cluster-critical
4986
+
securityContext:
4987
+
fsGroup: 1337
4988
+
serviceAccountName: helm-controller
4989
+
terminationGracePeriodSeconds: 600
4990
+
volumes:
4991
+
- emptyDir: {}
4992
+
name: temp
4993
+
---
4994
+
apiVersion: apiextensions.k8s.io/v1
4995
+
kind: CustomResourceDefinition
4996
+
metadata:
4997
+
annotations:
4998
+
controller-gen.kubebuilder.io/version: v0.19.0
4999
+
labels:
5000
+
app.kubernetes.io/component: notification-controller
5001
+
app.kubernetes.io/instance: flux-system
5002
+
app.kubernetes.io/part-of: flux
5003
+
app.kubernetes.io/version: v2.8.8
5004
+
name: alerts.notification.toolkit.fluxcd.io
5005
+
spec:
5006
+
group: notification.toolkit.fluxcd.io
5007
+
names:
5008
+
kind: Alert
5009
+
listKind: AlertList
5010
+
plural: alerts
5011
+
singular: alert
5012
+
scope: Namespaced
5013
+
versions:
5014
+
- additionalPrinterColumns:
5015
+
- jsonPath: .metadata.creationTimestamp
5016
+
name: Age
5017
+
type: date
5018
+
- jsonPath: .status.conditions[?(@.type=="Ready")].status
5019
+
name: Ready
5020
+
type: string
5021
+
- jsonPath: .status.conditions[?(@.type=="Ready")].message
5022
+
name: Status
5023
+
type: string
5024
+
deprecated: true
5025
+
deprecationWarning: v1beta2 Alert is deprecated, upgrade to v1beta3
5026
+
name: v1beta2
5027
+
schema:
5028
+
openAPIV3Schema:
5029
+
description: Alert is the Schema for the alerts API
5030
+
properties:
5031
+
apiVersion:
5032
+
description: |-
5033
+
APIVersion defines the versioned schema of this representation of an object.
5034
+
Servers should convert recognized schemas to the latest internal value, and
5035
+
may reject unrecognized values.
5036
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
5037
+
type: string
5038
+
kind:
5039
+
description: |-
5040
+
Kind is a string value representing the REST resource this object represents.
5041
+
Servers may infer this from the endpoint the client submits requests to.
5042
+
Cannot be updated.
5043
+
In CamelCase.
5044
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
5045
+
type: string
5046
+
metadata:
5047
+
type: object
5048
+
spec:
5049
+
description: AlertSpec defines an alerting rule for events involving a
5050
+
list of objects.
5051
+
properties:
5052
+
eventMetadata:
5053
+
additionalProperties:
5054
+
type: string
5055
+
description: |-
5056
+
EventMetadata is an optional field for adding metadata to events dispatched by the
5057
+
controller. This can be used for enhancing the context of the event. If a field
5058
+
would override one already present on the original event as generated by the emitter,
5059
+
then the override doesn't happen, i.e. the original value is preserved, and an info
5060
+
log is printed.
5061
+
type: object
5062
+
eventSeverity:
5063
+
default: info
5064
+
description: |-
5065
+
EventSeverity specifies how to filter events based on severity.
5066
+
If set to 'info' no events will be filtered.
5067
+
enum:
5068
+
- info
5069
+
- error
5070
+
type: string
5071
+
eventSources:
5072
+
description: |-
5073
+
EventSources specifies how to filter events based
5074
+
on the involved object kind, name and namespace.
5075
+
items:
5076
+
description: |-
5077
+
CrossNamespaceObjectReference contains enough information to let you locate the
5078
+
typed referenced object at cluster level
5079
+
properties:
5080
+
apiVersion:
5081
+
description: API version of the referent
5082
+
type: string
5083
+
kind:
5084
+
description: Kind of the referent
5085
+
enum:
5086
+
- Bucket
5087
+
- GitRepository
5088
+
- Kustomization
5089
+
- HelmRelease
5090
+
- HelmChart
5091
+
- HelmRepository
5092
+
- ImageRepository
5093
+
- ImagePolicy
5094
+
- ImageUpdateAutomation
5095
+
- OCIRepository
5096
+
- ArtifactGenerator
5097
+
- ExternalArtifact
5098
+
type: string
5099
+
matchLabels:
5100
+
additionalProperties:
5101
+
type: string
5102
+
description: |-
5103
+
MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
5104
+
map is equivalent to an element of matchExpressions, whose key field is "key", the
5105
+
operator is "In", and the values array contains only "value". The requirements are ANDed.
5106
+
MatchLabels requires the name to be set to `*`.
5107
+
type: object
5108
+
name:
5109
+
description: |-
5110
+
Name of the referent
5111
+
If multiple resources are targeted `*` may be set.
5112
+
maxLength: 253
5113
+
minLength: 1
5114
+
type: string
5115
+
namespace:
5116
+
description: Namespace of the referent
5117
+
maxLength: 253
5118
+
minLength: 1
5119
+
type: string
5120
+
required:
5121
+
- kind
5122
+
- name
5123
+
type: object
5124
+
type: array
5125
+
exclusionList:
5126
+
description: |-
5127
+
ExclusionList specifies a list of Golang regular expressions
5128
+
to be used for excluding messages.
5129
+
items:
5130
+
type: string
5131
+
type: array
5132
+
inclusionList:
5133
+
description: |-
5134
+
InclusionList specifies a list of Golang regular expressions
5135
+
to be used for including messages.
5136
+
items:
5137
+
type: string
5138
+
type: array
5139
+
providerRef:
5140
+
description: ProviderRef specifies which Provider this Alert should
5141
+
use.
5142
+
properties:
5143
+
name:
5144
+
description: Name of the referent.
5145
+
type: string
5146
+
required:
5147
+
- name
5148
+
type: object
5149
+
summary:
5150
+
description: Summary holds a short description of the impact and affected
5151
+
cluster.
5152
+
maxLength: 255
5153
+
type: string
5154
+
suspend:
5155
+
description: |-
5156
+
Suspend tells the controller to suspend subsequent
5157
+
events handling for this Alert.
5158
+
type: boolean
5159
+
required:
5160
+
- eventSources
5161
+
- providerRef
5162
+
type: object
5163
+
status:
5164
+
default:
5165
+
observedGeneration: -1
5166
+
description: AlertStatus defines the observed state of the Alert.
5167
+
properties:
5168
+
conditions:
5169
+
description: Conditions holds the conditions for the Alert.
5170
+
items:
5171
+
description: Condition contains details for one aspect of the current
5172
+
state of this API Resource.
5173
+
properties:
5174
+
lastTransitionTime:
5175
+
description: |-
5176
+
lastTransitionTime is the last time the condition transitioned from one status to another.
