Promote OCIRepository API to v1 (GA)
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
This commit is contained in:
Stefan Prodan
parent
220044db74
commit
34bb9862e6
3
PROJECT
3
PROJECT
|
|
@ -40,4 +40,7 @@ resources:
|
||||||
- group: source
|
- group: source
|
||||||
kind: Bucket
|
kind: Bucket
|
||||||
version: v1
|
version: v1
|
||||||
|
- group: source
|
||||||
|
kind: OCIRepository
|
||||||
|
version: v1
|
||||||
version: "2"
|
version: "2"
|
||||||
|
|
|
||||||
14
README.md
14
README.md
|
|
@ -16,13 +16,13 @@ and is a core component of the [GitOps toolkit](https://fluxcd.io/flux/component
|
||||||
|
|
||||||
## APIs
|
## APIs
|
||||||
|
|
||||||
| Kind | API Version |
|
| Kind | API Version |
|
||||||
|-------------------------------------------------------|------------------------------------|
|
|----------------------------------------------------|-------------------------------|
|
||||||
| [GitRepository](docs/spec/v1/gitrepositories.md) | `source.toolkit.fluxcd.io/v1` |
|
| [GitRepository](docs/spec/v1/gitrepositories.md) | `source.toolkit.fluxcd.io/v1` |
|
||||||
| [OCIRepository](docs/spec/v1beta2/ocirepositories.md) | `source.toolkit.fluxcd.io/v1beta2` |
|
| [OCIRepository](docs/spec/v1/ocirepositories.md) | `source.toolkit.fluxcd.io/v1` |
|
||||||
| [HelmRepository](docs/spec/v1/helmrepositories.md) | `source.toolkit.fluxcd.io/v1` |
|
| [HelmRepository](docs/spec/v1/helmrepositories.md) | `source.toolkit.fluxcd.io/v1` |
|
||||||
| [HelmChart](docs/spec/v1/helmcharts.md) | `source.toolkit.fluxcd.io/v1` |
|
| [HelmChart](docs/spec/v1/helmcharts.md) | `source.toolkit.fluxcd.io/v1` |
|
||||||
| [Bucket](docs/spec/v1/buckets.md) | `source.toolkit.fluxcd.io/v1` |
|
| [Bucket](docs/spec/v1/buckets.md) | `source.toolkit.fluxcd.io/v1` |
|
||||||
|
|
||||||
## Features
|
## Features
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -22,8 +22,8 @@ require (
|
||||||
github.com/modern-go/reflect2 v1.0.2 // indirect
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
||||||
github.com/spf13/pflag v1.0.6 // indirect
|
github.com/spf13/pflag v1.0.6 // indirect
|
||||||
github.com/x448/float16 v0.8.4 // indirect
|
github.com/x448/float16 v0.8.4 // indirect
|
||||||
golang.org/x/net v0.39.0 // indirect
|
golang.org/x/net v0.40.0 // indirect
|
||||||
golang.org/x/text v0.24.0 // indirect
|
golang.org/x/text v0.25.0 // indirect
|
||||||
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
|
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
|
||||||
gopkg.in/inf.v0 v0.9.1 // indirect
|
gopkg.in/inf.v0 v0.9.1 // indirect
|
||||||
k8s.io/klog/v2 v2.130.1 // indirect
|
k8s.io/klog/v2 v2.130.1 // indirect
|
||||||
|
|
|
||||||
12
api/go.sum
12
api/go.sum
|
|
@ -65,20 +65,20 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
|
||||||
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||||
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||||
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
|
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
|
||||||
golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
|
golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
|
||||||
golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
|
golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
|
||||||
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||||
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||||
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
|
golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
|
||||||
golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
|
golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
|
||||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||||
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||||
golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
|
golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
|
||||||
golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
|
golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
|
||||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||||
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||||
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,313 @@
|
||||||
|
/*
|
||||||
|
Copyright 2025 The Flux authors
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package v1
|
||||||
|
|
||||||
|
import (
|
||||||
|
"time"
|
||||||
|
|
||||||
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||||
|
|
||||||
|
"github.com/fluxcd/pkg/apis/meta"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
// OCIRepositoryKind is the string representation of an OCIRepository.
|
||||||
|
OCIRepositoryKind = "OCIRepository"
|
||||||
|
|
||||||
|
// OCIRepositoryPrefix is the prefix used for OCIRepository URLs.
|
||||||
|
OCIRepositoryPrefix = "oci://"
|
||||||
|
|
||||||
|
// GenericOCIProvider provides support for authentication using static credentials
|
||||||
|
// for any OCI compatible API such as Docker Registry, GitHub Container Registry,
|
||||||
|
// Docker Hub, Quay, etc.
|
||||||
|
GenericOCIProvider string = "generic"
|
||||||
|
|
||||||
|
// AmazonOCIProvider provides support for OCI authentication using AWS IRSA.
|
||||||
|
AmazonOCIProvider string = "aws"
|
||||||
|
|
||||||
|
// GoogleOCIProvider provides support for OCI authentication using GCP workload identity.
|
||||||
|
GoogleOCIProvider string = "gcp"
|
||||||
|
|
||||||
|
// AzureOCIProvider provides support for OCI authentication using a Azure Service Principal,
|
||||||
|
// Managed Identity or Shared Key.
|
||||||
|
AzureOCIProvider string = "azure"
|
||||||
|
|
||||||
|
// OCILayerExtract defines the operation type for extracting the content from an OCI artifact layer.
|
||||||
|
OCILayerExtract = "extract"
|
||||||
|
|
||||||
|
// OCILayerCopy defines the operation type for copying the content from an OCI artifact layer.
|
||||||
|
OCILayerCopy = "copy"
|
||||||
|
)
|
||||||
|
|
||||||
|
// OCIRepositorySpec defines the desired state of OCIRepository
|
||||||
|
type OCIRepositorySpec struct {
|
||||||
|
// URL is a reference to an OCI artifact repository hosted
|
||||||
|
// on a remote container registry.
|
||||||
|
// +kubebuilder:validation:Pattern="^oci://.*$"
|
||||||
|
// +required
|
||||||
|
URL string `json:"url"`
|
||||||
|
|
||||||
|
// The OCI reference to pull and monitor for changes,
|
||||||
|
// defaults to the latest tag.
|
||||||
|
// +optional
|
||||||
|
Reference *OCIRepositoryRef `json:"ref,omitempty"`
|
||||||
|
|
||||||
|
// LayerSelector specifies which layer should be extracted from the OCI artifact.
|
||||||
|
// When not specified, the first layer found in the artifact is selected.
|
||||||
|
// +optional
|
||||||
|
LayerSelector *OCILayerSelector `json:"layerSelector,omitempty"`
|
||||||
|
|
||||||
|
// The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.
|
||||||
|
// When not specified, defaults to 'generic'.
|
||||||
|
// +kubebuilder:validation:Enum=generic;aws;azure;gcp
|
||||||
|
// +kubebuilder:default:=generic
|
||||||
|
// +optional
|
||||||
|
Provider string `json:"provider,omitempty"`
|
||||||
|
|
||||||
|
// SecretRef contains the secret name containing the registry login
|
||||||
|
// credentials to resolve image metadata.
|
||||||
|
// The secret must be of type kubernetes.io/dockerconfigjson.
|
||||||
|
// +optional
|
||||||
|
SecretRef *meta.LocalObjectReference `json:"secretRef,omitempty"`
|
||||||
|
|
||||||
|
// Verify contains the secret name containing the trusted public keys
|
||||||
|
// used to verify the signature and specifies which provider to use to check
|
||||||
|
// whether OCI image is authentic.
|
||||||
|
// +optional
|
||||||
|
Verify *OCIRepositoryVerification `json:"verify,omitempty"`
|
||||||
|
|
||||||
|
// ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
|
||||||
|
// the image pull if the service account has attached pull secrets. For more information:
|
||||||
|
// https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account
|
||||||
|
// +optional
|
||||||
|
ServiceAccountName string `json:"serviceAccountName,omitempty"`
|
||||||
|
|
||||||
|
// CertSecretRef can be given the name of a Secret containing
|
||||||
|
// either or both of
|
||||||
|
//
|
||||||
|
// - a PEM-encoded client certificate (`tls.crt`) and private
|
||||||
|
// key (`tls.key`);
|
||||||
|
// - a PEM-encoded CA certificate (`ca.crt`)
|
||||||
|
//
|
||||||
|
// and whichever are supplied, will be used for connecting to the
|
||||||
|
// registry. The client cert and key are useful if you are
|
||||||
|
// authenticating with a certificate; the CA cert is useful if
|
||||||
|
// you are using a self-signed server certificate. The Secret must
|
||||||
|
// be of type `Opaque` or `kubernetes.io/tls`.
|
||||||
|
//
|
||||||
|
// Note: Support for the `caFile`, `certFile` and `keyFile` keys have
|
||||||
|
// been deprecated.
|
||||||
|
// +optional
|
||||||
|
CertSecretRef *meta.LocalObjectReference `json:"certSecretRef,omitempty"`
|
||||||
|
|
||||||
|
// ProxySecretRef specifies the Secret containing the proxy configuration
|
||||||
|
// to use while communicating with the container registry.
|
||||||
|
// +optional
|
||||||
|
ProxySecretRef *meta.LocalObjectReference `json:"proxySecretRef,omitempty"`
|
||||||
|
|
||||||
|
// Interval at which the OCIRepository URL is checked for updates.
|
||||||
|
// This interval is approximate and may be subject to jitter to ensure
|
||||||
|
// efficient use of resources.
|
||||||
|
// +kubebuilder:validation:Type=string
|
||||||
|
// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
|
||||||
|
// +required
|
||||||
|
Interval metav1.Duration `json:"interval"`
|
||||||
|
|
||||||
|
// The timeout for remote OCI Repository operations like pulling, defaults to 60s.
|
||||||
|
// +kubebuilder:default="60s"
|
||||||
|
// +kubebuilder:validation:Type=string
|
||||||
|
// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m))+$"
|
||||||
|
// +optional
|
||||||
|
Timeout *metav1.Duration `json:"timeout,omitempty"`
|
||||||
|
|
||||||
|
// Ignore overrides the set of excluded patterns in the .sourceignore format
|
||||||
|
// (which is the same as .gitignore). If not provided, a default will be used,
|
||||||
|
// consult the documentation for your version to find out what those are.
|
||||||
|
// +optional
|
||||||
|
Ignore *string `json:"ignore,omitempty"`
|
||||||
|
|
||||||
|
// Insecure allows connecting to a non-TLS HTTP container registry.
|
||||||
|
// +optional
|
||||||
|
Insecure bool `json:"insecure,omitempty"`
|
||||||
|
|
||||||
|
// This flag tells the controller to suspend the reconciliation of this source.
|
||||||
|
// +optional
|
||||||
|
Suspend bool `json:"suspend,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// OCIRepositoryRef defines the image reference for the OCIRepository's URL
|
||||||
|
type OCIRepositoryRef struct {
|
||||||
|
// Digest is the image digest to pull, takes precedence over SemVer.
|
||||||
|
// The value should be in the format 'sha256:<HASH>'.
|
||||||
|
// +optional
|
||||||
|
Digest string `json:"digest,omitempty"`
|
||||||
|
|
||||||
|
// SemVer is the range of tags to pull selecting the latest within
|
||||||
|
// the range, takes precedence over Tag.
|
||||||
|
// +optional
|
||||||
|
SemVer string `json:"semver,omitempty"`
|
||||||
|
|
||||||
|
// SemverFilter is a regex pattern to filter the tags within the SemVer range.
|
||||||
|
// +optional
|
||||||
|
SemverFilter string `json:"semverFilter,omitempty"`
|
||||||
|
|
||||||
|
// Tag is the image tag to pull, defaults to latest.
|
||||||
|
// +optional
|
||||||
|
Tag string `json:"tag,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// OCILayerSelector specifies which layer should be extracted from an OCI Artifact
|
||||||
|
type OCILayerSelector struct {
|
||||||
|
// MediaType specifies the OCI media type of the layer
|
||||||
|
// which should be extracted from the OCI Artifact. The
|
||||||
|
// first layer matching this type is selected.
|
||||||
|
// +optional
|
||||||
|
MediaType string `json:"mediaType,omitempty"`
|
||||||
|
|
||||||
|
// Operation specifies how the selected layer should be processed.
|
||||||
|
// By default, the layer compressed content is extracted to storage.
|
||||||
|
// When the operation is set to 'copy', the layer compressed content
|
||||||
|
// is persisted to storage as it is.
|
||||||
|
// +kubebuilder:validation:Enum=extract;copy
|
||||||
|
// +optional
|
||||||
|
Operation string `json:"operation,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// OCIRepositoryStatus defines the observed state of OCIRepository
|
||||||
|
type OCIRepositoryStatus struct {
|
||||||
|
// ObservedGeneration is the last observed generation.
|
||||||
|
// +optional
|
||||||
|
ObservedGeneration int64 `json:"observedGeneration,omitempty"`
|
||||||
|
|
||||||
|
// Conditions holds the conditions for the OCIRepository.
|
||||||
|
// +optional
|
||||||
|
Conditions []metav1.Condition `json:"conditions,omitempty"`
|
||||||
|
|
||||||
|
// URL is the download link for the artifact output of the last OCI Repository sync.
|
||||||
|
// +optional
|
||||||
|
URL string `json:"url,omitempty"`
|
||||||
|
|
||||||
|
// Artifact represents the output of the last successful OCI Repository sync.
|
||||||
|
// +optional
|
||||||
|
Artifact *Artifact `json:"artifact,omitempty"`
|
||||||
|
|
||||||
|
// ContentConfigChecksum is a checksum of all the configurations related to
|
||||||
|
// the content of the source artifact:
|
||||||
|
// - .spec.ignore
|
||||||
|
// - .spec.layerSelector
|
||||||
|
// observed in .status.observedGeneration version of the object. This can
|
||||||
|
// be used to determine if the content configuration has changed and the
|
||||||
|
// artifact needs to be rebuilt.
|
||||||
|
// It has the format of `<algo>:<checksum>`, for example: `sha256:<checksum>`.
|
||||||
|
//
|
||||||
|
// Deprecated: Replaced with explicit fields for observed artifact content
|
||||||
|
// config in the status.
|
||||||
|
// +optional
|
||||||
|
ContentConfigChecksum string `json:"contentConfigChecksum,omitempty"`
|
||||||
|
|
||||||
|
// ObservedIgnore is the observed exclusion patterns used for constructing
|
||||||
|
// the source artifact.
|
||||||
|
// +optional
|
||||||
|
ObservedIgnore *string `json:"observedIgnore,omitempty"`
|
||||||
|
|
||||||
|
// ObservedLayerSelector is the observed layer selector used for constructing
|
||||||
|
// the source artifact.
|
||||||
|
// +optional
|
||||||
|
ObservedLayerSelector *OCILayerSelector `json:"observedLayerSelector,omitempty"`
|
||||||
|
|
||||||
|
meta.ReconcileRequestStatus `json:",inline"`
|
||||||
|
}
|
||||||
|
|
||||||
|
const (
|
||||||
|
// OCIPullFailedReason signals that a pull operation failed.
|
||||||
|
OCIPullFailedReason string = "OCIArtifactPullFailed"
|
||||||
|
|
||||||
|
// OCILayerOperationFailedReason signals that an OCI layer operation failed.
|
||||||
|
OCILayerOperationFailedReason string = "OCIArtifactLayerOperationFailed"
|
||||||
|
)
|
||||||
|
|
||||||
|
// GetConditions returns the status conditions of the object.
|
||||||
|
func (in OCIRepository) GetConditions() []metav1.Condition {
|
||||||
|
return in.Status.Conditions
|
||||||
|
}
|
||||||
|
|
||||||
|
// SetConditions sets the status conditions on the object.
|
||||||
|
func (in *OCIRepository) SetConditions(conditions []metav1.Condition) {
|
||||||
|
in.Status.Conditions = conditions
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetRequeueAfter returns the duration after which the OCIRepository must be
|
||||||
|
// reconciled again.
|
||||||
|
func (in OCIRepository) GetRequeueAfter() time.Duration {
|
||||||
|
return in.Spec.Interval.Duration
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetArtifact returns the latest Artifact from the OCIRepository if present in
|
||||||
|
// the status sub-resource.
|
||||||
|
func (in *OCIRepository) GetArtifact() *Artifact {
|
||||||
|
return in.Status.Artifact
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetLayerMediaType returns the media type layer selector if found in spec.
