diff --git a/flux/.sops.yaml b/flux/.sops.yaml new file mode 100644 index 0000000..f915151 --- /dev/null +++ b/flux/.sops.yaml @@ -0,0 +1,4 @@ +creation_rules: + - path_regex: .*\/k3d-develop\/.*.yaml + encrypted_regex: ^(data|stringData)$ + age: age13hzmc9qhn82epztchgdfu5zvxkeecun4v5yxl2ma2a4kndqace7qgje450 diff --git a/flux/base/namespace/default-kustomization.yaml b/flux/base/namespace/default-kustomization.yaml new file mode 100644 index 0000000..25bf0dd --- /dev/null +++ b/flux/base/namespace/default-kustomization.yaml @@ -0,0 +1,17 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta1 +kind: Kustomization +metadata: + name: kustomization + namespace: default +spec: + decryption: + provider: sops + interval: 5m0s + path: ./flux/clusters/eks-cluster-name + prune: true + serviceAccountName: deploy + sourceRef: + kind: GitRepository + name: source + validation: client diff --git a/flux/base/namespace/default-memory-limit.yaml b/flux/base/namespace/default-memory-limit.yaml new file mode 100644 index 0000000..5382f50 --- /dev/null +++ b/flux/base/namespace/default-memory-limit.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: v1 +kind: LimitRange +metadata: + name: default-memory-limit +spec: + limits: + - default: + memory: 256Mi + defaultRequest: + memory: 256Mi + type: Container diff --git a/flux/base/namespace/default-source.yaml b/flux/base/namespace/default-source.yaml new file mode 100644 index 0000000..d363c96 --- /dev/null +++ b/flux/base/namespace/default-source.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: source.toolkit.fluxcd.io/v1beta1 +kind: GitRepository +metadata: + name: source + namespace: default +spec: + interval: 1m0s + ref: + branch: main + url: ssh://git@github.com/sueddeutsche/demo-flux-echoserver.git + secretRef: + name: GITHUB-SSH-TOKEN diff --git a/flux/base/namespace/deploy-rolebinding.yaml b/flux/base/namespace/deploy-rolebinding.yaml new file mode 100644 index 0000000..e951802 --- /dev/null +++ b/flux/base/namespace/deploy-rolebinding.yaml @@ -0,0 +1,14 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: deploy-rolebinding + namespace: default +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: edit +subjects: +- kind: ServiceAccount + name: deploy + namespace: default diff --git a/flux/base/namespace/deploy-serviceaccount.yaml b/flux/base/namespace/deploy-serviceaccount.yaml new file mode 100644 index 0000000..b7f3220 --- /dev/null +++ b/flux/base/namespace/deploy-serviceaccount.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: deploy + namespace: default diff --git a/flux/base/namespace/kustomization.yaml b/flux/base/namespace/kustomization.yaml new file mode 100644 index 0000000..ea586f7 --- /dev/null +++ b/flux/base/namespace/kustomization.yaml @@ -0,0 +1,10 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + - default-kustomization.yaml + - default-memory-limit.yaml + - default-source.yaml + - deploy-serviceaccount.yaml + - deploy-rolebinding.yaml + - namespace.yaml diff --git a/flux/base/namespace/namespace.yaml b/flux/base/namespace/namespace.yaml new file mode 100644 index 0000000..05afb83 --- /dev/null +++ b/flux/base/namespace/namespace.yaml @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: default diff --git a/flux/clusters/k3d-develop/.envrc b/flux/clusters/k3d-develop/.envrc new file mode 100644 index 0000000..10237f4 --- /dev/null +++ b/flux/clusters/k3d-develop/.envrc @@ -0,0 +1,2 @@ +export KUBECONFIG=$(cd ../../../kubeconfigs; pwd -P)/k3d-develop.yaml +export SOPS_AGE_KEY_FILE=$(pwd)/../../../local-k8s/keys/age.agekey \ No newline at end of file diff --git a/flux/clusters/k3d-develop/flux-system/flux-components.yaml b/flux/clusters/k3d-develop/flux-system/flux-components.yaml new file mode 100644 index 0000000..40daa94 --- /dev/null +++ b/flux/clusters/k3d-develop/flux-system/flux-components.yaml @@ -0,0 +1,6403 @@ +--- +# This manifest was generated by flux. DO NOT EDIT. +# Flux Version: v0.24.1 +# Components: source-controller,kustomize-controller,helm-controller,notification-controller,image-reflector-controller,image-automation-controller +apiVersion: v1 +kind: Namespace +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: flux-system +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.5.0 + creationTimestamp: null + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: alerts.notification.toolkit.fluxcd.io +spec: + group: notification.toolkit.fluxcd.io + names: + kind: Alert + listKind: AlertList + plural: alerts + singular: alert + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: Alert is the Schema for the alerts API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: AlertSpec defines an alerting rule for events involving a + list of objects + properties: + eventSeverity: + default: info + description: Filter events based on severity, defaults to ('info'). + If set to 'info' no events will be filtered. + enum: + - info + - error + type: string + eventSources: + description: Filter events based on the involved objects. + items: + description: CrossNamespaceObjectReference contains enough information + to let you locate the typed referenced object at cluster level + properties: + apiVersion: + description: API version of the referent + type: string + kind: + description: Kind of the referent + enum: + - Bucket + - GitRepository + - Kustomization + - HelmRelease + - HelmChart + - HelmRepository + - ImageRepository + - ImagePolicy + - ImageUpdateAutomation + type: string + name: + description: Name of the referent + maxLength: 53 + minLength: 1 + type: string + namespace: + description: Namespace of the referent + maxLength: 53 + minLength: 1 + type: string + required: + - name + type: object + type: array + exclusionList: + description: A list of Golang regular expressions to be used for excluding + messages. + items: + type: string + type: array + providerRef: + description: Send events using this provider. + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + summary: + description: Short description of the impact and affected cluster. + type: string + suspend: + description: This flag tells the controller to suspend subsequent + events dispatching. Defaults to false. + type: boolean + required: + - eventSources + - providerRef + type: object + status: + default: + observedGeneration: -1 + description: AlertStatus defines the observed state of Alert + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + type FooStatus struct{ // Represents the observations of a + foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + \ // +patchStrategy=merge // +listType=map // +listMapKey=type + \ Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.5.0 + creationTimestamp: null + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: buckets.source.toolkit.fluxcd.io +spec: + group: source.toolkit.fluxcd.io + names: + kind: Bucket + listKind: BucketList + plural: buckets + singular: bucket + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.endpoint + name: Endpoint + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: Bucket is the Schema for the buckets API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: BucketSpec defines the desired state of an S3 compatible + bucket + properties: + accessFrom: + description: AccessFrom defines an Access Control List for allowing + cross-namespace references to this object. + properties: + namespaceSelectors: + description: NamespaceSelectors is the list of namespace selectors + to which this ACL applies. Items in this list are evaluated + using a logical OR operation. + items: + description: NamespaceSelector selects the namespaces to which + this ACL applies. An empty map of MatchLabels matches all + namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: MatchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field is + "key", the operator is "In", and the values array contains + only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + bucketName: + description: The bucket name. + type: string + endpoint: + description: The bucket endpoint address. + type: string + ignore: + description: Ignore overrides the set of excluded patterns in the + .sourceignore format (which is the same as .gitignore). If not provided, + a default will be used, consult the documentation for your version + to find out what those are. + type: string + insecure: + description: Insecure allows connecting to a non-TLS S3 HTTP endpoint. + type: boolean + interval: + description: The interval at which to check for bucket updates. + type: string + provider: + default: generic + description: The S3 compatible storage provider name, default ('generic'). + enum: + - generic + - aws + - gcp + type: string + region: + description: The bucket region. + type: string + secretRef: + description: The name of the secret containing authentication credentials + for the Bucket. + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + suspend: + description: This flag tells the controller to suspend the reconciliation + of this source. + type: boolean + timeout: + default: 20s + description: The timeout for download operations, defaults to 20s. + type: string + required: + - bucketName + - endpoint + - interval + type: object + status: + default: + observedGeneration: -1 + description: BucketStatus defines the observed state of a bucket + properties: + artifact: + description: Artifact represents the output of the last successful + Bucket sync. + properties: + checksum: + description: Checksum is the SHA256 checksum of the artifact. + type: string + lastUpdateTime: + description: LastUpdateTime is the timestamp corresponding to + the last update of this artifact. + format: date-time + type: string + path: + description: Path is the relative file path of this artifact. + type: string + revision: + description: Revision is a human readable identifier traceable + in the origin source system. It can be a Git commit SHA, Git + tag, a Helm index timestamp, a Helm chart version, etc. + type: string + url: + description: URL is the HTTP address of this artifact. + type: string + required: + - path + - url + type: object + conditions: + description: Conditions holds the conditions for the Bucket. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + type FooStatus struct{ // Represents the observations of a + foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + \ // +patchStrategy=merge // +listType=map // +listMapKey=type + \ Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + url: + description: URL is the download link for the artifact output of the + last Bucket sync. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.5.0 + creationTimestamp: null + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: gitrepositories.source.toolkit.fluxcd.io +spec: + group: source.toolkit.fluxcd.io + names: + kind: GitRepository + listKind: GitRepositoryList + plural: gitrepositories + shortNames: + - gitrepo + singular: gitrepository + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.url + name: URL + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: GitRepository is the Schema for the gitrepositories API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: GitRepositorySpec defines the desired state of a Git repository. + properties: + accessFrom: + description: AccessFrom defines an Access Control List for allowing + cross-namespace references to this object. + properties: + namespaceSelectors: + description: NamespaceSelectors is the list of namespace selectors + to which this ACL applies. Items in this list are evaluated + using a logical OR operation. + items: + description: NamespaceSelector selects the namespaces to which + this ACL applies. An empty map of MatchLabels matches all + namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: MatchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field is + "key", the operator is "In", and the values array contains + only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + gitImplementation: + default: go-git + description: Determines which git client library to use. Defaults + to go-git, valid values are ('go-git', 'libgit2'). + enum: + - go-git + - libgit2 + type: string + ignore: + description: Ignore overrides the set of excluded patterns in the + .sourceignore format (which is the same as .gitignore). If not provided, + a default will be used, consult the documentation for your version + to find out what those are. + type: string + include: + description: Extra git repositories to map into the repository + items: + description: GitRepositoryInclude defines a source with a from and + to path. + properties: + fromPath: + description: The path to copy contents from, defaults to the + root directory. + type: string + repository: + description: Reference to a GitRepository to include. + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + toPath: + description: The path to copy contents to, defaults to the name + of the source ref. + type: string + required: + - repository + type: object + type: array + interval: + description: The interval at which to check for repository updates. + type: string + recurseSubmodules: + description: When enabled, after the clone is created, initializes + all submodules within, using their default settings. This option + is available only when using the 'go-git' GitImplementation. + type: boolean + ref: + description: The Git reference to checkout and monitor for changes, + defaults to master branch. + properties: + branch: + description: The Git branch to checkout, defaults to master. + type: string + commit: + description: The Git commit SHA to checkout, if specified Tag + filters will be ignored. + type: string + semver: + description: The Git tag semver expression, takes precedence over + Tag. + type: string + tag: + description: The Git tag to checkout, takes precedence over Branch. + type: string + type: object + secretRef: + description: The secret name containing the Git credentials. For HTTPS + repositories the secret must contain username and password fields. + For SSH repositories the secret must contain identity, identity.pub + and known_hosts fields. + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + suspend: + description: This flag tells the controller to suspend the reconciliation + of this source. + type: boolean + timeout: + default: 20s + description: The timeout for remote Git operations like cloning, defaults + to 20s. + type: string + url: + description: The repository URL, can be a HTTP/S or SSH address. + pattern: ^(http|https|ssh):// + type: string + verify: + description: Verify OpenPGP signature for the Git commit HEAD points + to. + properties: + mode: + description: Mode describes what git object should be verified, + currently ('head'). + enum: + - head + type: string + secretRef: + description: The secret name containing the public keys of all + trusted Git authors. + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + required: + - mode + type: object + required: + - interval + - url + type: object + status: + default: + observedGeneration: -1 + description: GitRepositoryStatus defines the observed state of a Git repository. + properties: + artifact: + description: Artifact represents the output of the last successful + repository sync. + properties: + checksum: + description: Checksum is the SHA256 checksum of the artifact. + type: string + lastUpdateTime: + description: LastUpdateTime is the timestamp corresponding to + the last update of this artifact. + format: date-time + type: string + path: + description: Path is the relative file path of this artifact. + type: string + revision: + description: Revision is a human readable identifier traceable + in the origin source system. It can be a Git commit SHA, Git + tag, a Helm index timestamp, a Helm chart version, etc. + type: string + url: + description: URL is the HTTP address of this artifact. + type: string + required: + - path + - url + type: object + conditions: + description: Conditions holds the conditions for the GitRepository. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + type FooStatus struct{ // Represents the observations of a + foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + \ // +patchStrategy=merge // +listType=map // +listMapKey=type + \ Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + includedArtifacts: + description: IncludedArtifacts represents the included artifacts from + the last successful repository sync. + items: + description: Artifact represents the output of a source synchronisation. + properties: + checksum: + description: Checksum is the SHA256 checksum of the artifact. + type: string + lastUpdateTime: + description: LastUpdateTime is the timestamp corresponding to + the last update of this artifact. + format: date-time + type: string + path: + description: Path is the relative file path of this artifact. + type: string + revision: + description: Revision is a human readable identifier traceable + in the origin source system. It can be a Git commit SHA, Git + tag, a Helm index timestamp, a Helm chart version, etc. + type: string + url: + description: URL is the HTTP address of this artifact. + type: string + required: + - path + - url + type: object + type: array + lastHandledReconcileAt: + description: LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + url: + description: URL is the download link for the artifact output of the + last repository sync. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.5.0 + creationTimestamp: null + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: helmcharts.source.toolkit.fluxcd.io +spec: + group: source.toolkit.fluxcd.io + names: + kind: HelmChart + listKind: HelmChartList + plural: helmcharts + shortNames: + - hc + singular: helmchart + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.chart + name: Chart + type: string + - jsonPath: .spec.version + name: Version + type: string + - jsonPath: .spec.sourceRef.kind + name: Source Kind + type: string + - jsonPath: .spec.sourceRef.name + name: Source Name + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: HelmChart is the Schema for the helmcharts API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: HelmChartSpec defines the desired state of a Helm chart. + properties: + accessFrom: + description: AccessFrom defines an Access Control List for allowing + cross-namespace references to this object. + properties: + namespaceSelectors: + description: NamespaceSelectors is the list of namespace selectors + to which this ACL applies. Items in this list are evaluated + using a logical OR operation. + items: + description: NamespaceSelector selects the namespaces to which + this ACL applies. An empty map of MatchLabels matches all + namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: MatchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field is + "key", the operator is "In", and the values array contains + only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + chart: + description: The name or path the Helm chart is available at in the + SourceRef. + type: string + interval: + description: The interval at which to check the Source for updates. + type: string + reconcileStrategy: + default: ChartVersion + description: Determines what enables the creation of a new artifact. + Valid values are ('ChartVersion', 'Revision'). See the documentation + of the values for an explanation on their behavior. Defaults to + ChartVersion when omitted. + enum: + - ChartVersion + - Revision + type: string + sourceRef: + description: The reference to the Source the chart is available at. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: Kind of the referent, valid values are ('HelmRepository', + 'GitRepository', 'Bucket'). + enum: + - HelmRepository + - GitRepository + - Bucket + type: string + name: + description: Name of the referent. + type: string + required: + - kind + - name + type: object + suspend: + description: This flag tells the controller to suspend the reconciliation + of this source. + type: boolean + valuesFile: + description: Alternative values file to use as the default chart values, + expected to be a relative path in the SourceRef. Deprecated in favor + of ValuesFiles, for backwards compatibility the file defined here + is merged before the ValuesFiles items. Ignored when omitted. + type: string + valuesFiles: + description: Alternative list of values files to use as the chart + values (values.yaml is not included by default), expected to be + a relative path in the SourceRef. Values files are merged in the + order of this list with the last file overriding the first. Ignored + when omitted. + items: + type: string + type: array + version: + default: '*' + description: The chart version semver expression, ignored for charts + from GitRepository and Bucket sources. Defaults to latest when omitted. + type: string + required: + - chart + - interval + - sourceRef + type: object + status: + default: + observedGeneration: -1 + description: HelmChartStatus defines the observed state of the HelmChart. + properties: + artifact: + description: Artifact represents the output of the last successful + chart sync. + properties: + checksum: + description: Checksum is the SHA256 checksum of the artifact. + type: string + lastUpdateTime: + description: LastUpdateTime is the timestamp corresponding to + the last update of this artifact. + format: date-time + type: string + path: + description: Path is the relative file path of this artifact. + type: string + revision: + description: Revision is a human readable identifier traceable + in the origin source system. It can be a Git commit SHA, Git + tag, a Helm index timestamp, a Helm chart version, etc. + type: string + url: + description: URL is the HTTP address of this artifact. + type: string + required: + - path + - url + type: object + conditions: + description: Conditions holds the conditions for the HelmChart. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + type FooStatus struct{ // Represents the observations of a + foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + \ // +patchStrategy=merge // +listType=map // +listMapKey=type + \ Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + url: + description: URL is the download link for the last chart pulled. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.5.0 + creationTimestamp: null + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: helmreleases.helm.toolkit.fluxcd.io +spec: + group: helm.toolkit.fluxcd.io + names: + kind: HelmRelease + listKind: HelmReleaseList + plural: helmreleases + shortNames: + - hr + singular: helmrelease + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v2beta1 + schema: + openAPIV3Schema: + description: HelmRelease is the Schema for the helmreleases API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: HelmReleaseSpec defines the desired state of a Helm release. + properties: + chart: + description: Chart defines the template of the v1beta1.HelmChart that + should be created for this HelmRelease. + properties: + spec: + description: Spec holds the template for the v1beta1.HelmChartSpec + for this HelmRelease. + properties: + chart: + description: The name or path the Helm chart is available + at in the SourceRef. + type: string + interval: + description: Interval at which to check the v1beta1.Source + for updates. Defaults to 'HelmReleaseSpec.Interval'. + type: string + reconcileStrategy: + default: ChartVersion + description: Determines what enables the creation of a new + artifact. Valid values are ('ChartVersion', 'Revision'). + See the documentation of the values for an explanation on + their behavior. Defaults to ChartVersion when omitted. + enum: + - ChartVersion + - Revision + type: string + sourceRef: + description: The name and namespace of the v1beta1.Source + the chart is available at. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: Kind of the referent. + enum: + - HelmRepository + - GitRepository + - Bucket + type: string + name: + description: Name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: Namespace of the referent. + maxLength: 63 + minLength: 1 + type: string + required: + - name + type: object + valuesFile: + description: Alternative values file to use as the default + chart values, expected to be a relative path in the SourceRef. + Deprecated in favor of ValuesFiles, for backwards compatibility + the file defined here is merged before the ValuesFiles items. + Ignored when omitted. + type: string + valuesFiles: + description: Alternative list of values files to use as the + chart values (values.yaml is not included by default), expected + to be a relative path in the SourceRef. Values files are + merged in the order of this list with the last file overriding + the first. Ignored when omitted. + items: + type: string + type: array + version: + default: '*' + description: Version semver expression, ignored for charts + from v1beta1.GitRepository and v1beta1.Bucket sources. Defaults + to latest when omitted. + type: string + required: + - chart + - sourceRef + type: object + required: + - spec + type: object + dependsOn: + description: DependsOn may contain a dependency.CrossNamespaceDependencyReference + slice with references to HelmRelease resources that must be ready + before this HelmRelease can be reconciled. + items: + description: CrossNamespaceDependencyReference holds the reference + to a dependency. + properties: + name: + description: Name holds the name reference of a dependency. + type: string + namespace: + description: Namespace holds the namespace reference of a dependency. + type: string + required: + - name + type: object + type: array + install: + description: Install holds the configuration for Helm install actions + for this HelmRelease. + properties: + crds: + description: "CRDs upgrade CRDs from the Helm Chart's crds directory + according to the CRD upgrade policy provided here. Valid values + are `Skip`, `Create` or `CreateReplace`. Default is `Create` + and if omitted CRDs are installed but not updated. \n Skip: + do neither install nor replace (update) any CRDs. \n Create: + new CRDs are created, existing CRDs are neither updated nor + deleted. \n CreateReplace: new CRDs are created, existing CRDs + are updated (replaced) but not deleted. \n By default, CRDs + are applied (installed) during Helm install action. With this + option users can opt-in to CRD replace existing CRDs on Helm + install actions, which is not (yet) natively supported by Helm. + https://helm.sh/docs/chart_best_practices/custom_resource_definitions." + enum: + - Skip + - Create + - CreateReplace + type: string + createNamespace: + description: CreateNamespace tells the Helm install action to + create the HelmReleaseSpec.TargetNamespace if it does not exist + yet. On uninstall, the namespace will not be garbage collected. + type: boolean + disableHooks: + description: DisableHooks prevents hooks from running during the + Helm install action. + type: boolean + disableOpenAPIValidation: + description: DisableOpenAPIValidation prevents the Helm install + action from validating rendered templates against the Kubernetes + OpenAPI Schema. + type: boolean + disableWait: + description: DisableWait disables the waiting for resources to + be ready after a Helm install has been performed. + type: boolean + disableWaitForJobs: + description: DisableWaitForJobs disables waiting for jobs to complete + after a Helm install has been performed. + type: boolean + remediation: + description: Remediation holds the remediation configuration for + when the Helm install action for the HelmRelease fails. The + default is to not perform any action. + properties: + ignoreTestFailures: + description: IgnoreTestFailures tells the controller to skip + remediation when the Helm tests are run after an install + action but fail. Defaults to 'Test.IgnoreFailures'. + type: boolean + remediateLastFailure: + description: RemediateLastFailure tells the controller to + remediate the last failure, when no retries remain. Defaults + to 'false'. + type: boolean + retries: + description: Retries is the number of retries that should + be attempted on failures before bailing. Remediation, using + an uninstall, is performed between each attempt. Defaults + to '0', a negative integer equals to unlimited retries. + type: integer + type: object + replace: + description: Replace tells the Helm install action to re-use the + 'ReleaseName', but only if that name is a deleted release which + remains in the history. + type: boolean + skipCRDs: + description: "SkipCRDs tells the Helm install action to not install + any CRDs. By default, CRDs are installed if not already present. + \n Deprecated use CRD policy (`crds`) attribute with value `Skip` + instead." + type: boolean + timeout: + description: Timeout is the time to wait for any individual Kubernetes + operation (like Jobs for hooks) during the performance of a + Helm install action. Defaults to 'HelmReleaseSpec.Timeout'. + type: string + type: object + interval: + description: Interval at which to reconcile the Helm release. + type: string + kubeConfig: + description: KubeConfig for reconciling the HelmRelease on a remote + cluster. When specified, KubeConfig takes precedence over ServiceAccountName. + properties: + secretRef: + description: SecretRef holds the name to a secret that contains + a 'value' key with the kubeconfig file as the value. It must + be in the same namespace as the HelmRelease. It is recommended + that the kubeconfig is self-contained, and the secret is regularly + updated if credentials such as a cloud-access-token expire. + Cloud specific `cmd-path` auth helpers will not function without + adding binaries and credentials to the Pod that is responsible + for reconciling the HelmRelease. + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + type: object + maxHistory: + description: MaxHistory is the number of revisions saved by Helm for + this HelmRelease. Use '0' for an unlimited number of revisions; + defaults to '10'. + type: integer + postRenderers: + description: PostRenderers holds an array of Helm PostRenderers, which + will be applied in order of their definition. + items: + description: PostRenderer contains a Helm PostRenderer specification. + properties: + kustomize: + description: Kustomization to apply as PostRenderer. + properties: + images: + description: Images is a list of (image name, new name, + new tag or digest) for changing image names, tags or digests. + This can also be achieved with a patch, but this operator + is simpler to specify. + items: + description: Image contains an image name, a new name, + a new tag or digest, which will replace the original + name and tag. + properties: + digest: + description: Digest is the value used to replace the + original image tag. If digest is present NewTag + value is ignored. + type: string + name: + description: Name is a tag-less image name. + type: string + newName: + description: NewName is the value used to replace + the original name. + type: string + newTag: + description: NewTag is the value used to replace the + original tag. + type: string + required: + - name + type: object + type: array + patchesJson6902: + description: JSON 6902 patches, defined as inline YAML objects. + items: + description: JSON6902Patch contains a JSON6902 patch and + the target the patch should be applied to. + properties: + patch: + description: Patch contains the JSON6902 patch document + with an array of operation objects. + items: + description: JSON6902 is a JSON6902 operation object. + https://datatracker.ietf.org/doc/html/rfc6902#section-4 + properties: + from: + description: From contains a JSON-pointer value + that references a location within the target + document where the operation is performed. + The meaning of the value depends on the value + of Op, and is NOT taken into account by all + operations. + type: string + op: + description: Op indicates the operation to perform. + Its value MUST be one of "add", "remove", + "replace", "move", "copy", or "test". https://datatracker.ietf.org/doc/html/rfc6902#section-4 + enum: + - test + - remove + - add + - replace + - move + - copy + type: string + path: + description: Path contains the JSON-pointer + value that references a location within the + target document where the operation is performed. + The meaning of the value depends on the value + of Op. + type: string + value: + description: Value contains a valid JSON structure. + The meaning of the value depends on the value + of Op, and is NOT taken into account by all + operations. + x-kubernetes-preserve-unknown-fields: true + required: + - op + - path + type: object + type: array + target: + description: Target points to the resources that the + patch document should be applied to. + properties: + annotationSelector: + description: AnnotationSelector is a string that + follows the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: Group is the API group to select + resources from. Together with Version and Kind + it is capable of unambiguously identifying and/or + selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: Kind of the API Group to select resources + from. Together with Group and Version it is + capable of unambiguously identifying and/or + selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: LabelSelector is a string that follows + the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: Version of the API Group to select + resources from. Together with Group and Kind + it is capable of unambiguously identifying and/or + selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + - target + type: object + type: array + patchesStrategicMerge: + description: Strategic merge patches, defined as inline + YAML objects. + items: + x-kubernetes-preserve-unknown-fields: true + type: array + type: object + type: object + type: array + releaseName: + description: ReleaseName used for the Helm release. Defaults to a + composition of '[TargetNamespace-]Name'. + maxLength: 53 + minLength: 1 + type: string + rollback: + description: Rollback holds the configuration for Helm rollback actions + for this HelmRelease. + properties: + cleanupOnFail: + description: CleanupOnFail allows deletion of new resources created + during the Helm rollback action when it fails. + type: boolean + disableHooks: + description: DisableHooks prevents hooks from running during the + Helm rollback action. + type: boolean + disableWait: + description: DisableWait disables the waiting for resources to + be ready after a Helm rollback has been performed. + type: boolean + disableWaitForJobs: + description: DisableWaitForJobs disables waiting for jobs to complete + after a Helm rollback has been performed. + type: boolean + force: + description: Force forces resource updates through a replacement + strategy. + type: boolean + recreate: + description: Recreate performs pod restarts for the resource if + applicable. + type: boolean + timeout: + description: Timeout is the time to wait for any individual Kubernetes + operation (like Jobs for hooks) during the performance of a + Helm rollback action. Defaults to 'HelmReleaseSpec.Timeout'. + type: string + type: object + serviceAccountName: + description: The name of the Kubernetes service account to impersonate + when reconciling this HelmRelease. + type: string + storageNamespace: + description: StorageNamespace used for the Helm storage. Defaults + to the namespace of the HelmRelease. + maxLength: 63 + minLength: 1 + type: string + suspend: + description: Suspend tells the controller to suspend reconciliation + for this HelmRelease, it does not apply to already started reconciliations. + Defaults to false. + type: boolean + targetNamespace: + description: TargetNamespace to target when performing operations + for the HelmRelease. Defaults to the namespace of the HelmRelease. + maxLength: 63 + minLength: 1 + type: string + test: + description: Test holds the configuration for Helm test actions for + this HelmRelease. + properties: + enable: + description: Enable enables Helm test actions for this HelmRelease + after an Helm install or upgrade action has been performed. + type: boolean + ignoreFailures: + description: IgnoreFailures tells the controller to skip remediation + when the Helm tests are run but fail. Can be overwritten for + tests run after install or upgrade actions in 'Install.IgnoreTestFailures' + and 'Upgrade.IgnoreTestFailures'. + type: boolean + timeout: + description: Timeout is the time to wait for any individual Kubernetes + operation during the performance of a Helm test action. Defaults + to 'HelmReleaseSpec.Timeout'. + type: string + type: object + timeout: + description: Timeout is the time to wait for any individual Kubernetes + operation (like Jobs for hooks) during the performance of a Helm + action. Defaults to '5m0s'. + type: string + uninstall: + description: Uninstall holds the configuration for Helm uninstall + actions for this HelmRelease. + properties: + disableHooks: + description: DisableHooks prevents hooks from running during the + Helm rollback action. + type: boolean + keepHistory: + description: KeepHistory tells Helm to remove all associated resources + and mark the release as deleted, but retain the release history. + type: boolean + timeout: + description: Timeout is the time to wait for any individual Kubernetes + operation (like Jobs for hooks) during the performance of a + Helm uninstall action. Defaults to 'HelmReleaseSpec.Timeout'. + type: string + type: object + upgrade: + description: Upgrade holds the configuration for Helm upgrade actions + for this HelmRelease. + properties: + cleanupOnFail: + description: CleanupOnFail allows deletion of new resources created + during the Helm upgrade action when it fails. + type: boolean + crds: + description: "CRDs upgrade CRDs from the Helm Chart's crds directory + according to the CRD upgrade policy provided here. Valid values + are `Skip`, `Create` or `CreateReplace`. Default is `Skip` and + if omitted CRDs are neither installed nor upgraded. \n Skip: + do neither install nor replace (update) any CRDs. \n Create: + new CRDs are created, existing CRDs are neither updated nor + deleted. \n CreateReplace: new CRDs are created, existing CRDs + are updated (replaced) but not deleted. \n By default, CRDs + are not applied during Helm upgrade action. With this option + users can opt-in to CRD upgrade, which is not (yet) natively + supported by Helm. https://helm.sh/docs/chart_best_practices/custom_resource_definitions." + enum: + - Skip + - Create + - CreateReplace + type: string + disableHooks: + description: DisableHooks prevents hooks from running during the + Helm upgrade action. + type: boolean + disableOpenAPIValidation: + description: DisableOpenAPIValidation prevents the Helm upgrade + action from validating rendered templates against the Kubernetes + OpenAPI Schema. + type: boolean + disableWait: + description: DisableWait disables the waiting for resources to + be ready after a Helm upgrade has been performed. + type: boolean + disableWaitForJobs: + description: DisableWaitForJobs disables waiting for jobs to complete + after a Helm upgrade has been performed. + type: boolean + force: + description: Force forces resource updates through a replacement + strategy. + type: boolean + preserveValues: + description: PreserveValues will make Helm reuse the last release's + values and merge in overrides from 'Values'. Setting this flag + makes the HelmRelease non-declarative. + type: boolean + remediation: + description: Remediation holds the remediation configuration for + when the Helm upgrade action for the HelmRelease fails. The + default is to not perform any action. + properties: + ignoreTestFailures: + description: IgnoreTestFailures tells the controller to skip + remediation when the Helm tests are run after an upgrade + action but fail. Defaults to 'Test.IgnoreFailures'. + type: boolean + remediateLastFailure: + description: RemediateLastFailure tells the controller to + remediate the last failure, when no retries remain. Defaults + to 'false' unless 'Retries' is greater than 0. + type: boolean + retries: + description: Retries is the number of retries that should + be attempted on failures before bailing. Remediation, using + 'Strategy', is performed between each attempt. Defaults + to '0', a negative integer equals to unlimited retries. + type: integer + strategy: + description: Strategy to use for failure remediation. Defaults + to 'rollback'. + enum: + - rollback + - uninstall + type: string + type: object + timeout: + description: Timeout is the time to wait for any individual Kubernetes + operation (like Jobs for hooks) during the performance of a + Helm upgrade action. Defaults to 'HelmReleaseSpec.Timeout'. + type: string + type: object + values: + description: Values holds the values for this Helm release. + x-kubernetes-preserve-unknown-fields: true + valuesFrom: + description: ValuesFrom holds references to resources containing Helm + values for this HelmRelease, and information about how they should + be merged. + items: + description: ValuesReference contains a reference to a resource + containing Helm values, and optionally the key they can be found + at. + properties: + kind: + description: Kind of the values referent, valid values are ('Secret', + 'ConfigMap'). + enum: + - Secret + - ConfigMap + type: string + name: + description: Name of the values referent. Should reside in the + same namespace as the referring resource. + maxLength: 253 + minLength: 1 + type: string + optional: + description: Optional marks this ValuesReference as optional. + When set, a not found error for the values reference is ignored, + but any ValuesKey, TargetPath or transient error will still + result in a reconciliation failure. + type: boolean + targetPath: + description: TargetPath is the YAML dot notation path the value + should be merged at. When set, the ValuesKey is expected to + be a single flat value. Defaults to 'None', which results + in the values getting merged at the root. + type: string + valuesKey: + description: ValuesKey is the data key where the values.yaml + or a specific value can be found at. Defaults to 'values.yaml'. + type: string + required: + - kind + - name + type: object + type: array + required: + - chart + - interval + type: object + status: + default: + observedGeneration: -1 + description: HelmReleaseStatus defines the observed state of a HelmRelease. + properties: + conditions: + description: Conditions holds the conditions for the HelmRelease. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + type FooStatus struct{ // Represents the observations of a + foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + \ // +patchStrategy=merge // +listType=map // +listMapKey=type + \ Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + failures: + description: Failures is the reconciliation failure count against + the latest desired state. It is reset after a successful reconciliation. + format: int64 + type: integer + helmChart: + description: HelmChart is the namespaced name of the HelmChart resource + created by the controller for the HelmRelease. + type: string + installFailures: + description: InstallFailures is the install failure count against + the latest desired state. It is reset after a successful reconciliation. + format: int64 + type: integer + lastAppliedRevision: + description: LastAppliedRevision is the revision of the last successfully + applied source. + type: string + lastAttemptedRevision: + description: LastAttemptedRevision is the revision of the last reconciliation + attempt. + type: string + lastAttemptedValuesChecksum: + description: LastAttemptedValuesChecksum is the SHA1 checksum of the + values of the last reconciliation attempt. + type: string + lastHandledReconcileAt: + description: LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change can be detected. + type: string + lastReleaseRevision: + description: LastReleaseRevision is the revision of the last successful + Helm release. + type: integer + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + upgradeFailures: + description: UpgradeFailures is the upgrade failure count against + the latest desired state. It is reset after a successful reconciliation. + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.5.0 + creationTimestamp: null + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: helmrepositories.source.toolkit.fluxcd.io +spec: + group: source.toolkit.fluxcd.io + names: + kind: HelmRepository + listKind: HelmRepositoryList + plural: helmrepositories + shortNames: + - helmrepo + singular: helmrepository + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.url + name: URL + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: HelmRepository is the Schema for the helmrepositories API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: HelmRepositorySpec defines the reference to a Helm repository. + properties: + accessFrom: + description: AccessFrom defines an Access Control List for allowing + cross-namespace references to this object. + properties: + namespaceSelectors: + description: NamespaceSelectors is the list of namespace selectors + to which this ACL applies. Items in this list are evaluated + using a logical OR operation. + items: + description: NamespaceSelector selects the namespaces to which + this ACL applies. An empty map of MatchLabels matches all + namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: MatchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field is + "key", the operator is "In", and the values array contains + only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + interval: + description: The interval at which to check the upstream for updates. + type: string + passCredentials: + description: PassCredentials allows the credentials from the SecretRef + to be passed on to a host that does not match the host as defined + in URL. This may be required if the host of the advertised chart + URLs in the index differ from the defined URL. Enabling this should + be done with caution, as it can potentially result in credentials + getting stolen in a MITM-attack. + type: boolean + secretRef: + description: The name of the secret containing authentication credentials + for the Helm repository. For HTTP/S basic auth the secret must contain + username and password fields. For TLS the secret must contain a + certFile and keyFile, and/or caCert fields. + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + suspend: + description: This flag tells the controller to suspend the reconciliation + of this source. + type: boolean + timeout: + default: 60s + description: The timeout of index downloading, defaults to 60s. + type: string + url: + description: The Helm repository URL, a valid URL contains at least + a protocol and host. + type: string + required: + - interval + - url + type: object + status: + default: + observedGeneration: -1 + description: HelmRepositoryStatus defines the observed state of the HelmRepository. + properties: + artifact: + description: Artifact represents the output of the last successful + repository sync. + properties: + checksum: + description: Checksum is the SHA256 checksum of the artifact. + type: string + lastUpdateTime: + description: LastUpdateTime is the timestamp corresponding to + the last update of this artifact. + format: date-time + type: string + path: + description: Path is the relative file path of this artifact. + type: string + revision: + description: Revision is a human readable identifier traceable + in the origin source system. It can be a Git commit SHA, Git + tag, a Helm index timestamp, a Helm chart version, etc. + type: string + url: + description: URL is the HTTP address of this artifact. + type: string + required: + - path + - url + type: object + conditions: + description: Conditions holds the conditions for the HelmRepository. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + type FooStatus struct{ // Represents the observations of a + foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + \ // +patchStrategy=merge // +listType=map // +listMapKey=type + \ Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + url: + description: URL is the download link for the last index fetched. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.5.0 + creationTimestamp: null + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: imagepolicies.image.toolkit.fluxcd.io +spec: + group: image.toolkit.fluxcd.io + names: + kind: ImagePolicy + listKind: ImagePolicyList + plural: imagepolicies + singular: imagepolicy + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.latestImage + name: LatestImage + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: ImagePolicy is the Schema for the imagepolicies API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ImagePolicySpec defines the parameters for calculating the + ImagePolicy + properties: + filterTags: + description: FilterTags enables filtering for only a subset of tags + based on a set of rules. If no rules are provided, all the tags + from the repository will be ordered and compared. + properties: + extract: + description: Extract allows a capture group to be extracted from + the specified regular expression pattern, useful before tag + evaluation. + type: string + pattern: + description: Pattern specifies a regular expression pattern used + to filter for image tags. + type: string + type: object + imageRepositoryRef: + description: ImageRepositoryRef points at the object specifying the + image being scanned + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + policy: + description: Policy gives the particulars of the policy to be followed + in selecting the most recent image + properties: + alphabetical: + description: Alphabetical set of rules to use for alphabetical + ordering of the tags. + properties: + order: + default: asc + description: Order specifies the sorting order of the tags. + Given the letters of the alphabet as tags, ascending order + would select Z, and descending order would select A. + enum: + - asc + - desc + type: string + type: object + numerical: + description: Numerical set of rules to use for numerical ordering + of the tags. + properties: + order: + default: asc + description: Order specifies the sorting order of the tags. + Given the integer values from 0 to 9 as tags, ascending + order would select 9, and descending order would select + 0. + enum: + - asc + - desc + type: string + type: object + semver: + description: SemVer gives a semantic version range to check against + the tags available. + properties: + range: + description: Range gives a semver range for the image tag; + the highest version within the range that's a tag yields + the latest image. + type: string + required: + - range + type: object + type: object + required: + - imageRepositoryRef + - policy + type: object + status: + default: + observedGeneration: -1 + description: ImagePolicyStatus defines the observed state of ImagePolicy + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + type FooStatus struct{ // Represents the observations of a + foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + \ // +patchStrategy=merge // +listType=map // +listMapKey=type + \ Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + latestImage: + description: LatestImage gives the first in the list of images scanned + by the image repository, when filtered and ordered according to + the policy. + type: string + observedGeneration: + description: ObservedGeneration is the last reconciled generation. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.latestImage + name: LatestImage + type: string + name: v1alpha2 + schema: + openAPIV3Schema: + description: ImagePolicy is the Schema for the imagepolicies API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ImagePolicySpec defines the parameters for calculating the + ImagePolicy + properties: + filterTags: + description: FilterTags enables filtering for only a subset of tags + based on a set of rules. If no rules are provided, all the tags + from the repository will be ordered and compared. + properties: + extract: + description: Extract allows a capture group to be extracted from + the specified regular expression pattern, useful before tag + evaluation. + type: string + pattern: + description: Pattern specifies a regular expression pattern used + to filter for image tags. + type: string + type: object + imageRepositoryRef: + description: ImageRepositoryRef points at the object specifying the + image being scanned + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + policy: + description: Policy gives the particulars of the policy to be followed + in selecting the most recent image + properties: + alphabetical: + description: Alphabetical set of rules to use for alphabetical + ordering of the tags. + properties: + order: + default: asc + description: Order specifies the sorting order of the tags. + Given the letters of the alphabet as tags, ascending order + would select Z, and descending order would select A. + enum: + - asc + - desc + type: string + type: object + numerical: + description: Numerical set of rules to use for numerical ordering + of the tags. + properties: + order: + default: asc + description: Order specifies the sorting order of the tags. + Given the integer values from 0 to 9 as tags, ascending + order would select 9, and descending order would select + 0. + enum: + - asc + - desc + type: string + type: object + semver: + description: SemVer gives a semantic version range to check against + the tags available. + properties: + range: + description: Range gives a semver range for the image tag; + the highest version within the range that's a tag yields + the latest image. + type: string + required: + - range + type: object + type: object + required: + - imageRepositoryRef + - policy + type: object + status: + description: ImagePolicyStatus defines the observed state of ImagePolicy + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + type FooStatus struct{ // Represents the observations of a + foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + \ // +patchStrategy=merge // +listType=map // +listMapKey=type + \ Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + latestImage: + description: LatestImage gives the first in the list of images scanned + by the image repository, when filtered and ordered according to + the policy. + type: string + observedGeneration: + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.latestImage + name: LatestImage + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: ImagePolicy is the Schema for the imagepolicies API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ImagePolicySpec defines the parameters for calculating the + ImagePolicy + properties: + filterTags: + description: FilterTags enables filtering for only a subset of tags + based on a set of rules. If no rules are provided, all the tags + from the repository will be ordered and compared. + properties: + extract: + description: Extract allows a capture group to be extracted from + the specified regular expression pattern, useful before tag + evaluation. + type: string + pattern: + description: Pattern specifies a regular expression pattern used + to filter for image tags. + type: string + type: object + imageRepositoryRef: + description: ImageRepositoryRef points at the object specifying the + image being scanned + properties: + name: + description: Name of the referent + type: string + namespace: + description: Namespace of the referent, when not specified it + acts as LocalObjectReference + type: string + required: + - name + type: object + policy: + description: Policy gives the particulars of the policy to be followed + in selecting the most recent image + properties: + alphabetical: + description: Alphabetical set of rules to use for alphabetical + ordering of the tags. + properties: + order: + default: asc + description: Order specifies the sorting order of the tags. + Given the letters of the alphabet as tags, ascending order + would select Z, and descending order would select A. + enum: + - asc + - desc + type: string + type: object + numerical: + description: Numerical set of rules to use for numerical ordering + of the tags. + properties: + order: + default: asc + description: Order specifies the sorting order of the tags. + Given the integer values from 0 to 9 as tags, ascending + order would select 9, and descending order would select + 0. + enum: + - asc + - desc + type: string + type: object + semver: + description: SemVer gives a semantic version range to check against + the tags available. + properties: + range: + description: Range gives a semver range for the image tag; + the highest version within the range that's a tag yields + the latest image. + type: string + required: + - range + type: object + type: object + required: + - imageRepositoryRef + - policy + type: object + status: + description: ImagePolicyStatus defines the observed state of ImagePolicy + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + type FooStatus struct{ // Represents the observations of a + foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + \ // +patchStrategy=merge // +listType=map // +listMapKey=type + \ Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + latestImage: + description: LatestImage gives the first in the list of images scanned + by the image repository, when filtered and ordered according to + the policy. + type: string + observedGeneration: + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.5.0 + creationTimestamp: null + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: imagerepositories.image.toolkit.fluxcd.io +spec: + group: image.toolkit.fluxcd.io + names: + kind: ImageRepository + listKind: ImageRepositoryList + plural: imagerepositories + singular: imagerepository + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.lastScanResult.scanTime + name: Last scan + type: string + - jsonPath: .status.lastScanResult.tagCount + name: Tags + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: ImageRepository is the Schema for the imagerepositories API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ImageRepositorySpec defines the parameters for scanning an + image repository, e.g., `fluxcd/flux`. + properties: + certSecretRef: + description: "CertSecretRef can be given the name of a secret containing + either or both of \n - a PEM-encoded client certificate (`certFile`) + and private key (`keyFile`); - a PEM-encoded CA certificate (`caFile`) + \n and whichever are supplied, will be used for connecting to the + \ registry. The client cert and key are useful if you are authenticating + with a certificate; the CA cert is useful if you are using a self-signed + server certificate." + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + image: + description: Image is the name of the image repository + type: string + interval: + description: Interval is the length of time to wait between scans + of the image repository. + type: string + secretRef: + description: SecretRef can be given the name of a secret containing + credentials to use for the image registry. The secret should be + created with `kubectl create secret docker-registry`, or the equivalent. + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + suspend: + description: This flag tells the controller to suspend subsequent + image scans. It does not apply to already started scans. Defaults + to false. + type: boolean + timeout: + description: Timeout for image scanning. Defaults to 'Interval' duration. + type: string + type: object + status: + default: + observedGeneration: -1 + description: ImageRepositoryStatus defines the observed state of ImageRepository + properties: + canonicalImageName: + description: CanonicalName is the name of the image repository with + all the implied bits made explicit; e.g., `docker.io/library/alpine` + rather than `alpine`. + type: string + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + type FooStatus struct{ // Represents the observations of a + foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + \ // +patchStrategy=merge // +listType=map // +listMapKey=type + \ Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change can be detected. + type: string + lastScanResult: + description: LastScanResult contains the number of fetched tags. + properties: + scanTime: + format: date-time + type: string + tagCount: + type: integer + required: + - tagCount + type: object + observedGeneration: + description: ObservedGeneration is the last reconciled generation. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.lastScanResult.scanTime + name: Last scan + type: string + - jsonPath: .status.lastScanResult.tagCount + name: Tags + type: string + name: v1alpha2 + schema: + openAPIV3Schema: + description: ImageRepository is the Schema for the imagerepositories API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ImageRepositorySpec defines the parameters for scanning an + image repository, e.g., `fluxcd/flux`. + properties: + certSecretRef: + description: "CertSecretRef can be given the name of a secret containing + either or both of \n - a PEM-encoded client certificate (`certFile`) + and private key (`keyFile`); - a PEM-encoded CA certificate (`caFile`) + \n and whichever are supplied, will be used for connecting to the + \ registry. The client cert and key are useful if you are authenticating + with a certificate; the CA cert is useful if you are using a self-signed + server certificate." + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + image: + description: Image is the name of the image repository + type: string + interval: + description: Interval is the length of time to wait between scans + of the image repository. + type: string + secretRef: + description: SecretRef can be given the name of a secret containing + credentials to use for the image registry. The secret should be + created with `kubectl create secret docker-registry`, or the equivalent. + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + suspend: + description: This flag tells the controller to suspend subsequent + image scans. It does not apply to already started scans. Defaults + to false. + type: boolean + timeout: + description: Timeout for image scanning. Defaults to 'Interval' duration. + type: string + type: object + status: + description: ImageRepositoryStatus defines the observed state of ImageRepository + properties: + canonicalImageName: + description: CanonicalName is the name of the image repository with + all the implied bits made explicit; e.g., `docker.io/library/alpine` + rather than `alpine`. + type: string + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + type FooStatus struct{ // Represents the observations of a + foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + \ // +patchStrategy=merge // +listType=map // +listMapKey=type + \ Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change can be detected. + type: string + lastScanResult: + description: LastScanResult contains the number of fetched tags. + properties: + scanTime: + format: date-time + type: string + tagCount: + type: integer + required: + - tagCount + type: object + observedGeneration: + description: ObservedGeneration is the last reconciled generation. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.lastScanResult.scanTime + name: Last scan + type: string + - jsonPath: .status.lastScanResult.tagCount + name: Tags + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: ImageRepository is the Schema for the imagerepositories API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ImageRepositorySpec defines the parameters for scanning an + image repository, e.g., `fluxcd/flux`. + properties: + accessFrom: + description: AccessFrom defines an ACL for allowing cross-namespace + references to the ImageRepository object based on the caller's namespace + labels. + properties: + namespaceSelectors: + items: + properties: + matchLabels: + additionalProperties: + type: string + type: object + type: object + type: array + type: object + certSecretRef: + description: "CertSecretRef can be given the name of a secret containing + either or both of \n - a PEM-encoded client certificate (`certFile`) + and private key (`keyFile`); - a PEM-encoded CA certificate (`caFile`) + \n and whichever are supplied, will be used for connecting to the + \ registry. The client cert and key are useful if you are authenticating + with a certificate; the CA cert is useful if you are using a self-signed + server certificate." + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + image: + description: Image is the name of the image repository + type: string + interval: + description: Interval is the length of time to wait between scans + of the image repository. + type: string + secretRef: + description: SecretRef can be given the name of a secret containing + credentials to use for the image registry. The secret should be + created with `kubectl create secret docker-registry`, or the equivalent. + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + suspend: + description: This flag tells the controller to suspend subsequent + image scans. It does not apply to already started scans. Defaults + to false. + type: boolean + timeout: + description: Timeout for image scanning. Defaults to 'Interval' duration. + type: string + type: object + status: + description: ImageRepositoryStatus defines the observed state of ImageRepository + properties: + canonicalImageName: + description: CanonicalName is the name of the image repository with + all the implied bits made explicit; e.g., `docker.io/library/alpine` + rather than `alpine`. + type: string + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + type FooStatus struct{ // Represents the observations of a + foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + \ // +patchStrategy=merge // +listType=map // +listMapKey=type + \ Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change can be detected. + type: string + lastScanResult: + description: LastScanResult contains the number of fetched tags. + properties: + scanTime: + format: date-time + type: string + tagCount: + type: integer + required: + - tagCount + type: object + observedGeneration: + description: ObservedGeneration is the last reconciled generation. + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.5.0 + creationTimestamp: null + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: imageupdateautomations.image.toolkit.fluxcd.io +spec: + group: image.toolkit.fluxcd.io + names: + kind: ImageUpdateAutomation + listKind: ImageUpdateAutomationList + plural: imageupdateautomations + singular: imageupdateautomation + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.lastAutomationRunTime + name: Last run + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: ImageUpdateAutomation is the Schema for the imageupdateautomations + API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ImageUpdateAutomationSpec defines the desired state of ImageUpdateAutomation + properties: + checkout: + description: Checkout gives the parameters for cloning the git repository, + ready to make changes. + properties: + branch: + description: Branch gives the branch to clone from the git repository. + If `.spec.push` is not supplied, commits will also be pushed + to this branch. + type: string + gitRepositoryRef: + description: GitRepositoryRef refers to the resource giving access + details to a git repository to update files in. + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + required: + - branch + - gitRepositoryRef + type: object + commit: + description: Commit specifies how to commit to the git repository. + properties: + authorEmail: + description: AuthorEmail gives the email to provide when making + a commit + type: string + authorName: + description: AuthorName gives the name to provide when making + a commit + type: string + messageTemplate: + description: MessageTemplate provides a template for the commit + message, into which will be interpolated the details of the + change made. + type: string + signingKey: + description: SigningKey provides the option to sign commits with + a GPG key + properties: + secretRef: + description: SecretRef holds the name to a secret that contains + a 'git.asc' key corresponding to the ASCII Armored file + containing the GPG signing keypair as the value. It must + be in the same namespace as the ImageUpdateAutomation. + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + type: object + required: + - authorEmail + - authorName + type: object + interval: + description: Interval gives an lower bound for how often the automation + run should be attempted. + type: string + push: + description: Push specifies how and where to push commits made by + the automation. If missing, commits are pushed (back) to `.spec.checkout.branch`. + properties: + branch: + description: Branch specifies that commits should be pushed to + the branch named. The branch is created using `.spec.checkout.branch` + as the starting point, if it doesn't already exist. + type: string + required: + - branch + type: object + suspend: + description: Suspend tells the controller to not run this automation, + until it is unset (or set to false). Defaults to false. + type: boolean + update: + default: + strategy: Setters + description: Update gives the specification for how to update the + files in the repository. This can be left empty, to use the default + value. + properties: + path: + description: Path to the directory containing the manifests to + be updated. Defaults to 'None', which translates to the root + path of the GitRepositoryRef. + type: string + strategy: + default: Setters + description: Strategy names the strategy to be used. + enum: + - Setters + type: string + required: + - strategy + type: object + required: + - checkout + - commit + - interval + type: object + status: + description: ImageUpdateAutomationStatus defines the observed state of + ImageUpdateAutomation + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + type FooStatus struct{ // Represents the observations of a + foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + \ // +patchStrategy=merge // +listType=map // +listMapKey=type + \ Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastAutomationRunTime: + description: LastAutomationRunTime records the last time the controller + ran this automation through to completion (even if no updates were + made). + format: date-time + type: string + lastHandledReconcileAt: + description: LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change can be detected. + type: string + lastPushCommit: + description: LastPushCommit records the SHA1 of the last commit made + by the controller, for this automation object + type: string + lastPushTime: + description: LastPushTime records the time of the last pushed change. + format: date-time + type: string + observedGeneration: + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.lastAutomationRunTime + name: Last run + type: string + name: v1alpha2 + schema: + openAPIV3Schema: + description: ImageUpdateAutomation is the Schema for the imageupdateautomations + API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ImageUpdateAutomationSpec defines the desired state of ImageUpdateAutomation + properties: + git: + description: GitSpec contains all the git-specific definitions. This + is technically optional, but in practice mandatory until there are + other kinds of source allowed. + properties: + checkout: + description: Checkout gives the parameters for cloning the git + repository, ready to make changes. If not present, the `spec.ref` + field from the referenced `GitRepository` or its default will + be used. + properties: + ref: + description: Reference gives a branch, tag or commit to clone + from the Git repository. + properties: + branch: + description: The Git branch to checkout, defaults to master. + type: string + commit: + description: The Git commit SHA to checkout, if specified + Tag filters will be ignored. + type: string + semver: + description: The Git tag semver expression, takes precedence + over Tag. + type: string + tag: + description: The Git tag to checkout, takes precedence + over Branch. + type: string + type: object + required: + - ref + type: object + commit: + description: Commit specifies how to commit to the git repository. + properties: + author: + description: Author gives the email and optionally the name + to use as the author of commits. + properties: + email: + description: Email gives the email to provide when making + a commit. + type: string + name: + description: Name gives the name to provide when making + a commit. + type: string + required: + - email + type: object + messageTemplate: + description: MessageTemplate provides a template for the commit + message, into which will be interpolated the details of + the change made. + type: string + signingKey: + description: SigningKey provides the option to sign commits + with a GPG key + properties: + secretRef: + description: SecretRef holds the name to a secret that + contains a 'git.asc' key corresponding to the ASCII + Armored file containing the GPG signing keypair as the + value. It must be in the same namespace as the ImageUpdateAutomation. + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + type: object + required: + - author + type: object + push: + description: Push specifies how and where to push commits made + by the automation. If missing, commits are pushed (back) to + `.spec.checkout.branch` or its default. + properties: + branch: + description: Branch specifies that commits should be pushed + to the branch named. The branch is created using `.spec.checkout.branch` + as the starting point, if it doesn't already exist. + type: string + required: + - branch + type: object + required: + - commit + type: object + interval: + description: Interval gives an lower bound for how often the automation + run should be attempted. + type: string + sourceRef: + description: SourceRef refers to the resource giving access details + to a git repository. + properties: + apiVersion: + description: API version of the referent + type: string + kind: + default: GitRepository + description: Kind of the referent + enum: + - GitRepository + type: string + name: + description: Name of the referent + type: string + required: + - kind + - name + type: object + suspend: + description: Suspend tells the controller to not run this automation, + until it is unset (or set to false). Defaults to false. + type: boolean + update: + default: + strategy: Setters + description: Update gives the specification for how to update the + files in the repository. This can be left empty, to use the default + value. + properties: + path: + description: Path to the directory containing the manifests to + be updated. Defaults to 'None', which translates to the root + path of the GitRepositoryRef. + type: string + strategy: + default: Setters + description: Strategy names the strategy to be used. + enum: + - Setters + type: string + required: + - strategy + type: object + required: + - interval + - sourceRef + type: object + status: + description: ImageUpdateAutomationStatus defines the observed state of + ImageUpdateAutomation + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + type FooStatus struct{ // Represents the observations of a + foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + \ // +patchStrategy=merge // +listType=map // +listMapKey=type + \ Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastAutomationRunTime: + description: LastAutomationRunTime records the last time the controller + ran this automation through to completion (even if no updates were + made). + format: date-time + type: string + lastHandledReconcileAt: + description: LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change can be detected. + type: string + lastPushCommit: + description: LastPushCommit records the SHA1 of the last commit made + by the controller, for this automation object + type: string + lastPushTime: + description: LastPushTime records the time of the last pushed change. + format: date-time + type: string + observedGeneration: + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.lastAutomationRunTime + name: Last run + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: ImageUpdateAutomation is the Schema for the imageupdateautomations + API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ImageUpdateAutomationSpec defines the desired state of ImageUpdateAutomation + properties: + git: + description: GitSpec contains all the git-specific definitions. This + is technically optional, but in practice mandatory until there are + other kinds of source allowed. + properties: + checkout: + description: Checkout gives the parameters for cloning the git + repository, ready to make changes. If not present, the `spec.ref` + field from the referenced `GitRepository` or its default will + be used. + properties: + ref: + description: Reference gives a branch, tag or commit to clone + from the Git repository. + properties: + branch: + description: The Git branch to checkout, defaults to master. + type: string + commit: + description: The Git commit SHA to checkout, if specified + Tag filters will be ignored. + type: string + semver: + description: The Git tag semver expression, takes precedence + over Tag. + type: string + tag: + description: The Git tag to checkout, takes precedence + over Branch. + type: string + type: object + required: + - ref + type: object + commit: + description: Commit specifies how to commit to the git repository. + properties: + author: + description: Author gives the email and optionally the name + to use as the author of commits. + properties: + email: + description: Email gives the email to provide when making + a commit. + type: string + name: + description: Name gives the name to provide when making + a commit. + type: string + required: + - email + type: object + messageTemplate: + description: MessageTemplate provides a template for the commit + message, into which will be interpolated the details of + the change made. + type: string + signingKey: + description: SigningKey provides the option to sign commits + with a GPG key + properties: + secretRef: + description: SecretRef holds the name to a secret that + contains a 'git.asc' key corresponding to the ASCII + Armored file containing the GPG signing keypair as the + value. It must be in the same namespace as the ImageUpdateAutomation. + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + type: object + required: + - author + type: object + push: + description: Push specifies how and where to push commits made + by the automation. If missing, commits are pushed (back) to + `.spec.checkout.branch` or its default. + properties: + branch: + description: Branch specifies that commits should be pushed + to the branch named. The branch is created using `.spec.checkout.branch` + as the starting point, if it doesn't already exist. + type: string + required: + - branch + type: object + required: + - commit + type: object + interval: + description: Interval gives an lower bound for how often the automation + run should be attempted. + type: string + sourceRef: + description: SourceRef refers to the resource giving access details + to a git repository. + properties: + apiVersion: + description: API version of the referent + type: string + kind: + default: GitRepository + description: Kind of the referent + enum: + - GitRepository + type: string + name: + description: Name of the referent + type: string + required: + - kind + - name + type: object + suspend: + description: Suspend tells the controller to not run this automation, + until it is unset (or set to false). Defaults to false. + type: boolean + update: + default: + strategy: Setters + description: Update gives the specification for how to update the + files in the repository. This can be left empty, to use the default + value. + properties: + path: + description: Path to the directory containing the manifests to + be updated. Defaults to 'None', which translates to the root + path of the GitRepositoryRef. + type: string + strategy: + default: Setters + description: Strategy names the strategy to be used. + enum: + - Setters + type: string + required: + - strategy + type: object + required: + - interval + - sourceRef + type: object + status: + description: ImageUpdateAutomationStatus defines the observed state of + ImageUpdateAutomation + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + type FooStatus struct{ // Represents the observations of a + foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + \ // +patchStrategy=merge // +listType=map // +listMapKey=type + \ Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastAutomationRunTime: + description: LastAutomationRunTime records the last time the controller + ran this automation through to completion (even if no updates were + made). + format: date-time + type: string + lastHandledReconcileAt: + description: LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change can be detected. + type: string + lastPushCommit: + description: LastPushCommit records the SHA1 of the last commit made + by the controller, for this automation object + type: string + lastPushTime: + description: LastPushTime records the time of the last pushed change. + format: date-time + type: string + observedGeneration: + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.5.0 + creationTimestamp: null + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: kustomizations.kustomize.toolkit.fluxcd.io +spec: + group: kustomize.toolkit.fluxcd.io + names: + kind: Kustomization + listKind: KustomizationList + plural: kustomizations + shortNames: + - ks + singular: kustomization + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: Kustomization is the Schema for the kustomizations API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: KustomizationSpec defines the desired state of a kustomization. + properties: + decryption: + description: Decrypt Kubernetes secrets before applying them on the + cluster. + properties: + provider: + description: Provider is the name of the decryption engine. + enum: + - sops + type: string + secretRef: + description: The secret name containing the private OpenPGP keys + used for decryption. + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + required: + - provider + type: object + dependsOn: + description: DependsOn may contain a dependency.CrossNamespaceDependencyReference + slice with references to Kustomization resources that must be ready + before this Kustomization can be reconciled. + items: + description: CrossNamespaceDependencyReference holds the reference + to a dependency. + properties: + name: + description: Name holds the name reference of a dependency. + type: string + namespace: + description: Namespace holds the namespace reference of a dependency. + type: string + required: + - name + type: object + type: array + force: + default: false + description: Force instructs the controller to recreate resources + when patching fails due to an immutable field change. + type: boolean + healthChecks: + description: A list of resources to be included in the health assessment. + items: + description: NamespacedObjectKindReference contains enough information + to let you locate the typed referenced object in any namespace + properties: + apiVersion: + description: API version of the referent, if not specified the + Kubernetes preferred version will be used + type: string + kind: + description: Kind of the referent + type: string + name: + description: Name of the referent + type: string + namespace: + description: Namespace of the referent, when not specified it + acts as LocalObjectReference + type: string + required: + - kind + - name + type: object + type: array + images: + description: Images is a list of (image name, new name, new tag or + digest) for changing image names, tags or digests. This can also + be achieved with a patch, but this operator is simpler to specify. + items: + description: Image contains an image name, a new name, a new tag + or digest, which will replace the original name and tag. + properties: + digest: + description: Digest is the value used to replace the original + image tag. If digest is present NewTag value is ignored. + type: string + name: + description: Name is a tag-less image name. + type: string + newName: + description: NewName is the value used to replace the original + name. + type: string + newTag: + description: NewTag is the value used to replace the original + tag. + type: string + required: + - name + type: object + type: array + interval: + description: The interval at which to reconcile the Kustomization. + type: string + kubeConfig: + description: The KubeConfig for reconciling the Kustomization on a + remote cluster. When specified, KubeConfig takes precedence over + ServiceAccountName. + properties: + secretRef: + description: SecretRef holds the name to a secret that contains + a 'value' key with the kubeconfig file as the value. It must + be in the same namespace as the Kustomization. It is recommended + that the kubeconfig is self-contained, and the secret is regularly + updated if credentials such as a cloud-access-token expire. + Cloud specific `cmd-path` auth helpers will not function without + adding binaries and credentials to the Pod that is responsible + for reconciling the Kustomization. + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + type: object + patches: + description: Strategic merge and JSON patches, defined as inline YAML + objects, capable of targeting objects based on kind, label and annotation + selectors. + items: + description: Patch contains an inline StrategicMerge or JSON6902 + patch, and the target the patch should be applied to. + properties: + patch: + description: Patch contains an inline StrategicMerge patch or + an inline JSON6902 patch with an array of operation objects. + type: string + target: + description: Target points to the resources that the patch document + should be applied to. + properties: + annotationSelector: + description: AnnotationSelector is a string