5177
+
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
5178
+
format: date-time
5179
+
type: string
5180
+
message:
5181
+
description: |-
5182
+
message is a human readable message indicating details about the transition.
5183
+
This may be an empty string.
5184
+
maxLength: 32768
5185
+
type: string
5186
+
observedGeneration:
5187
+
description: |-
5188
+
observedGeneration represents the .metadata.generation that the condition was set based upon.
5189
+
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
5190
+
with respect to the current state of the instance.
5191
+
format: int64
5192
+
minimum: 0
5193
+
type: integer
5194
+
reason:
5195
+
description: |-
5196
+
reason contains a programmatic identifier indicating the reason for the condition's last transition.
5197
+
Producers of specific condition types may define expected values and meanings for this field,
5198
+
and whether the values are considered a guaranteed API.
5199
+
The value should be a CamelCase string.
5200
+
This field may not be empty.
5201
+
maxLength: 1024
5202
+
minLength: 1
5203
+
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
5204
+
type: string
5205
+
status:
5206
+
description: status of the condition, one of True, False, Unknown.
5207
+
enum:
5208
+
- "True"
5209
+
- "False"
5210
+
- Unknown
5211
+
type: string
5212
+
type:
5213
+
description: type of condition in CamelCase or in foo.example.com/CamelCase.
5214
+
maxLength: 316
5215
+
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
5216
+
type: string
5217
+
required:
5218
+
- lastTransitionTime
5219
+
- message
5220
+
- reason
5221
+
- status
5222
+
- type
5223
+
type: object
5224
+
type: array
5225
+
lastHandledReconcileAt:
5226
+
description: |-
5227
+
LastHandledReconcileAt holds the value of the most recent
5228
+
reconcile request value, so a change of the annotation value
5229
+
can be detected.
5230
+
type: string
5231
+
observedGeneration:
5232
+
description: ObservedGeneration is the last observed generation.
5233
+
format: int64
5234
+
type: integer
5235
+
type: object
5236
+
type: object
5237
+
served: true
5238
+
storage: false
5239
+
subresources:
5240
+
status: {}
5241
+
- additionalPrinterColumns:
5242
+
- jsonPath: .metadata.creationTimestamp
5243
+
name: Age
5244
+
type: date
5245
+
name: v1beta3
5246
+
schema:
5247
+
openAPIV3Schema:
5248
+
description: Alert is the Schema for the alerts API
5249
+
properties:
5250
+
apiVersion:
5251
+
description: |-
5252
+
APIVersion defines the versioned schema of this representation of an object.
5253
+
Servers should convert recognized schemas to the latest internal value, and
5254
+
may reject unrecognized values.
5255
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
5256
+
type: string
5257
+
kind:
5258
+
description: |-
5259
+
Kind is a string value representing the REST resource this object represents.
5260
+
Servers may infer this from the endpoint the client submits requests to.
5261
+
Cannot be updated.
5262
+
In CamelCase.
5263
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
5264
+
type: string
5265
+
metadata:
5266
+
type: object
5267
+
spec:
5268
+
description: AlertSpec defines an alerting rule for events involving a
5269
+
list of objects.
5270
+
properties:
5271
+
eventMetadata:
5272
+
additionalProperties:
5273
+
type: string
5274
+
description: |-
5275
+
EventMetadata is an optional field for adding metadata to events dispatched by the
5276
+
controller. This can be used for enhancing the context of the event. If a field
5277
+
would override one already present on the original event as generated by the emitter,
5278
+
then the override doesn't happen, i.e. the original value is preserved, and an info
5279
+
log is printed.
5280
+
type: object
5281
+
eventSeverity:
5282
+
default: info
5283
+
description: |-
5284
+
EventSeverity specifies how to filter events based on severity.
5285
+
If set to 'info' no events will be filtered.
5286
+
enum:
5287
+
- info
5288
+
- error
5289
+
type: string
5290
+
eventSources:
5291
+
description: |-
5292
+
EventSources specifies how to filter events based
5293
+
on the involved object kind, name and namespace.
5294
+
items:
5295
+
description: |-
5296
+
CrossNamespaceObjectReference contains enough information to let you locate the
5297
+
typed referenced object at cluster level
5298
+
properties:
5299
+
apiVersion:
5300
+
description: API version of the referent
5301
+
type: string
5302
+
kind:
5303
+
description: Kind of the referent
5304
+
enum:
5305
+
- Bucket
5306
+
- GitRepository
5307
+
- Kustomization
5308
+
- HelmRelease
5309
+
- HelmChart
5310
+
- HelmRepository
5311
+
- ImageRepository
5312
+
- ImagePolicy
5313
+
- ImageUpdateAutomation
5314
+
- OCIRepository
5315
+
- ArtifactGenerator
5316
+
- ExternalArtifact
5317
+
type: string
5318
+
matchLabels:
5319
+
additionalProperties:
5320
+
type: string
5321
+
description: |-
5322
+
MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
5323
+
map is equivalent to an element of matchExpressions, whose key field is "key", the
5324
+
operator is "In", and the values array contains only "value". The requirements are ANDed.
5325
+
MatchLabels requires the name to be set to `*`.
5326
+
type: object
5327
+
name:
5328
+
description: |-
5329
+
Name of the referent
5330
+
If multiple resources are targeted `*` may be set.
5331
+
maxLength: 253
5332
+
minLength: 1
5333
+
type: string
5334
+
namespace:
5335
+
description: Namespace of the referent
5336
+
maxLength: 253
5337
+
minLength: 1
5338
+
type: string
5339
+
required:
5340
+
- kind
5341
+
- name
5342
+
type: object
5343
+
type: array
5344
+
exclusionList:
5345
+
description: |-
5346
+
ExclusionList specifies a list of Golang regular expressions
5347
+
to be used for excluding messages.
5348
+
items:
5349
+
type: string
5350
+
type: array
5351
+
inclusionList:
5352
+
description: |-
5353
+
InclusionList specifies a list of Golang regular expressions
5354
+
to be used for including messages.
5355
+
items:
5356
+
type: string
5357
+
type: array
5358
+
providerRef:
5359
+
description: ProviderRef specifies which Provider this Alert should
5360
+
use.
5361
+
properties:
5362
+
name:
5363
+
description: Name of the referent.
5364
+
type: string
5365
+
required:
5366
+
- name
5367
+
type: object
5368
+
summary:
5369
+
description: |-
5370
+
Summary holds a short description of the impact and affected cluster.
5371
+
Deprecated: Use EventMetadata instead.
5372
+
maxLength: 255
5373
+
type: string
5374
+
suspend:
5375
+
description: |-
5376
+
Suspend tells the controller to suspend subsequent
5377
+
events handling for this Alert.