|
||||||
|
func (in *OCIRepository) GetLayerMediaType() string {
|
||||||
|
if in.Spec.LayerSelector == nil {
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
|
||||||
|
return in.Spec.LayerSelector.MediaType
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetLayerOperation returns the layer selector operation (defaults to extract).
|
||||||
|
func (in *OCIRepository) GetLayerOperation() string {
|
||||||
|
if in.Spec.LayerSelector == nil || in.Spec.LayerSelector.Operation == "" {
|
||||||
|
return OCILayerExtract
|
||||||
|
}
|
||||||
|
|
||||||
|
return in.Spec.LayerSelector.Operation
|
||||||
|
}
|
||||||
|
|
||||||
|
// +genclient
|
||||||
|
// +kubebuilder:storageversion
|
||||||
|
// +kubebuilder:object:root=true
|
||||||
|
// +kubebuilder:resource:shortName=ocirepo
|
||||||
|
// +kubebuilder:subresource:status
|
||||||
|
// +kubebuilder:printcolumn:name="URL",type=string,JSONPath=`.spec.url`
|
||||||
|
// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description=""
|
||||||
|
// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].message",description=""
|
||||||
|
// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description=""
|
||||||
|
|
||||||
|
// OCIRepository is the Schema for the ocirepositories API
|
||||||
|
type OCIRepository struct {
|
||||||
|
metav1.TypeMeta `json:",inline"`
|
||||||
|
metav1.ObjectMeta `json:"metadata,omitempty"`
|
||||||
|
|
||||||
|
Spec OCIRepositorySpec `json:"spec,omitempty"`
|
||||||
|
// +kubebuilder:default={"observedGeneration":-1}
|
||||||
|
Status OCIRepositoryStatus `json:"status,omitempty"`
|
||||||
|
}
|
||||||
|
|
||||||
|
// OCIRepositoryList contains a list of OCIRepository
|
||||||
|
// +kubebuilder:object:root=true
|
||||||
|
type OCIRepositoryList struct {
|
||||||
|
metav1.TypeMeta `json:",inline"`
|
||||||
|
metav1.ListMeta `json:"metadata,omitempty"`
|
||||||
|
Items []OCIRepository `json:"items"`
|
||||||
|
}
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
SchemeBuilder.Register(&OCIRepository{}, &OCIRepositoryList{})
|
||||||
|
}
|
||||||
|
|
@ -696,6 +696,189 @@ func (in *LocalHelmChartSourceReference) DeepCopy() *LocalHelmChartSourceReferen
|
||||||
return out
|
return out
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *OCILayerSelector) DeepCopyInto(out *OCILayerSelector) {
|
||||||
|
*out = *in
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OCILayerSelector.
|
||||||
|
func (in *OCILayerSelector) DeepCopy() *OCILayerSelector {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(OCILayerSelector)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *OCIRepository) DeepCopyInto(out *OCIRepository) {
|
||||||
|
*out = *in
|
||||||
|
out.TypeMeta = in.TypeMeta
|
||||||
|
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
||||||
|
in.Spec.DeepCopyInto(&out.Spec)
|
||||||
|
in.Status.DeepCopyInto(&out.Status)
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OCIRepository.
|
||||||
|
func (in *OCIRepository) DeepCopy() *OCIRepository {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(OCIRepository)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||||
|
func (in *OCIRepository) DeepCopyObject() runtime.Object {
|
||||||
|
if c := in.DeepCopy(); c != nil {
|
||||||
|
return c
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *OCIRepositoryList) DeepCopyInto(out *OCIRepositoryList) {
|
||||||
|
*out = *in
|
||||||
|
out.TypeMeta = in.TypeMeta
|
||||||
|
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
||||||
|
if in.Items != nil {
|
||||||
|
in, out := &in.Items, &out.Items
|
||||||
|
*out = make([]OCIRepository, len(*in))
|
||||||
|
for i := range *in {
|
||||||
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OCIRepositoryList.
|
||||||
|
func (in *OCIRepositoryList) DeepCopy() *OCIRepositoryList {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(OCIRepositoryList)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||||
|
func (in *OCIRepositoryList) DeepCopyObject() runtime.Object {
|
||||||
|
if c := in.DeepCopy(); c != nil {
|
||||||
|
return c
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *OCIRepositoryRef) DeepCopyInto(out *OCIRepositoryRef) {
|
||||||
|
*out = *in
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OCIRepositoryRef.
|
||||||
|
func (in *OCIRepositoryRef) DeepCopy() *OCIRepositoryRef {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(OCIRepositoryRef)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *OCIRepositorySpec) DeepCopyInto(out *OCIRepositorySpec) {
|
||||||
|
*out = *in
|
||||||
|
if in.Reference != nil {
|
||||||
|
in, out := &in.Reference, &out.Reference
|
||||||
|
*out = new(OCIRepositoryRef)
|
||||||
|
**out = **in
|
||||||
|
}
|
||||||
|
if in.LayerSelector != nil {
|
||||||
|
in, out := &in.LayerSelector, &out.LayerSelector
|
||||||
|
*out = new(OCILayerSelector)
|
||||||
|
**out = **in
|
||||||
|
}
|
||||||
|
if in.SecretRef != nil {
|
||||||
|
in, out := &in.SecretRef, &out.SecretRef
|
||||||
|
*out = new(meta.LocalObjectReference)
|
||||||
|
**out = **in
|
||||||
|
}
|
||||||
|
if in.Verify != nil {
|
||||||
|
in, out := &in.Verify, &out.Verify
|
||||||
|
*out = new(OCIRepositoryVerification)
|
||||||
|
(*in).DeepCopyInto(*out)
|
||||||
|
}
|
||||||
|
if in.CertSecretRef != nil {
|
||||||
|
in, out := &in.CertSecretRef, &out.CertSecretRef
|
||||||
|
*out = new(meta.LocalObjectReference)
|
||||||
|
**out = **in
|
||||||
|
}
|
||||||
|
if in.ProxySecretRef != nil {
|
||||||
|
in, out := &in.ProxySecretRef, &out.ProxySecretRef
|
||||||
|
*out = new(meta.LocalObjectReference)
|
||||||
|
**out = **in
|
||||||
|
}
|
||||||
|
out.Interval = in.Interval
|
||||||
|
if in.Timeout != nil {
|
||||||
|
in, out := &in.Timeout, &out.Timeout
|
||||||
|
*out = new(metav1.Duration)
|
||||||
|
**out = **in
|
||||||
|
}
|
||||||
|
if in.Ignore != nil {
|
||||||
|
in, out := &in.Ignore, &out.Ignore
|
||||||
|
*out = new(string)
|
||||||
|
**out = **in
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OCIRepositorySpec.
|
||||||
|
func (in *OCIRepositorySpec) DeepCopy() *OCIRepositorySpec {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(OCIRepositorySpec)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
|
func (in *OCIRepositoryStatus) DeepCopyInto(out *OCIRepositoryStatus) {
|
||||||
|
*out = *in
|
||||||
|
if in.Conditions != nil {
|
||||||
|
in, out := &in.Conditions, &out.Conditions
|
||||||
|
*out = make([]metav1.Condition, len(*in))
|
||||||
|
for i := range *in {
|
||||||
|
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if in.Artifact != nil {
|
||||||
|
in, out := &in.Artifact, &out.Artifact
|
||||||
|
*out = new(Artifact)
|
||||||
|
(*in).DeepCopyInto(*out)
|
||||||
|
}
|
||||||
|
if in.ObservedIgnore != nil {
|
||||||
|
in, out := &in.ObservedIgnore, &out.ObservedIgnore
|
||||||
|
*out = new(string)
|
||||||
|
**out = **in
|
||||||
|
}
|
||||||
|
if in.ObservedLayerSelector != nil {
|
||||||
|
in, out := &in.ObservedLayerSelector, &out.ObservedLayerSelector
|
||||||
|
*out = new(OCILayerSelector)
|
||||||
|
**out = **in
|
||||||
|
}
|
||||||
|
out.ReconcileRequestStatus = in.ReconcileRequestStatus
|
||||||
|
}
|
||||||
|
|
||||||
|
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OCIRepositoryStatus.
|
||||||
|
func (in *OCIRepositoryStatus) DeepCopy() *OCIRepositoryStatus {
|
||||||
|
if in == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
out := new(OCIRepositoryStatus)
|
||||||
|
in.DeepCopyInto(out)
|
||||||
|
return out
|
||||||
|
}
|
||||||
|
|
||||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||||
func (in *OCIRepositoryVerification) DeepCopyInto(out *OCIRepositoryVerification) {
|
func (in *OCIRepositoryVerification) DeepCopyInto(out *OCIRepositoryVerification) {
|
||||||
*out = *in
|
*out = *in
|
||||||
|
|
|
||||||
|
|
@ -283,10 +283,10 @@ func (in *OCIRepository) GetLayerOperation() string {
|
||||||
}
|
}
|
||||||
|
|
||||||
// +genclient
|
// +genclient
|
||||||
// +kubebuilder:storageversion
|
|
||||||
// +kubebuilder:object:root=true
|
// +kubebuilder:object:root=true
|
||||||
// +kubebuilder:resource:shortName=ocirepo
|
// +kubebuilder:resource:shortName=ocirepo
|
||||||
// +kubebuilder:subresource:status
|
// +kubebuilder:subresource:status
|
||||||
|
// +kubebuilder:deprecatedversion:warning="v1beta2 OCIRepository is deprecated, upgrade to v1"
|
||||||
// +kubebuilder:printcolumn:name="URL",type=string,JSONPath=`.spec.url`
|
// +kubebuilder:printcolumn:name="URL",type=string,JSONPath=`.spec.url`
|
||||||
// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description=""
|
// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description=""
|
||||||
// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].message",description=""
|
// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].message",description=""
|
||||||
|
|
|
||||||
|
|
@ -29,7 +29,7 @@ spec:
|
||||||
- jsonPath: .metadata.creationTimestamp
|
- jsonPath: .metadata.creationTimestamp
|
||||||
name: Age
|
name: Age
|
||||||
type: date
|
type: date
|
||||||
name: v1beta2
|
name: v1
|
||||||
schema:
|
schema:
|
||||||
openAPIV3Schema:
|
openAPIV3Schema:
|
||||||
description: OCIRepository is the Schema for the ocirepositories API
|
description: OCIRepository is the Schema for the ocirepositories API
|
||||||
|
|
@ -425,3 +425,414 @@ spec:
|
||||||
storage: true
|
storage: true
|
||||||
subresources:
|
subresources:
|
||||||
status: {}
|
status: {}
|
||||||
|
- additionalPrinterColumns:
|
||||||
|
- jsonPath: .spec.url
|
||||||
|
name: URL
|
||||||
|
type: string
|
||||||
|
- jsonPath: .status.conditions[?(@.type=="Ready")].status
|
||||||
|
name: Ready
|
||||||
|
type: string
|
||||||
|
- jsonPath: .status.conditions[?(@.type=="Ready")].message
|
||||||
|
name: Status
|
||||||
|
type: string
|
||||||
|
- jsonPath: .metadata.creationTimestamp
|
||||||
|
name: Age
|
||||||
|
type: date
|
||||||
|
deprecated: true
|
||||||
|
deprecationWarning: v1beta2 OCIRepository is deprecated, upgrade to v1
|
||||||
|
name: v1beta2
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: OCIRepository is the Schema for the ocirepositories API
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: |-
|
||||||
|
APIVersion defines the versioned schema of this representation of an object.
|
||||||
|
Servers should convert recognized schemas to the latest internal value, and
|
||||||
|
may reject unrecognized values.
|
||||||
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: |-
|
||||||
|
Kind is a string value representing the REST resource this object represents.
|
||||||
|
Servers may infer this from the endpoint the client submits requests to.
|
||||||
|
Cannot be updated.
|
||||||
|
In CamelCase.
|
||||||
|
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: OCIRepositorySpec defines the desired state of OCIRepository
|
||||||
|
properties:
|
||||||
|
certSecretRef:
|
||||||
|
description: |-
|
||||||
|
CertSecretRef can be given the name of a Secret containing
|
||||||
|
either or both of
|
||||||
|
|
||||||
|
- a PEM-encoded client certificate (`tls.crt`) and private
|
||||||
|
key (`tls.key`);
|
||||||
|
- a PEM-encoded CA certificate (`ca.crt`)
|
||||||
|
|
||||||
|
and whichever are supplied, will be used for connecting to the
|
||||||
|
registry. The client cert and key are useful if you are
|
||||||
|
authenticating with a certificate; the CA cert is useful if
|
||||||
|
you are using a self-signed server certificate. The Secret must
|
||||||
|
be of type `Opaque` or `kubernetes.io/tls`.
|
||||||
|
|
||||||
|
Note: Support for the `caFile`, `certFile` and `keyFile` keys have
|
||||||
|
been deprecated.
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
description: Name of the referent.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
type: object
|
||||||
|
ignore:
|
||||||
|
description: |-
|
||||||
|
Ignore overrides the set of excluded patterns in the .sourceignore format
|
||||||
|
(which is the same as .gitignore). If not provided, a default will be used,
|
||||||
|
consult the documentation for your version to find out what those are.
|
||||||
|
type: string
|
||||||
|
insecure:
|
||||||
|
description: Insecure allows connecting to a non-TLS HTTP container
|
||||||
|
registry.
|
||||||
|
type: boolean
|
||||||
|
interval:
|
||||||
|
description: |-
|
||||||
|
Interval at which the OCIRepository URL is checked for updates.
|
||||||
|
This interval is approximate and may be subject to jitter to ensure
|
||||||
|
efficient use of resources.
|
||||||
|
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
|
||||||
|
type: string
|
||||||
|
layerSelector:
|
||||||
|
description: |-
|
||||||
|
LayerSelector specifies which layer should be extracted from the OCI artifact.
|
||||||
|
When not specified, the first layer found in the artifact is selected.
|
||||||
|
properties:
|
||||||
|
mediaType:
|
||||||
|
description: |-
|
||||||
|
MediaType specifies the OCI media type of the layer
|
||||||
|
which should be extracted from the OCI Artifact. The
|
||||||
|
first layer matching this type is selected.
|
||||||
|
type: string
|
||||||
|
operation:
|
||||||
|
description: |-
|
||||||
|
Operation specifies how the selected layer should be processed.
|
||||||
|
By default, the layer compressed content is extracted to storage.
|
||||||
|
When the operation is set to 'copy', the layer compressed content
|
||||||
|
is persisted to storage as it is.
|
||||||
|
enum:
|
||||||
|
- extract
|
||||||
|
- copy
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
provider:
|
||||||
|
default: generic
|
||||||
|
description: |-
|
||||||
|
The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.
|
||||||
|
When not specified, defaults to 'generic'.
|
||||||
|
enum:
|
||||||
|
- generic
|
||||||
|
- aws
|
||||||
|
- azure
|
||||||
|
- gcp
|
||||||
|
type: string
|
||||||
|
proxySecretRef:
|
||||||
|
description: |-
|
||||||
|
ProxySecretRef specifies the Secret containing the proxy configuration
|
||||||
|
to use while communicating with the container registry.
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
description: Name of the referent.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
type: object
|
||||||
|
ref:
|
||||||
|
description: |-
|
||||||
|
The OCI reference to pull and monitor for changes,
|
||||||
|
defaults to the latest tag.
|
||||||
|
properties:
|
||||||
|
digest:
|
||||||
|
description: |-
|
||||||
|
Digest is the image digest to pull, takes precedence over SemVer.
|
||||||
|
The value should be in the format 'sha256:<HASH>'.
|
||||||
|
type: string
|
||||||
|
semver:
|
||||||
|
description: |-
|
||||||
|
SemVer is the range of tags to pull selecting the latest within
|
||||||
|
the range, takes precedence over Tag.
|
||||||
|
type: string
|
||||||
|
semverFilter:
|
||||||
|
description: SemverFilter is a regex pattern to filter the tags
|
||||||
|
within the SemVer range.
|
||||||
|
type: string
|
||||||
|
tag:
|
||||||
|
description: Tag is the image tag to pull, defaults to latest.
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
secretRef:
|
||||||
|
description: |-
|
||||||
|
SecretRef contains the secret name containing the registry login
|
||||||
|
credentials to resolve image metadata.
|
||||||
|
The secret must be of type kubernetes.io/dockerconfigjson.