that follows + the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: Group is the API group to select resources + from. Together with Version and Kind it is capable of + unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: LabelSelector is a string that follows the + label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: Version of the API Group to select resources + from. Together with Group and Kind it is capable of unambiguously + identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + type: object + type: array + patchesJson6902: + description: JSON 6902 patches, defined as inline YAML objects. + items: + description: JSON6902Patch contains a JSON6902 patch and the target + the patch should be applied to. + properties: + patch: + description: Patch contains the JSON6902 patch document with + an array of operation objects. + items: + description: JSON6902 is a JSON6902 operation object. https://datatracker.ietf.org/doc/html/rfc6902#section-4 + properties: + from: + description: From contains a JSON-pointer value that references + a location within the target document where the operation + is performed. The meaning of the value depends on the + value of Op, and is NOT taken into account by all operations. + type: string + op: + description: Op indicates the operation to perform. Its + value MUST be one of "add", "remove", "replace", "move", + "copy", or "test". https://datatracker.ietf.org/doc/html/rfc6902#section-4 + enum: + - test + - remove + - add + - replace + - move + - copy + type: string + path: + description: Path contains the JSON-pointer value that + references a location within the target document where + the operation is performed. The meaning of the value + depends on the value of Op. + type: string + value: + description: Value contains a valid JSON structure. The + meaning of the value depends on the value of Op, and + is NOT taken into account by all operations. + x-kubernetes-preserve-unknown-fields: true + required: + - op + - path + type: object + type: array + target: + description: Target points to the resources that the patch document + should be applied to. + properties: + annotationSelector: + description: AnnotationSelector is a string that follows + the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: Group is the API group to select resources + from. Together with Version and Kind it is capable of + unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: LabelSelector is a string that follows the + label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: Version of the API Group to select resources + from. Together with Group and Kind it is capable of unambiguously + identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + - target + type: object + type: array + patchesStrategicMerge: + description: Strategic merge patches, defined as inline YAML objects. + items: + x-kubernetes-preserve-unknown-fields: true + type: array + path: + description: Path to the directory containing the kustomization.yaml + file, or the set of plain YAMLs a kustomization.yaml should be generated + for. Defaults to 'None', which translates to the root path of the + SourceRef. + type: string + postBuild: + description: PostBuild describes which actions to perform on the YAML + manifest generated by building the kustomize overlay. + properties: + substitute: + additionalProperties: + type: string + description: Substitute holds a map of key/value pairs. The variables + defined in your YAML manifests that match any of the keys defined + in the map will be substituted with the set value. Includes + support for bash string replacement functions e.g. ${var:=default}, + ${var:position} and ${var/substring/replacement}. + type: object + substituteFrom: + description: SubstituteFrom holds references to ConfigMaps and + Secrets containing the variables and their values to be substituted + in the YAML manifests. The ConfigMap and the Secret data keys + represent the var names and they must match the vars declared + in the manifests for the substitution to happen. + items: + description: SubstituteReference contains a reference to a resource + containing the variables name and value. + properties: + kind: + description: Kind of the values referent, valid values are + ('Secret', 'ConfigMap'). + enum: + - Secret + - ConfigMap + type: string + name: + description: Name of the values referent. Should reside + in the same namespace as the referring resource. + maxLength: 253 + minLength: 1 + type: string + required: + - kind + - name + type: object + type: array + type: object + prune: + description: Prune enables garbage collection. + type: boolean + retryInterval: + description: The interval at which to retry a previously failed reconciliation. + When not specified, the controller uses the KustomizationSpec.Interval + value to retry failures. + type: string + serviceAccountName: + description: The name of the Kubernetes service account to impersonate + when reconciling this Kustomization. + type: string + sourceRef: + description: Reference of the source where the kustomization file + is. + properties: + apiVersion: + description: API version of the referent + type: string + kind: + description: Kind of the referent + enum: + - GitRepository + - Bucket + type: string + name: + description: Name of the referent + type: string + namespace: + description: Namespace of the referent, defaults to the Kustomization + namespace + type: string + required: + - kind + - name + type: object + suspend: + description: This flag tells the controller to suspend subsequent + kustomize executions, it does not apply to already started executions. + Defaults to false. + type: boolean + targetNamespace: + description: TargetNamespace sets or overrides the namespace in the + kustomization.yaml file. + maxLength: 63 + minLength: 1 + type: string + timeout: + description: Timeout for validation, apply and health checking operations. + Defaults to 'Interval' duration. + type: string + validation: + description: Validate the Kubernetes objects before applying them + on the cluster. The validation strategy can be 'client' (local dry-run), + 'server' (APIServer dry-run) or 'none'. When 'Force' is 'true', + validation will fallback to 'client' if set to 'server' because + server-side validation is not supported in this scenario. + enum: + - none + - client + - server + type: string + required: + - interval + - prune + - sourceRef + type: object + status: + default: + observedGeneration: -1 + description: KustomizationStatus defines the observed state of a kustomization. + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + type FooStatus struct{ // Represents the observations of a + foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + \ // +patchStrategy=merge // +listType=map // +listMapKey=type + \ Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastAppliedRevision: + description: The last successfully applied revision. The revision + format for Git sources is /. + type: string + lastAttemptedRevision: + description: LastAttemptedRevision is the revision of the last reconciliation + attempt. + type: string + lastHandledReconcileAt: + description: LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last reconciled generation. + format: int64 + type: integer + snapshot: + description: The last successfully applied revision metadata. + properties: + checksum: + description: The manifests sha1 checksum. + type: string + entries: + description: A list of Kubernetes kinds grouped by namespace. + items: + description: Snapshot holds the metadata of namespaced Kubernetes + objects + properties: + kinds: + additionalProperties: + type: string + description: The list of Kubernetes kinds. + type: object + namespace: + description: The namespace of this entry. + type: string + required: + - kinds + type: object + type: array + required: + - checksum + - entries + type: object + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta2 + schema: + openAPIV3Schema: + description: Kustomization is the Schema for the kustomizations API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: KustomizationSpec defines the configuration to calculate + the desired state from a Source using Kustomize. + properties: + decryption: + description: Decrypt Kubernetes secrets before applying them on the + cluster. + properties: + provider: + description: Provider is the name of the decryption engine. + enum: + - sops + type: string + secretRef: + description: The secret name containing the private OpenPGP keys + used for decryption. + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + required: + - provider + type: object + dependsOn: + description: DependsOn may contain a dependency.CrossNamespaceDependencyReference + slice with references to Kustomization resources that must be ready + before this Kustomization can be reconciled. + items: + description: CrossNamespaceDependencyReference holds the reference + to a dependency. + properties: + name: + description: Name holds the name reference of a dependency. + type: string + namespace: + description: Namespace holds the namespace reference of a dependency. + type: string + required: + - name + type: object + type: array + force: + default: false + description: Force instructs the controller to recreate resources + when patching fails due to an immutable field change. + type: boolean + healthChecks: + description: A list of resources to be included in the health assessment. + items: + description: NamespacedObjectKindReference contains enough information + to let you locate the typed referenced object in any namespace + properties: + apiVersion: + description: API version of the referent, if not specified the + Kubernetes preferred version will be used + type: string + kind: + description: Kind of the referent + type: string + name: + description: Name of the referent + type: string + namespace: + description: Namespace of the referent, when not specified it + acts as LocalObjectReference + type: string + required: + - kind + - name + type: object + type: array + images: + description: Images is a list of (image name, new name, new tag or + digest) for changing image names, tags or digests. This can also + be achieved with a patch, but this operator is simpler to specify. + items: + description: Image contains an image name, a new name, a new tag + or digest, which will replace the original name and tag. + properties: + digest: + description: Digest is the value used to replace the original + image tag. If digest is present NewTag value is ignored. + type: string + name: + description: Name is a tag-less image name. + type: string + newName: + description: NewName is the value used to replace the original + name. + type: string + newTag: + description: NewTag is the value used to replace the original + tag. + type: string + required: + - name + type: object + type: array + interval: + description: The interval at which to reconcile the Kustomization. + type: string + kubeConfig: + description: The KubeConfig for reconciling the Kustomization on a + remote cluster. When specified, KubeConfig takes precedence over + ServiceAccountName. + properties: + secretRef: + description: SecretRef holds the name to a secret that contains + a 'value' key with the kubeconfig file as the value. It must + be in the same namespace as the Kustomization. It is recommended + that the kubeconfig is self-contained, and the secret is regularly + updated if credentials such as a cloud-access-token expire. + Cloud specific `cmd-path` auth helpers will not function without + adding binaries and credentials to the Pod that is responsible + for reconciling the Kustomization. + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + type: object + patches: + description: Strategic merge and JSON patches, defined as inline YAML + objects, capable of targeting objects based on kind, label and annotation + selectors. + items: + description: Patch contains an inline StrategicMerge or JSON6902 + patch, and the target the patch should be applied to. + properties: + patch: + description: Patch contains an inline StrategicMerge patch or + an inline JSON6902 patch with an array of operation objects. + type: string + target: + description: Target points to the resources that the patch document + should be applied to. + properties: + annotationSelector: + description: AnnotationSelector is a string that follows + the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: Group is the API group to select resources + from. Together with Version and Kind it is capable of + unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: LabelSelector is a string that follows the + label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: Version of the API Group to select resources + from. Together with Group and Kind it is capable of unambiguously + identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + type: object + type: array + patchesJson6902: + description: 'JSON 6902 patches, defined as inline YAML objects. Deprecated: + Use Patches instead.' + items: + description: JSON6902Patch contains a JSON6902 patch and the target + the patch should be applied to. + properties: + patch: + description: Patch contains the JSON6902 patch document with + an array of operation objects. + items: + description: JSON6902 is a JSON6902 operation object. https://datatracker.ietf.org/doc/html/rfc6902#section-4 + properties: + from: + description: From contains a JSON-pointer value that references + a location within the target document where the operation + is performed. The meaning of the value depends on the + value of Op, and is NOT taken into account by all operations. + type: string + op: + description: Op indicates the operation to perform. Its + value MUST be one of "add", "remove", "replace", "move", + "copy", or "test". https://datatracker.ietf.org/doc/html/rfc6902#section-4 + enum: + - test + - remove + - add + - replace + - move + - copy + type: string + path: + description: Path contains the JSON-pointer value that + references a location within the target document where + the operation is performed. The meaning of the value + depends on the value of Op. + type: string + value: + description: Value contains a valid JSON structure. The + meaning of the value depends on the value of Op, and + is NOT taken into account by all operations. + x-kubernetes-preserve-unknown-fields: true + required: + - op + - path + type: object + type: array + target: + description: Target points to the resources that the patch document + should be applied to. + properties: + annotationSelector: + description: AnnotationSelector is a string that follows + the label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: Group is the API group to select resources + from. Together with Version and Kind it is capable of + unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: LabelSelector is a string that follows the + label selection expression https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: Version of the API Group to select resources + from. Together with Group and Kind it is capable of unambiguously + identifying and/or selecting resources. https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + - target + type: object + type: array + patchesStrategicMerge: + description: 'Strategic merge patches, defined as inline YAML objects. + Deprecated: Use Patches instead.' + items: + x-kubernetes-preserve-unknown-fields: true + type: array + path: + description: Path to the directory containing the kustomization.yaml + file, or the set of plain YAMLs a kustomization.yaml should be generated + for. Defaults to 'None', which translates to the root path of the + SourceRef. + type: string + postBuild: + description: PostBuild describes which actions to perform on the YAML + manifest generated by building the kustomize overlay. + properties: + substitute: + additionalProperties: + type: string + description: Substitute holds a map of key/value pairs. The variables + defined in your YAML manifests that match any of the keys defined + in the map will be substituted with the set value. Includes + support for bash string replacement functions e.g. ${var:=default}, + ${var:position} and ${var/substring/replacement}. + type: object + substituteFrom: + description: SubstituteFrom holds references to ConfigMaps and + Secrets containing the variables and their values to be substituted + in the YAML manifests. The ConfigMap and the Secret data keys + represent the var names and they must match the vars declared + in the manifests for the substitution to happen. + items: + description: SubstituteReference contains a reference to a resource + containing the variables name and value. + properties: + kind: + description: Kind of the values referent, valid values are + ('Secret', 'ConfigMap'). + enum: + - Secret + - ConfigMap + type: string + name: + description: Name of the values referent. Should reside + in the same namespace as the referring resource. + maxLength: 253 + minLength: 1 + type: string + required: + - kind + - name + type: object + type: array + type: object + prune: + description: Prune enables garbage collection. + type: boolean + retryInterval: + description: The interval at which to retry a previously failed reconciliation. + When not specified, the controller uses the KustomizationSpec.Interval + value to retry failures. + type: string + serviceAccountName: + description: The name of the Kubernetes service account to impersonate + when reconciling this Kustomization. + type: string + sourceRef: + description: Reference of the source where the kustomization file + is. + properties: + apiVersion: + description: API version of the referent. + type: string + kind: + description: Kind of the referent. + enum: + - GitRepository + - Bucket + type: string + name: + description: Name of the referent. + type: string + namespace: + description: Namespace of the referent, defaults to the namespace + of the Kubernetes resource object that contains the reference. + type: string + required: + - kind + - name + type: object + suspend: + description: This flag tells the controller to suspend subsequent + kustomize executions, it does not apply to already started executions. + Defaults to false. + type: boolean + targetNamespace: + description: TargetNamespace sets or overrides the namespace in the + kustomization.yaml file. + maxLength: 63 + minLength: 1 + type: string + timeout: + description: Timeout for validation, apply and health checking operations. + Defaults to 'Interval' duration. + type: string + validation: + description: 'Deprecated: Not used in v1beta2.' + enum: + - none + - client + - server + type: string + wait: + description: Wait instructs the controller to check the health of + all the reconciled resources. When enabled, the HealthChecks are + ignored. Defaults to false. + type: boolean + required: + - interval + - prune + - sourceRef + type: object + status: + default: + observedGeneration: -1 + description: KustomizationStatus defines the observed state of a kustomization. + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + type FooStatus struct{ // Represents the observations of a + foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + \ // +patchStrategy=merge // +listType=map // +listMapKey=type + \ Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + inventory: + description: Inventory contains the list of Kubernetes resource object + references that have been successfully applied. + properties: + entries: + description: Entries of Kubernetes resource object references. + items: + description: ResourceRef contains the information necessary + to locate a resource within a cluster. + properties: + id: + description: ID is the string representation of the Kubernetes + resource object's metadata, in the format '___'. + type: string + v: + description: Version is the API version of the Kubernetes + resource object's kind. + type: string + required: + - id + - v + type: object + type: array + required: + - entries + type: object + lastAppliedRevision: + description: The last successfully applied revision. The revision + format for Git sources is /. + type: string + lastAttemptedRevision: + description: LastAttemptedRevision is the revision of the last reconciliation + attempt. + type: string + lastHandledReconcileAt: + description: LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last reconciled generation. + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.5.0 + creationTimestamp: null + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: providers.notification.toolkit.fluxcd.io +spec: + group: notification.toolkit.fluxcd.io + names: + kind: Provider + listKind: ProviderList + plural: providers + singular: provider + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: Provider is the Schema for the providers API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ProviderSpec defines the desired state of Provider + properties: + address: + description: HTTP/S webhook address of this provider + pattern: ^(http|https):// + type: string + certSecretRef: + description: CertSecretRef can be given the name of a secret containing + a PEM-encoded CA certificate (`caFile`) + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + channel: + description: Alert channel for this provider + type: string + proxy: + description: HTTP/S address of the proxy + pattern: ^(http|https):// + type: string + secretRef: + description: Secret reference containing the provider webhook URL + using "address" as data key + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + suspend: + description: This flag tells the controller to suspend subsequent + events handling. Defaults to false. + type: boolean + type: + description: Type of provider + enum: + - slack + - discord + - msteams + - rocket + - generic + - github + - gitlab + - bitbucket + - azuredevops + - googlechat + - webex + - sentry + - azureeventhub + - telegram + - lark + - matrix + - opsgenie + - alertmanager + type: string + username: + description: Bot username for this provider + type: string + required: + - type + type: object + status: + default: + observedGeneration: -1 + description: ProviderStatus defines the observed state of Provider + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + type FooStatus struct{ // Represents the observations of a + foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + \ // +patchStrategy=merge // +listType=map // +listMapKey=type + \ Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + observedGeneration: + description: ObservedGeneration is the last reconciled generation. + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.5.0 + creationTimestamp: null + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: receivers.notification.toolkit.fluxcd.io +spec: + group: notification.toolkit.fluxcd.io + names: + kind: Receiver + listKind: ReceiverList + plural: receivers + singular: receiver + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: Receiver is the Schema for the receivers API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ReceiverSpec defines the desired state of Receiver + properties: + events: + description: A list of events to handle, e.g. 