5378
+
type: boolean
5379
+
required:
5380
+
- eventSources
5381
+
- providerRef
5382
+
type: object
5383
+
type: object
5384
+
served: true
5385
+
storage: true
5386
+
subresources: {}
5387
+
---
5388
+
apiVersion: apiextensions.k8s.io/v1
5389
+
kind: CustomResourceDefinition
5390
+
metadata:
5391
+
annotations:
5392
+
controller-gen.kubebuilder.io/version: v0.19.0
5393
+
labels:
5394
+
app.kubernetes.io/component: notification-controller
5395
+
app.kubernetes.io/instance: flux-system
5396
+
app.kubernetes.io/part-of: flux
5397
+
app.kubernetes.io/version: v2.8.8
5398
+
name: providers.notification.toolkit.fluxcd.io
5399
+
spec:
5400
+
group: notification.toolkit.fluxcd.io
5401
+
names:
5402
+
kind: Provider
5403
+
listKind: ProviderList
5404
+
plural: providers
5405
+
singular: provider
5406
+
scope: Namespaced
5407
+
versions:
5408
+
- additionalPrinterColumns:
5409
+
- jsonPath: .metadata.creationTimestamp
5410
+
name: Age
5411
+
type: date
5412
+
- jsonPath: .status.conditions[?(@.type=="Ready")].status
5413
+
name: Ready
5414
+
type: string
5415
+
- jsonPath: .status.conditions[?(@.type=="Ready")].message
5416
+
name: Status
5417
+
type: string
5418
+
deprecated: true
5419
+
deprecationWarning: v1beta2 Provider is deprecated, upgrade to v1beta3
5420
+
name: v1beta2
5421
+
schema:
5422
+
openAPIV3Schema:
5423
+
description: Provider is the Schema for the providers API.
5424
+
properties:
5425
+
apiVersion:
5426
+
description: |-
5427
+
APIVersion defines the versioned schema of this representation of an object.
5428
+
Servers should convert recognized schemas to the latest internal value, and
5429
+
may reject unrecognized values.
5430
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
5431
+
type: string
5432
+
kind:
5433
+
description: |-
5434
+
Kind is a string value representing the REST resource this object represents.
5435
+
Servers may infer this from the endpoint the client submits requests to.
5436
+
Cannot be updated.
5437
+
In CamelCase.
5438
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
5439
+
type: string
5440
+
metadata:
5441
+
type: object
5442
+
spec:
5443
+
description: ProviderSpec defines the desired state of the Provider.
5444
+
properties:
5445
+
address:
5446
+
description: |-
5447
+
Address specifies the endpoint, in a generic sense, to where alerts are sent.
5448
+
What kind of endpoint depends on the specific Provider type being used.
5449
+
For the generic Provider, for example, this is an HTTP/S address.
5450
+
For other Provider types this could be a project ID or a namespace.
5451
+
maxLength: 2048
5452
+
type: string
5453
+
certSecretRef:
5454
+
description: |-
5455
+
CertSecretRef specifies the Secret containing
5456
+
a PEM-encoded CA certificate (in the `ca.crt` key).
5457
+
5458
+
Note: Support for the `caFile` key has
5459
+
been deprecated.
5460
+
properties:
5461
+
name:
5462
+
description: Name of the referent.
5463
+
type: string
5464
+
required:
5465
+
- name
5466
+
type: object
5467
+
channel:
5468
+
description: Channel specifies the destination channel where events
5469
+
should be posted.
5470
+
maxLength: 2048
5471
+
type: string
5472
+
interval:
5473
+
description: Interval at which to reconcile the Provider with its
5474
+
Secret references.
5475
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
5476
+
type: string
5477
+
proxy:
5478
+
description: Proxy the HTTP/S address of the proxy server.
5479
+
maxLength: 2048
5480
+
pattern: ^(http|https)://.*$
5481
+
type: string
5482
+
secretRef:
5483
+
description: |-
5484
+
SecretRef specifies the Secret containing the authentication
5485
+
credentials for this Provider.
5486
+
properties:
5487
+
name:
5488
+
description: Name of the referent.
5489
+
type: string
5490
+
required:
5491
+
- name
5492
+
type: object
5493
+
suspend:
5494
+
description: |-
5495
+
Suspend tells the controller to suspend subsequent
5496
+
events handling for this Provider.
5497
+
type: boolean
5498
+
timeout:
5499
+
description: Timeout for sending alerts to the Provider.
5500
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$
5501
+
type: string
5502
+
type:
5503
+
description: Type specifies which Provider implementation to use.
5504
+
enum:
5505
+
- slack
5506
+
- discord
5507
+
- msteams
5508
+
- rocket
5509
+
- generic
5510
+
- generic-hmac
5511
+
- github
5512
+
- gitlab
5513
+
- gitea
5514
+
- bitbucketserver
5515
+
- bitbucket
5516
+
- azuredevops
5517
+
- googlechat
5518
+
- googlepubsub
5519
+
- webex
5520
+
- sentry
5521
+
- azureeventhub
5522
+
- telegram
5523
+
- lark
5524
+
- matrix
5525
+
- opsgenie
5526
+
- alertmanager
5527
+
- grafana
5528
+
- githubdispatch
5529
+
- pagerduty
5530
+
- datadog
5531
+
type: string
5532
+
username:
5533
+
description: Username specifies the name under which events are posted.
5534
+
maxLength: 2048
5535
+
type: string
5536
+
required:
5537
+
- type
5538
+
type: object
5539
+
status:
5540
+
default:
5541
+
observedGeneration: -1
5542
+
description: ProviderStatus defines the observed state of the Provider.
5543
+
properties:
5544
+
conditions:
5545
+
description: Conditions holds the conditions for the Provider.
5546
+
items:
5547
+
description: Condition contains details for one aspect of the current
5548
+
state of this API Resource.
5549
+
properties:
5550
+
lastTransitionTime:
5551
+
description: |-
5552
+
lastTransitionTime is the last time the condition transitioned from one status to another.
5553
+
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
5554
+
format: date-time
5555
+
type: string
5556
+
message:
5557
+
description: |-
5558
+
message is a human readable message indicating details about the transition.
5559
+
This may be an empty string.
5560
+
maxLength: 32768
5561
+
type: string
5562
+
observedGeneration:
5563
+
description: |-
5564
+
observedGeneration represents the .metadata.generation that the condition was set based upon.
5565
+
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
5566
+
with respect to the current state of the instance.
5567
+
format: int64
5568
+
minimum: 0
5569
+
type: integer
5570
+
reason:
5571
+
description: |-
5572
+
reason contains a programmatic identifier indicating the reason for the condition's last transition.
5573
+
Producers of specific condition types may define expected values and meanings for this field,
5574
+
and whether the values are considered a guaranteed API.
5575
+
The value should be a CamelCase string.
5576
+
This field may not be empty.