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
description: Name of the referent.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
type: object
|
||||||
|
serviceAccountName:
|
||||||
|
description: |-
|
||||||
|
ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
|
||||||
|
the image pull if the service account has attached pull secrets. For more information:
|
||||||
|
https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account
|
||||||
|
type: string
|
||||||
|
suspend:
|
||||||
|
description: This flag tells the controller to suspend the reconciliation
|
||||||
|
of this source.
|
||||||
|
type: boolean
|
||||||
|
timeout:
|
||||||
|
default: 60s
|
||||||
|
description: The timeout for remote OCI Repository operations like
|
||||||
|
pulling, defaults to 60s.
|
||||||
|
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$
|
||||||
|
type: string
|
||||||
|
url:
|
||||||
|
description: |-
|
||||||
|
URL is a reference to an OCI artifact repository hosted
|
||||||
|
on a remote container registry.
|
||||||
|
pattern: ^oci://.*$
|
||||||
|
type: string
|
||||||
|
verify:
|
||||||
|
description: |-
|
||||||
|
Verify contains the secret name containing the trusted public keys
|
||||||
|
used to verify the signature and specifies which provider to use to check
|
||||||
|
whether OCI image is authentic.
|
||||||
|
properties:
|
||||||
|
matchOIDCIdentity:
|
||||||
|
description: |-
|
||||||
|
MatchOIDCIdentity specifies the identity matching criteria to use
|
||||||
|
while verifying an OCI artifact which was signed using Cosign keyless
|
||||||
|
signing. The artifact's identity is deemed to be verified if any of the
|
||||||
|
specified matchers match against the identity.
|
||||||
|
items:
|
||||||
|
description: |-
|
||||||
|
OIDCIdentityMatch specifies options for verifying the certificate identity,
|
||||||
|
i.e. the issuer and the subject of the certificate.
|
||||||
|
properties:
|
||||||
|
issuer:
|
||||||
|
description: |-
|
||||||
|
Issuer specifies the regex pattern to match against to verify
|
||||||
|
the OIDC issuer in the Fulcio certificate. The pattern must be a
|
||||||
|
valid Go regular expression.
|
||||||
|
type: string
|
||||||
|
subject:
|
||||||
|
description: |-
|
||||||
|
Subject specifies the regex pattern to match against to verify
|
||||||
|
the identity subject in the Fulcio certificate. The pattern must
|
||||||
|
be a valid Go regular expression.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- issuer
|
||||||
|
- subject
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
provider:
|
||||||
|
default: cosign
|
||||||
|
description: Provider specifies the technology used to sign the
|
||||||
|
OCI Artifact.
|
||||||
|
enum:
|
||||||
|
- cosign
|
||||||
|
- notation
|
||||||
|
type: string
|
||||||
|
secretRef:
|
||||||
|
description: |-
|
||||||
|
SecretRef specifies the Kubernetes Secret containing the
|
||||||
|
trusted public keys.
|
||||||
|
properties:
|
||||||
|
name:
|
||||||
|
description: Name of the referent.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- provider
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- interval
|
||||||
|
- url
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
default:
|
||||||
|
observedGeneration: -1
|
||||||
|
description: OCIRepositoryStatus defines the observed state of OCIRepository
|
||||||
|
properties:
|
||||||
|
artifact:
|
||||||
|
description: Artifact represents the output of the last successful
|
||||||
|
OCI Repository sync.
|
||||||
|
properties:
|
||||||
|
digest:
|
||||||
|
description: Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
|
||||||
|
pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$
|
||||||
|
type: string
|
||||||
|
lastUpdateTime:
|
||||||
|
description: |-
|
||||||
|
LastUpdateTime is the timestamp corresponding to the last update of the
|
||||||
|
Artifact.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
additionalProperties:
|
||||||
|
type: string
|
||||||
|
description: Metadata holds upstream information such as OCI annotations.
|
||||||
|
type: object
|
||||||
|
path:
|
||||||
|
description: |-
|
||||||
|
Path is the relative file path of the Artifact. It can be used to locate
|
||||||
|
the file in the root of the Artifact storage on the local file system of
|
||||||
|
the controller managing the Source.
|
||||||
|
type: string
|
||||||
|
revision:
|
||||||
|
description: |-
|
||||||
|
Revision is a human-readable identifier traceable in the origin source
|
||||||
|
system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
|
||||||
|
type: string
|
||||||
|
size:
|
||||||
|
description: Size is the number of bytes in the file.
|
||||||
|
format: int64
|
||||||
|
type: integer
|
||||||
|
url:
|
||||||
|
description: |-
|
||||||
|
URL is the HTTP address of the Artifact as exposed by the controller
|
||||||
|
managing the Source. It can be used to retrieve the Artifact for
|
||||||
|
consumption, e.g. by another controller applying the Artifact contents.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- lastUpdateTime
|
||||||
|
- path
|
||||||
|
- revision
|
||||||
|
- url
|
||||||
|
type: object
|
||||||
|
conditions:
|
||||||
|
description: Conditions holds the conditions for the OCIRepository.
|
||||||
|
items:
|
||||||
|
description: Condition contains details for one aspect of the current
|
||||||
|
state of this API Resource.
|
||||||
|
properties:
|
||||||
|
lastTransitionTime:
|
||||||
|
description: |-
|
||||||
|
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||||
|
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: |-
|
||||||
|
message is a human readable message indicating details about the transition.
|
||||||
|
This may be an empty string.
|
||||||
|
maxLength: 32768
|
||||||
|
type: string
|
||||||
|
observedGeneration:
|
||||||
|
description: |-
|
||||||
|
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||||
|
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||||
|
with respect to the current state of the instance.
|
||||||
|
format: int64
|
||||||
|
minimum: 0
|
||||||
|
type: integer
|
||||||
|
reason:
|
||||||
|
description: |-
|
||||||
|
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||||
|
Producers of specific condition types may define expected values and meanings for this field,
|
||||||
|
and whether the values are considered a guaranteed API.
|
||||||
|
The value should be a CamelCase string.
|
||||||
|
This field may not be empty.
|
||||||
|
maxLength: 1024
|
||||||
|
minLength: 1
|
||||||
|
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||||
|
type: string
|
||||||
|
status:
|
||||||
|
description: status of the condition, one of True, False, Unknown.
|
||||||
|
enum:
|
||||||
|
- "True"
|
||||||
|
- "False"
|
||||||
|
- Unknown
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||||
|
maxLength: 316
|
||||||
|
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- lastTransitionTime
|
||||||
|
- message
|
||||||
|
- reason
|
||||||
|
- status
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
contentConfigChecksum:
|
||||||
|
description: |-
|
||||||
|
ContentConfigChecksum is a checksum of all the configurations related to
|
||||||
|
the content of the source artifact:
|
||||||
|
- .spec.ignore
|
||||||
|
- .spec.layerSelector
|
||||||
|
observed in .status.observedGeneration version of the object. This can
|
||||||
|
be used to determine if the content configuration has changed and the
|
||||||
|
artifact needs to be rebuilt.
|
||||||
|
It has the format of `<algo>:<checksum>`, for example: `sha256:<checksum>`.
|
||||||
|
|
||||||
|
Deprecated: Replaced with explicit fields for observed artifact content
|
||||||
|
config in the status.
|
||||||
|
type: string
|
||||||
|
lastHandledReconcileAt:
|
||||||
|
description: |-
|
||||||
|
LastHandledReconcileAt holds the value of the most recent
|
||||||
|
reconcile request value, so a change of the annotation value
|
||||||
|
can be detected.
|
||||||
|
type: string
|
||||||
|
observedGeneration:
|
||||||
|
description: ObservedGeneration is the last observed generation.
|
||||||
|
format: int64
|
||||||
|
type: integer
|
||||||
|
observedIgnore:
|
||||||
|
description: |-
|
||||||
|
ObservedIgnore is the observed exclusion patterns used for constructing
|
||||||
|
the source artifact.
|
||||||
|
type: string
|
||||||
|
observedLayerSelector:
|
||||||
|
description: |-
|
||||||
|
ObservedLayerSelector is the observed layer selector used for constructing
|
||||||
|
the source artifact.
|
||||||
|
properties:
|
||||||
|
mediaType:
|
||||||
|
description: |-
|
||||||
|
MediaType specifies the OCI media type of the layer
|
||||||
|
which should be extracted from the OCI Artifact. The
|
||||||
|
first layer matching this type is selected.
|
||||||
|
type: string
|
||||||
|
operation:
|
||||||
|
description: |-
|
||||||
|
Operation specifies how the selected layer should be processed.
|
||||||
|
By default, the layer compressed content is extracted to storage.
|
||||||
|
When the operation is set to 'copy', the layer compressed content
|
||||||
|
is persisted to storage as it is.
|
||||||
|
enum:
|
||||||
|
- extract
|
||||||
|
- copy
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
url:
|
||||||
|
description: URL is the download link for the artifact output of the
|
||||||
|
last OCI Repository sync.
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: false
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
|
|
|
||||||
|
|
@ -1,4 +1,4 @@
|
||||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
apiVersion: source.toolkit.fluxcd.io/v1
|
||||||
kind: OCIRepository
|
kind: OCIRepository
|
||||||
metadata:
|
metadata:
|
||||||
name: ocirepository-sample
|
name: ocirepository-sample
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
---
|
---
|
||||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
apiVersion: source.toolkit.fluxcd.io/v1
|
||||||
kind: HelmRepository
|
kind: HelmRepository
|
||||||
metadata:
|
metadata:
|
||||||
name: podinfo
|
name: podinfo
|
||||||
|
|
@ -8,7 +8,7 @@ spec:
|
||||||
type: "oci"
|
type: "oci"
|
||||||
interval: 1m
|
interval: 1m
|
||||||
---
|
---
|
||||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
apiVersion: source.toolkit.fluxcd.io/v1
|
||||||
kind: HelmChart
|
kind: HelmChart
|
||||||
metadata:
|
metadata:
|
||||||
name: podinfo
|
name: podinfo
|
||||||
|
|
@ -20,7 +20,7 @@ spec:
|
||||||
version: '6.1.*'
|
version: '6.1.*'
|
||||||
interval: 1m
|
interval: 1m
|
||||||
---
|
---
|
||||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
apiVersion: source.toolkit.fluxcd.io/v1
|
||||||
kind: HelmChart
|
kind: HelmChart
|
||||||
metadata:
|
metadata:
|
||||||
name: podinfo-keyless
|
name: podinfo-keyless
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
---
|
---
|
||||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
apiVersion: source.toolkit.fluxcd.io/v1
|
||||||
kind: OCIRepository
|
kind: OCIRepository
|
||||||
metadata:
|
metadata:
|
||||||
name: podinfo-deploy-signed-with-key
|
name: podinfo-deploy-signed-with-key
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
||||||
---
|
---
|
||||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
apiVersion: source.toolkit.fluxcd.io/v1
|
||||||
kind: OCIRepository
|
kind: OCIRepository
|
||||||
metadata:
|
metadata:
|
||||||
name: podinfo-deploy-signed-with-keyless
|
name: podinfo-deploy-signed-with-keyless
|
||||||
|
|
|
||||||
|
|
@ -16,6 +16,8 @@ Resource Types:
|
||||||
<a href="#source.toolkit.fluxcd.io/v1.HelmChart">HelmChart</a>
|
<a href="#source.toolkit.fluxcd.io/v1.HelmChart">HelmChart</a>
|
||||||
</li><li>
|
</li><li>
|
||||||
<a href="#source.toolkit.fluxcd.io/v1.HelmRepository">HelmRepository</a>
|
<a href="#source.toolkit.fluxcd.io/v1.HelmRepository">HelmRepository</a>
|
||||||
|
</li><li>
|
||||||
|
<a href="#source.toolkit.fluxcd.io/v1.OCIRepository">OCIRepository</a>
|
||||||
</li></ul>
|
</li></ul>
|
||||||
<h3 id="source.toolkit.fluxcd.io/v1.Bucket">Bucket
|
<h3 id="source.toolkit.fluxcd.io/v1.Bucket">Bucket
|
||||||
</h3>
|
</h3>
|
||||||
|
|
@ -1013,6 +1015,292 @@ HelmRepositoryStatus
|
||||||
</table>
|
</table>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
<h3 id="source.toolkit.fluxcd.io/v1.OCIRepository">OCIRepository
|
||||||
|
</h3>
|
||||||
|
<p>OCIRepository is the Schema for the ocirepositories API</p>
|
||||||
|
<div class="md-typeset__scrollwrap">
|
||||||
|
<div class="md-typeset__table">
|
||||||
|
<table>
|
||||||
|
<thead>
|
||||||
|
<tr>
|
||||||
|
<th>Field</th>
|
||||||
|
<th>Description</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>apiVersion</code><br>
|
||||||
|
string</td>
|
||||||
|
<td>
|
||||||
|
<code>source.toolkit.fluxcd.io/v1</code>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>kind</code><br>
|
||||||
|
string
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<code>OCIRepository</code>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>metadata</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#objectmeta-v1-meta">
|
||||||
|
Kubernetes meta/v1.ObjectMeta
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
Refer to the Kubernetes API documentation for the fields of the
|
||||||
|
<code>metadata</code> field.
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>spec</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositorySpec">
|
||||||
|
OCIRepositorySpec
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<br/>
|
||||||
|
<br/>
|
||||||
|
<table>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>url</code><br>
|
||||||
|
<em>
|
||||||
|
string
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<p>URL is a reference to an OCI artifact repository hosted
|
||||||
|
on a remote container registry.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>ref</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositoryRef">
|
||||||
|
OCIRepositoryRef
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>The OCI reference to pull and monitor for changes,
|
||||||
|
defaults to the latest tag.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>layerSelector</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="#source.toolkit.fluxcd.io/v1.OCILayerSelector">
|
||||||
|
OCILayerSelector
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>LayerSelector specifies which layer should be extracted from the OCI artifact.
|
||||||
|
When not specified, the first layer found in the artifact is selected.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>provider</code><br>
|
||||||
|
<em>
|
||||||
|
string
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>The provider used for authentication, can be ‘aws’, ‘azure’, ‘gcp’ or ‘generic’.
|
||||||
|
When not specified, defaults to ‘generic’.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>secretRef</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="https://pkg.go.dev/github.com/fluxcd/pkg/apis/meta#LocalObjectReference">
|
||||||
|
github.com/fluxcd/pkg/apis/meta.LocalObjectReference
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>SecretRef contains the secret name containing the registry login
|
||||||
|
credentials to resolve image metadata.
|
||||||
|
The secret must be of type kubernetes.io/dockerconfigjson.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>verify</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositoryVerification">
|
||||||
|
OCIRepositoryVerification
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>Verify contains the secret name containing the trusted public keys
|
||||||
|
used to verify the signature and specifies which provider to use to check
|
||||||
|
whether OCI image is authentic.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>serviceAccountName</code><br>
|
||||||
|
<em>
|
||||||
|
string
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
|
||||||
|
the image pull if the service account has attached pull secrets. For more information:
|
||||||
|
<a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account">https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account</a></p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>certSecretRef</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="https://pkg.go.dev/github.com/fluxcd/pkg/apis/meta#LocalObjectReference">
|
||||||
|
github.com/fluxcd/pkg/apis/meta.LocalObjectReference
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>CertSecretRef can be given the name of a Secret containing
|
||||||
|
either or both of</p>
|
||||||
|
<ul>
|
||||||
|
<li>a PEM-encoded client certificate (<code>tls.crt</code>) and private
|
||||||
|
key (<code>tls.key</code>);</li>
|
||||||
|
<li>a PEM-encoded CA certificate (<code>ca.crt</code>)</li>
|
||||||
|
</ul>
|
||||||
|
<p>and whichever are supplied, will be used for connecting to the
|
||||||
|
registry. The client cert and key are useful if you are
|
||||||
|
authenticating with a certificate; the CA cert is useful if
|
||||||
|
you are using a self-signed server certificate. The Secret must
|
||||||
|
be of type <code>Opaque</code> or <code>kubernetes.io/tls</code>.</p>
|
||||||
|
<p>Note: Support for the <code>caFile</code>, <code>certFile</code> and <code>keyFile</code> keys have
|
||||||
|
been deprecated.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>proxySecretRef</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="https://pkg.go.dev/github.com/fluxcd/pkg/apis/meta#LocalObjectReference">
|
||||||
|
github.com/fluxcd/pkg/apis/meta.LocalObjectReference
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>ProxySecretRef specifies the Secret containing the proxy configuration
|
||||||
|
to use while communicating with the container registry.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>interval</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
|
||||||
|
Kubernetes meta/v1.Duration
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<p>Interval at which the OCIRepository URL is checked for updates.