'push' for GitHub or + 'Push Hook' for GitLab. + items: + type: string + type: array + resources: + description: A list of resources to be notified about changes. + items: + description: CrossNamespaceObjectReference contains enough information + to let you locate the typed referenced object at cluster level + properties: + apiVersion: + description: API version of the referent + type: string + kind: + description: Kind of the referent + enum: + - Bucket + - GitRepository + - Kustomization + - HelmRelease + - HelmChart + - HelmRepository + - ImageRepository + - ImagePolicy + - ImageUpdateAutomation + type: string + name: + description: Name of the referent + maxLength: 53 + minLength: 1 + type: string + namespace: + description: Namespace of the referent + maxLength: 53 + minLength: 1 + type: string + required: + - name + type: object + type: array + secretRef: + description: Secret reference containing the token used to validate + the payload authenticity + properties: + name: + description: Name of the referent + type: string + required: + - name + type: object + suspend: + description: This flag tells the controller to suspend subsequent + events handling. Defaults to false. + type: boolean + type: + description: Type of webhook sender, used to determine the validation + procedure and payload deserialization. + enum: + - generic + - generic-hmac + - github + - gitlab + - bitbucket + - harbor + - dockerhub + - quay + - gcr + - nexus + - acr + type: string + required: + - resources + - type + type: object + status: + default: + observedGeneration: -1 + description: ReceiverStatus defines the observed state of Receiver + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource. --- This struct is intended for direct + use as an array at the field path .status.conditions. For example, + type FooStatus struct{ // Represents the observations of a + foo's current state. // Known .status.conditions.type are: + \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type + \ // +patchStrategy=merge // +listType=map // +listMapKey=type + \ Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` + \n // other fields }" + properties: + lastTransitionTime: + description: lastTransitionTime is the last time the condition + transitioned from one status to another. This should be when + the underlying condition changed. If that is not known, then + using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: message is a human readable message indicating + details about the transition. This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: observedGeneration represents the .metadata.generation + that the condition was set based upon. For instance, if .metadata.generation + is currently 12, but the .status.conditions[x].observedGeneration + is 9, the condition is out of date with respect to the current + state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: reason contains a programmatic identifier indicating + the reason for the condition's last transition. Producers + of specific condition types may define expected values and + meanings for this field, and whether the values are considered + a guaranteed API. The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + --- Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + url: + description: Generated webhook URL in the format of '/hook/sha256sum(token+name+namespace)'. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: helm-controller + namespace: flux-system +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: image-automation-controller + namespace: flux-system +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: image-reflector-controller + namespace: flux-system +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: kustomize-controller + namespace: flux-system +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: notification-controller + namespace: flux-system +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: source-controller + namespace: flux-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: crd-controller-flux-system +rules: +- apiGroups: + - source.toolkit.fluxcd.io + resources: + - '*' + verbs: + - '*' +- apiGroups: + - kustomize.toolkit.fluxcd.io + resources: + - '*' + verbs: + - '*' +- apiGroups: + - helm.toolkit.fluxcd.io + resources: + - '*' + verbs: + - '*' +- apiGroups: + - notification.toolkit.fluxcd.io + resources: + - '*' + verbs: + - '*' +- apiGroups: + - image.toolkit.fluxcd.io + resources: + - '*' + verbs: + - '*' +- apiGroups: + - "" + resources: + - namespaces + - secrets + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +- apiGroups: + - "" + resources: + - configmaps + - configmaps/status + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: cluster-reconciler-flux-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: +- kind: ServiceAccount + name: kustomize-controller + namespace: flux-system +- kind: ServiceAccount + name: helm-controller + namespace: flux-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: crd-controller-flux-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: crd-controller-flux-system +subjects: +- kind: ServiceAccount + name: kustomize-controller + namespace: flux-system +- kind: ServiceAccount + name: helm-controller + namespace: flux-system +- kind: ServiceAccount + name: source-controller + namespace: flux-system +- kind: ServiceAccount + name: notification-controller + namespace: flux-system +- kind: ServiceAccount + name: image-reflector-controller + namespace: flux-system +- kind: ServiceAccount + name: image-automation-controller + namespace: flux-system +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + control-plane: controller + name: notification-controller + namespace: flux-system +spec: + ports: + - name: http + port: 80 + protocol: TCP + targetPort: http + selector: + app: notification-controller + type: ClusterIP +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + control-plane: controller + name: source-controller + namespace: flux-system +spec: + ports: + - name: http + port: 80 + protocol: TCP + targetPort: http + selector: + app: source-controller + type: ClusterIP +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + control-plane: controller + name: webhook-receiver + namespace: flux-system +spec: + ports: + - name: http + port: 80 + protocol: TCP + targetPort: http-webhook + selector: + app: notification-controller + type: ClusterIP +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + control-plane: controller + name: helm-controller + namespace: flux-system +spec: + replicas: 1 + selector: + matchLabels: + app: helm-controller + template: + metadata: + annotations: + prometheus.io/port: "8080" + prometheus.io/scrape: "true" + labels: + app: helm-controller + spec: + containers: + - args: + - --events-addr=http://notification-controller.flux-system.svc.cluster.local/ + - --watch-all-namespaces=true + - --log-level=info + - --log-encoding=json + - --enable-leader-election + env: + - name: RUNTIME_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: ghcr.io/fluxcd/helm-controller:v0.14.1 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 8080 + name: http-prom + - containerPort: 9440 + name: healthz + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + resources: + limits: + cpu: 1000m + memory: 1Gi + requests: + cpu: 100m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /tmp + name: temp + nodeSelector: + kubernetes.io/os: linux + serviceAccountName: helm-controller + terminationGracePeriodSeconds: 600 + volumes: + - emptyDir: {} + name: temp +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + control-plane: controller + name: image-automation-controller + namespace: flux-system +spec: + replicas: 1 + selector: + matchLabels: + app: image-automation-controller + template: + metadata: + annotations: + prometheus.io/port: "8080" + prometheus.io/scrape: "true" + labels: + app: image-automation-controller + spec: + containers: + - args: + - --events-addr=http://notification-controller.flux-system.svc.cluster.local/ + - --watch-all-namespaces=true + - --log-level=info + - --log-encoding=json + - --enable-leader-election + env: + - name: RUNTIME_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: ghcr.io/fluxcd/image-automation-controller:v0.18.0 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 8080 + name: http-prom + - containerPort: 9440 + name: healthz + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + resources: + limits: + cpu: 1000m + memory: 1Gi + requests: + cpu: 100m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /tmp + name: temp + nodeSelector: + kubernetes.io/os: linux + securityContext: + fsGroup: 1337 + serviceAccountName: image-automation-controller + terminationGracePeriodSeconds: 10 + volumes: + - emptyDir: {} + name: temp +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + control-plane: controller + name: image-reflector-controller + namespace: flux-system +spec: + replicas: 1 + selector: + matchLabels: + app: image-reflector-controller + template: + metadata: + annotations: + prometheus.io/port: "8080" + prometheus.io/scrape: "true" + labels: + app: image-reflector-controller + spec: + containers: + - args: + - --events-addr=http://notification-controller.flux-system.svc.cluster.local/ + - --watch-all-namespaces=true + - --log-level=info + - --log-encoding=json + - --enable-leader-election + env: + - name: RUNTIME_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: ghcr.io/fluxcd/image-reflector-controller:v0.14.0 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 8080 + name: http-prom + - containerPort: 9440 + name: healthz + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + resources: + limits: + cpu: 1000m + memory: 1Gi + requests: + cpu: 100m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /tmp + name: temp + - mountPath: /data + name: data + nodeSelector: + kubernetes.io/os: linux + securityContext: + fsGroup: 1337 + serviceAccountName: image-reflector-controller + terminationGracePeriodSeconds: 10 + volumes: + - emptyDir: {} + name: temp + - emptyDir: {} + name: data +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + control-plane: controller + name: kustomize-controller + namespace: flux-system +spec: + replicas: 1 + selector: + matchLabels: + app: kustomize-controller + template: + metadata: + annotations: + prometheus.io/port: "8080" + prometheus.io/scrape: "true" + labels: + app: kustomize-controller + spec: + containers: + - args: + - --events-addr=http://notification-controller.flux-system.svc.cluster.local/ + - --watch-all-namespaces=true + - --log-level=info + - --log-encoding=json + - --enable-leader-election + env: + - name: RUNTIME_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: ghcr.io/fluxcd/kustomize-controller:v0.18.2 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 8080 + name: http-prom + - containerPort: 9440 + name: healthz + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + resources: + limits: + cpu: 1000m + memory: 1Gi + requests: + cpu: 100m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /tmp + name: temp + nodeSelector: + kubernetes.io/os: linux + securityContext: + fsGroup: 1337 + serviceAccountName: kustomize-controller + terminationGracePeriodSeconds: 60 + volumes: + - emptyDir: {} + name: temp +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + control-plane: controller + name: notification-controller + namespace: flux-system +spec: + replicas: 1 + selector: + matchLabels: + app: notification-controller + template: + metadata: + annotations: + prometheus.io/port: "8080" + prometheus.io/scrape: "true" + labels: + app: notification-controller + spec: + containers: + - args: + - --watch-all-namespaces=true + - --log-level=info + - --log-encoding=json + - --enable-leader-election + env: + - name: RUNTIME_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: ghcr.io/fluxcd/notification-controller:v0.19.0 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 9090 + name: http + - containerPort: 9292 + name: http-webhook + - containerPort: 8080 + name: http-prom + - containerPort: 9440 + name: healthz + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + resources: + limits: + cpu: 1000m + memory: 1Gi + requests: + cpu: 100m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /tmp + name: temp + nodeSelector: + kubernetes.io/os: linux + serviceAccountName: notification-controller + terminationGracePeriodSeconds: 10 + volumes: + - emptyDir: {} + name: temp +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + control-plane: controller + name: source-controller + namespace: flux-system +spec: + replicas: 1 + selector: + matchLabels: + app: source-controller + strategy: + type: Recreate + template: + metadata: + annotations: + prometheus.io/port: "8080" + prometheus.io/scrape: "true" + labels: + app: source-controller + spec: + containers: + - args: + - --events-addr=http://notification-controller.flux-system.svc.cluster.local/ + - --watch-all-namespaces=true + - --log-level=info + - --log-encoding=json + - --enable-leader-election + - --storage-path=/data + - --storage-adv-addr=source-controller.$(RUNTIME_NAMESPACE).svc.cluster.local. + env: + - name: RUNTIME_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: ghcr.io/fluxcd/source-controller:v0.19.2 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 9090 + name: http + - containerPort: 8080 + name: http-prom + - containerPort: 9440 + name: healthz + readinessProbe: + httpGet: + path: / + port: http + resources: + limits: + cpu: 1000m + memory: 1Gi + requests: + cpu: 50m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + volumeMounts: + - mountPath: /data + name: data + - mountPath: /tmp + name: tmp + nodeSelector: + kubernetes.io/os: linux + securityContext: + fsGroup: 1337 + serviceAccountName: source-controller + terminationGracePeriodSeconds: 10 + volumes: + - emptyDir: {} + name: data + - emptyDir: {} + name: tmp +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: allow-egress + namespace: flux-system +spec: + egress: + - {} + ingress: + - from: + - podSelector: {} + podSelector: {} + policyTypes: + - Ingress + - Egress +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: allow-scraping + namespace: flux-system +spec: + ingress: + - from: + - namespaceSelector: {} + ports: + - port: 8080 + protocol: TCP + podSelector: {} + policyTypes: + - Ingress +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v0.24.1 + name: allow-webhooks + namespace: flux-system +spec: + ingress: + - from: + - namespaceSelector: {} + podSelector: + matchLabels: + app: notification-controller + policyTypes: + - Ingress diff --git a/flux/clusters/k3d-develop/flux-system/flux-sync.yaml b/flux/clusters/k3d-develop/flux-system/flux-sync.yaml new file mode 100644 index 0000000..ffb5544 --- /dev/null +++ b/flux/clusters/k3d-develop/flux-system/flux-sync.yaml @@ -0,0 +1,37 @@ +--- +apiVersion: source.toolkit.fluxcd.io/v1beta1 +kind: GitRepository +metadata: + name: flux-system + namespace: flux-system +spec: + interval: 1m0s + ref: + branch: add_local_development_env + secretRef: + name: local-git-secret + timeout: 20s + url: ssh://git@local-git.local-git.svc.cluster.local:2222/srv/git/local-flux.git +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1beta2 +kind: Kustomization +metadata: + name: flux-system + namespace: flux-system +spec: + decryption: + provider: sops + secretRef: + name: age-key-secret + interval: 1m0s + path: ./flux/clusters/k3d-develop + prune: true + sourceRef: + kind: GitRepository + name: flux-system + postBuild: + substitute: + eks_cluster_name: "k3d-develop" + aws_account_id: "000000000000" + environment: "local" + zone: "local" diff --git a/flux/clusters/k3d-develop/flux-system/install.sh b/flux/clusters/k3d-develop/flux-system/install.sh new file mode 100755 index 0000000..8bbd5af --- /dev/null +++ b/flux/clusters/k3d-develop/flux-system/install.sh @@ -0,0 +1,15 @@ +#!/bin/bash +export WORKDIR=$(dirname $0) + +cd $WORKDIR + +kubectl apply -n flux-system -f flux-components.yaml +sops exec-file local-git-secret.yaml "kubectl apply -n flux-system -f {}" + +kubectl create secret -n flux-system generic age-key-secret --from-file age.agekey=../../../../local-k8s/keys/age.agekey --dry-run=client -o yaml | kubectl apply -f- + +kubectl apply -n flux-system -f flux-sync.yaml + +flux reconcile source git -n flux-system flux-system + +cd - diff --git a/flux/clusters/k3d-develop/flux-system/kustomization.yaml b/flux/clusters/k3d-develop/flux-system/kustomization.yaml new file mode 100644 index 0000000..646f035 --- /dev/null +++ b/flux/clusters/k3d-develop/flux-system/kustomization.yaml @@ -0,0 +1,11 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +resources: + # we need dedicated 'flux-components.yaml' in each cluster - otherwise a flux-system update in one cluster + # would be populated to all clusters + - flux-components.yaml + - flux-sync.yaml + - local-git-secret.yaml + +namespace: flux-system \ No newline at end of file diff --git a/flux/clusters/k3d-develop/flux-system/local-git-secret.yaml b/flux/clusters/k3d-develop/flux-system/local-git-secret.yaml new file mode 100644 index 0000000..106eb8c --- /dev/null +++ b/flux/clusters/k3d-develop/flux-system/local-git-secret.yaml @@ -0,0 +1,28 @@ +apiVersion: v1 +data: + identity: ENC[AES256_GCM,data:N76T3nVl9SDcJa6J5DG1UWutiG8RslNhWadUEu2oFBiRhGiF7/ycHRrqHbi3jGc3qLiVugT2M5vfQvbcvde8x3Jj1OcmmlvSxXBXLto7GzNXjlehJFcNcIXmSKUeW070ums77rr4Yv0Y11JOkRIE5aa3kFiC+6gXfltDONoAS+CB+MfYBPzg2qQe3NIHUy7ryG413vMNAYclsfyDRKmE2nu35bD9gnedoks6jxU5Dd93Ud8XmeqiaB/bt9KwYgKZlenClUycHY+3y/erJ3EAaFO0n/ADXskfawJYn/KKKTdInJqfxrLqbPK1a7YqKv1q4l4reuAEHthsDdXTBrdrUUx+0L7MmOwx+6EGI/7PiILwqFhOWa8g/Qtt95v4k7eqq+8uFuKrJt/IDkgHYJUAKIM7nxF/uSymKInNdWoOSa8yKoAvQhIxIPP1Hqy+fxDSceBQdYG72b7rViLQaZqThoEqT1EUS7OTWoVblE53lVaZL6X+AwafzZFNq0VnF4ocr5gUfFRVD5/ir6BiuPWW8/yAzcd3NNVNcp2/+cv2LIlZge1mY2ONRNZF0AjVgUO0mWWRdjbrzEVciYMTkECfzMBypJbCAoWcCB1Zd9VP/9+bCUelQHHyy7PYciHzscl5j68N/IOfXpx7CCjbdxxxWEUYkHmtda9L090QDnaOos1e9V7XCHSahdYnMpBvofh7mJ90h5QEThfc2kSZxsD9jTatV8DpbHmGh6U91JlT0rw+UBvH7x5ohPh/ii8lo5sltPvvAbWY2Qcdj4Qyo8eaICxHIjR6NCYFoQ1GJ0bAPFbNONre2yR5TWDs0WMwqA0KP6gsV887+iN0ByybuAXe7NCt+A9MuxbwcDTcDu9pYuZ9lDAn9OZw4Vihj1qBsxcXjzfJDy6sC+oKIn6y2OKhhR0/hHb0Re0fL89PTIRDKxT2n3+B+ljBYOc0LsezZY2X2XfyuOgOOA76C+npdklDRrepSsVOQnnI1otBL9RSyrTBy33QKSbNd2KxnTwT38YfzTcpwP0KHVCiKEz/RTAIRkl3/2PhJxRioOoexFMTaEcNz+HGMoRSk0IGebm1cITNhtfPyuKLDpwDlntjeQFjJqldba73hbl8FH25h17rfZpDhBUMpT7pk5wIZhCPY+gXZnUKvHuD8RO1Eu9aEXOlNxSg/BSEnY32ylXIXI9uORYK3wzxc2Rvh3R/Z/qOK0lM1A1UbnnvKfm/E/TicOdLdFa3twiVE1WW3qghz4uPL6sRv5NRoT+J81+xWsZJ4Yzp8nEtUSbk3tt674Qbh/3wfFYqjHznBf6qRf6eQl0u1rvfUFfyU848MQP4ULRkOjtNw7eYOL+e00PH/1ZLzFi4uqljyfSHW9YQLA1Mhlfl6C8x+W098JQG1W4hq/VZbIH+4sqxY92gIXP/H2N9ytnpYctAHw/uOGHbN+WYjQbZYhsSMN10HjIawmB1Ukw3HVZYfeMQWU1eKsKdNwELxjpwKNd7ftJmZvizQ7d8CEWtIJnH3Gb9LfOfos9hZ2H4cT0FT2IGqsjdS5ijzDhqgUaEC1rcEKYkcsnb17Hkr2UGFWhOh1Q6cPCGbwU8zYYunYozV+rLV6yYq85E98H84thv/42TWG0APniyyismxM+br3sgly6DnvaZMo37w4I/kJdyCC1IXaMs8ooKbW+2LCt+0Va4r4JLh0k8F07gL+nOx3EXGGxKGOCGLn35CPIL2P4eTqP7IkU6vBzGUEceGGafiHTo64qXy89tKrfcRm8BPkvNcYZtnDjuu3MEoRuXRBM/QCqP7c9dYidA4j0CBN0YhgmoNTsWzoqMcUkr8uhcOLpKn+o071AFoQCvRcWcYw1stchC52b/xJz03UzwFgGx7VtOyOsf7KZtpxzzQWkjZTq+VLPx31swlx4Ryk1a0yem+QEH/dHKyqmkuDEzn7pHnbquzd4pkIqsYJErjet2v4ptG67ERXY+5Xs4SWK5aBRPuhknVEJt1fQXbTomXG9Yzw3yF5tef5kLBoWuzPkAYk9a1ebqLBCbxpz4M6notsxXF/vJ3fuXzwrHSff8owBO/LIE76ifuGnOJJ+A1OkjphVe3i5inOEyDWTzsYh9AOsO26qOv3T7IYnCdCkGSpJiBTOKOePpYqw8MC5eQWYMOn7JkRgLq0So1XeX7Ql4roJVoOmbLGhWOMP6zkNzASW/NTDYAGednIYd1iEO3ihxYbUBITYFzf6tC1/RmI4wayvqQcj+kbOx1/P38KqHQ+Rj6op26wmnx8WFejQ6JQt96+paJqKyGYD5F3uL6x6FszhXItXI8v1XqqARuW21pu38JOLgUjXVuCmuEjPrxZlEnoeMB1nJYjf/MN1+5i2528CZC2YB39iBhotpz7dfVOzxa8Qxy92OqhunXrp+78MdZ7I99jZrZP+ygzlIOnNTPebEyhdq73f6vjZe/jy9JkZB6YriurAcrqiMLIfLje/KwF2Raa0EFk/RBH7MGGR9aG7BaFb1Hsxm2ZvcPuBQEU4E2A/zvUsfTK8iwml/UfzA5mmlPvD01F+sp66Rn5mmEbwVGiUitzT2MDYUmhx/p4YeUo1xVyzcnG21FdcJ9UH0bXUuP64ltvZ+i1CvywvUFUnxSEfZ0iieQXItdamtOS0AS8EQUq3bWkripvO/dsFbPLuAvZ+r7K2QMrpBVgugkVtvDwyVr6eKD32j13wT4eLgsff2JlynE8C4CwUOFUWJervkzCLPUbbO7uxMfJ3dqRy29YzrbbrlqMDVdboOSyP4D7oWQnDfdFylwOfgNRwTtX0MIDWFSgwvyY9oZ31VqhDaHbJoZ28440KFH+mV9kSYIZFHlD6oWZS4xQaLiUZcK+KAUxB7ZtsXFH1aaN78DnZhsRyFhhTOluXJ9lZQaSdQ+ZOF7s/+V4/L2axY2Qn7FQyZdaa8UEkVbUlCD4GVYvwWs7AlkZpXdkwJwDWPVvtu/87QIJvVcPgc1viZUfyp9THsMXbOpaGo9dWkAAb0hixkkg98N4QcSzjR8RHS0A+WxaSKrputE+5F6vym2jE0MsbpSpqXXp2wvKdF94++8SUmmZq01MXyi1IDFtGes3ChU18u9JaBMsdsi5uG7qK511dICjIApF4yOx7Kvx5suq2mRR+dKTin9uESU7ZkWztuFIMPeryGmUK2EYoY18pJ7RctzNxrBNsLq5Lu2g86b9/rZ9gFTIdpM5Xj5JPcCnM+GDGSyQQNpRo3E3Ev0KBCVGX0rGuQZxZ3IcS/kc4OJH9nBj7u+LGAxpMJHSGxTfAoVMDuyeC+8Jab8X0wGTT34Kwv7HlE0Ut3EeXizSpFD+9jBBvmwX3jWu/s4z+gW0N4LoDVo1drAgD4Fjitmuq+LYQIBriKN+Da8W3eQRzUKtXYJB+lbPdv/eC1A3pbyI/JsFP6Agi0JhTQAsUeM+jQNZZ6YocqfpKGgPtBUotqfAKSdxJo+LRctmBW0YsthXzT9RcRwKA+RpM2wWclpeMxRH/jUBX64uNlvhmkGMlJlfo6KBa+LzZyfwya6dkaGVXv3CwH/WxfB/OZDhEIw+QWvwLxUaejPdd0n4+X05Sx9BtcTv5cD0rixR5CPPIbdwktcgomfwz1HqhaNGppzeBhjCtcVHk7wzTT/uXykRtAuVdMYR3nZ9kDfXvKDL9KUfPDFlwGJhdemojXxkn2QrzPO/eIKr5EE18nb3P/V5KtTXcFvPB4B4lvTJff36/bm+CXpyv9qC4MFy7g3VgUCa4ZeY4670Y5PTBE7gW8ezjMHsXt+vmaTawFJ87leGMnKfV/woFQelNxTAoL5Q1zbRxdo8cGLHnOTdC4JNO+IayrsTVyhCyx1uNKChBLXMz82fPs023eAgaMv+VNuHl/D0O6O+JwvQ7ix/jzOeWz2ksjGGj2En0l/oq2hIC3DDbM0C1uXjxsS/nhuZ/L3rjaxqZaNotNrZqnBER+dyCIpJnFxdhHuwTBpNhWXDrjRYTwTy/AUVKKncDMzrgehQW/TlAZCVDngAnwdTGWtzTwkkGZ58YDmruo3U6nYjNptrc3pYO+9w99UV/D+91iSA8HjjWRJbfObY73dqtbYJrchK5vaSndruY98IpkrU1etIEiN0j7ZA0+Urbd1S6o+3xjQXwrg2CHnJgUibydJ2UA6rUDFu0UBw7RhplocNtGL6lm8Sstkn/RUSYqfIU26WxOSvb2W+iN/WYurFuR6QG5s9sm5NkYsVkMKVdJ+PAiM2kDGTqKLM6SOd7Xga9U/rD/FGNjQ/xgk7+dpNj69IGS6nUDzMzsH6Ruz94GtAALN8KbOImIglxru5t4G2D61OUd2LPGbPQbecY8TPQfuUjua5uIV3x2+ET4QhnxzuvkO4mjidGfRAtuX+Wb8GAmjyqENM4ytQHwZqVv8aA/YIpULAndCpk5UmGWnHr1wNKslwd+JwIJlOdlb+4FVwPoIXOWHR14BV7fObdAB7A8Tw6tuzZGv+POr7ngMSuVJSlEUVU8V7n9xTSi3QWnV3BA+OluWn67Do1nvl3C0sgdGCNsENLj9hAy1/uigiPF9isXMGO8/TehfsgQBJaPPt9bdHN4C7laD9NuiCGdXWMsIN6mbgxl53vodBsfb3KW7I9gthjk+n8qSQ==,iv:LveWuvKKB2aGyYnSCyGi8eQTgCS4KQnC7ikKbMBgtcA=,tag:Iuf7weGuGmoZIWQbRQp41A==,type:str] + identity.pub: ENC[AES256_GCM,data:O8z9eT/y9ZP5SAEzma6bWHJ7+9NCzr3g0slfEAHXJHqrzZzYZuiFyXVtJ2V+P25f9noB2fgwI0YdY4mYRP0iaJIhxLRtwmCpBcntzTsiI29INq1i/uzgKO/q5BXe+B9IkUr92BrhiEEMeHGuYwgmvGMyO1GOnTTARorlyuT9TZ9X86iIU7FomvjjJSQ4Px3IkrLiQDdLMugC/j+edEzcLv2bnxAUJa9Tu4lWrRhtqwvn6y8WhhKNbkhg3cJxwnhwG+GwU1a3dD25onEW5tyQoiwZUt1L6ZipPUcXkgZSdWdl8XQEDcNPmrXs3eOrVuJbXcoEOb2fjXhGMDDS+ayIxrF9RgAutbE25d4U1Rl0c2wgwZQiPSU3k63vhuSsJW1hBe3Fqe+nItZBiMZD3sBPKIjzvwXLSFzecBSFsfTsz1Ec4/YZvvLJsovBuQpE5YRotrAXJvN/BLF1rQ9RZkVAAGEgKMC4F62phg/aLfZTkNGg0Lmb2LywRZjTTSw+Z2eIx1vstMc30iPmSW/ZON8cVMdSuLk5QW1UbVG1d+Afq9lxWYj+8+JYmoQ3GnIgWEvueJrhvu3XJbb1ecDEnz256dRSHFeveaez3wvaa9gorC15zajsHjGXmBUExvlWOmgx/j67+axxAXxS35kXNz+WxopIEPZ9+vP02YDZGEGuIp73gfKvcgERkhMfVdNBgs8pQQOoQvmPrbZqgTblJEyl1PqUmpMTYLQnYVpDIFIHdnPI3wqSZf71J3fRdZnhkdz979VwtN6dsfV83CS+swubOUmay7jnDXeZkvpYSA3LXGp2dhQhOqV1XSwX/AarrsTBi4hsYjVvcmmMx8LOg/fuZ6b25VIHLENuyMXKRio0YDzYio4glpMx4wDNjzV6jG5dKdZaJvN8qlssADesCJijhLNFVfddXEL3pRspzF796oNsaRCUCfkYyNuUXuqWHckDsV18be9GUYgcfQQW5q1biDvkHN7ibEFIsgFc4SP7Y1RGC0Vti1TMLA==,iv:SOhYWsn/xpBr4rHPCxkw1tAJkbvzcKOHcXzqKhz8naQ=,tag:qKzpeJnpvFOjFDDWVFf9jw==,type:str] + known_hosts: ENC[AES256_GCM,data:+moKZwHxTY911OAzA4/ixu5lD27dY2r++gmMD45byn2/3gV888NRSnNf6bm+mU13Z7qbpgbQRFqCm078R5WL2F2hHujvdJO+LGxAYNAXqLKYkBYToI/K4f9Af8m7mQeKh6m2kN9cGpEYfEZom8lpHxqkyf6hZ1c+kM2qGp6gjaRkq+LMh5smcSaeDEu8oYJdotfZp+gZxtL9GwuLDZBl53OlOCWZXNSuLAMlJryYNvVttmlYuTQG6bCsSRU+gWQSZkQvK0O7NYUX1KZVOhyBzLZKbxIjg/z4ACOG7YhA3M1OAWycc/kwInZUT+JFFCasyy0qkL6F8L0O8JON2eXg6fHDhfwgVLsYOnzx2W62cvqP2OtQralFHRBXU2SU7UyA29LMW7ep/rWc0eKNecA8wKqNAfdF0pvyrZnuuDiNhCf/iTxV4vbXwLVhG0MfvNU/USGYllAHvXbdLvyXh4LDK5ooVZ/Wz5lIWYBt3rIBCjEm+43EkXyQCvcYXt/cH5l3GmO6lg2o1amsEG+aj1CiUt9S6m507dKxSXMZd/oP56fmdZawRWgsA+x1PXGBLwk3IZ4PfJA9Cc1mMyITN/gup4CHvpjm6mDCs7Ffv41skGeXRCywODu5wcljpJ1s4p6uRnqfdBmnJ/LL05Tk5PklcLyzviskJBoDYAAtGk07Hxulz4DY6ZH3Y8TRzRxdEKVyoz9u2rYBTO9+Yp0rtFP45IyWux/ZeD89lFDa3sWfaTdreW2CQpy1wyDsJqXlop4HwX90Yml5LBXt/QpI6bo+gmYRhwiWueVuZw9YLjc81VnwDZfv9gK/H318THUeQJGjBd2LMTrfnMf/xvLrwWj6p0SmVA5p6yQGv7lnkbFtqdHzbzxEn6WwDVmsuhr3lFkaKZN/z3aHbOsAETBNMLlzu5cleD7DP19c1sTZjZ5JSfi8pCGu75T2go4ei6pTgNfZdcXawQBHexCWsJ6Xa1uwJuQykqjcMGe7ZNlnkX3ZjTmPMfvq7TnzQLDh1yopWlqumiv9qKHIa/rQCtMN/8iqWG5b6vguy5WX19mZ5PaLw3H3LrkyHeXkFaFjz5yx3MC4pRP9cuvjel2dj++pIbXDpk4ld8119HKCMbb8nvIZAJomdCnWZThHp9Y6miDXpSKAwa8VpxOtGF+VFg2ImJzkWmqY5XlPCigkBLgFSOLjFEU66Nx8PEoPQIwfu4lFHi3FJX95YFdCiZkTTcNiz4L2Kps80YjNhyZCeYmvRnwC1NPf4XCejZuhygu6bVrQM//Hi61h1O2l4Os6xWk02BW5WXCt1HRd/vF75nwvRI1OQkhz/qm6wA/z6CzeWuImQBrndhezCFVOdiWIrKvgrdFh2NYcuzWmMu0McCwDk4caxY8gIcJGugiu7JiF938vbO3WP2FKv0TiRVhqDlLNkc1/VZSlEavyFoYS4i3QYJCrXuVvDfCiXsAyfi6EY5Jfamc7+vfUu+nav433UCDXyLPuoUNJxmdHndurPLcoZbPmzis74qTl3xsdimn5NhoW0RYdEBjtHUWNX7S2j2Uw1zRNhJCyw7FXLnJ8p/WnE8aHz3iJidBQActOO2oXYx9/OR0hA9Jk7TR/aKsbHOdzFnsW1zdsd4KQ2DxjmgtM7at9I9ia+bIUi7xhGP9ViHcIu1CErl2IE0D2QoC1s1hdnKTPvm/EhE9Ia3TqHsbljnPEE/4LA4oHdiNX5bfzmVi19k8bU5ENFVuvGs/IT42wnzmpxfhFsqzdJ4cD2faSeYFdFPZbTgiLK0F6sIvYCXodptOHePu/ejyjXJ7E28T8IiHdLs4Ne1uw/u59oXWglP1Hl6QNCUZWYNpsLsUAfWlG0936EZr1n1Ir0Vobd3OmgRY24EfMjDLUb2muFqx3lkPHr3YmfVeLq72QtZvwbekprNfHjxXluBtZYiO/5MlGMMHdEpwCSXO/40PhFqGIC+yBvm2jZOuXJFISGq3NfX7tkFMoZ4TcxQUNFdLDhAgzvYpo9jLqkNb5xBgows7SEfh46rAIPtFNcovqhMqUkHVBjwnYn5HJIDY2Hm6cJj230ehsWvOs94bdTckVFdo0BVM37WAtOJmNAK9cQ/V0zlEdFsY2t6BEvajUfK4YIabXsc++U5MgD+emY6HLEjGjEi25Un1qzNKS+YTeId0dlK/VhjJDcIrARd81uUvRByGq+fNt0kcabNN8lDB9N15KV5KbJVwXL9dlS9EYD4IOHQT4e13xTAjUEPBnRnYLXXfa87BeHWb485hVtxQ/Jyq87h+CSMTmVzQfmdASb4G6CVi3KKmzPAq0HHoc4H1LCd9a81e9dZ6h9W3v9/WIV4bcJWJN+HWdr00yqRAWQGNtAoijvwd0pGEpS9up6Yv3QbgAm3G1E7g0aACuJYLF4v0aLevXQuUw9igp/zp4VGlwSBALbb4lsLFOV3Jl+N5HNmF0YSel8YOIj3n8w7gl8nObWMRGMrU=,iv:4INynJi4WzhOkH6HRXLksfKx7DiGlgxTAxOXG2PAE8w=,tag:/rkaPHyvl8jmsbl8WliU+g==,type:str] +kind: Secret +metadata: + name: local-git-secret +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age13hzmc9qhn82epztchgdfu5zvxkeecun4v5yxl2ma2a4kndqace7qgje450 + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnUjJqM2RUYUJjTUZKdDZS + ZERxMkora1NELzI2dFB5RklNL0s5akV1TW5ZCi9OamVrWmpXbkUrWDlTeEc1emha + d1FKbVAyUU1BTFpEaFY0OUpFVDBjQUkKLS0tIG1yTms1cDFyTW9oWFVDSTdOVEhy + djRHY1VyNjdhUmtZcDlVeCtBWlRYMXMKSK7RaZaSBRBfw398JvCHzD+IuQymF2u5 + HfP4ZQQ2yCm3Io0HkuluCfdbRG48C6caL3hSipD/rsaPdapy7qVfhA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2022-02-16T23:06:34Z" + mac: ENC[AES256_GCM,data:3Co3XJ/4hfGzdxniq3wycxO3CGLmGFvBPdxEkg3DjsIMpife9XkWPBLIGlgDZBkhdXGw4WYA/ZEiQh+PN5/wm9R3Ii7b1n6W3/wsXbqmKke6VpZsZTLcM2uxuxGaU50VK4WwkF0KRBKbWiSOlSH76LUKz2RNkrPsO4YZ9i6OxgM=,iv:6kqVrwAzuoK2uYLMMEExlM0Zq3vcQJLxitmSx+7uuVY=,tag:hm5og5i58u35YPoXWcUkqQ==,type:str] + pgp: [] + encrypted_regex: ^(data|stringData)$ + version: 3.7.1 diff --git a/kubeconfigs/k3d-develop.yaml b/kubeconfigs/k3d-develop.yaml new file mode 100644 index 0000000..e04f3d2 --- /dev/null +++ b/kubeconfigs/k3d-develop.yaml @@ -0,0 +1,20 @@ +--- +apiVersion: v1 +clusters: +- cluster: + certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJkekNDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdGMyVnkKZG1WeUxXTmhRREUyTkRVeE16QTFNREF3SGhjTk1qSXdNakUzTWpBME1UUXdXaGNOTXpJd01qRTFNakEwTVRRdwpXakFqTVNFd0h3WURWUVFEREJock0zTXRjMlZ5ZG1WeUxXTmhRREUyTkRVeE16QTFNREF3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFUL1JqRDlodGdsN25NT3ZkRVhKdnpkbTJUZUE3cmhOZjhpUjVGL00wT3IKTngwa1FlSUNoVUJqdXQ0bTJwQ2JpRnFhdU1Fak1pZzdNS0dPUWZobFVTeUNvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVU1sOGxGVHhhbEVlbEtNRHdqM1pTCkx6MEpqU3N3Q2dZSUtvWkl6ajBFQXdJRFNBQXdSUUloQUlsTDhnMHRsbit1eGd4SnZsK254T0pDVVo3RDM2ZWYKcmpFbWdEZEVocGc4QWlCTytvb3dXalJGNkVrZElNTUN2ME5HeVg0TXBzb3N3cnJ4WHluc2RlOHBpZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + server: https://0.0.0.0:56008 + name: k3d-develop +contexts: +- context: + cluster: k3d-develop + user: admin@k3d-develop + name: k3d-develop +current-context: k3d-develop +kind: Config +preferences: {} +users: +- name: admin@k3d-develop + user: + client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrVENDQVRlZ0F3SUJBZ0lJQXdhc2R4OWFBQWN3Q2dZSUtvWkl6ajBFQXdJd0l6RWhNQjhHQTFVRUF3d1kKYXpOekxXTnNhV1Z1ZEMxallVQXhOalExTVRNd05UQXdNQjRYRFRJeU1ESXhOekl3TkRFME1Gb1hEVEl6TURJeApOekl3TkRFME1Gb3dNREVYTUJVR0ExVUVDaE1PYzNsemRHVnRPbTFoYzNSbGNuTXhGVEFUQmdOVkJBTVRESE41CmMzUmxiVHBoWkcxcGJqQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJNUzNaMlRLZGVPNUozSGoKS25XQUZwOUpreUVvQVRjWDJ3M1BDbXc4WGgrdHR6dXc4aEtQYUcxbHpNSkNSSzRDdHlBaG01T2VsZkFXL3IyeAo4V0R1S08yalNEQkdNQTRHQTFVZER3RUIvd1FFQXdJRm9EQVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0RBakFmCkJnTlZIU01FR0RBV2dCUUljZmhUTXdNUVpMa2JYTzhrNzErL3FMbWdJekFLQmdncWhrak9QUVFEQWdOSUFEQkYKQWlFQTVrbWRWcDRHcVpYYkNIdTJHQ0o5b2FkY1BkUGlZZEQyVDRYbGdXSEdjVndDSUV1ZEQ4b1VHWjEwSmxLbwpwQmh3QUlOUTdjTkVzUEZaYnN5SndHOWl1aHlCCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJkakNDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdFkyeHAKWlc1MExXTmhRREUyTkRVeE16QTFNREF3SGhjTk1qSXdNakUzTWpBME1UUXdXaGNOTXpJd01qRTFNakEwTVRRdwpXakFqTVNFd0h3WURWUVFEREJock0zTXRZMnhwWlc1MExXTmhRREUyTkRVeE16QTFNREF3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFRRTBsQklIeS9FNnQrYzhNM3N4QU8vcmh1T2VJNVJjbVI4VVI1SmpKNjIKQVY2N2NaRkJrQjdsckJMTUlkNndzTmwrOXpaMEpQTzJiNndrMEsyMUhDdDdvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVUNISDRVek1ERUdTNUcxenZKTzlmCnY2aTVvQ013Q2dZSUtvWkl6ajBFQXdJRFJ3QXdSQUlnWDRCdTI1S1dMWDBYeXV5R3NldE9VNjNmc0RCcWphVmsKYjZpQ2pkeDNNOXNDSUFJSlFEQnRXd0ZVdTNKN282dDNoK0plMlA3SGVwRkN5ajkvMUhhSUxkSmkKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= + client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUM3Q0hJOFJjVHdNSHFHenRGcndHZGFMYkZEVDZVVTFkMXhSdGR0NEZvT3RvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFeExkblpNcDE0N2tuY2VNcWRZQVduMG1USVNnQk54ZmJEYzhLYkR4ZUg2MjNPN0R5RW85bwpiV1hNd2tKRXJnSzNJQ0diazU2VjhCYit2Ykh4WU80bzdRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo= diff --git a/local-k8s/k3d-develop-config.yaml b/local-k8s/k3d-develop-config.yaml new file mode 100644 index 0000000..7df7e32 --- /dev/null +++ b/local-k8s/k3d-develop-config.yaml @@ -0,0 +1,16 @@ +apiVersion: k3d.io/v1alpha3 +kind: Simple +name: develop +ports: + - port: 8080:80 + nodeFilters: + - loadbalancer + - port: 2222:2222 + nodeFilters: + - loadbalancer +options: + k3s: + extraArgs: + - arg: --no-deploy=traefik + nodeFilters: + - server:* diff --git a/local-k8s/keys/age.agekey b/local-k8s/keys/age.agekey new file mode 100644 index 0000000..8112b9a --- /dev/null +++ b/local-k8s/keys/age.agekey @@ -0,0 +1,3 @@ +# created: 2022-02-17T00:06:34+01:00 +# public key: age13hzmc9qhn82epztchgdfu5zvxkeecun4v5yxl2ma2a4kndqace7qgje450 +AGE-SECRET-KEY-1WTT2LNRAF6H0C8PY6WDK2CENUVW9SVAUC3LLCSM46XPK3F40XZJSJGDXUV diff --git a/local-k8s/keys/identity b/local-k8s/keys/identity new file mode 100644 index 0000000..027926a --- /dev/null +++ b/local-k8s/keys/identity @@ -0,0 +1,38 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn +NhAAAAAwEAAQAAAYEAnTqGJiGtMpvRqrtk+04ToX/nGfuOV2+cBJOyG3jYfhW/+jXBx5Sm +Tm//Tm5d/9wOj6Ry0SAvxOUXVHzYAhII4aMSAerYB+5fYZPqVrVgfxEwdMW6s3XQhtq5y0 +Uh74ibiLVGDmkrR9ogBmrq9IGTC7Y50+vpQGkbEdmxcNICXrjibR2Vgq73Z2HLxbHiwhum +SLNrCxGNg4MiwXq4zbRGayP+Ft4v9bMcBZfHKOh2COpf3cIc8M0gD2w0FHWaWLxJZt5RLy +kdu8M6UAUDlOOO8eO43BGgAnUzwK2QGiHoYfkgxGrI4IOvZcZfPUvkwvHvwZdlSWvLz2ZM +pQILutIVLMR7xaliN87M5wZkADnuHj8ngqEifG0Jzm2SOUurnFJjJ/2MCqB27TimtWml8/ +gJV3SNhNoHGh3euLrmRM1jUvE8iu6mAnUeyi5pJtCcStVW9oiSj5IQveu92ME6mbwLY9l8 +tbV4nQ985m++/SKdnoygwOTVJPHHJBJAeeM54HDFAAAFiCqtEWcqrRFnAAAAB3NzaC1yc2 +EAAAGBAJ06hiYhrTKb0aq7ZPtOE6F/5xn7jldvnASTsht42H4Vv/o1wceUpk5v/05uXf/c +Do+kctEgL8TlF1R82AISCOGjEgHq2AfuX2GT6la1YH8RMHTFurN10IbauctFIe+Im4i1Rg +5pK0faIAZq6vSBkwu2OdPr6UBpGxHZsXDSAl644m0dlYKu92dhy8Wx4sIbpkizawsRjYOD +IsF6uM20Rmsj/hbeL/WzHAWXxyjodgjqX93CHPDNIA9sNBR1mli8SWbeUS8pHbvDOlAFA5 +TjjvHjuNwRoAJ1M8CtkBoh6GH5IMRqyOCDr2XGXz1L5MLx78GXZUlry89mTKUCC7rSFSzE +e8WpYjfOzOcGZAA57h4/J4KhInxtCc5tkjlLq5xSYyf9jAqgdu04prVppfP4CVd0jYTaBx +od3ri65kTNY1LxPIrupgJ1HsouaSbQnErVVvaIko+SEL3rvdjBOpm8C2PZfLW1eJ0PfOZv +vv0inZ6MoMDk1STxxyQSQHnjOeBwxQAAAAMBAAEAAAGBAI6os1+V3ti0mSEYtx9uUFGRA9 +eHcDfVhPKCMHDMzWJZyb71V8YHEn7JEBXR/mhQ+sVKqQMm+TDlzK1UOYpnYreYhpZGx40q +tFCNLWtPVyb0KctKPYTnuTUi8MGHEKuOf9Ei6VXaBvNC7xvjlxwTFaDizsWCoDlZJL6lj2 +KWqp/XkVsAJNBWgRTEn2fZZ65H+DCu2slIO+a/7aEwAM5kbCB6n+mP4GRHB33roUF06uRc +BG/p2OiEtjpIK1kE++7XpzX1VQoTs3ffHYhvbo14g42NHcfLIBldmhcfns17JUQ+ifb8ky +Z89o9JQjGa6vLyc5gaI3XNlZ/LeXFcbBKStwbt9pQvAWkne1iie0J+LR7oKoS8lUq4609T +6MyEFe8cH8woS5ahD2pRgwWJfJ83MUyvPoKMAlP6uvyshiAQjiHE2I2VtioAvLbCjhJ043 +FykLLK0osalOGa9AMBrK/3GxBgKG4/V82SvM3XdWiKPwdGZHWh0ml964fJWF7np5fxAQAA +AMBcXHG34X2yTVkGLQlu6O+mjDDpbGHyTRJLO7QlscWgyaWHCinwE5buQnF5S6h+NKeznP +F6he+RKtwC3p+pq8OB4d1YxYy8gM9gQ03gi+K/V8+iv4wvdn/NQEQu9Xhi08Nx33H1yaaL +vFHP7nUZtt11sEVGw/deUU5JIM9ZvAvke82SWkEKBS/Drzjqw5qBQwmWCDNfBv5wLZdIpM +CVD4/AHKu4i6NJ2rHpHQ3qNE1B56bFcA73pxwm/nhIheLSftQAAADBAM8Wt6j5aIBf9iNn +OmGyfWoFXcHF3DhuGaA4YwQY+JAMvFUFUdwyD/lIJ4AIEiTfm6L/Avgykz9gJgUjsUdkED +akrdtZ2rAIQnTjxYv36JLHuNArY+Jrlsl/BAmHkNzMvGuvVU+hKcNTDXVy5HltDK9wEZ2y +bHvu3HdCBln0sU452lOZpPbeuMdRfzRQubnLzk7tHs5Cko31mh7t55pFA74F+tRF//js0C +uz/ohg1z1AvWuogdDYbqUkzi7RduQLjQAAAMEAwl0YX3iy8Yj9iaeSUHh11M6RSq6B8/yd ++yaXNhdSQUoLjbXxwF3CObF+eAQ5mvLbFTPerxruu3vdaqHIW0HkwIM2OlPYSzlzeSLX4V +xe5baxxF+Fd4m01cBEIvem8Zcm7HzzimpaPJgm+ou8/5J1Wvh8GhUE7/WQz0SUyCK3hNvH +HinDtQHtx6Cn3iqnD0Wol8idpPGJtQH/XW4jSkEmrmwuTJUW14uAvuq3H2ERAdZKVCQULx +LQkSkHWlOejJAZAAAAD2RldmVsb3BtZW50QGtleQECAw== +-----END OPENSSH PRIVATE KEY----- diff --git a/local-k8s/keys/identity.pub b/local-k8s/keys/identity.pub new file mode 100644 index 0000000..d878484 --- /dev/null +++ b/local-k8s/keys/identity.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCdOoYmIa0ym9Gqu2T7ThOhf+cZ+45Xb5wEk7IbeNh+Fb/6NcHHlKZOb/9Obl3/3A6PpHLRIC/E5RdUfNgCEgjhoxIB6tgH7l9hk+pWtWB/ETB0xbqzddCG2rnLRSHviJuItUYOaStH2iAGaur0gZMLtjnT6+lAaRsR2bFw0gJeuOJtHZWCrvdnYcvFseLCG6ZIs2sLEY2DgyLBerjNtEZrI/4W3i/1sxwFl8co6HYI6l/dwhzwzSAPbDQUdZpYvElm3lEvKR27wzpQBQOU447x47jcEaACdTPArZAaIehh+SDEasjgg69lxl89S+TC8e/Bl2VJa8vPZkylAgu60hUsxHvFqWI3zsznBmQAOe4ePyeCoSJ8bQnObZI5S6ucUmMn/YwKoHbtOKa1aaXz+AlXdI2E2gcaHd64uuZEzWNS8TyK7qYCdR7KLmkm0JxK1Vb2iJKPkhC9673YwTqZvAtj2Xy1tXidD3zmb779Ip2ejKDA5NUk8cckEkB54zngcMU= development@key diff --git a/local-k8s/keys/known_hosts b/local-k8s/keys/known_hosts new file mode 100644 index 0000000..c5bb18d --- /dev/null +++ b/local-k8s/keys/known_hosts @@ -0,0 +1,4 @@ +[local-git.local-git.svc.cluster.local]:2222 ssh-dss AAAAB3NzaC1kc3MAAACBALsXz3kkVkhjVjmfZGzGufMNn4tHk6QLxuOfkZquRaSFC5cQiZ07rBLQo3v1f0c/82i7WJ8GeXC1IlR8NCacpiLFZ8HHWEFi3RH5XxBDJ/BKdq09eUNiqNwGNHanlT4MgYTjvOW4pWvxbYVxy4igOyOH5XwgFx2hUYersqKB0awTAAAAFQCXyqTDEXvvHYLGz3JT48CiFj/xUwAAAIEAm5LLEw0URe5FOgA6yxfbZ+YcR/vrwzLWfVWrFDVM01eVkvowQoFGpbMoxfBpwI6fYclG8qUG/zYstaaWzNcfeLaAlHfzHKvYndw+w2d7PkAUxRBw+aqbDw6rRE6mAyVSialIPIMuNm56WqMtnaMLCGqWw6CPRmF/tRGjztwNP1UAAACAZYv0I1u9fH+EYetvCe07wrzcTSpNF/Smn805/aZlyuiCl4cyjBo/k3LHoP2nx860LSN9nawEGVWO2YjqXU6b/jfu1jZ/lN9lUC05oqVp+fZRIM2dgrhBbTO2aenINykPW1dPIf3vGMqRhp5lVgEoL6gMhOiSQB/2Q5yNNl4Y06Q= +[local-git.local-git.svc.cluster.local]:2222 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8pTwwGSERWAeStBH5CLRE7rF+kRjM/Qmk3e5tqLr0PEDD06nClABL0ZGlnI3TTILT0uTNquK9Ei0hfXhpiVcPVb8zqZ85MbiHYM027W+/09ZkpQmNF7yh+L46WRBR3J5G+k6g84FwyM3L+wgqELchhiiCR2liSdSExIBId43oNraxCsfyOGjLGzVhXLxt2ZWu6sc/CKyqMjpKrO3zpBuSnji1hGfk9+udpQAJxxK3Hv1diH/NtuxjPelWclIwB54vsnCiUX1DgKZY/u2i8WuusIihJhLt6RB00oYY1IDCVcGgiPg3mEmh4u5Kiv5KFYBTIOv7pkxOMVkxtbFSO9+B +[local-git.local-git.svc.cluster.local]:2222 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIVvv1GwrkC/rxOQWKuPyiXWsPjvahWWTicwkfNE+6I2wBO9PMI285FO7TlRdFqYtub/cjonOLG0qT8oUHcAIk8= +[local-git.local-git.svc.cluster.local]:2222 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID79FCNdT1ppKiNXCabO3lIESDjsI2aic550ibcxooJ1 diff --git a/local-k8s/keys/local-git-secret.yaml b/local-k8s/keys/local-git-secret.yaml new file mode 100644 index 0000000..01b9774 --- /dev/null +++ b/local-k8s/keys/local-git-secret.yaml @@ -0,0 +1,8 @@ +apiVersion: v1 +data: + identity: LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUJsd0FBQUFkemMyZ3RjbgpOaEFBQUFBd0VBQVFBQUFZRUFuVHFHSmlHdE1wdlJxcnRrKzA0VG9YL25HZnVPVjIrY0JKT3lHM2pZZmhXLytqWEJ4NVNtClRtLy9UbTVkLzl3T2o2UnkwU0F2eE9VWFZIellBaElJNGFNU0FlcllCKzVmWVpQcVZyVmdmeEV3ZE1XNnMzWFFodHE1eTAKVWg3NGliaUxWR0Rta3JSOW9nQm1ycTlJR1RDN1k1MCt2cFFHa2JFZG14Y05JQ1hyamliUjJWZ3E3M1oySEx4Ykhpd2h1bQpTTE5yQ3hHTmc0TWl3WHE0emJSR2F5UCtGdDR2OWJNY0JaZkhLT2gyQ09wZjNjSWM4TTBnRDJ3MEZIV2FXTHhKWnQ1Ukx5CmtkdThNNlVBVURsT09POGVPNDNCR2dBblV6d0syUUdpSG9ZZmtneEdySTRJT3ZaY1pmUFV2a3d2SHZ3WmRsU1d2THoyWk0KcFFJTHV0SVZMTVI3eGFsaU44N001d1prQURudUhqOG5ncUVpZkcwSnptMlNPVXVybkZKakovMk1DcUIyN1RpbXRXbWw4LwpnSlYzU05oTm9IR2gzZXVMcm1STTFqVXZFOGl1Nm1BblVleWk1cEp0Q2NTdFZXOW9pU2o1SVF2ZXU5Mk1FNm1id0xZOWw4CnRiVjRuUTk4NW0rKy9TS2Rub3lnd09UVkpQSEhKQkpBZWVNNTRIREZBQUFGaUNxdEVXY3FyUkZuQUFBQUIzTnphQzF5YzIKRUFBQUdCQUowNmhpWWhyVEtiMGFxN1pQdE9FNkYvNXhuN2psZHZuQVNUc2h0NDJINFZ2L28xd2NlVXBrNXYvMDV1WGYvYwpEbytrY3RFZ0w4VGxGMVI4MkFJU0NPR2pFZ0hxMkFmdVgyR1Q2bGExWUg4Uk1IVEZ1ck4xMEliYXVjdEZJZStJbTRpMVJnCjVwSzBmYUlBWnE2dlNCa3d1Mk9kUHI2VUJwR3hIWnNYRFNBbDY0NG0wZGxZS3U5MmRoeThXeDRzSWJwa2l6YXdzUmpZT0QKSXNGNnVNMjBSbXNqL2hiZUwvV3pIQVdYeHlqb2RnanFYOTNDSFBETklBOXNOQlIxbWxpOFNXYmVVUzhwSGJ2RE9sQUZBNQpUamp2SGp1TndSb0FKMU04Q3RrQm9oNkdINUlNUnF5T0NEcjJYR1h6MUw1TUx4NzhHWFpVbHJ5ODltVEtVQ0M3clNGU3pFCmU4V3BZamZPek9jR1pBQTU3aDQvSjRLaElueHRDYzV0a2psTHE1eFNZeWY5akFxZ2R1MDRwclZwcGZQNENWZDBqWVRhQngKb2Qzcmk2NWtUTlkxTHhQSXJ1cGdKMUhzb3VhU2JRbkVyVlZ2YUlrbytTRUwzcnZkakJPcG04QzJQWmZMVzFlSjBQZk9adgp2djBpblo2TW9NRGsxU1R4eHlRU1FIbmpPZUJ3eFFBQUFBTUJBQUVBQUFHQkFJNm9zMStWM3RpMG1TRVl0eDl1VUZHUkE5CmVIY0RmVmhQS0NNSERNeldKWnliNzFWOFlIRW43SkVCWFIvbWhRK3NWS3FRTW0rVERseksxVU9ZcG5ZcmVZaHBaR3g0MHEKdEZDTkxXdFBWeWIwS2N0S1BZVG51VFVpOE1HSEVLdU9mOUVpNlZYYUJ2TkM3eHZqbHh3VEZhRGl6c1dDb0RsWkpMNmxqMgpLV3FwL1hrVnNBSk5CV2dSVEVuMmZaWjY1SCtEQ3Uyc2xJTythLzdhRXdBTTVrYkNCNm4rbVA0R1JIQjMzcm9VRjA2dVJjCkJHL3AyT2lFdGpwSUsxa0UrKzdYcHpYMVZRb1RzM2ZmSFlodmJvMTRnNDJOSGNmTElCbGRtaGNmbnMxN0pVUStpZmI4a3kKWjg5bzlKUWpHYTZ2THljNWdhSTNYTmxaL0xlWEZjYkJLU3R3YnQ5cFF2QVdrbmUxaWllMEorTFI3b0tvUzhsVXE0NjA5VAo2TXlFRmU4Y0g4d29TNWFoRDJwUmd3V0pmSjgzTVV5dlBvS01BbFA2dXZ5c2hpQVFqaUhFMkkyVnRpb0F2TGJDamhKMDQzCkZ5a0xMSzBvc2FsT0dhOUFNQnJLLzNHeEJnS0c0L1Y4MlN2TTNYZFdpS1B3ZEdaSFdoMG1sOTY0ZkpXRjducDVmeEFRQUEKQU1CY1hIRzM0WDJ5VFZrR0xRbHU2TyttakREcGJHSHlUUkpMTzdRbHNjV2d5YVdIQ2lud0U1YnVRbkY1UzZoK05LZXpuUApGNmhlK1JLdHdDM3ArcHE4T0I0ZDFZeFl5OGdNOWdRMDNnaStLL1Y4K2l2NHd2ZG4vTlFFUXU5WGhpMDhOeDMzSDF5YWFMCnZGSFA3blVadHQxMXNFVkd3L2RlVVU1SklNOVp2QXZrZTgyU1drRUtCUy9EcnpqcXc1cUJRd21XQ0ROZkJ2NXdMWmRJcE0KQ1ZENC9BSEt1NGk2TkoyckhwSFEzcU5FMUI1NmJGY0E3M3B4d20vbmhJaGVMU2Z0UUFBQURCQU04V3Q2ajVhSUJmOWlObgpPbUd5ZldvRlhjSEYzRGh1R2FBNFl3UVkrSkFNdkZVRlVkd3lEL2xJSjRBSUVpVGZtNkwvQXZneWt6OWdKZ1Vqc1Vka0VECmFrcmR0WjJyQUlRblRqeFl2MzZKTEh1TkFyWStKcmxzbC9CQW1Ia056TXZHdXZWVStoS2NOVERYVnk1SGx0REs5d0VaMnkKYkh2dTNIZENCbG4wc1U0NTJsT1pwUGJldU1kUmZ6UlF1Ym5Mems3dEhzNUNrbzMxbWg3dDU1cEZBNzRGK3RSRi8vanMwQwp1ei9vaGcxejFBdld1b2dkRFlicVVremk3UmR1UUxqUUFBQU1FQXdsMFlYM2l5OFlqOWlhZVNVSGgxMU02UlNxNkI4L3lkCit5YVhOaGRTUVVvTGpiWHh3RjNDT2JGK2VBUTVtdkxiRlRQZXJ4cnV1M3ZkYXFISVcwSGt3SU0yT2xQWVN6bHplU0xYNFYKeGU1YmF4eEYrRmQ0bTAxY0JFSXZlbThaY203SHp6aW1wYVBKZ20rb3U4LzVKMVd2aDhHaFVFNy9XUXowU1V5Q0szaE52SApIaW5EdFFIdHg2Q24zaXFuRDBXb2w4aWRwUEdKdFFIL1hXNGpTa0Vtcm13dVRKVVcxNHVBdnVxM0gyRVJBZFpLVkNRVUx4CkxRa1NrSFdsT2VqSkFaQUFBQUQyUmxkbVZzYjNCdFpXNTBRR3RsZVFFQ0F3PT0KLS0tLS1FTkQgT1BFTlNTSCBQUklWQVRFIEtFWS0tLS0tCg== + identity.pub: c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCZ1FDZE9vWW1JYTB5bTlHcXUyVDdUaE9oZitjWis0NVhiNXdFazdJYmVOaCtGYi82TmNISGxLWk9iLzlPYmwzLzNBNlBwSExSSUMvRTVSZFVmTmdDRWdqaG94SUI2dGdIN2w5aGsrcFd0V0IvRVRCMHhicXpkZENHMnJuTFJTSHZpSnVJdFVZT2FTdEgyaUFHYXVyMGdaTUx0am5UNitsQWFSc1IyYkZ3MGdKZXVPSnRIWldDcnZkblljdkZzZUxDRzZaSXMyc0xFWTJEZ3lMQmVyak50RVpySS80VzNpLzFzeHdGbDhjbzZIWUk2bC9kd2h6d3pTQVBiRFFVZFpwWXZFbG0zbEV2S1IyN3d6cFFCUU9VNDQ3eDQ3amNFYUFDZFRQQXJaQWFJZWhoK1NERWFzamdnNjlseGw4OVMrVEM4ZS9CbDJWSmE4dlBaa3lsQWd1NjBoVXN4SHZGcVdJM3pzem5CbVFBT2U0ZVB5ZUNvU0o4YlFuT2JaSTVTNnVjVW1Nbi9Zd0tvSGJ0T0thMWFhWHorQWxYZEkyRTJnY2FIZDY0dXVaRXpXTlM4VHlLN3FZQ2RSN0tMbWttMEp4SzFWYjJpSktQa2hDOTY3M1l3VHFadkF0ajJYeTF0WGlkRDN6bWI3NzlJcDJlaktEQTVOVWs4Y2NrRWtCNTR6bmdjTVU9IGRldmVsb3BtZW50QGtleQo= + known_hosts: W2xvY2FsLWdpdC5sb2NhbC1naXQuc3ZjLmNsdXN0ZXIubG9jYWxdOjIyMjIgc3NoLWRzcyBBQUFBQjNOemFDMWtjM01BQUFDQkFMc1h6M2trVmtoalZqbWZaR3pHdWZNTm40dEhrNlFMeHVPZmtacXVSYVNGQzVjUWlaMDdyQkxRbzN2MWYwYy84Mmk3V0o4R2VYQzFJbFI4TkNhY3BpTEZaOEhIV0VGaTNSSDVYeEJESi9CS2RxMDllVU5pcU53R05IYW5sVDRNZ1lUanZPVzRwV3Z4YllWeHk0aWdPeU9INVh3Z0Z4MmhVWWVyc3FLQjBhd1RBQUFBRlFDWHlxVERFWHZ2SFlMR3ozSlQ0OENpRmoveFV3QUFBSUVBbTVMTEV3MFVSZTVGT2dBNnl4ZmJaK1ljUi92cnd6TFdmVldyRkRWTTAxZVZrdm93UW9GR3BiTW94ZkJwd0k2ZlljbEc4cVVHL3pZc3RhYVd6TmNmZUxhQWxIZnpIS3ZZbmR3K3cyZDdQa0FVeFJCdythcWJEdzZyUkU2bUF5VlNpYWxJUElNdU5tNTZXcU10bmFNTENHcVd3NkNQUm1GL3RSR2p6dHdOUDFVQUFBQ0FaWXYwSTF1OWZIK0VZZXR2Q2UwN3dyemNUU3BORi9TbW44MDUvYVpseXVpQ2w0Y3lqQm8vazNMSG9QMm54ODYwTFNOOW5hd0VHVldPMllqcVhVNmIvamZ1MWpaL2xOOWxVQzA1b3FWcCtmWlJJTTJkZ3JoQmJUTzJhZW5JTnlrUFcxZFBJZjN2R01xUmhwNWxWZ0VvTDZnTWhPaVNRQi8yUTV5Tk5sNFkwNlE9Cltsb2NhbC1naXQubG9jYWwtZ2l0LnN2Yy5jbHVzdGVyLmxvY2FsXToyMjIyIHNzaC1yc2EgQUFBQUIzTnphQzF5YzJFQUFBQURBUUFCQUFBQkFRQzhwVHd3R1NFUldBZVN0Qkg1Q0xSRTdyRitrUmpNL1FtazNlNXRxTHIwUEVERDA2bkNsQUJMMFpHbG5JM1RUSUxUMHVUTnF1SzlFaTBoZlhocGlWY1BWYjh6cVo4NU1iaUhZTTAyN1crLzA5WmtwUW1ORjd5aCtMNDZXUkJSM0o1RytrNmc4NEZ3eU0zTCt3Z3FFTGNoaGlpQ1IybGlTZFNFeElCSWQ0M29OcmF4Q3NmeU9HakxHelZoWEx4dDJaV3U2c2MvQ0t5cU1qcEtyTzN6cEJ1U25qaTFoR2ZrOSt1ZHBRQUp4eEszSHYxZGlIL050dXhqUGVsV2NsSXdCNTR2c25DaVVYMURnS1pZL3UyaThXdXVzSWloSmhMdDZSQjAwb1lZMUlEQ1ZjR2dpUGczbUVtaDR1NUtpdjVLRllCVElPdjdwa3hPTVZreHRiRlNPOStCCltsb2NhbC1naXQubG9jYWwtZ2l0LnN2Yy5jbHVzdGVyLmxvY2FsXToyMjIyIGVjZHNhLXNoYTItbmlzdHAyNTYgQUFBQUUyVmpaSE5oTFhOb1lUSXRibWx6ZEhBeU5UWUFBQUFJYm1semRIQXlOVFlBQUFCQkJJVnZ2MUd3cmtDL3J4T1FXS3VQeWlYV3NQanZhaFdXVGljd2tmTkUrNkkyd0JPOVBNSTI4NUZPN1RsUmRGcVl0dWIvY2pvbk9MRzBxVDhvVUhjQUlrOD0KW2xvY2FsLWdpdC5sb2NhbC1naXQuc3ZjLmNsdXN0ZXIubG9jYWxdOjIyMjIgc3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSUQ3OUZDTmRUMXBwS2lOWENhYk8zbElFU0Rqc0kyYWljNTUwaWJjeG9vSjEK +kind: Secret +metadata: + name: local-git-secret diff --git a/local-k8s/local-git/custom-cont-init.d/init-git.sh b/local-k8s/local-git/custom-cont-init.d/init-git.sh new file mode 100755 index 0000000..7e8fe13 --- /dev/null +++ b/local-k8s/local-git/custom-cont-init.d/init-git.sh @@ -0,0 +1,14 @@ +#!/bin/bash + +GITREPOS=("flux") + +apk update +apk add git +rm /etc/motd +mkdir -p /srv/git +for repo in ${GITREPOS[@]}; do + mkdir -p /srv/git/${repo}.git + cd /srv/git/${repo}.git + git init --bare +done +chown -R git:git /srv/git diff --git a/local-k8s/local-git/deployment.yaml b/local-k8s/local-git/deployment.yaml new file mode 100644 index 0000000..d46195b --- /dev/null +++ b/local-k8s/local-git/deployment.yaml @@ -0,0 +1,42 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: local-git + name: local-git +spec: + replicas: 1 + selector: + matchLabels: + app: local-git + template: + metadata: + labels: + app: local-git + spec: + containers: + - image: lscr.io/linuxserver/openssh-server:latest + name: local-git + envFrom: + - configMapRef: + name: ssh + ports: + - containerPort: 2222 + resources: + limits: + memory: 100Mi + requests: + memory: 100Mi + volumeMounts: + - name: custom-cont-initd + mountPath: /config/custom-cont-init.d + - name: ssh-host-keys + mountPath: /config/ssh_host_keys + volumes: + - name: custom-cont-initd + configMap: + name: custom-cont-initd + - name: ssh-host-keys + configMap: + name: ssh-host-keys \ No newline at end of file diff --git a/local-k8s/local-git/kustomization.yaml b/local-k8s/local-git/kustomization.yaml new file mode 100644 index 0000000..56ca39e --- /dev/null +++ b/local-k8s/local-git/kustomization.yaml @@ -0,0 +1,29 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +namespace: local-git + +resources: +- namespace.yaml +- deployment.yaml +- service.yaml + +configMapGenerator: +- name: ssh-host-keys + files: + - ssh_host_keys/ssh_host_dsa_key + - ssh_host_keys/ssh_host_ecdsa_key + - ssh_host_keys/ssh_host_ed25519_key + - ssh_host_keys/ssh_host_rsa_key + - ssh_host_keys/sshd_config + - ssh_host_keys/ssh_host_dsa_key.pub + - ssh_host_keys/ssh_host_ecdsa_key.pub + - ssh_host_keys/ssh_host_ed25519_key.pub + - ssh_host_keys/ssh_host_rsa_key.pub +- name: custom-cont-initd + files: + - custom-cont-init.d/init-git.sh +- name: ssh + literals: + - USER_NAME=git + - PUBLIC_KEY="ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDJRtmmvw07NlSNoNsIAaeBsBqrsULoZXo6JlTqOLPcJV9JDwVV3SzVUeNUGwHTNjdrI0Nx3Rzdd6BzXl0T48nrEpCFffjl3oWnhLOpPGWhyCw9n5VSA/Oin1Ah9wilhyjwlrIxsolT0+l6zLwdHdhKHu4tFQM+wzXb0T3Mcq1IqyS1IrNdRQP2WZL8bgi27onLVdxlYVJ/uIKg7qdJh2cCxDmFFaoK5zukNXj7ryL14P/W5Q8LzEgIzQQHokpkbluDGVQNGSi+dT4nqnQfu/iuZHqLvnbQZDaV5xjcgQLD2BGk83iNiuf82i1WxJA7qc83tN4/XE+px2FIT8CH+LqybG5BSGxK0h5kZZlPOQnwiWSEOphLwSB08hx26QJynLwzABWkuFVP/KPhwgAGpvOQzvMLxYR3LwHNcn17jL8qm+C8Vs2V+uEcSmxZVPxVx/38qerJ0m181N6HbYAzp0zdJnf/HFvF8RLplBrD+wpNWUS6SuMJ8qJOzsl9qovW6YU= develop-git" \ No newline at end of file diff --git a/local-k8s/local-git/namespace.yaml b/local-k8s/local-git/namespace.yaml new file mode 100644 index 0000000..05afb83 --- /dev/null +++ b/local-k8s/local-git/namespace.yaml @@ -0,0 +1,5 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: default diff --git a/local-k8s/local-git/service.yaml b/local-k8s/local-git/service.yaml new file mode 100644 index 0000000..4e325fe --- /dev/null +++ b/local-k8s/local-git/service.yaml @@ -0,0 +1,12 @@ +kind: Service +apiVersion: v1 +metadata: + name: local-git +spec: + selector: + app: local-git + ports: + - protocol: TCP + port: 2222 + targetPort: 2222 + type: LoadBalancer \ No newline at end of file diff --git a/local-k8s/local-git/ssh_host_keys/ssh_host_dsa_key b/local-k8s/local-git/ssh_host_keys/ssh_host_dsa_key new file mode 100644 index 0000000..90ef58e --- /dev/null +++ b/local-k8s/local-git/ssh_host_keys/ssh_host_dsa_key @@ -0,0 +1,21 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABsgAAAAdzc2gtZH +NzAAAAgQC7F895JFZIY1Y5n2RsxrnzDZ+LR5OkC8bjn5GarkWkhQuXEImdO6wS0KN79X9H +P/Nou1ifBnlwtSJUfDQmnKYixWfBx1hBYt0R+V8QQyfwSnatPXlDYqjcBjR2p5U+DIGE47 +zluKVr8W2FccuIoDsjh+V8IBcdoVGHq7KigdGsEwAAABUAl8qkwxF77x2Cxs9yU+PAohY/ +8VMAAACBAJuSyxMNFEXuRToAOssX22fmHEf768My1n1VqxQ1TNNXlZL6MEKBRqWzKMXwac +COn2HJRvKlBv82LLWmlszXH3i2gJR38xyr2J3cPsNnez5AFMUQcPmqmw8Oq0ROpgMlUomp +SDyDLjZuelqjLZ2jCwhqlsOgj0Zhf7URo87cDT9VAAAAgGWL9CNbvXx/hGHrbwntO8K83E +0qTRf0pp/NOf2mZcrogpeHMowaP5Nyx6D9p8fOtC0jfZ2sBBlVjtmI6l1Om/437tY2f5Tf +ZVAtOaKlafn2USDNnYK4QW0ztmnpyDcpD1tXTyH97xjKkYaeZVYBKC+oDITokkAf9kOcjT +ZeGNOkAAAB8MfWTQ7H1k0OAAAAB3NzaC1kc3MAAACBALsXz3kkVkhjVjmfZGzGufMNn4tH +k6QLxuOfkZquRaSFC5cQiZ07rBLQo3v1f0c/82i7WJ8GeXC1IlR8NCacpiLFZ8HHWEFi3R +H5XxBDJ/BKdq09eUNiqNwGNHanlT4MgYTjvOW4pWvxbYVxy4igOyOH5XwgFx2hUYersqKB +0awTAAAAFQCXyqTDEXvvHYLGz3JT48CiFj/xUwAAAIEAm5LLEw0URe5FOgA6yxfbZ+YcR/ +vrwzLWfVWrFDVM01eVkvowQoFGpbMoxfBpwI6fYclG8qUG/zYstaaWzNcfeLaAlHfzHKvY +ndw+w2d7PkAUxRBw+aqbDw6rRE6mAyVSialIPIMuNm56WqMtnaMLCGqWw6CPRmF/tRGjzt +wNP1UAAACAZYv0I1u9fH+EYetvCe07wrzcTSpNF/Smn805/aZlyuiCl4cyjBo/k3LHoP2n +x860LSN9nawEGVWO2YjqXU6b/jfu1jZ/lN9lUC05oqVp+fZRIM2dgrhBbTO2aenINykPW1 +dPIf3vGMqRhp5lVgEoL6gMhOiSQB/2Q5yNNl4Y06QAAAAUTp9atwucnczOY50dtDITspvc +MhwAAAATcm9vdEBvcGVuc3NoLXNlcnZlcgECAwQFBgc= +-----END OPENSSH PRIVATE KEY----- diff --git a/local-k8s/local-git/ssh_host_keys/ssh_host_dsa_key.pub b/local-k8s/local-git/ssh_host_keys/ssh_host_dsa_key.pub new file mode 100644 index 0000000..9795093 --- /dev/null +++ b/local-k8s/local-git/ssh_host_keys/ssh_host_dsa_key.pub @@ -0,0 +1 @@ +ssh-dss AAAAB3NzaC1kc3MAAACBALsXz3kkVkhjVjmfZGzGufMNn4tHk6QLxuOfkZquRaSFC5cQiZ07rBLQo3v1f0c/82i7WJ8GeXC1IlR8NCacpiLFZ8HHWEFi3RH5XxBDJ/BKdq09eUNiqNwGNHanlT4MgYTjvOW4pWvxbYVxy4igOyOH5XwgFx2hUYersqKB0awTAAAAFQCXyqTDEXvvHYLGz3JT48CiFj/xUwAAAIEAm5LLEw0URe5FOgA6yxfbZ+YcR/vrwzLWfVWrFDVM01eVkvowQoFGpbMoxfBpwI6fYclG8qUG/zYstaaWzNcfeLaAlHfzHKvYndw+w2d7PkAUxRBw+aqbDw6rRE6mAyVSialIPIMuNm56WqMtnaMLCGqWw6CPRmF/tRGjztwNP1UAAACAZYv0I1u9fH+EYetvCe07wrzcTSpNF/Smn805/aZlyuiCl4cyjBo/k3LHoP2nx860LSN9nawEGVWO2YjqXU6b/jfu1jZ/lN9lUC05oqVp+fZRIM2dgrhBbTO2aenINykPW1dPIf3vGMqRhp5lVgEoL6gMhOiSQB/2Q5yNNl4Y06Q= root@openssh-server diff --git a/local-k8s/local-git/ssh_host_keys/ssh_host_ecdsa_key b/local-k8s/local-git/ssh_host_keys/ssh_host_ecdsa_key new file mode 100644 index 0000000..45bf875 --- /dev/null +++ b/local-k8s/local-git/ssh_host_keys/ssh_host_ecdsa_key @@ -0,0 +1,9 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS +1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQSFb79RsK5Av68TkFirj8ol1rD472oV +lk4nMJHzRPuiNsATvTzCNvORTu05UXRamLbm/3I6JzixtKk/KFB3ACJPAAAAsNB/B/LQfw +fyAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIVvv1GwrkC/rxOQ +WKuPyiXWsPjvahWWTicwkfNE+6I2wBO9PMI285FO7TlRdFqYtub/cjonOLG0qT8oUHcAIk +8AAAAgeio5xlPhUaHFf4X18Z2byRuEhHUAnOWiFRnPINruQ/wAAAATcm9vdEBvcGVuc3No +LXNlcnZlcgECAwQF +-----END OPENSSH PRIVATE KEY----- diff --git a/local-k8s/local-git/ssh_host_keys/ssh_host_ecdsa_key.pub b/local-k8s/local-git/ssh_host_keys/ssh_host_ecdsa_key.pub new file mode 100644 index 0000000..493d0ea --- /dev/null +++ b/local-k8s/local-git/ssh_host_keys/ssh_host_ecdsa_key.pub @@ -0,0 +1 @@ +ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIVvv1GwrkC/rxOQWKuPyiXWsPjvahWWTicwkfNE+6I2wBO9PMI285FO7TlRdFqYtub/cjonOLG0qT8oUHcAIk8= root@openssh-server diff --git a/local-k8s/local-git/ssh_host_keys/ssh_host_ed25519_key b/local-k8s/local-git/ssh_host_keys/ssh_host_ed25519_key new file mode 100644 index 0000000..d01f87d --- /dev/null +++ b/local-k8s/local-git/ssh_host_keys/ssh_host_ed25519_key @@ -0,0 +1,7 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW +QyNTUxOQAAACA+/RQjXU9aaSojVwmmzt5SBEg47CNmonOedIm3MaKCdQAAAJiFV4a0hVeG +tAAAAAtzc2gtZWQyNTUxOQAAACA+/RQjXU9aaSojVwmmzt5SBEg47CNmonOedIm3MaKCdQ +AAAECir/zsA1snWhqhpkE2pK18PwQTlI8yVgiISKgbqeUDzT79FCNdT1ppKiNXCabO3lIE +SDjsI2aic550ibcxooJ1AAAAE3Jvb3RAb3BlbnNzaC1zZXJ2ZXIBAg== +-----END OPENSSH PRIVATE KEY----- diff --git a/local-k8s/local-git/ssh_host_keys/ssh_host_ed25519_key.pub b/local-k8s/local-git/ssh_host_keys/ssh_host_ed25519_key.pub new file mode 100644 index 0000000..2816039 --- /dev/null +++ b/local-k8s/local-git/ssh_host_keys/ssh_host_ed25519_key.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID79FCNdT1ppKiNXCabO3lIESDjsI2aic550ibcxooJ1 root@openssh-server diff --git a/local-k8s/local-git/ssh_host_keys/ssh_host_rsa_key b/local-k8s/local-git/ssh_host_keys/ssh_host_rsa_key new file mode 100644 index 0000000..f38f71e --- /dev/null +++ b/local-k8s/local-git/ssh_host_keys/ssh_host_rsa_key @@ -0,0 +1,27 @@ +-----BEGIN OPENSSH PRIVATE KEY----- +b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn +NhAAAAAwEAAQAAAQEAvKU8MBkhEVgHkrQR+Qi0RO6xfpEYzP0JpN3ubai69DxAw9OpwpQA +S9GRpZyN00yC09LkzarivRItIX14aYlXD1W/M6mfOTG4h2DNNu1vv9PWZKUJjRe8ofi+Ol +kQUdyeRvpOoPOBcMjNy/sIKhC3IYYogkdpYknUhMSASHeN6Da2sQrH8jhoyxs1YVy8bdmV +rurHPwisqjI6Sqzt86Qbkp44tYRn5PfrnaUACccStx79XYh/zbbsYz3pVnJSMAeeL7Jwol +F9Q4CmWP7tovFrrrCIoSYS7ekQdNKGGNSAwlXBoIj4N5hJoeLuSor+ShWAUyDr+6ZMTjFZ +MbWxUjvfgQAAA9AZCHZtGQh2bQAAAAdzc2gtcnNhAAABAQC8pTwwGSERWAeStBH5CLRE7r +F+kRjM/Qmk3e5tqLr0PEDD06nClABL0ZGlnI3TTILT0uTNquK9Ei0hfXhpiVcPVb8zqZ85 +MbiHYM027W+/09ZkpQmNF7yh+L46WRBR3J5G+k6g84FwyM3L+wgqELchhiiCR2liSdSExI +BId43oNraxCsfyOGjLGzVhXLxt2ZWu6sc/CKyqMjpKrO3zpBuSnji1hGfk9+udpQAJxxK3 +Hv1diH/NtuxjPelWclIwB54vsnCiUX1DgKZY/u2i8WuusIihJhLt6RB00oYY1IDCVcGgiP +g3mEmh4u5Kiv5KFYBTIOv7pkxOMVkxtbFSO9+BAAAAAwEAAQAAAQEArdJG8j7FZHjLiZbY +lLI7gOS7sda6lm91ym8gOfTmRxOZzZcj7gF3gGUbIhFt8UunpMzHPOb/w52S7i/xmrUM/j +lRU6Yw639v+3XrwXfop0XnX5dehJ5hlpFfnt3gFr4FLXuIpe+ZzrWIQzMM483BIGfAvcJV +TVagNrHlTmCy5kqmIAYs9jXChQ4Zku2nDvKA0ghMRLYMb5iDS4nE8t+5+42wQAtsVJUWoJ +VPT5j/D4nnUAqebtY+yvNvDJ3Jdt7EK05+3ZKEmfdGfPrIQ2kGTVh/unJrwh/y8G0Ri8Yq +7DcL9kRqhmsNZgIqdzP9mekxSHU+E6L6XY+teyD/0ibDfQAAAIAf/loFd5FANToz99KwLp +GnYQondYE0A9Zj5fokabRjzgdK0KiOBOV1AuzC8BeA8OEYAev+vR7Sh5bRfm2Sf79qybdM +VlkJiklgURQ2WrCWCgZlFvd+cwllK775TuMbFJVWyISKWUO1DbTY9z7yjGaBo6Z/sqs+LL +arWxIxLcqaEgAAAIEA6jRba6y8aWILOKnW3sqqgPw5LXr0oChj4iaaKM2FIQNk0XLxkVQX +MR9U6yKTUGgTEe+HLQ/xt84EFMHw6vfAnsgSBkU1rEs1ddneDH5O42vfLt0LlVuYCdEynq +OmRhipvAnhfLw/pZe7Sk5I4VTLqx6ZoKnPCWaAo+VdKHF8q0sAAACBAM4zfNG8uILM7xzg +U0/Ys/aifH9jigL6gzLSaksJZqY74WrDSyU2vVVfzXxKyWzvXX01IXWiGxqom2yBJ1akK9 +69kU5JUEo2ZWUfWj2fhNhzUhpSD5Gzp+GDiYMcAN6jX1lDTrqQS2bzZVEEGnJUfvnl5Byn +WzOofGuSrsIr9nTjAAAAE3Jvb3RAb3BlbnNzaC1zZXJ2ZXIBAgMEBQYH +-----END OPENSSH PRIVATE KEY----- diff --git a/local-k8s/local-git/ssh_host_keys/ssh_host_rsa_key.pub b/local-k8s/local-git/ssh_host_keys/ssh_host_rsa_key.pub new file mode 100644 index 0000000..bbdcffc --- /dev/null +++ b/local-k8s/local-git/ssh_host_keys/ssh_host_rsa_key.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8pTwwGSERWAeStBH5CLRE7rF+kRjM/Qmk3e5tqLr0PEDD06nClABL0ZGlnI3TTILT0uTNquK9Ei0hfXhpiVcPVb8zqZ85MbiHYM027W+/09ZkpQmNF7yh+L46WRBR3J5G+k6g84FwyM3L+wgqELchhiiCR2liSdSExIBId43oNraxCsfyOGjLGzVhXLxt2ZWu6sc/CKyqMjpKrO3zpBuSnji1hGfk9+udpQAJxxK3Hv1diH/NtuxjPelWclIwB54vsnCiUX1DgKZY/u2i8WuusIihJhLt6RB00oYY1IDCVcGgiPg3mEmh4u5Kiv5KFYBTIOv7pkxOMVkxtbFSO9+B root@openssh-server diff --git a/local-k8s/local-git/ssh_host_keys/sshd_config b/local-k8s/local-git/ssh_host_keys/sshd_config new file mode 100644 index 0000000..2fcd783 --- /dev/null +++ b/local-k8s/local-git/ssh_host_keys/sshd_config @@ -0,0 +1,117 @@ +# $OpenBSD: sshd_config,v 1.103 2018/04/09 20:41:22 tj Exp $ + +# This is the sshd server system-wide configuration file. See +# sshd_config(5) for more information. + +# This sshd was compiled with PATH=/bin:/usr/bin:/sbin:/usr/sbin + +# The strategy used for options in the default sshd_config shipped with +# OpenSSH is to specify options with their default value where +# possible, but leave them commented. Uncommented options override the +# default value. + +#Port 22 +#AddressFamily any +#ListenAddress 0.0.0.0 +#ListenAddress :: + +#HostKey /etc/ssh/ssh_host_rsa_key +#HostKey /etc/ssh/ssh_host_ecdsa_key +#HostKey /etc/ssh/ssh_host_ed25519_key + +# Ciphers and keying +#RekeyLimit default none + +# Logging +#SyslogFacility AUTH +#LogLevel INFO + +# Authentication: + +#LoginGraceTime 2m +#PermitRootLogin prohibit-password +#StrictModes yes +#MaxAuthTries 6 +#MaxSessions 10 + +#PubkeyAuthentication yes + +# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2 +# but this is overridden so installations will only check .ssh/authorized_keys +AuthorizedKeysFile .ssh/authorized_keys + +#AuthorizedPrincipalsFile none + +#AuthorizedKeysCommand none +#AuthorizedKeysCommandUser nobody + +# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts +#HostbasedAuthentication no +# Change to yes if you don't trust ~/.ssh/known_hosts for +# HostbasedAuthentication +#IgnoreUserKnownHosts no +# Don't read the user's ~/.rhosts and ~/.shosts files +#IgnoreRhosts yes + +# To disable tunneled clear text passwords, change to no here! +PasswordAuthentication no +#PermitEmptyPasswords no + +# Change to no to disable s/key passwords +#ChallengeResponseAuthentication yes + +# Kerberos options +#KerberosAuthentication no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes +#KerberosGetAFSToken no + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the ChallengeResponseAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via ChallengeResponseAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and ChallengeResponseAuthentication to 'no'. +#UsePAM no + +#AllowAgentForwarding yes +# Feel free to re-enable these if your use case requires them. +AllowTcpForwarding no +GatewayPorts no +X11Forwarding no +#X11DisplayOffset 10 +#X11UseLocalhost yes +#PermitTTY yes +#PrintMotd yes +#PrintLastLog yes +#TCPKeepAlive yes +#PermitUserEnvironment no +#Compression delayed +#ClientAliveInterval 0 +#ClientAliveCountMax 3 +#UseDNS no +PidFile /config/sshd.pid +#MaxStartups 10:30:100 +#PermitTunnel no +#ChrootDirectory none +#VersionAddendum none + +# no default banner path +#Banner none + +# override default of no subsystems +Subsystem sftp /usr/lib/ssh/sftp-server -u 022 + +# Example of overriding settings on a per-user basis +#Match User anoncvs +# X11Forwarding no +# AllowTcpForwarding no +# PermitTTY no +# ForceCommand cvs server diff --git a/local-k8s/local-k8s.sh b/local-k8s/local-k8s.sh new file mode 100755 index 0000000..0c094b7 --- /dev/null +++ b/local-k8s/local-k8s.sh @@ -0,0 +1,147 @@ +#!/bin/bash + + + +get_workdir() { + DIRPATH=$1 + cd $DIRPATH + pwd + cd - > /dev/null +} + +export WORKDIR=$(get_workdir $(dirname $0)) + +wait_until_ready() { + NAMESPACE=$1 + LABEL=$2 + while [[ $(kubectl get pods -n ${NAMESPACE} -l app=${LABEL} -o 'jsonpath={..status.conditions[?(@.type=="Ready")].status}') != "True" ]]; do + echo "waiting for pod" && sleep 1 + done +} + +generate_host_keys() { + HOSTKEYDIR=$WORKDIR/local-git/ssh_host_keys + if [ ! -e $HOSTKEYDIR/ssh_host_dsa_key ]; then + ssh-keygen -q -N "" -C "root@openssh-server" -t dsa -f $HOSTKEYDIR/ssh_host_dsa_key + fi + if [ ! -e $HOSTKEYDIR/ssh_host_rsa_key ]; then + ssh-keygen -q -N "" -C "root@openssh-server" -t rsa -b 2048 -f $HOSTKEYDIR/ssh_host_rsa_key + fi + if [ ! -e $HOSTKEYDIR/ssh_host_ecdsa_key ]; then + ssh-keygen -q -N "" -C "root@openssh-server" -t ecdsa -f $HOSTKEYDIR/ssh_host_ecdsa_key + fi + if [ ! -e $HOSTKEYDIR/ssh_host_ed25519_key ]; then + ssh-keygen -q -N "" -C "root@openssh-server" -t ed25519 -f $HOSTKEYDIR/ssh_host_ed25519_key + fi +} + +generate_keys() { + KEYDIR=$WORKDIR/keys + HOSTKEYDIR=$WORKDIR/local-git/ssh_host_keys + HOSTKEYS=("ssh_host_dsa_key" "ssh_host_rsa_key" "ssh_host_ecdsa_key" "ssh_host_ed25519_key") + if [ ! -e $KEYDIR ]; then + mkdir -p $KEYDIR + fi + if [ ! -e $KEYDIR/known_hosts ]; then + for key in "${HOSTKEYS[@]}"; do + echo "[local-git.local-git.svc.cluster.local]:2222 $(cat $HOSTKEYDIR/$key.pub | awk '{print $1" "$2}')" >> $KEYDIR/known_hosts + done + fi + + if [ ! -e $KEYDIR/identity ]; then + ssh-keygen -q -N "" -C "development@key" -f $KEYDIR/identity + fi + kubectl create secret generic local-git-secret \ + --from-file=$KEYDIR/identity \ + --from-file=$KEYDIR/identity.pub \ + --from-file=$KEYDIR/known_hosts --dry-run=client -o yaml | \ + kubectl patch --local -f- --type=json \ + -p='[{"op": "remove", "path": "/metadata/creationTimestamp"}]' -o yaml > $KEYDIR/local-git-secret.yaml + if [ ! -e $KEYDIR/age.agekey ];then + age-keygen -o $KEYDIR/age.agekey + fi +} + +prepare_flux_dir() { + KEYDIR=$WORKDIR/keys + FLUXDIR=$WORKDIR/../flux + CLUSTERDIR=$FLUXDIR/clusters/k3d-develop + + PUBAGEKEY=$(cat $KEYDIR/age.agekey | grep public\ key | awk -F:\ '{print $2}') + if [ ! -e $FLUXDIR/.sops.yaml ]; then + cat > $FLUXDIR/.sops.yaml < $CLUSTERDIR/flux-system/local-git-secret.yaml + fi +} + + +clean() { + KEYDIR=$WORKDIR/keys + FLUXDIR=$WORKDIR/../flux + CLUSTERDIR=$FLUXDIR/clusters/k3d-develop + HOSTKEYDIR=$WORKDIR/local-git/ssh_host_keys + + rm $HOSTKEYDIR/ssh_host_* + rm $KEYDIR/* + rmdir $KEYDIR + rm $FLUXDIR/.sops.yaml + rm $CLUSTERDIR/flux-system/local-git-secret.yaml +} + +start() { + + #k3d cluster create -c $WORKDIR/k3d-develop-config.yaml + #mkdir -p $WORKDIR/../kubeconfigs + #k3d kubeconfig get develop > $WORKDIR/../kubeconfigs/k3d-develop.yaml + + export KUBECONFIG="$WORKDIR/../kubeconfigs/k3d-develop.yaml" + + kubectl apply -k $WORKDIR/local-git + + git remote add develop ssh://git@localhost:2222/srv/git/local-flux.git 2>&1 >/dev/null || git remote set-url develop ssh://git@localhost:2222/srv/git/local-flux.git + + git remote get-url develop + + chmod 600 $WORKDIR/keys/identity + ssh-add $WORKDIR/keys/identity + + echo + echo "Wait until git server is ready" + echo + wait_until_ready local-git local-git + echo "Wait 15 sec" + sleep 15 + echo + git push develop --all +} + +delete() { + k3d cluster delete develop +} + +case $1 in + start) + start + ;; + delete) + delete + ;; + generate) + generate_host_keys + generate_keys + prepare_flux_dir + ;; + clean) + clean + ;; + *) + echo "$0 start | delete | generate | clean" + ;; +esac \ No newline at end of file diff --git a/local-k8s/readme.md b/local-k8s/readme.md new file mode 100644 index 0000000..04379ab --- /dev/null +++ b/local-k8s/readme.md @@ -0,0 +1,107 @@ +# Lokale Entwicklungsumgebung für fluxcd + +Hier kann ein lokaler Kubernetes Cluster hochgefahren werden. Zudem wird ein schlanker git server (openssh-server) als Pod gestartet. + +## Vorraussetzung + +Docker wird als gegeben vorrausgesetzt. + +* [k3d](https://k3d.io) + +Mit Hilfe von k3d kann ein lokaler Kubernetes gestartet werden. Dies funktioniert sowohl unter MacOS als auch Linux (Windows mit WSL). + +## Benutzung + +Starten der Entwicklungsumgebung: + +``` +./local-k8s.sh start +``` + +Entfernen des Kubernetes Clusters: + +``` +./local-k8s.sh delete +``` + +## Git Server + +Es wird ein Git Server (openssh server) als POD gestartet. Dieser ist dann unter ssh://git@localhost:2222/srv/git/local-git.git erreichbar. + +Auf dem HOST System: +``` +ssh://git@localhost:2222/srv/git/local-git.git +``` + +Von Kubernetes aus ist der Git Server unter folgender Adresse erreichbar: +``` +ssh://git@local-git.local-git.svc.cluster.local:2222/srv/git/local-flux.git +``` + +### Hinzufügen von Code in Flux + +Das `local-k8s.sh` Script fügt im Repo ein weiteres git-remote Target hinzu: + +``` +git remote add develop ssh://git@localhost:2222/srv/git/local-flux.git +``` + +Damit können nun Änderungen an dem k3d-develop cluster Teil (flux/cluster/k3d-develop) durchgeführt werden. Zudem muss in +`flux/cluster/k3d-develop/flux-sync.yaml` der Branch angepasst werden. Sobald dies erfolgt ist, können die Änderungen auf +den Git Server hinzugefügt werden: + +``` +git push develop +``` + +### Hinzufügen weiterer Repos + +Die Repos werden über ein Init Script angelegt: + + +__/local-git/custom-cont-init.d/init-git.sh:__ + +``` +#!/bin/bash + +GITREPOS=("local-flux" "test") + +apk update +apk add git +rm /etc/motd +mkdir -p /srv/git +for repo in ${GITREPOS[@]}; do + mkdir -p /srv/git/${repo}.git + cd /srv/git/${repo}.git + git init --bare +done +chown -R git:git /srv/git +``` + +Das Array GITREPOS steuert die Anlage der Repos. Diese werden nur beim Aufsetzen der Umgebung angelegt. Im laufenden Betrieb ist das +nicht möglich. + +## Test mit weiterer NodeGroup + +Möchte man etwas mit einer weiteren NodeGroup testen (wie z.b. nginx Ingress oder varnish), so kann man tatsächlich mit k3d einen weiteren Node simulieren: + +``` +k3d node create -c develop --k3s-node-label node=ingress ingress + +# -c develop - ist der Clustername, hier sollte develop schon richtig sein +# --k3s-node-label node=ingress - der node wird mit dem Label node=ingess makiert und kann später damit explzit gewählt werden +# ingress - so heißt diese Node Gruppe +``` + +Damit der Scheduler den neuen Node nicht verwendet, muss dieser noch getainted werden: + +``` +kubectl taint nodes k3d-ingress-0 node=ingress:NoSchedule + +# Der interne Node Name wird anscheinend wie folgt zusammengebaut: k3d-NODEGROUPNAME-COUNTER +# node=ingress:NoSchedule ist der taint +``` + +Hier gibt es weiterführende Infos: + +* [Taint and Tolerations](https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/) \ No newline at end of file