5577
+
maxLength: 1024
5578
+
minLength: 1
5579
+
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
5580
+
type: string
5581
+
status:
5582
+
description: status of the condition, one of True, False, Unknown.
5583
+
enum:
5584
+
- "True"
5585
+
- "False"
5586
+
- Unknown
5587
+
type: string
5588
+
type:
5589
+
description: type of condition in CamelCase or in foo.example.com/CamelCase.
5590
+
maxLength: 316
5591
+
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
5592
+
type: string
5593
+
required:
5594
+
- lastTransitionTime
5595
+
- message
5596
+
- reason
5597
+
- status
5598
+
- type
5599
+
type: object
5600
+
type: array
5601
+
lastHandledReconcileAt:
5602
+
description: |-
5603
+
LastHandledReconcileAt holds the value of the most recent
5604
+
reconcile request value, so a change of the annotation value
5605
+
can be detected.
5606
+
type: string
5607
+
observedGeneration:
5608
+
description: ObservedGeneration is the last reconciled generation.
5609
+
format: int64
5610
+
type: integer
5611
+
type: object
5612
+
type: object
5613
+
served: true
5614
+
storage: false
5615
+
subresources:
5616
+
status: {}
5617
+
- additionalPrinterColumns:
5618
+
- jsonPath: .metadata.creationTimestamp
5619
+
name: Age
5620
+
type: date
5621
+
name: v1beta3
5622
+
schema:
5623
+
openAPIV3Schema:
5624
+
description: Provider is the Schema for the providers API
5625
+
properties:
5626
+
apiVersion:
5627
+
description: |-
5628
+
APIVersion defines the versioned schema of this representation of an object.
5629
+
Servers should convert recognized schemas to the latest internal value, and
5630
+
may reject unrecognized values.
5631
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
5632
+
type: string
5633
+
kind:
5634
+
description: |-
5635
+
Kind is a string value representing the REST resource this object represents.
5636
+
Servers may infer this from the endpoint the client submits requests to.
5637
+
Cannot be updated.
5638
+
In CamelCase.
5639
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
5640
+
type: string
5641
+
metadata:
5642
+
type: object
5643
+
spec:
5644
+
description: ProviderSpec defines the desired state of the Provider.
5645
+
properties:
5646
+
address:
5647
+
description: |-
5648
+
Address specifies the endpoint, in a generic sense, to where alerts are sent.
5649
+
What kind of endpoint depends on the specific Provider type being used.
5650
+
For the generic Provider, for example, this is an HTTP/S address.
5651
+
For other Provider types this could be a project ID or a namespace.
5652
+
maxLength: 2048
5653
+
type: string
5654
+
certSecretRef:
5655
+
description: |-
5656
+
CertSecretRef specifies the Secret containing TLS certificates
5657
+
for secure communication.
5658
+
5659
+
Supported configurations:
5660
+
- CA-only: Server authentication (provide ca.crt only)
5661
+
- mTLS: Mutual authentication (provide ca.crt + tls.crt + tls.key)
5662
+
- Client-only: Client authentication with system CA (provide tls.crt + tls.key only)
5663
+
5664
+
Legacy keys "caFile", "certFile", "keyFile" are supported but deprecated. Use "ca.crt", "tls.crt", "tls.key" instead.
5665
+
properties:
5666
+
name:
5667
+
description: Name of the referent.
5668
+
type: string
5669
+
required:
5670
+
- name
5671
+
type: object
5672
+
channel:
5673
+
description: Channel specifies the destination channel where events
5674
+
should be posted.
5675
+
maxLength: 2048
5676
+
type: string
5677
+
commitStatusExpr:
5678
+
description: |-
5679
+
CommitStatusExpr is a CEL expression that evaluates to a string value
5680
+
that can be used to generate a custom commit status message for use
5681
+
with eligible Provider types (github, gitlab, gitea, bitbucketserver,
5682
+
bitbucket, azuredevops). Supported variables are: event, provider,
5683
+
and alert.
5684
+
type: string
5685
+
interval:
5686
+
description: |-
5687
+
Interval at which to reconcile the Provider with its Secret references.
5688
+
Deprecated and not used in v1beta3.
5689
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
5690
+
type: string
5691
+
proxy:
5692
+
description: |-
5693
+
Proxy the HTTP/S address of the proxy server.
5694
+
Deprecated: Use ProxySecretRef instead. Will be removed in v1.
5695
+
maxLength: 2048
5696
+
pattern: ^(http|https)://.*$
5697
+
type: string
5698
+
proxySecretRef:
5699
+
description: |-
5700
+
ProxySecretRef specifies the Secret containing the proxy configuration
5701
+
for this Provider. The Secret should contain an 'address' key with the
5702
+
HTTP/S address of the proxy server. Optional 'username' and 'password'
5703
+
keys can be provided for proxy authentication.
5704
+
properties:
5705
+
name:
5706
+
description: Name of the referent.
5707
+
type: string
5708
+
required:
5709
+
- name
5710
+
type: object
5711
+
secretRef:
5712
+
description: |-
5713
+
SecretRef specifies the Secret containing the authentication
5714
+
credentials for this Provider.
5715
+
properties:
5716
+
name:
5717
+
description: Name of the referent.
5718
+
type: string
5719
+
required:
5720
+
- name
5721
+
type: object
5722
+
serviceAccountName:
5723
+
description: |-
5724
+
ServiceAccountName is the name of the Kubernetes ServiceAccount used to
5725
+
authenticate with cloud provider services through workload identity.
5726
+
This enables multi-tenant authentication without storing static credentials.
5727
+
5728
+
Supported provider types: azureeventhub, azuredevops, googlepubsub
5729
+
5730
+
When specified, the controller will:
5731
+
1. Create an OIDC token for the specified ServiceAccount
5732
+
2. Exchange it for cloud provider credentials via STS
5733
+
3. Use the obtained credentials for API authentication
5734
+
5735
+
When unspecified, controller-level authentication is used (single-tenant).
5736
+
5737
+
An error is thrown if static credentials are also defined in SecretRef.
5738
+
This field requires the ObjectLevelWorkloadIdentity feature gate to be enabled.
5739
+
type: string
5740
+
suspend:
5741
+
description: |-
5742
+
Suspend tells the controller to suspend subsequent
5743
+
events handling for this Provider.
5744
+
type: boolean
5745
+
timeout:
5746
+
description: Timeout for sending alerts to the Provider.
5747
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$
5748
+
type: string
5749
+
type:
5750
+
description: Type specifies which Provider implementation to use.