|
||||||
|
This interval is approximate and may be subject to jitter to ensure
|
||||||
|
efficient use of resources.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>timeout</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
|
||||||
|
Kubernetes meta/v1.Duration
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>The timeout for remote OCI Repository operations like pulling, defaults to 60s.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>ignore</code><br>
|
||||||
|
<em>
|
||||||
|
string
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>Ignore overrides the set of excluded patterns in the .sourceignore format
|
||||||
|
(which is the same as .gitignore). If not provided, a default will be used,
|
||||||
|
consult the documentation for your version to find out what those are.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>insecure</code><br>
|
||||||
|
<em>
|
||||||
|
bool
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>Insecure allows connecting to a non-TLS HTTP container registry.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>suspend</code><br>
|
||||||
|
<em>
|
||||||
|
bool
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>This flag tells the controller to suspend the reconciliation of this source.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</table>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>status</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositoryStatus">
|
||||||
|
OCIRepositoryStatus
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
<h3 id="source.toolkit.fluxcd.io/v1.Artifact">Artifact
|
<h3 id="source.toolkit.fluxcd.io/v1.Artifact">Artifact
|
||||||
</h3>
|
</h3>
|
||||||
<p>
|
<p>
|
||||||
|
|
@ -1020,7 +1308,8 @@ HelmRepositoryStatus
|
||||||
<a href="#source.toolkit.fluxcd.io/v1.BucketStatus">BucketStatus</a>,
|
<a href="#source.toolkit.fluxcd.io/v1.BucketStatus">BucketStatus</a>,
|
||||||
<a href="#source.toolkit.fluxcd.io/v1.GitRepositoryStatus">GitRepositoryStatus</a>,
|
<a href="#source.toolkit.fluxcd.io/v1.GitRepositoryStatus">GitRepositoryStatus</a>,
|
||||||
<a href="#source.toolkit.fluxcd.io/v1.HelmChartStatus">HelmChartStatus</a>,
|
<a href="#source.toolkit.fluxcd.io/v1.HelmChartStatus">HelmChartStatus</a>,
|
||||||
<a href="#source.toolkit.fluxcd.io/v1.HelmRepositoryStatus">HelmRepositoryStatus</a>)
|
<a href="#source.toolkit.fluxcd.io/v1.HelmRepositoryStatus">HelmRepositoryStatus</a>,
|
||||||
|
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositoryStatus">OCIRepositoryStatus</a>)
|
||||||
</p>
|
</p>
|
||||||
<p>Artifact represents the output of a Source reconciliation.</p>
|
<p>Artifact represents the output of a Source reconciliation.</p>
|
||||||
<div class="md-typeset__scrollwrap">
|
<div class="md-typeset__scrollwrap">
|
||||||
|
|
@ -2744,11 +3033,502 @@ string
|
||||||
</table>
|
</table>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
<h3 id="source.toolkit.fluxcd.io/v1.OCILayerSelector">OCILayerSelector
|
||||||
|
</h3>
|
||||||
|
<p>
|
||||||
|
(<em>Appears on:</em>
|
||||||
|
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositorySpec">OCIRepositorySpec</a>,
|
||||||
|
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositoryStatus">OCIRepositoryStatus</a>)
|
||||||
|
</p>
|
||||||
|
<p>OCILayerSelector specifies which layer should be extracted from an OCI Artifact</p>
|
||||||
|
<div class="md-typeset__scrollwrap">
|
||||||
|
<div class="md-typeset__table">
|
||||||
|
<table>
|
||||||
|
<thead>
|
||||||
|
<tr>
|
||||||
|
<th>Field</th>
|
||||||
|
<th>Description</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>mediaType</code><br>
|
||||||
|
<em>
|
||||||
|
string
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>MediaType specifies the OCI media type of the layer
|
||||||
|
which should be extracted from the OCI Artifact. The
|
||||||
|
first layer matching this type is selected.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>operation</code><br>
|
||||||
|
<em>
|
||||||
|
string
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>Operation specifies how the selected layer should be processed.
|
||||||
|
By default, the layer compressed content is extracted to storage.
|
||||||
|
When the operation is set to ‘copy’, the layer compressed content
|
||||||
|
is persisted to storage as it is.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<h3 id="source.toolkit.fluxcd.io/v1.OCIRepositoryRef">OCIRepositoryRef
|
||||||
|
</h3>
|
||||||
|
<p>
|
||||||
|
(<em>Appears on:</em>
|
||||||
|
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositorySpec">OCIRepositorySpec</a>)
|
||||||
|
</p>
|
||||||
|
<p>OCIRepositoryRef defines the image reference for the OCIRepository’s URL</p>
|
||||||
|
<div class="md-typeset__scrollwrap">
|
||||||
|
<div class="md-typeset__table">
|
||||||
|
<table>
|
||||||
|
<thead>
|
||||||
|
<tr>
|
||||||
|
<th>Field</th>
|
||||||
|
<th>Description</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>digest</code><br>
|
||||||
|
<em>
|
||||||
|
string
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>Digest is the image digest to pull, takes precedence over SemVer.
|
||||||
|
The value should be in the format ‘sha256:<HASH>’.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>semver</code><br>
|
||||||
|
<em>
|
||||||
|
string
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>SemVer is the range of tags to pull selecting the latest within
|
||||||
|
the range, takes precedence over Tag.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>semverFilter</code><br>
|
||||||
|
<em>
|
||||||
|
string
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>SemverFilter is a regex pattern to filter the tags within the SemVer range.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>tag</code><br>
|
||||||
|
<em>
|
||||||
|
string
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>Tag is the image tag to pull, defaults to latest.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<h3 id="source.toolkit.fluxcd.io/v1.OCIRepositorySpec">OCIRepositorySpec
|
||||||
|
</h3>
|
||||||
|
<p>
|
||||||
|
(<em>Appears on:</em>
|
||||||
|
<a href="#source.toolkit.fluxcd.io/v1.OCIRepository">OCIRepository</a>)
|
||||||
|
</p>
|
||||||
|
<p>OCIRepositorySpec defines the desired state of OCIRepository</p>
|
||||||
|
<div class="md-typeset__scrollwrap">
|
||||||
|
<div class="md-typeset__table">
|
||||||
|
<table>
|
||||||
|
<thead>
|
||||||
|
<tr>
|
||||||
|
<th>Field</th>
|
||||||
|
<th>Description</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>url</code><br>
|
||||||
|
<em>
|
||||||
|
string
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<p>URL is a reference to an OCI artifact repository hosted
|
||||||
|
on a remote container registry.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>ref</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositoryRef">
|
||||||
|
OCIRepositoryRef
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>The OCI reference to pull and monitor for changes,
|
||||||
|
defaults to the latest tag.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>layerSelector</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="#source.toolkit.fluxcd.io/v1.OCILayerSelector">
|
||||||
|
OCILayerSelector
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>LayerSelector specifies which layer should be extracted from the OCI artifact.
|
||||||
|
When not specified, the first layer found in the artifact is selected.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>provider</code><br>
|
||||||
|
<em>
|
||||||
|
string
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>The provider used for authentication, can be ‘aws’, ‘azure’, ‘gcp’ or ‘generic’.
|
||||||
|
When not specified, defaults to ‘generic’.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>secretRef</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="https://pkg.go.dev/github.com/fluxcd/pkg/apis/meta#LocalObjectReference">
|
||||||
|
github.com/fluxcd/pkg/apis/meta.LocalObjectReference
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>SecretRef contains the secret name containing the registry login
|
||||||
|
credentials to resolve image metadata.
|
||||||
|
The secret must be of type kubernetes.io/dockerconfigjson.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>verify</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositoryVerification">
|
||||||
|
OCIRepositoryVerification
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>Verify contains the secret name containing the trusted public keys
|
||||||
|
used to verify the signature and specifies which provider to use to check
|
||||||
|
whether OCI image is authentic.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>serviceAccountName</code><br>
|
||||||
|
<em>
|
||||||
|
string
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
|
||||||
|
the image pull if the service account has attached pull secrets. For more information:
|
||||||
|
<a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account">https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account</a></p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>certSecretRef</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="https://pkg.go.dev/github.com/fluxcd/pkg/apis/meta#LocalObjectReference">
|
||||||
|
github.com/fluxcd/pkg/apis/meta.LocalObjectReference
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>CertSecretRef can be given the name of a Secret containing
|
||||||
|
either or both of</p>
|
||||||
|
<ul>
|
||||||
|
<li>a PEM-encoded client certificate (<code>tls.crt</code>) and private
|
||||||
|
key (<code>tls.key</code>);</li>
|
||||||
|
<li>a PEM-encoded CA certificate (<code>ca.crt</code>)</li>
|
||||||
|
</ul>
|
||||||
|
<p>and whichever are supplied, will be used for connecting to the
|
||||||
|
registry. The client cert and key are useful if you are
|
||||||
|
authenticating with a certificate; the CA cert is useful if
|
||||||
|
you are using a self-signed server certificate. The Secret must
|
||||||
|
be of type <code>Opaque</code> or <code>kubernetes.io/tls</code>.</p>
|
||||||
|
<p>Note: Support for the <code>caFile</code>, <code>certFile</code> and <code>keyFile</code> keys have
|
||||||
|
been deprecated.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>proxySecretRef</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="https://pkg.go.dev/github.com/fluxcd/pkg/apis/meta#LocalObjectReference">
|
||||||
|
github.com/fluxcd/pkg/apis/meta.LocalObjectReference
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>ProxySecretRef specifies the Secret containing the proxy configuration
|
||||||
|
to use while communicating with the container registry.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>interval</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
|
||||||
|
Kubernetes meta/v1.Duration
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<p>Interval at which the OCIRepository URL is checked for updates.
|
||||||
|
This interval is approximate and may be subject to jitter to ensure
|
||||||
|
efficient use of resources.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>timeout</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
|
||||||
|
Kubernetes meta/v1.Duration
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>The timeout for remote OCI Repository operations like pulling, defaults to 60s.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>ignore</code><br>
|
||||||
|
<em>
|
||||||
|
string
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>Ignore overrides the set of excluded patterns in the .sourceignore format
|
||||||
|
(which is the same as .gitignore). If not provided, a default will be used,
|
||||||
|
consult the documentation for your version to find out what those are.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>insecure</code><br>
|
||||||
|
<em>
|
||||||
|
bool
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>Insecure allows connecting to a non-TLS HTTP container registry.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>suspend</code><br>
|
||||||
|
<em>
|
||||||
|
bool
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>This flag tells the controller to suspend the reconciliation of this source.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<h3 id="source.toolkit.fluxcd.io/v1.OCIRepositoryStatus">OCIRepositoryStatus
|
||||||
|
</h3>
|
||||||
|
<p>
|
||||||
|
(<em>Appears on:</em>
|
||||||
|
<a href="#source.toolkit.fluxcd.io/v1.OCIRepository">OCIRepository</a>)
|
||||||
|
</p>
|
||||||
|
<p>OCIRepositoryStatus defines the observed state of OCIRepository</p>
|
||||||
|
<div class="md-typeset__scrollwrap">
|
||||||
|
<div class="md-typeset__table">
|
||||||
|
<table>
|
||||||
|
<thead>
|
||||||
|
<tr>
|
||||||
|
<th>Field</th>
|
||||||
|
<th>Description</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
<tbody>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>observedGeneration</code><br>
|
||||||
|
<em>
|
||||||
|
int64
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>ObservedGeneration is the last observed generation.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>conditions</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Condition">
|
||||||
|
[]Kubernetes meta/v1.Condition
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>Conditions holds the conditions for the OCIRepository.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>url</code><br>
|
||||||
|
<em>
|
||||||
|
string
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>URL is the download link for the artifact output of the last OCI Repository sync.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>artifact</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="#source.toolkit.fluxcd.io/v1.Artifact">
|
||||||
|
Artifact
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>Artifact represents the output of the last successful OCI Repository sync.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>contentConfigChecksum</code><br>
|
||||||
|
<em>
|
||||||
|
string
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>ContentConfigChecksum is a checksum of all the configurations related to
|
||||||
|
the content of the source artifact:
|
||||||
|
- .spec.ignore
|
||||||
|
- .spec.layerSelector
|
||||||
|
observed in .status.observedGeneration version of the object. This can
|
||||||
|
be used to determine if the content configuration has changed and the
|
||||||
|
artifact needs to be rebuilt.
|
||||||
|
It has the format of <code><algo>:<checksum></code>, for example: <code>sha256:<checksum></code>.</p>
|
||||||
|
<p>Deprecated: Replaced with explicit fields for observed artifact content
|
||||||
|
config in the status.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>observedIgnore</code><br>
|
||||||
|
<em>
|
||||||
|
string
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>ObservedIgnore is the observed exclusion patterns used for constructing
|
||||||
|
the source artifact.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>observedLayerSelector</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="#source.toolkit.fluxcd.io/v1.OCILayerSelector">
|
||||||
|
OCILayerSelector
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<em>(Optional)</em>
|
||||||
|
<p>ObservedLayerSelector is the observed layer selector used for constructing
|
||||||
|
the source artifact.</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
<tr>
|
||||||
|
<td>
|
||||||
|
<code>ReconcileRequestStatus</code><br>
|
||||||
|
<em>
|
||||||
|
<a href="https://pkg.go.dev/github.com/fluxcd/pkg/apis/meta#ReconcileRequestStatus">
|
||||||
|
github.com/fluxcd/pkg/apis/meta.ReconcileRequestStatus
|
||||||
|
</a>
|
||||||
|
</em>
|
||||||
|
</td>
|
||||||
|
<td>
|
||||||
|
<p>
|
||||||
|
(Members of <code>ReconcileRequestStatus</code> are embedded into this type.)
|
||||||
|
</p>
|
||||||
|
</td>
|
||||||
|
</tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
<h3 id="source.toolkit.fluxcd.io/v1.OCIRepositoryVerification">OCIRepositoryVerification
|
<h3 id="source.toolkit.fluxcd.io/v1.OCIRepositoryVerification">OCIRepositoryVerification
|
||||||
</h3>
|
</h3>
|
||||||
<p>
|
<p>
|
||||||
(<em>Appears on:</em>
|
(<em>Appears on:</em>
|
||||||
<a href="#source.toolkit.fluxcd.io/v1.HelmChartSpec">HelmChartSpec</a>)
|
<a href="#source.toolkit.fluxcd.io/v1.HelmChartSpec">HelmChartSpec</a>,
|
||||||
|
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositorySpec">OCIRepositorySpec</a>)
|
||||||
</p>
|
</p>
|
||||||
<p>OCIRepositoryVerification verifies the authenticity of an OCI Artifact</p>
|
<p>OCIRepositoryVerification verifies the authenticity of an OCI Artifact</p>
|
||||||
<div class="md-typeset__scrollwrap">
|
<div class="md-typeset__scrollwrap">
|
||||||
|
|
|
||||||
|
|
@ -6,6 +6,7 @@ This is the v1 API specification for defining the desired state sources of Kuber
|
||||||
|
|
||||||
* Source kinds:
|
* Source kinds:
|
||||||
+ [GitRepository](gitrepositories.md)
|
+ [GitRepository](gitrepositories.md)
|
||||||
|
+ [OCIRepository](ocirepositories.md)
|
||||||
+ [HelmRepository](helmrepositories.md)
|
+ [HelmRepository](helmrepositories.md)
|
||||||
+ [HelmChart](helmcharts.md)
|
+ [HelmChart](helmcharts.md)
|
||||||
+ [Bucket](buckets.md)
|
+ [Bucket](buckets.md)
|
||||||
|
|
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -77,7 +77,7 @@ import (
|
||||||
const maxConcurrentBucketFetches = 100
|
const maxConcurrentBucketFetches = 100
|
||||||
|
|
||||||
// bucketReadyCondition contains the information required to summarize a
|
// bucketReadyCondition contains the information required to summarize a
|
||||||
// v1beta2.Bucket Ready Condition.
|
// v1.Bucket Ready Condition.
|
||||||
var bucketReadyCondition = summarize.Conditions{
|
var bucketReadyCondition = summarize.Conditions{
|
||||||
Target: meta.ReadyCondition,
|
Target: meta.ReadyCondition,
|
||||||
Owned: []string{
|
Owned: []string{
|
||||||
|
|
@ -117,7 +117,7 @@ var bucketFailConditions = []string{
|
||||||
// +kubebuilder:rbac:groups=source.toolkit.fluxcd.io,resources=buckets/finalizers,verbs=get;create;update;patch;delete
|
// +kubebuilder:rbac:groups=source.toolkit.fluxcd.io,resources=buckets/finalizers,verbs=get;create;update;patch;delete
|
||||||
// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch
|
// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch
|
||||||
|
|
||||||
// BucketReconciler reconciles a v1beta2.Bucket object.
|
// BucketReconciler reconciles a v1.Bucket object.
|
||||||
type BucketReconciler struct {
|
type BucketReconciler struct {
|
||||||
client.Client
|
client.Client
|
||||||
kuberecorder.EventRecorder
|
kuberecorder.EventRecorder
|
||||||
|
|
@ -155,7 +155,7 @@ type BucketProvider interface {
|
||||||
Close(context.Context)
|
Close(context.Context)
|
||||||
}
|
}
|
||||||
|
|
||||||
// bucketReconcileFunc is the function type for all the v1beta2.Bucket
|
// bucketReconcileFunc is the function type for all the v1.Bucket
|
||||||
// (sub)reconcile functions. The type implementations are grouped and
|
// (sub)reconcile functions. The type implementations are grouped and
|
||||||
// executed serially to perform the complete reconcile of the object.
|
// executed serially to perform the complete reconcile of the object.
|
||||||
type bucketReconcileFunc func(ctx context.Context, sp *patch.SerialPatcher, obj *sourcev1.Bucket, index *index.Digester, dir string) (sreconcile.Result, error)
|
type bucketReconcileFunc func(ctx context.Context, sp *patch.SerialPatcher, obj *sourcev1.Bucket, index *index.Digester, dir string) (sreconcile.Result, error)
|
||||||
|
|
@ -418,7 +418,7 @@ func (r *BucketReconciler) reconcileStorage(ctx context.Context, sp *patch.Seria
|
||||||
// reconcileSource fetches the upstream bucket contents with the client for the
|
// reconcileSource fetches the upstream bucket contents with the client for the
|
||||||
// given object's Provider, and returns the result.
|
// given object's Provider, and returns the result.
|
||||||
// When a SecretRef is defined, it attempts to fetch the Secret before calling
|
// When a SecretRef is defined, it attempts to fetch the Secret before calling
|
||||||
// the provider. If this fails, it records v1beta2.FetchFailedCondition=True on
|
// the provider. If this fails, it records v1.FetchFailedCondition=True on
|
||||||
// the object and returns early.
|
// the object and returns early.
|
||||||
func (r *BucketReconciler) reconcileSource(ctx context.Context, sp *patch.SerialPatcher, obj *sourcev1.Bucket, index *index.Digester, dir string) (sreconcile.Result, error) {
|
func (r *BucketReconciler) reconcileSource(ctx context.Context, sp *patch.SerialPatcher, obj *sourcev1.Bucket, index *index.Digester, dir string) (sreconcile.Result, error) {
|
||||||
secret, err := r.getSecret(ctx, obj.Spec.SecretRef, obj.GetNamespace())
|
secret, err := r.getSecret(ctx, obj.Spec.SecretRef, obj.GetNamespace())
|
||||||
|
|
@ -588,7 +588,7 @@ func (r *BucketReconciler) reconcileSource(ctx context.Context, sp *patch.Serial
|
||||||
// (Status) data on the object does not match the given.
|
// (Status) data on the object does not match the given.
|
||||||
//
|
//
|
||||||
// The inspection of the given data to the object is differed, ensuring any
|
// The inspection of the given data to the object is differed, ensuring any
|
||||||
// stale observations like v1beta2.ArtifactOutdatedCondition are removed.
|
// stale observations like v1.ArtifactOutdatedCondition are removed.
|
||||||
// If the given Artifact does not differ from the object's current, it returns
|
// If the given Artifact does not differ from the object's current, it returns
|
||||||
// early.
|
// early.
|
||||||
// On a successful archive, the Artifact in the Status of the object is set,
|
// On a successful archive, the Artifact in the Status of the object is set,
|
||||||
|
|
|
||||||
|
|
@ -70,7 +70,7 @@ import (
|
||||||
)
|
)
|
||||||
|
|
||||||
// gitRepositoryReadyCondition contains the information required to summarize a
|
// gitRepositoryReadyCondition contains the information required to summarize a
|
||||||
// v1beta2.GitRepository Ready Condition.
|
// v1.GitRepository Ready Condition.
|
||||||
var gitRepositoryReadyCondition = summarize.Conditions{
|
var gitRepositoryReadyCondition = summarize.Conditions{
|
||||||
Target: meta.ReadyCondition,
|
Target: meta.ReadyCondition,
|
||||||
Owned: []string{
|
Owned: []string{
|
||||||
|
|
@ -125,7 +125,7 @@ func getPatchOptions(ownedConditions []string, controllerName string) []patch.Op
|
||||||
// +kubebuilder:rbac:groups=source.toolkit.fluxcd.io,resources=gitrepositories/finalizers,verbs=get;create;update;patch;delete
|
// +kubebuilder:rbac:groups=source.toolkit.fluxcd.io,resources=gitrepositories/finalizers,verbs=get;create;update;patch;delete
|
||||||
// +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
|
// +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
|
||||||
|
|
||||||
// GitRepositoryReconciler reconciles a v1beta2.GitRepository object.
|
// GitRepositoryReconciler reconciles a v1.GitRepository object.
|
||||||
type GitRepositoryReconciler struct {
|
type GitRepositoryReconciler struct {
|
||||||
client.Client
|
client.Client
|
||||||
kuberecorder.EventRecorder
|
kuberecorder.EventRecorder
|
||||||
|
|
@ -147,7 +147,7 @@ type GitRepositoryReconcilerOptions struct {
|
||||||
}
|
}
|
||||||
|
|
||||||
// gitRepositoryReconcileFunc is the function type for all the
|
// gitRepositoryReconcileFunc is the function type for all the
|
||||||
// v1beta2.GitRepository (sub)reconcile functions.
|
// v1.GitRepository (sub)reconcile functions.
|
||||||
type gitRepositoryReconcileFunc func(ctx context.Context, sp *patch.SerialPatcher, obj *sourcev1.GitRepository, commit *git.Commit, includes *artifactSet, dir string) (sreconcile.Result, error)
|
type gitRepositoryReconcileFunc func(ctx context.Context, sp *patch.SerialPatcher, obj *sourcev1.GitRepository, commit *git.Commit, includes *artifactSet, dir string) (sreconcile.Result, error)
|
||||||
|
|
||||||
func (r *GitRepositoryReconciler) SetupWithManager(mgr ctrl.Manager) error {
|
func (r *GitRepositoryReconciler) SetupWithManager(mgr ctrl.Manager) error {
|
||||||
|
|
@ -447,23 +447,23 @@ func (r *GitRepositoryReconciler) reconcileStorage(ctx context.Context, sp *patc
|
||||||
//
|
//
|
||||||
// The included repositories are fetched and their metadata are stored. In case
|
// The included repositories are fetched and their metadata are stored. In case
|
||||||
// one of the included repositories isn't ready, it records
|
// one of the included repositories isn't ready, it records
|
||||||
// v1beta2.IncludeUnavailableCondition=True and returns early. When all the
|
// v1.IncludeUnavailableCondition=True and returns early. When all the
|
||||||
// included repositories are ready, it removes
|
// included repositories are ready, it removes
|
||||||
// v1beta2.IncludeUnavailableCondition from the object.
|
// v1.IncludeUnavailableCondition from the object.
|
||||||
// When the included artifactSet differs from the current set in the Status of
|
// When the included artifactSet differs from the current set in the Status of
|
||||||
// the object, it marks the object with v1beta2.ArtifactOutdatedCondition=True.
|
// the object, it marks the object with v1.ArtifactOutdatedCondition=True.
|
||||||
// The repository is cloned to the given dir, using the specified configuration
|
// The repository is cloned to the given dir, using the specified configuration
|
||||||
// to check out the reference. In case of an error during this process
|
// to check out the reference. In case of an error during this process
|
||||||
// (including transient errors), it records v1beta2.FetchFailedCondition=True
|
// (including transient errors), it records v1.FetchFailedCondition=True
|
||||||
// and returns early.
|
// and returns early.
|
||||||
// On a successful checkout, it removes v1beta2.FetchFailedCondition and
|
// On a successful checkout, it removes v1.FetchFailedCondition and
|
||||||
// compares the current revision of HEAD to the revision of the Artifact in the
|
// compares the current revision of HEAD to the revision of the Artifact in the
|
||||||
// Status of the object. It records v1beta2.ArtifactOutdatedCondition=True when
|
// Status of the object. It records v1.ArtifactOutdatedCondition=True when
|
||||||
// they differ.
|
// they differ.
|
||||||
// If specified, the signature of the Git commit is verified. If the signature
|
// If specified, the signature of the Git commit is verified. If the signature
|
||||||
// can not be verified or the verification fails, it records
|
// can not be verified or the verification fails, it records
|
||||||
// v1beta2.SourceVerifiedCondition=False and returns early. When successful,
|
// v1.SourceVerifiedCondition=False and returns early. When successful,
|
||||||
// it records v1beta2.SourceVerifiedCondition=True.
|
// it records v1.SourceVerifiedCondition=True.
|
||||||
// When all the above is successful, the given Commit pointer is set to the
|
// When all the above is successful, the given Commit pointer is set to the
|
||||||
// commit of the checked out Git repository.
|
// commit of the checked out Git repository.
|
||||||
//
|
//
|
||||||
|
|
@ -787,7 +787,7 @@ func (r *GitRepositoryReconciler) getSecretData(ctx context.Context, name, names
|
||||||
// (Status) data on the object does not match the given.
|
// (Status) data on the object does not match the given.
|
||||||
//
|
//
|
||||||
// The inspection of the given data to the object is differed, ensuring any
|
// The inspection of the given data to the object is differed, ensuring any
|
||||||
// stale observations like v1beta2.ArtifactOutdatedCondition are removed.
|
// stale observations like v1.ArtifactOutdatedCondition are removed.
|
||||||
// If the given Artifact and/or artifactSet (includes) and observed artifact
|
// If the given Artifact and/or artifactSet (includes) and observed artifact
|
||||||
// content config do not differ from the object's current, it returns early.
|
// content config do not differ from the object's current, it returns early.
|
||||||
// Source ignore patterns are loaded, and the given directory is archived while
|
// Source ignore patterns are loaded, and the given directory is archived while
|
||||||
|
|
@ -903,15 +903,15 @@ func (r *GitRepositoryReconciler) reconcileArtifact(ctx context.Context, sp *pat
|
||||||
}
|
}
|
||||||
|
|
||||||
// reconcileInclude reconciles the on the object specified
|
// reconcileInclude reconciles the on the object specified
|
||||||
// v1beta2.GitRepositoryInclude list by copying their Artifact (sub)contents to
|
// v1.GitRepositoryInclude list by copying their Artifact (sub)contents to
|
||||||
// the specified paths in the given directory.
|
// the specified paths in the given directory.
|
||||||
//
|
//
|
||||||
// When one of the includes is unavailable, it marks the object with
|
// When one of the includes is unavailable, it marks the object with
|
||||||
// v1beta2.IncludeUnavailableCondition=True and returns early.
|
// v1.IncludeUnavailableCondition=True and returns early.
|
||||||
// When the copy operations are successful, it removes the
|
// When the copy operations are successful, it removes the
|
||||||
// v1beta2.IncludeUnavailableCondition from the object.
|
// v1.IncludeUnavailableCondition from the object.
|
||||||
// When the composed artifactSet differs from the current set in the Status of
|
// When the composed artifactSet differs from the current set in the Status of
|
||||||
// the object, it marks the object with v1beta2.ArtifactOutdatedCondition=True.
|
// the object, it marks the object with v1.ArtifactOutdatedCondition=True.
|
||||||
func (r *GitRepositoryReconciler) reconcileInclude(ctx context.Context, sp *patch.SerialPatcher,
|
func (r *GitRepositoryReconciler) reconcileInclude(ctx context.Context, sp *patch.SerialPatcher,
|
||||||
obj *sourcev1.GitRepository, _ *git.Commit, includes *artifactSet, dir string) (sreconcile.Result, error) {
|
obj *sourcev1.GitRepository, _ *git.Commit, includes *artifactSet, dir string) (sreconcile.Result, error) {
|
||||||
|
|
||||||
|
|
@ -1060,10 +1060,10 @@ func (r *GitRepositoryReconciler) fetchIncludes(ctx context.Context, obj *source
|
||||||
// verifySignature verifies the signature of the given Git commit and/or its referencing tag
|
// verifySignature verifies the signature of the given Git commit and/or its referencing tag
|
||||||
// depending on the verification mode specified on the object.
|
// depending on the verification mode specified on the object.
|
||||||
// If the signature can not be verified or the verification fails, it records
|
// If the signature can not be verified or the verification fails, it records
|
||||||
// v1beta2.SourceVerifiedCondition=False and returns.
|
// v1.SourceVerifiedCondition=False and returns.
|
||||||
// When successful, it records v1beta2.SourceVerifiedCondition=True.
|
// When successful, it records v1.SourceVerifiedCondition=True.
|
||||||
// If no verification mode is specified on the object, the
|
// If no verification mode is specified on the object, the
|
||||||
// v1beta2.SourceVerifiedCondition Condition is removed.
|
// v1.SourceVerifiedCondition Condition is removed.
|
||||||
func (r *GitRepositoryReconciler) verifySignature(ctx context.Context, obj *sourcev1.GitRepository, commit git.Commit) (sreconcile.Result, error) {
|
func (r *GitRepositoryReconciler) verifySignature(ctx context.Context, obj *sourcev1.GitRepository, commit git.Commit) (sreconcile.Result, error) {
|
||||||
// Check if there is a commit verification is configured and remove any old
|
// Check if there is a commit verification is configured and remove any old
|
||||||
// observations if there is none
|
// observations if there is none
|
||||||
|
|
|
||||||
|
|
@ -67,7 +67,6 @@ import (
|
||||||
"github.com/fluxcd/pkg/testserver"
|
"github.com/fluxcd/pkg/testserver"
|
||||||
|
|
||||||
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
||||||
sourcev1beta2 "github.com/fluxcd/source-controller/api/v1beta2"
|
|
||||||
serror "github.com/fluxcd/source-controller/internal/error"
|
serror "github.com/fluxcd/source-controller/internal/error"
|
||||||
"github.com/fluxcd/source-controller/internal/helm/chart"
|
"github.com/fluxcd/source-controller/internal/helm/chart"
|
||||||
"github.com/fluxcd/source-controller/internal/helm/chart/secureloader"
|
"github.com/fluxcd/source-controller/internal/helm/chart/secureloader"
|
||||||
|
|
@ -1366,7 +1365,7 @@ func TestHelmChartReconciler_buildFromOCIHelmRepository(t *testing.T) {
|
||||||
Spec: sourcev1.HelmRepositorySpec{
|
Spec: sourcev1.HelmRepositorySpec{
|
||||||
URL: fmt.Sprintf("oci://%s/testrepo", testRegistryServer.registryHost),
|
URL: fmt.Sprintf("oci://%s/testrepo", testRegistryServer.registryHost),
|
||||||
Timeout: &metav1.Duration{Duration: timeout},
|
Timeout: &metav1.Duration{Duration: timeout},
|
||||||
Provider: sourcev1beta2.GenericOCIProvider,
|
Provider: sourcev1.GenericOCIProvider,
|
||||||
Type: sourcev1.HelmRepositoryTypeOCI,
|
Type: sourcev1.HelmRepositoryTypeOCI,
|
||||||
Insecure: true,
|
Insecure: true,
|
||||||
},
|
},
|
||||||
|
|
@ -2595,7 +2594,7 @@ func TestHelmChartReconciler_reconcileSourceFromOCI_authStrategy(t *testing.T) {
|
||||||
Interval: metav1.Duration{Duration: interval},
|
Interval: metav1.Duration{Duration: interval},
|
||||||
Timeout: &metav1.Duration{Duration: timeout},
|
Timeout: &metav1.Duration{Duration: timeout},
|
||||||
Type: sourcev1.HelmRepositoryTypeOCI,
|
Type: sourcev1.HelmRepositoryTypeOCI,
|
||||||
Provider: sourcev1beta2.GenericOCIProvider,
|
Provider: sourcev1.GenericOCIProvider,
|
||||||
URL: fmt.Sprintf("oci://%s/testrepo", server.registryHost),
|
URL: fmt.Sprintf("oci://%s/testrepo", server.registryHost),
|
||||||
Insecure: tt.insecure,
|
Insecure: tt.insecure,
|
||||||
},
|
},
|
||||||
|
|
@ -2798,7 +2797,7 @@ func TestHelmChartRepository_reconcileSource_verifyOCISourceSignature_keyless(t
|
||||||
Spec: sourcev1.HelmRepositorySpec{
|
Spec: sourcev1.HelmRepositorySpec{
|
||||||
URL: "oci://ghcr.io/stefanprodan/charts",
|
URL: "oci://ghcr.io/stefanprodan/charts",
|
||||||
Timeout: &metav1.Duration{Duration: timeout},
|
Timeout: &metav1.Duration{Duration: timeout},
|
||||||
Provider: sourcev1beta2.GenericOCIProvider,
|
Provider: sourcev1.GenericOCIProvider,
|
||||||
Type: sourcev1.HelmRepositoryTypeOCI,
|
Type: sourcev1.HelmRepositoryTypeOCI,
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
|
|
@ -3059,7 +3058,7 @@ func TestHelmChartReconciler_reconcileSourceFromOCI_verifySignatureNotation(t *t
|
||||||
Spec: sourcev1.HelmRepositorySpec{
|
Spec: sourcev1.HelmRepositorySpec{
|
||||||
URL: fmt.Sprintf("oci://%s/testrepo", server.registryHost),
|
URL: fmt.Sprintf("oci://%s/testrepo", server.registryHost),
|
||||||
Timeout: &metav1.Duration{Duration: timeout},
|
Timeout: &metav1.Duration{Duration: timeout},
|
||||||
Provider: sourcev1beta2.GenericOCIProvider,
|
Provider: sourcev1.GenericOCIProvider,
|
||||||
Type: sourcev1.HelmRepositoryTypeOCI,
|
Type: sourcev1.HelmRepositoryTypeOCI,
|
||||||
Insecure: true,
|
Insecure: true,
|
||||||
},
|
},
|
||||||
|
|
@ -3332,7 +3331,7 @@ func TestHelmChartReconciler_reconcileSourceFromOCI_verifySignatureCosign(t *tes
|
||||||
Spec: sourcev1.HelmRepositorySpec{
|
Spec: sourcev1.HelmRepositorySpec{
|
||||||
URL: fmt.Sprintf("oci://%s/testrepo", server.registryHost),
|
URL: fmt.Sprintf("oci://%s/testrepo", server.registryHost),
|
||||||
Timeout: &metav1.Duration{Duration: timeout},
|
Timeout: &metav1.Duration{Duration: timeout},
|
||||||
Provider: sourcev1beta2.GenericOCIProvider,
|
Provider: sourcev1.GenericOCIProvider,
|
||||||
Type: sourcev1.HelmRepositoryTypeOCI,
|
Type: sourcev1.HelmRepositoryTypeOCI,
|
||||||
Insecure: true,
|
Insecure: true,
|
||||||
},
|
},
|
||||||
|
|
|
||||||
|
|
@ -71,7 +71,6 @@ import (
|
||||||
"sigs.k8s.io/controller-runtime/pkg/predicate"
|
"sigs.k8s.io/controller-runtime/pkg/predicate"
|
||||||
|
|
||||||
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
||||||
ociv1 "github.com/fluxcd/source-controller/api/v1beta2"
|
|
||||||
serror "github.com/fluxcd/source-controller/internal/error"
|
serror "github.com/fluxcd/source-controller/internal/error"
|
||||||
soci "github.com/fluxcd/source-controller/internal/oci"
|
soci "github.com/fluxcd/source-controller/internal/oci"
|
||||||
scosign "github.com/fluxcd/source-controller/internal/oci/cosign"
|
scosign "github.com/fluxcd/source-controller/internal/oci/cosign"
|
||||||
|
|
@ -83,7 +82,7 @@ import (
|
||||||
)
|
)
|
||||||
|
|
||||||
// ociRepositoryReadyCondition contains the information required to summarize a
|
// ociRepositoryReadyCondition contains the information required to summarize a
|
||||||
// v1beta2.OCIRepository Ready Condition.