5751
+
enum:
5752
+
- slack
5753
+
- discord
5754
+
- msteams
5755
+
- rocket
5756
+
- generic
5757
+
- generic-hmac
5758
+
- github
5759
+
- gitlab
5760
+
- gitea
5761
+
- giteapullrequestcomment
5762
+
- bitbucketserver
5763
+
- bitbucket
5764
+
- azuredevops
5765
+
- googlechat
5766
+
- googlepubsub
5767
+
- webex
5768
+
- sentry
5769
+
- azureeventhub
5770
+
- telegram
5771
+
- lark
5772
+
- matrix
5773
+
- opsgenie
5774
+
- alertmanager
5775
+
- grafana
5776
+
- githubdispatch
5777
+
- githubpullrequestcomment
5778
+
- gitlabmergerequestcomment
5779
+
- pagerduty
5780
+
- datadog
5781
+
- nats
5782
+
- zulip
5783
+
- otel
5784
+
type: string
5785
+
username:
5786
+
description: Username specifies the name under which events are posted.
5787
+
maxLength: 2048
5788
+
type: string
5789
+
required:
5790
+
- type
5791
+
type: object
5792
+
x-kubernetes-validations:
5793
+
- message: spec.commitStatusExpr is only supported for the 'github', 'gitlab',
5794
+
'gitea', 'bitbucketserver', 'bitbucket', 'azuredevops' provider types
5795
+
rule: self.type == 'github' || self.type == 'gitlab' || self.type ==
5796
+
'gitea' || self.type == 'bitbucketserver' || self.type == 'bitbucket'
5797
+
|| self.type == 'azuredevops' || !has(self.commitStatusExpr)
5798
+
type: object
5799
+
served: true
5800
+
storage: true
5801
+
subresources: {}
5802
+
---
5803
+
apiVersion: apiextensions.k8s.io/v1
5804
+
kind: CustomResourceDefinition
5805
+
metadata:
5806
+
annotations:
5807
+
controller-gen.kubebuilder.io/version: v0.19.0
5808
+
labels:
5809
+
app.kubernetes.io/component: notification-controller
5810
+
app.kubernetes.io/instance: flux-system
5811
+
app.kubernetes.io/part-of: flux
5812
+
app.kubernetes.io/version: v2.8.8
5813
+
name: receivers.notification.toolkit.fluxcd.io
5814
+
spec:
5815
+
group: notification.toolkit.fluxcd.io
5816
+
names:
5817
+
kind: Receiver
5818
+
listKind: ReceiverList
5819
+
plural: receivers
5820
+
singular: receiver
5821
+
scope: Namespaced
5822
+
versions:
5823
+
- additionalPrinterColumns:
5824
+
- jsonPath: .metadata.creationTimestamp
5825
+
name: Age
5826
+
type: date
5827
+
- jsonPath: .status.conditions[?(@.type=="Ready")].status
5828
+
name: Ready
5829
+
type: string
5830
+
- jsonPath: .status.conditions[?(@.type=="Ready")].message
5831
+
name: Status
5832
+
type: string
5833
+
name: v1
5834
+
schema:
5835
+
openAPIV3Schema:
5836
+
description: Receiver is the Schema for the receivers API.
5837
+
properties:
5838
+
apiVersion:
5839
+
description: |-
5840
+
APIVersion defines the versioned schema of this representation of an object.
5841
+
Servers should convert recognized schemas to the latest internal value, and
5842
+
may reject unrecognized values.
5843
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
5844
+
type: string
5845
+
kind:
5846
+
description: |-
5847
+
Kind is a string value representing the REST resource this object represents.
5848
+
Servers may infer this from the endpoint the client submits requests to.
5849
+
Cannot be updated.
5850
+
In CamelCase.
5851
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
5852
+
type: string
5853
+
metadata:
5854
+
type: object
5855
+
spec:
5856
+
description: ReceiverSpec defines the desired state of the Receiver.
5857
+
properties:
5858
+
events:
5859
+
description: |-
5860
+
Events specifies the list of event types to handle,
5861
+
e.g. 'push' for GitHub or 'Push Hook' for GitLab.
5862
+
items:
5863
+
type: string
5864
+
type: array
5865
+
interval:
5866
+
default: 10m
5867
+
description: Interval at which to reconcile the Receiver with its
5868
+
Secret references.
5869
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
5870
+
type: string
5871
+
resourceFilter:
5872
+
description: |-
5873
+
ResourceFilter is a CEL expression expected to return a boolean that is
5874
+
evaluated for each resource referenced in the Resources field when a
5875
+
webhook is received. If the expression returns false then the controller
5876
+
will not request a reconciliation for the resource.
5877
+
When the expression is specified the controller will parse it and mark
5878
+
the object as terminally failed if the expression is invalid or does not
5879
+
return a boolean.
5880
+
type: string
5881
+
resources:
5882
+
description: A list of resources to be notified about changes.
5883
+
items:
5884
+
description: |-
5885
+
CrossNamespaceObjectReference contains enough information to let you locate the
5886
+
typed referenced object at cluster level
5887
+
properties:
5888
+
apiVersion:
5889
+
description: API version of the referent
5890
+
type: string
5891
+
kind:
5892
+
description: Kind of the referent
5893
+
enum:
5894
+
- Bucket
5895
+
- GitRepository
5896
+
- Kustomization
5897
+
- HelmRelease
5898
+
- HelmChart
5899
+
- HelmRepository
5900
+
- ImageRepository
5901
+
- ImagePolicy
5902
+
- ImageUpdateAutomation
5903
+
- OCIRepository
5904
+
- ArtifactGenerator
5905
+
- ExternalArtifact
5906
+
type: string
5907
+
matchLabels:
5908
+
additionalProperties:
5909
+
type: string
5910
+
description: |-
5911
+
MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
5912
+
map is equivalent to an element of matchExpressions, whose key field is "key", the
5913
+
operator is "In", and the values array contains only "value". The requirements are ANDed.
5914
+
MatchLabels requires the name to be set to `*`.
5915
+
type: object
5916
+
name:
5917
+
description: |-
5918
+
Name of the referent
5919
+
If multiple resources are targeted `*` may be set.
5920
+
maxLength: 253
5921
+
minLength: 1
5922
+
type: string
5923
+
namespace:
5924
+
description: Namespace of the referent
5925
+
maxLength: 253
5926
+
minLength: 1
5927
+
type: string
5928
+
required:
5929
+
- kind
5930
+
- name
5931
+
type: object
5932
+
type: array
5933
+
secretRef:
5934
+
description: |-
5935
+
SecretRef specifies the Secret containing the token used
5936
+
to validate the payload authenticity. The Secret must contain a 'token'
5937
+
key. For GCR receivers, the Secret must also contain an 'email' key
5938
+
with the IAM service account email configured on the Pub/Sub push
5939
+
subscription, and an 'audience' key with the expected OIDC token audience.
5940
+
properties:
5941
+
name:
5942
+
description: Name of the referent.