|
// v1.OCIRepository Ready Condition.
|
||||||
var ociRepositoryReadyCondition = summarize.Conditions{
|
var ociRepositoryReadyCondition = summarize.Conditions{
|
||||||
Target: meta.ReadyCondition,
|
Target: meta.ReadyCondition,
|
||||||
Owned: []string{
|
Owned: []string{
|
||||||
|
|
@ -130,12 +129,12 @@ func (e invalidOCIURLError) Error() string {
|
||||||
return e.err.Error()
|
return e.err.Error()
|
||||||
}
|
}
|
||||||
|
|
||||||
// ociRepositoryReconcileFunc is the function type for all the v1beta2.OCIRepository
|
// ociRepositoryReconcileFunc is the function type for all the v1.OCIRepository
|
||||||
// (sub)reconcile functions. The type implementations are grouped and
|
// (sub)reconcile functions. The type implementations are grouped and
|
||||||
// executed serially to perform the complete reconcile of the object.
|
// executed serially to perform the complete reconcile of the object.
|
||||||
type ociRepositoryReconcileFunc func(ctx context.Context, sp *patch.SerialPatcher, obj *ociv1.OCIRepository, metadata *sourcev1.Artifact, dir string) (sreconcile.Result, error)
|
type ociRepositoryReconcileFunc func(ctx context.Context, sp *patch.SerialPatcher, obj *sourcev1.OCIRepository, metadata *sourcev1.Artifact, dir string) (sreconcile.Result, error)
|
||||||
|
|
||||||
// OCIRepositoryReconciler reconciles a v1beta2.OCIRepository object
|
// OCIRepositoryReconciler reconciles a v1.OCIRepository object
|
||||||
type OCIRepositoryReconciler struct {
|
type OCIRepositoryReconciler struct {
|
||||||
client.Client
|
client.Client
|
||||||
helper.Metrics
|
helper.Metrics
|
||||||
|
|
@ -165,7 +164,7 @@ func (r *OCIRepositoryReconciler) SetupWithManagerAndOptions(mgr ctrl.Manager, o
|
||||||
r.requeueDependency = opts.DependencyRequeueInterval
|
r.requeueDependency = opts.DependencyRequeueInterval
|
||||||
|
|
||||||
return ctrl.NewControllerManagedBy(mgr).
|
return ctrl.NewControllerManagedBy(mgr).
|
||||||
For(&ociv1.OCIRepository{}, builder.WithPredicates(
|
For(&sourcev1.OCIRepository{}, builder.WithPredicates(
|
||||||
predicate.Or(predicate.GenerationChangedPredicate{}, predicates.ReconcileRequestedPredicate{}),
|
predicate.Or(predicate.GenerationChangedPredicate{}, predicates.ReconcileRequestedPredicate{}),
|
||||||
)).
|
)).
|
||||||
WithOptions(controller.Options{
|
WithOptions(controller.Options{
|
||||||
|
|
@ -185,7 +184,7 @@ func (r *OCIRepositoryReconciler) Reconcile(ctx context.Context, req ctrl.Reques
|
||||||
log := ctrl.LoggerFrom(ctx)
|
log := ctrl.LoggerFrom(ctx)
|
||||||
|
|
||||||
// Fetch the OCIRepository
|
// Fetch the OCIRepository
|
||||||
obj := &ociv1.OCIRepository{}
|
obj := &sourcev1.OCIRepository{}
|
||||||
if err := r.Get(ctx, req.NamespacedName, obj); err != nil {
|
if err := r.Get(ctx, req.NamespacedName, obj); err != nil {
|
||||||
return ctrl.Result{}, client.IgnoreNotFound(err)
|
return ctrl.Result{}, client.IgnoreNotFound(err)
|
||||||
}
|
}
|
||||||
|
|
@ -257,7 +256,7 @@ func (r *OCIRepositoryReconciler) Reconcile(ctx context.Context, req ctrl.Reques
|
||||||
// reconcile iterates through the ociRepositoryReconcileFunc tasks for the
|
// reconcile iterates through the ociRepositoryReconcileFunc tasks for the
|
||||||
// object. It returns early on the first call that returns
|
// object. It returns early on the first call that returns
|
||||||
// reconcile.ResultRequeue, or produces an error.
|
// reconcile.ResultRequeue, or produces an error.
|
||||||
func (r *OCIRepositoryReconciler) reconcile(ctx context.Context, sp *patch.SerialPatcher, obj *ociv1.OCIRepository, reconcilers []ociRepositoryReconcileFunc) (sreconcile.Result, error) {
|
func (r *OCIRepositoryReconciler) reconcile(ctx context.Context, sp *patch.SerialPatcher, obj *sourcev1.OCIRepository, reconcilers []ociRepositoryReconcileFunc) (sreconcile.Result, error) {
|
||||||
oldObj := obj.DeepCopy()
|
oldObj := obj.DeepCopy()
|
||||||
|
|
||||||
rreconcile.ProgressiveStatus(false, obj, meta.ProgressingReason, "reconciliation in progress")
|
rreconcile.ProgressiveStatus(false, obj, meta.ProgressingReason, "reconciliation in progress")
|
||||||
|
|
@ -329,9 +328,9 @@ func (r *OCIRepositoryReconciler) reconcile(ctx context.Context, sp *patch.Seria
|
||||||
}
|
}
|
||||||
|
|
||||||
// reconcileSource fetches the upstream OCI artifact metadata and content.
|
// reconcileSource fetches the upstream OCI artifact metadata and content.
|
||||||
// If this fails, it records v1beta2.FetchFailedCondition=True on the object and returns early.
|
// If this fails, it records v1.FetchFailedCondition=True on the object and returns early.
|
||||||
func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch.SerialPatcher,
|
func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch.SerialPatcher,
|
||||||
obj *ociv1.OCIRepository, metadata *sourcev1.Artifact, dir string) (sreconcile.Result, error) {
|
obj *sourcev1.OCIRepository, metadata *sourcev1.Artifact, dir string) (sreconcile.Result, error) {
|
||||||
var authenticator authn.Authenticator
|
var authenticator authn.Authenticator
|
||||||
|
|
||||||
ctxTimeout, cancel := context.WithTimeout(ctx, obj.Spec.Timeout.Duration)
|
ctxTimeout, cancel := context.WithTimeout(ctx, obj.Spec.Timeout.Duration)
|
||||||
|
|
@ -366,7 +365,7 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
|
||||||
return sreconcile.ResultEmpty, e
|
return sreconcile.ResultEmpty, e
|
||||||
}
|
}
|
||||||
|
|
||||||
if _, ok := keychain.(soci.Anonymous); obj.Spec.Provider != ociv1.GenericOCIProvider && ok {
|
if _, ok := keychain.(soci.Anonymous); obj.Spec.Provider != sourcev1.GenericOCIProvider && ok {
|
||||||
var opts []auth.Option
|
var opts []auth.Option
|
||||||
if obj.Spec.ServiceAccountName != "" {
|
if obj.Spec.ServiceAccountName != "" {
|
||||||
// Check object-level workload identity feature gate.
|
// Check object-level workload identity feature gate.
|
||||||
|
|
@ -384,7 +383,7 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
|
||||||
}
|
}
|
||||||
if r.TokenCache != nil {
|
if r.TokenCache != nil {
|
||||||
involvedObject := cache.InvolvedObject{
|
involvedObject := cache.InvolvedObject{
|
||||||
Kind: ociv1.OCIRepositoryKind,
|
Kind: sourcev1.OCIRepositoryKind,
|
||||||
Name: obj.GetName(),
|
Name: obj.GetName(),
|
||||||
Namespace: obj.GetNamespace(),
|
Namespace: obj.GetNamespace(),
|
||||||
Operation: cache.OperationReconcile,
|
Operation: cache.OperationReconcile,
|
||||||
|
|
@ -443,7 +442,7 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
|
||||||
if err != nil {
|
if err != nil {
|
||||||
e := serror.NewGeneric(
|
e := serror.NewGeneric(
|
||||||
fmt.Errorf("failed to determine artifact digest: %w", err),
|
fmt.Errorf("failed to determine artifact digest: %w", err),
|
||||||
ociv1.OCIPullFailedReason,
|
sourcev1.OCIPullFailedReason,
|
||||||
)
|
)
|
||||||
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
||||||
return sreconcile.ResultEmpty, e
|
return sreconcile.ResultEmpty, e
|
||||||
|
|
@ -508,7 +507,7 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
|
||||||
if err != nil {
|
if err != nil {
|
||||||
e := serror.NewGeneric(
|
e := serror.NewGeneric(
|
||||||
fmt.Errorf("failed to pull artifact from '%s': %w", obj.Spec.URL, err),
|
fmt.Errorf("failed to pull artifact from '%s': %w", obj.Spec.URL, err),
|
||||||
ociv1.OCIPullFailedReason,
|
sourcev1.OCIPullFailedReason,
|
||||||
)
|
)
|
||||||
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
||||||
return sreconcile.ResultEmpty, e
|
return sreconcile.ResultEmpty, e
|
||||||
|
|
@ -519,7 +518,7 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
|
||||||
if err != nil {
|
if err != nil {
|
||||||
e := serror.NewGeneric(
|
e := serror.NewGeneric(
|
||||||
fmt.Errorf("failed to parse artifact manifest: %w", err),
|
fmt.Errorf("failed to parse artifact manifest: %w", err),
|
||||||
ociv1.OCILayerOperationFailedReason,
|
sourcev1.OCILayerOperationFailedReason,
|
||||||
)
|
)
|
||||||
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
||||||
return sreconcile.ResultEmpty, e
|
return sreconcile.ResultEmpty, e
|
||||||
|
|
@ -529,29 +528,29 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
|
||||||
// Extract the compressed content from the selected layer
|
// Extract the compressed content from the selected layer
|
||||||
blob, err := r.selectLayer(obj, img)
|
blob, err := r.selectLayer(obj, img)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
e := serror.NewGeneric(err, ociv1.OCILayerOperationFailedReason)
|
e := serror.NewGeneric(err, sourcev1.OCILayerOperationFailedReason)
|
||||||
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
||||||
return sreconcile.ResultEmpty, e
|
return sreconcile.ResultEmpty, e
|
||||||
}
|
}
|
||||||
|
|
||||||
// Persist layer content to storage using the specified operation
|
// Persist layer content to storage using the specified operation
|
||||||
switch obj.GetLayerOperation() {
|
switch obj.GetLayerOperation() {
|
||||||
case ociv1.OCILayerExtract:
|
case sourcev1.OCILayerExtract:
|
||||||
if err = tar.Untar(blob, dir, tar.WithMaxUntarSize(-1), tar.WithSkipSymlinks()); err != nil {
|
if err = tar.Untar(blob, dir, tar.WithMaxUntarSize(-1), tar.WithSkipSymlinks()); err != nil {
|
||||||
e := serror.NewGeneric(
|
e := serror.NewGeneric(
|
||||||
fmt.Errorf("failed to extract layer contents from artifact: %w", err),
|
fmt.Errorf("failed to extract layer contents from artifact: %w", err),
|
||||||
ociv1.OCILayerOperationFailedReason,
|
sourcev1.OCILayerOperationFailedReason,
|
||||||
)
|
)
|
||||||
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
||||||
return sreconcile.ResultEmpty, e
|
return sreconcile.ResultEmpty, e
|
||||||
}
|
}
|
||||||
case ociv1.OCILayerCopy:
|
case sourcev1.OCILayerCopy:
|
||||||
metadata.Path = fmt.Sprintf("%s.tgz", r.digestFromRevision(metadata.Revision))
|
metadata.Path = fmt.Sprintf("%s.tgz", r.digestFromRevision(metadata.Revision))
|
||||||
file, err := os.Create(filepath.Join(dir, metadata.Path))
|
file, err := os.Create(filepath.Join(dir, metadata.Path))
|
||||||
if err != nil {
|
if err != nil {
|
||||||
e := serror.NewGeneric(
|
e := serror.NewGeneric(
|
||||||
fmt.Errorf("failed to create file to copy layer to: %w", err),
|
fmt.Errorf("failed to create file to copy layer to: %w", err),
|
||||||
ociv1.OCILayerOperationFailedReason,
|
sourcev1.OCILayerOperationFailedReason,
|
||||||
)
|
)
|
||||||
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
||||||
return sreconcile.ResultEmpty, e
|
return sreconcile.ResultEmpty, e
|
||||||
|
|
@ -562,7 +561,7 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
|
||||||
if err != nil {
|
if err != nil {
|
||||||
e := serror.NewGeneric(
|
e := serror.NewGeneric(
|
||||||
fmt.Errorf("failed to copy layer from artifact: %w", err),
|
fmt.Errorf("failed to copy layer from artifact: %w", err),
|
||||||
ociv1.OCILayerOperationFailedReason,
|
sourcev1.OCILayerOperationFailedReason,
|
||||||
)
|
)
|
||||||
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
||||||
return sreconcile.ResultEmpty, e
|
return sreconcile.ResultEmpty, e
|
||||||
|
|
@ -570,7 +569,7 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
|
||||||
default:
|
default:
|
||||||
e := serror.NewGeneric(
|
e := serror.NewGeneric(
|
||||||
fmt.Errorf("unsupported layer operation: %s", obj.GetLayerOperation()),
|
fmt.Errorf("unsupported layer operation: %s", obj.GetLayerOperation()),
|
||||||
ociv1.OCILayerOperationFailedReason,
|
sourcev1.OCILayerOperationFailedReason,
|
||||||
)
|
)
|
||||||
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
||||||
return sreconcile.ResultEmpty, e
|
return sreconcile.ResultEmpty, e
|
||||||
|
|
@ -582,7 +581,7 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
|
||||||
|
|
||||||
// selectLayer finds the matching layer and returns its compressed contents.