5943
+
type: string
5944
+
required:
5945
+
- name
5946
+
type: object
5947
+
suspend:
5948
+
description: |-
5949
+
Suspend tells the controller to suspend subsequent
5950
+
events handling for this receiver.
5951
+
type: boolean
5952
+
type:
5953
+
description: |-
5954
+
Type of webhook sender, used to determine
5955
+
the validation procedure and payload deserialization.
5956
+
enum:
5957
+
- generic
5958
+
- generic-hmac
5959
+
- github
5960
+
- gitlab
5961
+
- bitbucket
5962
+
- harbor
5963
+
- dockerhub
5964
+
- quay
5965
+
- gcr
5966
+
- nexus
5967
+
- acr
5968
+
- cdevents
5969
+
type: string
5970
+
required:
5971
+
- resources
5972
+
- secretRef
5973
+
- type
5974
+
type: object
5975
+
status:
5976
+
default:
5977
+
observedGeneration: -1
5978
+
description: ReceiverStatus defines the observed state of the Receiver.
5979
+
properties:
5980
+
conditions:
5981
+
description: Conditions holds the conditions for the Receiver.
5982
+
items:
5983
+
description: Condition contains details for one aspect of the current
5984
+
state of this API Resource.
5985
+
properties:
5986
+
lastTransitionTime:
5987
+
description: |-
5988
+
lastTransitionTime is the last time the condition transitioned from one status to another.
5989
+
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
5990
+
format: date-time
5991
+
type: string
5992
+
message:
5993
+
description: |-
5994
+
message is a human readable message indicating details about the transition.
5995
+
This may be an empty string.
5996
+
maxLength: 32768
5997
+
type: string
5998
+
observedGeneration:
5999
+
description: |-
6000
+
observedGeneration represents the .metadata.generation that the condition was set based upon.
6001
+
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
6002
+
with respect to the current state of the instance.
6003
+
format: int64
6004
+
minimum: 0
6005
+
type: integer
6006
+
reason:
6007
+
description: |-
6008
+
reason contains a programmatic identifier indicating the reason for the condition's last transition.
6009
+
Producers of specific condition types may define expected values and meanings for this field,
6010
+
and whether the values are considered a guaranteed API.
6011
+
The value should be a CamelCase string.
6012
+
This field may not be empty.
6013
+
maxLength: 1024
6014
+
minLength: 1
6015
+
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
6016
+
type: string
6017
+
status:
6018
+
description: status of the condition, one of True, False, Unknown.
6019
+
enum:
6020
+
- "True"
6021
+
- "False"
6022
+
- Unknown
6023
+
type: string
6024
+
type:
6025
+
description: type of condition in CamelCase or in foo.example.com/CamelCase.
6026
+
maxLength: 316
6027
+
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
6028
+
type: string
6029
+
required:
6030
+
- lastTransitionTime
6031
+
- message
6032
+
- reason
6033
+
- status
6034
+
- type
6035
+
type: object
6036
+
type: array
6037
+
lastHandledReconcileAt:
6038
+
description: |-
6039
+
LastHandledReconcileAt holds the value of the most recent
6040
+
reconcile request value, so a change of the annotation value
6041
+
can be detected.
6042
+
type: string
6043
+
observedGeneration:
6044
+
description: ObservedGeneration is the last observed generation of
6045
+
the Receiver object.
6046
+
format: int64
6047
+
type: integer
6048
+
webhookPath:
6049
+
description: |-
6050
+
WebhookPath is the generated incoming webhook address in the format
6051
+
of '/hook/sha256sum(token+name+namespace)'.
6052
+
type: string
6053
+
type: object
6054
+
type: object
6055
+
served: true
6056
+
storage: true
6057
+
subresources:
6058
+
status: {}
6059
+
- additionalPrinterColumns:
6060
+
- jsonPath: .metadata.creationTimestamp
6061
+
name: Age
6062
+
type: date
6063
+
- jsonPath: .status.conditions[?(@.type=="Ready")].status
6064
+
name: Ready
6065
+
type: string
6066
+
- jsonPath: .status.conditions[?(@.type=="Ready")].message
6067
+
name: Status
6068
+
type: string
6069
+
deprecated: true
6070
+
deprecationWarning: v1beta2 Receiver is deprecated, upgrade to v1
6071
+
name: v1beta2
6072
+
schema:
6073
+
openAPIV3Schema:
6074
+
description: Receiver is the Schema for the receivers API.
6075
+
properties:
6076
+
apiVersion:
6077
+
description: |-
6078
+
APIVersion defines the versioned schema of this representation of an object.
6079
+
Servers should convert recognized schemas to the latest internal value, and
6080
+
may reject unrecognized values.
6081
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
6082
+
type: string
6083
+
kind:
6084
+
description: |-
6085
+
Kind is a string value representing the REST resource this object represents.
6086
+
Servers may infer this from the endpoint the client submits requests to.
6087
+
Cannot be updated.
6088
+
In CamelCase.
6089
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
6090
+
type: string
6091
+
metadata:
6092
+
type: object
6093
+
spec:
6094
+
description: ReceiverSpec defines the desired state of the Receiver.
6095
+
properties:
6096
+
events:
6097
+
description: |-
6098
+
Events specifies the list of event types to handle,
6099
+
e.g. 'push' for GitHub or 'Push Hook' for GitLab.
6100
+
items:
6101
+
type: string
6102
+
type: array
6103
+
interval:
6104
+
description: Interval at which to reconcile the Receiver with its
6105
+
Secret references.
6106
+
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
6107
+
type: string
6108
+
resources:
6109
+
description: A list of resources to be notified about changes.
6110
+
items:
6111
+
description: |-
6112
+
CrossNamespaceObjectReference contains enough information to let you locate the
6113
+
typed referenced object at cluster level
6114
+
properties:
6115
+
apiVersion:
6116
+
description: API version of the referent
6117
+
type: string
6118
+
kind:
6119
+
description: Kind of the referent
6120
+
enum:
6121
+
- Bucket
6122
+
- GitRepository
6123
+
- Kustomization
6124
+
- HelmRelease
6125
+
- HelmChart
6126
+
- HelmRepository
6127
+
- ImageRepository
6128
+
- ImagePolicy
6129
+
- ImageUpdateAutomation
6130
+
- OCIRepository
6131
+
- ArtifactGenerator
6132
+
- ExternalArtifact
6133
+
type: string
6134
+
matchLabels:
6135
+
additionalProperties:
6136
+
type: string
6137
+
description: |-
6138
+
MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
6139
+
map is equivalent to an element of matchExpressions, whose key field is "key", the
6140
+
operator is "In", and the values array contains only "value". The requirements are ANDed.
6141
+
MatchLabels requires the name to be set to `*`.
6142
+
type: object
6143
+
name:
6144
+
description: |-
6145
+
Name of the referent
6146
+
If multiple resources are targeted `*` may be set.
6147
+
maxLength: 253
6148
+
minLength: 1
6149
+
type: string
6150
+
namespace:
6151
+
description: Namespace of the referent
6152
+
maxLength: 253
6153
+
minLength: 1
6154
+
type: string
6155
+
required:
6156
+
- kind
6157
+
- name
6158
+
type: object
6159
+
type: array
6160
+
secretRef:
6161
+
description: |-
6162
+
SecretRef specifies the Secret containing the token used
6163
+
to validate the payload authenticity.
6164
+
properties:
6165
+
name:
6166
+
description: Name of the referent.
6167
+
type: string
6168
+
required:
6169
+
- name
6170
+
type: object
6171
+
suspend:
6172
+
description: |-
6173
+
Suspend tells the controller to suspend subsequent
6174
+
events handling for this receiver.
6175
+
type: boolean
6176
+
type:
6177
+
description: |-
6178
+
Type of webhook sender, used to determine
6179
+
the validation procedure and payload deserialization.
6180
+
enum:
6181
+
- generic
6182
+
- generic-hmac
6183
+
- github
6184
+
- gitlab
6185
+
- bitbucket
6186
+
- harbor
6187
+
- dockerhub
6188
+
- quay
6189
+
- gcr
6190
+
- nexus
6191
+
- acr
6192
+
type: string
6193
+
required:
6194
+
- resources
6195
+
- secretRef
6196
+
- type
6197
+
type: object
6198
+
status:
6199
+
default:
6200
+
observedGeneration: -1
6201
+
description: ReceiverStatus defines the observed state of the Receiver.
6202
+
properties:
6203
+
conditions:
6204
+
description: Conditions holds the conditions for the Receiver.
6205
+
items:
6206
+
description: Condition contains details for one aspect of the current
6207
+
state of this API Resource.
6208
+
properties:
6209
+
lastTransitionTime:
6210
+
description: |-
6211
+
lastTransitionTime is the last time the condition transitioned from one status to another.
6212
+
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
6213
+
format: date-time
6214
+
type: string
6215
+
message:
6216
+
description: |-
6217
+
message is a human readable message indicating details about the transition.
6218
+
This may be an empty string.
6219
+
maxLength: 32768
6220
+
type: string
6221
+
observedGeneration:
6222
+
description: |-
6223
+
observedGeneration represents the .metadata.generation that the condition was set based upon.
6224
+
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
6225
+
with respect to the current state of the instance.
6226
+
format: int64
6227
+
minimum: 0
6228
+
type: integer
6229
+
reason:
6230
+
description: |-
6231
+
reason contains a programmatic identifier indicating the reason for the condition's last transition.
6232
+
Producers of specific condition types may define expected values and meanings for this field,
6233
+
and whether the values are considered a guaranteed API.
6234
+
The value should be a CamelCase string.
6235
+
This field may not be empty.
6236
+
maxLength: 1024
6237
+
minLength: 1
6238
+
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
6239
+
type: string
6240
+
status:
6241
+
description: status of the condition, one of True, False, Unknown.
6242
+
enum:
6243
+
- "True"
6244
+
- "False"
6245
+
- Unknown
6246
+
type: string
6247
+
type:
6248
+
description: type of condition in CamelCase or in foo.example.com/CamelCase.
6249
+
maxLength: 316
6250
+
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
6251
+
type: string
6252
+
required:
6253
+
- lastTransitionTime
6254
+
- message
6255
+
- reason
6256
+
- status
6257
+
- type
6258
+
type: object
6259
+
type: array
6260
+
lastHandledReconcileAt:
6261
+
description: |-
6262
+
LastHandledReconcileAt holds the value of the most recent
6263
+
reconcile request value, so a change of the annotation value
6264
+
can be detected.
6265
+
type: string
6266
+
observedGeneration:
6267
+
description: ObservedGeneration is the last observed generation of
6268
+
the Receiver object.
6269
+
format: int64
6270
+
type: integer
6271
+
url:
6272
+
description: |-
6273
+
URL is the generated incoming webhook address in the format
6274
+
of '/hook/sha256sum(token+name+namespace)'.
6275
+
Deprecated: Replaced by WebhookPath.
6276
+
type: string
6277
+
webhookPath:
6278
+
description: |-
6279
+
WebhookPath is the generated incoming webhook address in the format
6280
+
of '/hook/sha256sum(token+name+namespace)'.
6281
+
type: string
6282
+
type: object
6283
+
type: object
6284
+
served: true
6285
+
storage: false
6286
+
subresources:
6287
+
status: {}
6288
+
---
6289
+
apiVersion: v1
6290
+
kind: ServiceAccount
6291
+
metadata:
6292
+
labels:
6293
+
app.kubernetes.io/component: notification-controller
6294
+
app.kubernetes.io/instance: flux-system
6295
+
app.kubernetes.io/part-of: flux
6296
+
app.kubernetes.io/version: v2.8.8
6297
+
name: notification-controller
6298
+
namespace: flux-system
6299
+
---
6300
+
apiVersion: v1
6301
+
kind: Service
6302
+
metadata:
6303
+
labels:
6304
+
app.kubernetes.io/component: notification-controller
6305
+
app.kubernetes.io/instance: flux-system
6306
+
app.kubernetes.io/part-of: flux
6307
+
app.kubernetes.io/version: v2.8.8
6308
+
control-plane: controller
6309
+
name: notification-controller
6310
+
namespace: flux-system
6311
+
spec:
6312
+
ports:
6313
+
- name: http
6314
+
port: 80
6315
+
protocol: TCP
6316
+
targetPort: http
6317
+
selector:
6318
+
app: notification-controller
6319
+
type: ClusterIP
6320
+
---
6321
+
apiVersion: v1
6322
+
kind: Service
6323
+
metadata:
6324
+
labels:
6325
+
app.kubernetes.io/component: notification-controller
6326
+
app.kubernetes.io/instance: flux-system
6327
+
app.kubernetes.io/part-of: flux
6328
+