|
// selectLayer finds the matching layer and returns its compressed contents.
|
||||||
// If no layer selector was provided, we pick the first layer from the OCI artifact.
|
// If no layer selector was provided, we pick the first layer from the OCI artifact.
|
||||||
func (r *OCIRepositoryReconciler) selectLayer(obj *ociv1.OCIRepository, image gcrv1.Image) (io.ReadCloser, error) {
|
func (r *OCIRepositoryReconciler) selectLayer(obj *sourcev1.OCIRepository, image gcrv1.Image) (io.ReadCloser, error) {
|
||||||
layers, err := image.Layers()
|
layers, err := image.Layers()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, fmt.Errorf("failed to parse artifact layers: %w", err)
|
return nil, fmt.Errorf("failed to parse artifact layers: %w", err)
|
||||||
|
|
@ -663,7 +662,7 @@ func (r *OCIRepositoryReconciler) digestFromRevision(revision string) string {
|
||||||
// If not, when using cosign it falls back to a keyless approach for verification.
|
// If not, when using cosign it falls back to a keyless approach for verification.
|
||||||
// When notation is used, a trust policy is required to verify the image.
|
// When notation is used, a trust policy is required to verify the image.
|
||||||
// The verification result is returned as a VerificationResult and any error encountered.
|
// The verification result is returned as a VerificationResult and any error encountered.
|
||||||
func (r *OCIRepositoryReconciler) verifySignature(ctx context.Context, obj *ociv1.OCIRepository,
|
func (r *OCIRepositoryReconciler) verifySignature(ctx context.Context, obj *sourcev1.OCIRepository,
|
||||||
ref name.Reference, keychain authn.Keychain, auth authn.Authenticator,
|
ref name.Reference, keychain authn.Keychain, auth authn.Authenticator,
|
||||||
transport *http.Transport, opt ...remote.Option) (soci.VerificationResult, error) {
|
transport *http.Transport, opt ...remote.Option) (soci.VerificationResult, error) {
|
||||||
|
|
||||||
|
|
@ -831,12 +830,12 @@ func (r *OCIRepositoryReconciler) retrieveSecret(ctx context.Context, verifySecr
|
||||||
}
|
}
|
||||||
|
|
||||||
// parseRepository validates and extracts the repository URL.
|
// parseRepository validates and extracts the repository URL.
|
||||||
func (r *OCIRepositoryReconciler) parseRepository(obj *ociv1.OCIRepository) (name.Repository, error) {
|
func (r *OCIRepositoryReconciler) parseRepository(obj *sourcev1.OCIRepository) (name.Repository, error) {
|
||||||
if !strings.HasPrefix(obj.Spec.URL, ociv1.OCIRepositoryPrefix) {
|
if !strings.HasPrefix(obj.Spec.URL, sourcev1.OCIRepositoryPrefix) {
|
||||||
return name.Repository{}, fmt.Errorf("URL must be in format 'oci://<domain>/<org>/<repo>'")
|
return name.Repository{}, fmt.Errorf("URL must be in format 'oci://<domain>/<org>/<repo>'")
|
||||||
}
|
}
|
||||||
|
|
||||||
url := strings.TrimPrefix(obj.Spec.URL, ociv1.OCIRepositoryPrefix)
|
url := strings.TrimPrefix(obj.Spec.URL, sourcev1.OCIRepositoryPrefix)
|
||||||
|
|
||||||
options := []name.Option{}
|
options := []name.Option{}
|
||||||
if obj.Spec.Insecure {
|
if obj.Spec.Insecure {
|
||||||
|
|
@ -856,7 +855,7 @@ func (r *OCIRepositoryReconciler) parseRepository(obj *ociv1.OCIRepository) (nam
|
||||||
}
|
}
|
||||||
|
|
||||||
// getArtifactRef determines which tag or revision should be used and returns the OCI artifact FQN.
|
// getArtifactRef determines which tag or revision should be used and returns the OCI artifact FQN.
|
||||||
func (r *OCIRepositoryReconciler) getArtifactRef(obj *ociv1.OCIRepository, options []remote.Option) (name.Reference, error) {
|
func (r *OCIRepositoryReconciler) getArtifactRef(obj *sourcev1.OCIRepository, options []remote.Option) (name.Reference, error) {
|
||||||
repo, err := r.parseRepository(obj)
|
repo, err := r.parseRepository(obj)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, invalidOCIURLError{err}
|
return nil, invalidOCIURLError{err}
|
||||||
|
|
@ -920,7 +919,7 @@ func (r *OCIRepositoryReconciler) getTagBySemver(repo name.Repository, exp strin
|
||||||
// keychain generates the credential keychain based on the resource
|
// keychain generates the credential keychain based on the resource
|
||||||
// configuration. If no auth is specified a default keychain with
|
// configuration. If no auth is specified a default keychain with
|
||||||
// anonymous access is returned
|
// anonymous access is returned
|
||||||
func (r *OCIRepositoryReconciler) keychain(ctx context.Context, obj *ociv1.OCIRepository) (authn.Keychain, error) {
|
func (r *OCIRepositoryReconciler) keychain(ctx context.Context, obj *sourcev1.OCIRepository) (authn.Keychain, error) {
|
||||||
pullSecretNames := sets.NewString()
|
pullSecretNames := sets.NewString()
|
||||||
|
|
||||||
// lookup auth secret
|
// lookup auth secret
|
||||||
|
|
@ -966,7 +965,7 @@ func (r *OCIRepositoryReconciler) keychain(ctx context.Context, obj *ociv1.OCIRe
|
||||||
// the returned transport will include the TLS client and/or CA certificates.
|
// the returned transport will include the TLS client and/or CA certificates.
|
||||||
// If the insecure flag is set, the transport will skip the verification of the server's certificate.
|
// If the insecure flag is set, the transport will skip the verification of the server's certificate.
|
||||||
// Additionally, if a proxy is specified, transport will use it.
|
// Additionally, if a proxy is specified, transport will use it.
|
||||||
func (r *OCIRepositoryReconciler) transport(ctx context.Context, obj *ociv1.OCIRepository, proxyURL *url.URL) (*http.Transport, error) {
|
func (r *OCIRepositoryReconciler) transport(ctx context.Context, obj *sourcev1.OCIRepository, proxyURL *url.URL) (*http.Transport, error) {
|
||||||
transport := remote.DefaultTransport.(*http.Transport).Clone()
|
transport := remote.DefaultTransport.(*http.Transport).Clone()
|
||||||
|
|
||||||
tlsConfig, err := r.getTLSConfig(ctx, obj)
|
tlsConfig, err := r.getTLSConfig(ctx, obj)
|
||||||
|
|
@ -986,7 +985,7 @@ func (r *OCIRepositoryReconciler) transport(ctx context.Context, obj *ociv1.OCIR
|
||||||
|
|
||||||
// getTLSConfig gets the TLS configuration for the transport based on the
|
// getTLSConfig gets the TLS configuration for the transport based on the
|
||||||
// specified secret reference in the OCIRepository object, or the insecure flag.
|
// specified secret reference in the OCIRepository object, or the insecure flag.
|
||||||
func (r *OCIRepositoryReconciler) getTLSConfig(ctx context.Context, obj *ociv1.OCIRepository) (*cryptotls.Config, error) {
|
func (r *OCIRepositoryReconciler) getTLSConfig(ctx context.Context, obj *sourcev1.OCIRepository) (*cryptotls.Config, error) {
|
||||||
if obj.Spec.CertSecretRef == nil || obj.Spec.CertSecretRef.Name == "" {
|
if obj.Spec.CertSecretRef == nil || obj.Spec.CertSecretRef.Name == "" {
|
||||||
if obj.Spec.Insecure {
|
if obj.Spec.Insecure {
|
||||||
return &cryptotls.Config{
|
return &cryptotls.Config{
|
||||||
|
|
@ -1025,7 +1024,7 @@ func (r *OCIRepositoryReconciler) getTLSConfig(ctx context.Context, obj *ociv1.O
|
||||||
|
|
||||||
// getProxyURL gets the proxy configuration for the transport based on the
|
// getProxyURL gets the proxy configuration for the transport based on the
|
||||||
// specified proxy secret reference in the OCIRepository object.
|
// specified proxy secret reference in the OCIRepository object.
|
||||||
func (r *OCIRepositoryReconciler) getProxyURL(ctx context.Context, obj *ociv1.OCIRepository) (*url.URL, error) {
|
func (r *OCIRepositoryReconciler) getProxyURL(ctx context.Context, obj *sourcev1.OCIRepository) (*url.URL, error) {
|
||||||
if obj.Spec.ProxySecretRef == nil || obj.Spec.ProxySecretRef.Name == "" {
|
if obj.Spec.ProxySecretRef == nil || obj.Spec.ProxySecretRef.Name == "" {
|
||||||
return nil, nil
|
return nil, nil
|
||||||
}
|
}
|
||||||
|
|
@ -1070,7 +1069,7 @@ func (r *OCIRepositoryReconciler) getProxyURL(ctx context.Context, obj *ociv1.OC
|
||||||
// The hostname of any URL in the Status of the object are updated, to ensure
|
// The hostname of any URL in the Status of the object are updated, to ensure
|
||||||
// they match the Storage server hostname of current runtime.
|
// they match the Storage server hostname of current runtime.
|
||||||
func (r *OCIRepositoryReconciler) reconcileStorage(ctx context.Context, sp *patch.SerialPatcher,
|
func (r *OCIRepositoryReconciler) reconcileStorage(ctx context.Context, sp *patch.SerialPatcher,
|
||||||
obj *ociv1.OCIRepository, _ *sourcev1.Artifact, _ string) (sreconcile.Result, error) {
|
obj *sourcev1.OCIRepository, _ *sourcev1.Artifact, _ string) (sreconcile.Result, error) {
|
||||||
// Garbage collect previous advertised artifact(s) from storage
|
// Garbage collect previous advertised artifact(s) from storage
|
||||||
_ = r.garbageCollect(ctx, obj)
|
_ = r.garbageCollect(ctx, obj)
|
||||||
|
|
||||||
|
|
@ -1127,13 +1126,13 @@ func (r *OCIRepositoryReconciler) reconcileStorage(ctx context.Context, sp *patc
|
||||||
// (Status) data on the object does not match the given.
|
// (Status) data on the object does not match the given.
|
||||||
//
|
//
|
||||||
// The inspection of the given data to the object is differed, ensuring any
|
// The inspection of the given data to the object is differed, ensuring any
|
||||||
// stale observations like v1beta2.ArtifactOutdatedCondition are removed.
|
// stale observations like v1.ArtifactOutdatedCondition are removed.
|
||||||
// If the given Artifact does not differ from the object's current, it returns
|
// If the given Artifact does not differ from the object's current, it returns
|
||||||
// early.
|
// early.
|
||||||
// On a successful archive, the Artifact in the Status of the object is set,
|
// On a successful archive, the Artifact in the Status of the object is set,
|
||||||
// and the symlink in the Storage is updated to its path.
|
// and the symlink in the Storage is updated to its path.
|
||||||
func (r *OCIRepositoryReconciler) reconcileArtifact(ctx context.Context, sp *patch.SerialPatcher,
|
func (r *OCIRepositoryReconciler) reconcileArtifact(ctx context.Context, sp *patch.SerialPatcher,
|
||||||
obj *ociv1.OCIRepository, metadata *sourcev1.Artifact, dir string) (sreconcile.Result, error) {
|
obj *sourcev1.OCIRepository, metadata *sourcev1.Artifact, dir string) (sreconcile.Result, error) {
|
||||||
// Create artifact
|
// Create artifact
|
||||||
artifact := r.Storage.NewArtifactFor(obj.Kind, obj, metadata.Revision,
|
artifact := r.Storage.NewArtifactFor(obj.Kind, obj, metadata.Revision,
|
||||||
fmt.Sprintf("%s.tar.gz", r.digestFromRevision(metadata.Revision)))
|
fmt.Sprintf("%s.tar.gz", r.digestFromRevision(metadata.Revision)))
|
||||||
|
|
@ -1190,7 +1189,7 @@ func (r *OCIRepositoryReconciler) reconcileArtifact(ctx context.Context, sp *pat
|
||||||
defer unlock()
|
defer unlock()
|
||||||
|
|
||||||
switch obj.GetLayerOperation() {
|
switch obj.GetLayerOperation() {
|
||||||
case ociv1.OCILayerCopy:
|
case sourcev1.OCILayerCopy:
|
||||||
if err = r.Storage.CopyFromPath(&artifact, filepath.Join(dir, metadata.Path)); err != nil {
|
if err = r.Storage.CopyFromPath(&artifact, filepath.Join(dir, metadata.Path)); err != nil {
|
||||||
e := serror.NewGeneric(
|
e := serror.NewGeneric(
|
||||||
fmt.Errorf("unable to copy artifact to storage: %w", err),
|
fmt.Errorf("unable to copy artifact to storage: %w", err),
|
||||||
|
|
@ -1246,7 +1245,7 @@ func (r *OCIRepositoryReconciler) reconcileArtifact(ctx context.Context, sp *pat
|
||||||
// reconcileDelete handles the deletion of the object.
|
// reconcileDelete handles the deletion of the object.
|
||||||
// It first garbage collects all Artifacts for the object from the Storage.
|
// It first garbage collects all Artifacts for the object from the Storage.
|
||||||
// Removing the finalizer from the object if successful.
|
// Removing the finalizer from the object if successful.
|
||||||
func (r *OCIRepositoryReconciler) reconcileDelete(ctx context.Context, obj *ociv1.OCIRepository) (sreconcile.Result, error) {
|
func (r *OCIRepositoryReconciler) reconcileDelete(ctx context.Context, obj *sourcev1.OCIRepository) (sreconcile.Result, error) {
|
||||||
// Garbage collect the resource's artifacts
|
// Garbage collect the resource's artifacts
|
||||||
if err := r.garbageCollect(ctx, obj); err != nil {
|
if err := r.garbageCollect(ctx, obj); err != nil {
|
||||||
// Return the error so we retry the failed garbage collection
|
// Return the error so we retry the failed garbage collection
|
||||||
|
|
@ -1257,7 +1256,7 @@ func (r *OCIRepositoryReconciler) reconcileDelete(ctx context.Context, obj *ociv
|
||||||
controllerutil.RemoveFinalizer(obj, sourcev1.SourceFinalizer)
|
controllerutil.RemoveFinalizer(obj, sourcev1.SourceFinalizer)
|
||||||
|
|
||||||
// Cleanup caches.
|
// Cleanup caches.
|
||||||
r.TokenCache.DeleteEventsForObject(ociv1.OCIRepositoryKind,
|
r.TokenCache.DeleteEventsForObject(sourcev1.OCIRepositoryKind,
|
||||||
obj.GetName(), obj.GetNamespace(), cache.OperationReconcile)
|
obj.GetName(), obj.GetNamespace(), cache.OperationReconcile)
|
||||||
|
|
||||||
// Stop reconciliation as the object is being deleted
|
// Stop reconciliation as the object is being deleted
|
||||||
|
|
@ -1269,7 +1268,7 @@ func (r *OCIRepositoryReconciler) reconcileDelete(ctx context.Context, obj *ociv
|
||||||
// It removes all but the current Artifact from the Storage, unless the
|
// It removes all but the current Artifact from the Storage, unless the
|
||||||
// deletion timestamp on the object is set. Which will result in the
|
// deletion timestamp on the object is set. Which will result in the
|
||||||
// removal of all Artifacts for the objects.
|
// removal of all Artifacts for the objects.
|
||||||
func (r *OCIRepositoryReconciler) garbageCollect(ctx context.Context, obj *ociv1.OCIRepository) error {
|
func (r *OCIRepositoryReconciler) garbageCollect(ctx context.Context, obj *sourcev1.OCIRepository) error {
|
||||||
if !obj.DeletionTimestamp.IsZero() {
|
if !obj.DeletionTimestamp.IsZero() {
|
||||||
if deleted, err := r.Storage.RemoveAll(r.Storage.NewArtifactFor(obj.Kind, obj.GetObjectMeta(), "", "*")); err != nil {
|
if deleted, err := r.Storage.RemoveAll(r.Storage.NewArtifactFor(obj.Kind, obj.GetObjectMeta(), "", "*")); err != nil {
|
||||||
return serror.NewGeneric(
|
return serror.NewGeneric(
|
||||||
|
|
@ -1317,7 +1316,7 @@ func (r *OCIRepositoryReconciler) eventLogf(ctx context.Context, obj runtime.Obj
|
||||||
}
|
}
|
||||||
|
|
||||||
// notify emits notification related to the reconciliation.