app.kubernetes.io/version: v2.8.8
6329
+
control-plane: controller
6330
+
name: webhook-receiver
6331
+
namespace: flux-system
6332
+
spec:
6333
+
ports:
6334
+
- name: http
6335
+
port: 80
6336
+
protocol: TCP
6337
+
targetPort: http-webhook
6338
+
selector:
6339
+
app: notification-controller
6340
+
type: ClusterIP
6341
+
---
6342
+
apiVersion: apps/v1
6343
+
kind: Deployment
6344
+
metadata:
6345
+
labels:
6346
+
app.kubernetes.io/component: notification-controller
6347
+
app.kubernetes.io/instance: flux-system
6348
+
app.kubernetes.io/part-of: flux
6349
+
app.kubernetes.io/version: v2.8.8
6350
+
control-plane: controller
6351
+
name: notification-controller
6352
+
namespace: flux-system
6353
+
spec:
6354
+
replicas: 1
6355
+
selector:
6356
+
matchLabels:
6357
+
app: notification-controller
6358
+
template:
6359
+
metadata:
6360
+
annotations:
6361
+
prometheus.io/port: "8080"
6362
+
prometheus.io/scrape: "true"
6363
+
labels:
6364
+
app: notification-controller
6365
+
app.kubernetes.io/component: notification-controller
6366
+
app.kubernetes.io/instance: flux-system
6367
+
app.kubernetes.io/part-of: flux
6368
+
app.kubernetes.io/version: v2.8.8
6369
+
spec:
6370
+
containers:
6371
+
- args:
6372
+
- --watch-all-namespaces=true
6373
+
- --log-level=info
6374
+
- --log-encoding=json
6375
+
- --enable-leader-election
6376
+
env:
6377
+
- name: RUNTIME_NAMESPACE
6378
+
valueFrom:
6379
+
fieldRef:
6380
+
fieldPath: metadata.namespace
6381
+
- name: GOMEMLIMIT
6382
+
valueFrom:
6383
+
resourceFieldRef:
6384
+
containerName: manager
6385
+
resource: limits.memory
6386
+
image: ghcr.io/fluxcd/notification-controller:v1.8.4
6387
+
imagePullPolicy: IfNotPresent
6388
+
livenessProbe:
6389
+
httpGet:
6390
+
path: /healthz
6391
+
port: healthz
6392
+
name: manager
6393
+
ports:
6394
+
- containerPort: 9090
6395
+
name: http
6396
+
protocol: TCP
6397
+
- containerPort: 9292
6398
+
name: http-webhook
6399
+
protocol: TCP
6400
+
- containerPort: 8080
6401
+
name: http-prom
6402
+
protocol: TCP
6403
+
- containerPort: 9440
6404
+
name: healthz
6405
+
protocol: TCP
6406
+
readinessProbe:
6407
+
httpGet:
6408
+
path: /readyz
6409
+
port: healthz
6410
+
resources:
6411
+
limits:
6412
+
cpu: 1000m
6413
+
memory: 1Gi
6414
+
requests:
6415
+
cpu: 100m
6416
+
memory: 64Mi
6417
+
securityContext:
6418
+
allowPrivilegeEscalation: false
6419
+
capabilities:
6420
+
drop:
6421
+
- ALL
6422
+
readOnlyRootFilesystem: true
6423
+
runAsNonRoot: true
6424
+
seccompProfile:
6425
+
type: RuntimeDefault
6426
+
volumeMounts:
6427
+
- mountPath: /tmp
6428
+
name: temp
6429
+
nodeSelector:
6430
+
kubernetes.io/os: linux
6431
+
securityContext:
6432
+
fsGroup: 1337
6433
+
serviceAccountName: notification-controller
6434
+
terminationGracePeriodSeconds: 10
6435
+
volumes:
6436
+
- emptyDir: {}
6437
+
name: temp
+23
k8s/flux/system/gotk-sync.yaml
+23
k8s/flux/system/gotk-sync.yaml
···
1
+
apiVersion: source.toolkit.fluxcd.io/v1
2
+
kind: GitRepository
3
+
metadata:
4
+
name: flux-system
5
+
namespace: flux-system
6
+
spec:
7
+
interval: 15m0s
8
+
ref:
9
+
branch: master
10
+
url: https://github.com/alyraffauf/cute.haus
11
+
---
12
+
apiVersion: kustomize.toolkit.fluxcd.io/v1
13
+
kind: Kustomization
14
+
metadata:
15
+
name: flux-system
16
+
namespace: flux-system
17
+
spec:
18
+
interval: 15m0s
19
+
path: ./k8s/flux/system
20
+
prune: true
21
+
sourceRef:
22
+
kind: GitRepository
23
+
name: flux-system
+6
k8s/flux/system/kustomization.yaml
+6
k8s/flux/system/kustomization.yaml
+87
k8s/flux/system/layers.yaml
+87
k8s/flux/system/layers.yaml
···
1
+
apiVersion: kustomize.toolkit.fluxcd.io/v1
2
+
kind: Kustomization
3
+
metadata:
4
+
name: sources
5
+
namespace: flux-system
6
+
spec:
7
+
interval: 15m
8
+
path: ./k8s/flux/sources
9
+
prune: true
10
+
sourceRef:
11
+
kind: GitRepository
12
+
name: flux-system
13
+
---
14
+
apiVersion: kustomize.toolkit.fluxcd.io/v1
15
+
kind: Kustomization
16
+
metadata:
17
+
name: infra-crds
18
+
namespace: flux-system
19
+
spec:
20
+
dependsOn:
21
+
- name: sources
22
+
interval: 15m
23
+
path: ./k8s/flux/infra-crds
24
+
prune: true
25
+
sourceRef:
26
+
kind: GitRepository
27
+
name: flux-system
28
+
---
29
+
apiVersion: kustomize.toolkit.fluxcd.io/v1
30
+
kind: Kustomization
31
+
metadata:
32
+
name: infra-core
33
+
namespace: flux-system
34
+
spec:
35
+
dependsOn:
36
+
- name: infra-crds
37
+
interval: 15m
38
+
path: ./k8s/flux/infra-core
39
+
prune: true
40
+
sourceRef:
41
+
kind: GitRepository
42
+
name: flux-system
43
+
---
44
+
apiVersion: kustomize.toolkit.fluxcd.io/v1
45
+
kind: Kustomization
46
+
metadata:
47
+
name: platform
48
+
namespace: flux-system
49
+
spec:
50
+
dependsOn:
51
+
- name: infra-core
52
+
interval: 15m
53
+
path: ./k8s/flux/platform
54
+
prune: true
55
+
sourceRef:
56
+
kind: GitRepository
57
+
name: flux-system
58
+
---
59
+
apiVersion: kustomize.toolkit.fluxcd.io/v1
60
+
kind: Kustomization
61
+
metadata:
62
+
name: apps
63
+
namespace: flux-system
64
+
spec:
65
+
dependsOn:
66
+
- name: platform
67
+
interval: 15m
68
+
path: ./k8s/flux/apps
69
+
prune: true
70
+
sourceRef:
71
+
kind: GitRepository
72
+
name: flux-system
73
+
---
74
+
apiVersion: kustomize.toolkit.fluxcd.io/v1
75
+
kind: Kustomization
76
+
metadata:
77
+
name: external-routes
78
+
namespace: flux-system
79
+
spec:
80
+
dependsOn:
81
+
- name: apps
82
+
interval: 15m
83
+
path: ./k8s/flux/external-routes
84
+
prune: true
85
+
sourceRef:
86
+
kind: GitRepository
87
+
name: flux-system