|
// notify emits notification related to the reconciliation.
|
||||||
func (r *OCIRepositoryReconciler) notify(ctx context.Context, oldObj, newObj *ociv1.OCIRepository, res sreconcile.Result, resErr error) {
|
func (r *OCIRepositoryReconciler) notify(ctx context.Context, oldObj, newObj *sourcev1.OCIRepository, res sreconcile.Result, resErr error) {
|
||||||
// Notify successful reconciliation for new artifact and recovery from any
|
// Notify successful reconciliation for new artifact and recovery from any
|
||||||
// failure.
|
// failure.
|
||||||
if resErr == nil && res == sreconcile.ResultSuccess && newObj.Status.Artifact != nil {
|
if resErr == nil && res == sreconcile.ResultSuccess && newObj.Status.Artifact != nil {
|
||||||
|
|
@ -1383,7 +1382,7 @@ type remoteOptions []remote.Option
|
||||||
// ociContentConfigChanged evaluates the current spec with the observations
|
// ociContentConfigChanged evaluates the current spec with the observations
|
||||||
// of the artifact in the status to determine if artifact content configuration
|
// of the artifact in the status to determine if artifact content configuration
|
||||||
// has changed and requires rebuilding the artifact.
|
// has changed and requires rebuilding the artifact.
|
||||||
func ociContentConfigChanged(obj *ociv1.OCIRepository) bool {
|
func ociContentConfigChanged(obj *sourcev1.OCIRepository) bool {
|
||||||
if !ptr.Equal(obj.Spec.Ignore, obj.Status.ObservedIgnore) {
|
if !ptr.Equal(obj.Spec.Ignore, obj.Status.ObservedIgnore) {
|
||||||
return true
|
return true
|
||||||
}
|
}
|
||||||
|
|
@ -1398,7 +1397,7 @@ func ociContentConfigChanged(obj *ociv1.OCIRepository) bool {
|
||||||
// Returns true if both arguments are nil or both arguments
|
// Returns true if both arguments are nil or both arguments
|
||||||
// dereference to the same value.
|
// dereference to the same value.
|
||||||
// Based on k8s.io/utils/pointer/pointer.go pointer value equality.
|
// Based on k8s.io/utils/pointer/pointer.go pointer value equality.
|
||||||
func layerSelectorEqual(a, b *ociv1.OCILayerSelector) bool {
|
func layerSelectorEqual(a, b *sourcev1.OCILayerSelector) bool {
|
||||||
if (a == nil) != (b == nil) {
|
if (a == nil) != (b == nil) {
|
||||||
return false
|
return false
|
||||||
}
|
}
|
||||||
|
|
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -56,7 +56,6 @@ import (
|
||||||
"github.com/fluxcd/pkg/testserver"
|
"github.com/fluxcd/pkg/testserver"
|
||||||
|
|
||||||
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
||||||
sourcev1beta2 "github.com/fluxcd/source-controller/api/v1beta2"
|
|
||||||
"github.com/fluxcd/source-controller/internal/cache"
|
"github.com/fluxcd/source-controller/internal/cache"
|
||||||
// +kubebuilder:scaffold:imports
|
// +kubebuilder:scaffold:imports
|
||||||
)
|
)
|
||||||
|
|
@ -274,7 +273,6 @@ func TestMain(m *testing.M) {
|
||||||
initTestTLS()
|
initTestTLS()
|
||||||
|
|
||||||
utilruntime.Must(sourcev1.AddToScheme(scheme.Scheme))
|
utilruntime.Must(sourcev1.AddToScheme(scheme.Scheme))
|
||||||
utilruntime.Must(sourcev1beta2.AddToScheme(scheme.Scheme))
|
|
||||||
|
|
||||||
testEnv = testenv.New(
|
testEnv = testenv.New(
|
||||||
testenv.WithCRDPath(filepath.Join("..", "..", "config", "crd", "bases")),
|
testenv.WithCRDPath(filepath.Join("..", "..", "config", "crd", "bases")),
|
||||||
|
|
|
||||||
|
|
@ -32,7 +32,6 @@ import (
|
||||||
"sigs.k8s.io/controller-runtime/pkg/client"
|
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||||
|
|
||||||
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
||||||
sourcev1beta2 "github.com/fluxcd/source-controller/api/v1beta2"
|
|
||||||
"github.com/fluxcd/source-controller/internal/helm/registry"
|
"github.com/fluxcd/source-controller/internal/helm/registry"
|
||||||
soci "github.com/fluxcd/source-controller/internal/oci"
|
soci "github.com/fluxcd/source-controller/internal/oci"
|
||||||
stls "github.com/fluxcd/source-controller/internal/tls"
|
stls "github.com/fluxcd/source-controller/internal/tls"
|
||||||
|
|
@ -135,7 +134,7 @@ func GetClientOpts(ctx context.Context, c client.Client, obj *sourcev1.HelmRepos
|
||||||
return nil, "", fmt.Errorf("failed to configure login options: %w", err)
|
return nil, "", fmt.Errorf("failed to configure login options: %w", err)
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
} else if obj.Spec.Provider != sourcev1beta2.GenericOCIProvider && obj.Spec.Type == sourcev1.HelmRepositoryTypeOCI && ociRepo {
|
} else if obj.Spec.Provider != sourcev1.GenericOCIProvider && obj.Spec.Type == sourcev1.HelmRepositoryTypeOCI && ociRepo {
|
||||||
authenticator, authErr := soci.OIDCAuth(ctx, obj.Spec.URL, obj.Spec.Provider)
|
authenticator, authErr := soci.OIDCAuth(ctx, obj.Spec.URL, obj.Spec.Provider)
|
||||||
if authErr != nil {
|
if authErr != nil {
|
||||||
return nil, "", fmt.Errorf("failed to get credential from '%s': %w", obj.Spec.Provider, authErr)
|
return nil, "", fmt.Errorf("failed to get credential from '%s': %w", obj.Spec.Provider, authErr)
|
||||||
|
|
|
||||||
|
|
@ -25,7 +25,7 @@ import (
|
||||||
"github.com/fluxcd/pkg/auth"
|
"github.com/fluxcd/pkg/auth"
|
||||||
authutils "github.com/fluxcd/pkg/auth/utils"
|
authutils "github.com/fluxcd/pkg/auth/utils"
|
||||||
|
|
||||||
sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
|
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
||||||
)
|
)
|
||||||
|
|
||||||
// Anonymous is an authn.AuthConfig that always returns an anonymous
|
// Anonymous is an authn.AuthConfig that always returns an anonymous
|
||||||
|
|
|
||||||
|
|
@ -29,7 +29,7 @@ import (
|
||||||
"github.com/fluxcd/pkg/runtime/conditions"
|
"github.com/fluxcd/pkg/runtime/conditions"
|
||||||
"github.com/fluxcd/pkg/runtime/patch"
|
"github.com/fluxcd/pkg/runtime/patch"
|
||||||
|
|
||||||
sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
|
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
||||||
serror "github.com/fluxcd/source-controller/internal/error"
|
serror "github.com/fluxcd/source-controller/internal/error"
|
||||||
)
|
)
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -26,7 +26,8 @@ import (
|
||||||
"sigs.k8s.io/controller-runtime/pkg/client"
|
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||||
|
|
||||||
"github.com/fluxcd/pkg/apis/meta"
|
"github.com/fluxcd/pkg/apis/meta"
|
||||||
sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
|
|
||||||
|
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
||||||
"github.com/fluxcd/source-controller/internal/object"
|
"github.com/fluxcd/source-controller/internal/object"
|
||||||
"github.com/fluxcd/source-controller/internal/reconcile"
|
"github.com/fluxcd/source-controller/internal/reconcile"
|
||||||
)
|
)
|
||||||
|
|
|
||||||
29
main.go
29
main.go
|
|
@ -53,9 +53,7 @@ import (
|
||||||
"github.com/fluxcd/pkg/runtime/pprof"
|
"github.com/fluxcd/pkg/runtime/pprof"
|
||||||
"github.com/fluxcd/pkg/runtime/probes"
|
"github.com/fluxcd/pkg/runtime/probes"
|
||||||
|
|
||||||
v1 "github.com/fluxcd/source-controller/api/v1"
|
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
||||||
"github.com/fluxcd/source-controller/api/v1beta2"
|
|
||||||
|
|
||||||
// +kubebuilder:scaffold:imports
|
// +kubebuilder:scaffold:imports
|
||||||
|
|
||||||
"github.com/fluxcd/source-controller/internal/cache"
|
"github.com/fluxcd/source-controller/internal/cache"
|
||||||
|
|
@ -86,8 +84,7 @@ var (
|
||||||
func init() {
|
func init() {
|
||||||
utilruntime.Must(clientgoscheme.AddToScheme(scheme))
|
utilruntime.Must(clientgoscheme.AddToScheme(scheme))
|
||||||
|
|
||||||
utilruntime.Must(v1beta2.AddToScheme(scheme))
|
utilruntime.Must(sourcev1.AddToScheme(scheme))
|
||||||
utilruntime.Must(v1.AddToScheme(scheme))
|
|
||||||
// +kubebuilder:scaffold:scheme
|
// +kubebuilder:scaffold:scheme
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -196,7 +193,7 @@ func main() {
|
||||||
|
|
||||||
probes.SetupChecks(mgr, setupLog)
|
probes.SetupChecks(mgr, setupLog)
|
||||||
|
|
||||||
metrics := helper.NewMetrics(mgr, metrics.MustMakeRecorder(), v1.SourceFinalizer)
|
metrics := helper.NewMetrics(mgr, metrics.MustMakeRecorder(), sourcev1.SourceFinalizer)
|
||||||
cacheRecorder := cache.MustMakeMetrics()
|
cacheRecorder := cache.MustMakeMetrics()
|
||||||
eventRecorder := mustSetupEventRecorder(mgr, eventsAddr, controllerName)
|
eventRecorder := mustSetupEventRecorder(mgr, eventsAddr, controllerName)
|
||||||
storage := mustInitStorage(storagePath, storageAdvAddr, artifactRetentionTTL, artifactRetentionRecords, artifactDigestAlgo)
|
storage := mustInitStorage(storagePath, storageAdvAddr, artifactRetentionTTL, artifactRetentionRecords, artifactDigestAlgo)
|
||||||
|
|
@ -230,7 +227,7 @@ func main() {
|
||||||
DependencyRequeueInterval: requeueDependency,
|
DependencyRequeueInterval: requeueDependency,
|
||||||
RateLimiter: helper.GetRateLimiter(rateLimiterOptions),
|
RateLimiter: helper.GetRateLimiter(rateLimiterOptions),
|
||||||
}); err != nil {
|
}); err != nil {
|
||||||
setupLog.Error(err, "unable to create controller", "controller", v1.GitRepositoryKind)
|
setupLog.Error(err, "unable to create controller", "controller", sourcev1.GitRepositoryKind)
|
||||||
os.Exit(1)
|
os.Exit(1)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -247,7 +244,7 @@ func main() {
|
||||||
}).SetupWithManagerAndOptions(mgr, controller.HelmRepositoryReconcilerOptions{
|
}).SetupWithManagerAndOptions(mgr, controller.HelmRepositoryReconcilerOptions{
|
||||||
RateLimiter: helper.GetRateLimiter(rateLimiterOptions),
|
RateLimiter: helper.GetRateLimiter(rateLimiterOptions),
|
||||||
}); err != nil {
|
}); err != nil {
|
||||||
setupLog.Error(err, "unable to create controller", "controller", v1.HelmRepositoryKind)
|
setupLog.Error(err, "unable to create controller", "controller", sourcev1.HelmRepositoryKind)
|
||||||
os.Exit(1)
|
os.Exit(1)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -265,7 +262,7 @@ func main() {
|
||||||
}).SetupWithManagerAndOptions(ctx, mgr, controller.HelmChartReconcilerOptions{
|
}).SetupWithManagerAndOptions(ctx, mgr, controller.HelmChartReconcilerOptions{
|
||||||
RateLimiter: helper.GetRateLimiter(rateLimiterOptions),
|
RateLimiter: helper.GetRateLimiter(rateLimiterOptions),
|
||||||
}); err != nil {
|
}); err != nil {
|
||||||
setupLog.Error(err, "unable to create controller", "controller", v1.HelmChartKind)
|
setupLog.Error(err, "unable to create controller", "controller", sourcev1.HelmChartKind)
|
||||||
os.Exit(1)
|
os.Exit(1)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -278,7 +275,7 @@ func main() {
|
||||||
}).SetupWithManagerAndOptions(mgr, controller.BucketReconcilerOptions{
|
}).SetupWithManagerAndOptions(mgr, controller.BucketReconcilerOptions{
|
||||||
RateLimiter: helper.GetRateLimiter(rateLimiterOptions),
|
RateLimiter: helper.GetRateLimiter(rateLimiterOptions),
|
||||||
}); err != nil {
|
}); err != nil {
|
||||||
setupLog.Error(err, "unable to create controller", "controller", v1.BucketKind)
|
setupLog.Error(err, "unable to create controller", "controller", sourcev1.BucketKind)
|
||||||
os.Exit(1)
|
os.Exit(1)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
@ -292,7 +289,7 @@ func main() {
|
||||||
}).SetupWithManagerAndOptions(mgr, controller.OCIRepositoryReconcilerOptions{
|
}).SetupWithManagerAndOptions(mgr, controller.OCIRepositoryReconcilerOptions{
|
||||||
RateLimiter: helper.GetRateLimiter(rateLimiterOptions),
|
RateLimiter: helper.GetRateLimiter(rateLimiterOptions),
|
||||||
}); err != nil {
|
}); err != nil {
|
||||||
setupLog.Error(err, "unable to create controller", "controller", v1beta2.OCIRepositoryKind)
|
setupLog.Error(err, "unable to create controller", "controller", sourcev1.OCIRepositoryKind)
|
||||||
os.Exit(1)
|
os.Exit(1)
|
||||||
}
|
}
|
||||||
// +kubebuilder:scaffold:builder
|
// +kubebuilder:scaffold:builder
|
||||||
|
|
@ -380,11 +377,11 @@ func mustSetupManager(metricsAddr, healthAddr string, maxConcurrent int,
|
||||||
},
|
},
|
||||||
Cache: ctrlcache.Options{
|
Cache: ctrlcache.Options{
|
||||||
ByObject: map[ctrlclient.Object]ctrlcache.ByObject{
|
ByObject: map[ctrlclient.Object]ctrlcache.ByObject{
|
||||||
&v1.GitRepository{}: {Label: watchSelector},
|
&sourcev1.GitRepository{}: {Label: watchSelector},
|
||||||
&v1.HelmRepository{}: {Label: watchSelector},
|
&sourcev1.HelmRepository{}: {Label: watchSelector},
|
||||||
&v1.HelmChart{}: {Label: watchSelector},
|
&sourcev1.HelmChart{}: {Label: watchSelector},
|
||||||
&v1.Bucket{}: {Label: watchSelector},
|
&sourcev1.Bucket{}: {Label: watchSelector},
|
||||||
&v1beta2.OCIRepository{}: {Label: watchSelector},
|
&sourcev1.OCIRepository{}: {Label: watchSelector},
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
Metrics: metricsserver.Options{
|
Metrics: metricsserver.Options{
|
||||||
|
|
|
||||||
|
|
@ -52,7 +52,7 @@ import (
|
||||||
|
|
||||||
const (
|
const (
|
||||||
objectName string = "test.yaml"
|
objectName string = "test.yaml"
|
||||||
objectEtag string = "2020beab5f1711919157756379622d1d"
|
objectEtag string = "b07bba5a280b58791bc78fb9fc414b09"
|
||||||
)
|
)
|
||||||
|
|
||||||
var (
|
var (
|
||||||
|
|
@ -801,7 +801,7 @@ func removeObjectFromBucket(ctx context.Context) {
|
||||||
|
|
||||||
func getObjectFile() string {
|
func getObjectFile() string {
|
||||||
return `
|
return `
|
||||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
apiVersion: source.toolkit.fluxcd.io/v1
|
||||||
kind: Bucket
|
kind: Bucket
|
||||||
metadata:
|
metadata:
|
||||||
name: podinfo
|
name: podinfo
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue