Merge pull request #1794 from fluxcd/ocirepository-v1
Promote OCIRepository API to v1 (GA)
This commit is contained in:
Stefan Prodan
GitHub
commit
e98b89a5a0
1
Makefile
1
Makefile
|
|
@ -115,7 +115,6 @@ manifests: controller-gen ## Generate manifests, e.g. CRD, RBAC, etc.
|
|||
cd api; $(CONTROLLER_GEN) $(CRD_OPTIONS) rbac:roleName=manager-role paths="./..." output:crd:artifacts:config="../config/crd/bases"
|
||||
|
||||
api-docs: gen-crd-api-reference-docs ## Generate API reference documentation
|
||||
$(GEN_CRD_API_REFERENCE_DOCS) -api-dir=./api/v1beta2 -config=./hack/api-docs/config.json -template-dir=./hack/api-docs/template -out-file=./docs/api/v1beta2/source.md
|
||||
$(GEN_CRD_API_REFERENCE_DOCS) -api-dir=./api/v1 -config=./hack/api-docs/config.json -template-dir=./hack/api-docs/template -out-file=./docs/api/v1/source.md
|
||||
|
||||
tidy: ## Run go mod tidy
|
||||
|
|
|
|||
3
PROJECT
3
PROJECT
|
|
@ -40,4 +40,7 @@ resources:
|
|||
- group: source
|
||||
kind: Bucket
|
||||
version: v1
|
||||
- group: source
|
||||
kind: OCIRepository
|
||||
version: v1
|
||||
version: "2"
|
||||
|
|
|
|||
14
README.md
14
README.md
|
|
@ -16,13 +16,13 @@ and is a core component of the [GitOps toolkit](https://fluxcd.io/flux/component
|
|||
|
||||
## APIs
|
||||
|
||||
| Kind | API Version |
|
||||
|-------------------------------------------------------|------------------------------------|
|
||||
| [GitRepository](docs/spec/v1/gitrepositories.md) | `source.toolkit.fluxcd.io/v1` |
|
||||
| [OCIRepository](docs/spec/v1beta2/ocirepositories.md) | `source.toolkit.fluxcd.io/v1beta2` |
|
||||
| [HelmRepository](docs/spec/v1/helmrepositories.md) | `source.toolkit.fluxcd.io/v1` |
|
||||
| [HelmChart](docs/spec/v1/helmcharts.md) | `source.toolkit.fluxcd.io/v1` |
|
||||
| [Bucket](docs/spec/v1/buckets.md) | `source.toolkit.fluxcd.io/v1` |
|
||||
| Kind | API Version |
|
||||
|----------------------------------------------------|-------------------------------|
|
||||
| [GitRepository](docs/spec/v1/gitrepositories.md) | `source.toolkit.fluxcd.io/v1` |
|
||||
| [OCIRepository](docs/spec/v1/ocirepositories.md) | `source.toolkit.fluxcd.io/v1` |
|
||||
| [HelmRepository](docs/spec/v1/helmrepositories.md) | `source.toolkit.fluxcd.io/v1` |
|
||||
| [HelmChart](docs/spec/v1/helmcharts.md) | `source.toolkit.fluxcd.io/v1` |
|
||||
| [Bucket](docs/spec/v1/buckets.md) | `source.toolkit.fluxcd.io/v1` |
|
||||
|
||||
## Features
|
||||
|
||||
|
|
|
|||
|
|
@ -22,8 +22,8 @@ require (
|
|||
github.com/modern-go/reflect2 v1.0.2 // indirect
|
||||
github.com/spf13/pflag v1.0.6 // indirect
|
||||
github.com/x448/float16 v0.8.4 // indirect
|
||||
golang.org/x/net v0.39.0 // indirect
|
||||
golang.org/x/text v0.24.0 // indirect
|
||||
golang.org/x/net v0.40.0 // indirect
|
||||
golang.org/x/text v0.25.0 // indirect
|
||||
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
|
||||
gopkg.in/inf.v0 v0.9.1 // indirect
|
||||
k8s.io/klog/v2 v2.130.1 // indirect
|
||||
|
|
|
|||
12
api/go.sum
12
api/go.sum
|
|
@ -65,20 +65,20 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
|
|||
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
|
||||
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
|
||||
golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
|
||||
golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
|
||||
golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
|
||||
golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
|
||||
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
|
||||
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.32.0 h1:s77OFDvIQeibCmezSnk/q6iAfkdiQaJi4VzroCFrN20=
|
||||
golang.org/x/sys v0.32.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
|
||||
golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
|
||||
golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
|
||||
golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
|
||||
golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
|
||||
golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
|
||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
|
||||
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
|
||||
|
|
|
|||
|
|
@ -0,0 +1,296 @@
|
|||
/*
|
||||
Copyright 2025 The Flux authors
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1
|
||||
|
||||
import (
|
||||
"time"
|
||||
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
|
||||
"github.com/fluxcd/pkg/apis/meta"
|
||||
)
|
||||
|
||||
const (
|
||||
// OCIRepositoryKind is the string representation of an OCIRepository.
|
||||
OCIRepositoryKind = "OCIRepository"
|
||||
|
||||
// OCIRepositoryPrefix is the prefix used for OCIRepository URLs.
|
||||
OCIRepositoryPrefix = "oci://"
|
||||
|
||||
// GenericOCIProvider provides support for authentication using static credentials
|
||||
// for any OCI compatible API such as Docker Registry, GitHub Container Registry,
|
||||
// Docker Hub, Quay, etc.
|
||||
GenericOCIProvider string = "generic"
|
||||
|
||||
// AmazonOCIProvider provides support for OCI authentication using AWS IRSA.
|
||||
AmazonOCIProvider string = "aws"
|
||||
|
||||
// GoogleOCIProvider provides support for OCI authentication using GCP workload identity.
|
||||
GoogleOCIProvider string = "gcp"
|
||||
|
||||
// AzureOCIProvider provides support for OCI authentication using a Azure Service Principal,
|
||||
// Managed Identity or Shared Key.
|
||||
AzureOCIProvider string = "azure"
|
||||
|
||||
// OCILayerExtract defines the operation type for extracting the content from an OCI artifact layer.
|
||||
OCILayerExtract = "extract"
|
||||
|
||||
// OCILayerCopy defines the operation type for copying the content from an OCI artifact layer.
|
||||
OCILayerCopy = "copy"
|
||||
)
|
||||
|
||||
// OCIRepositorySpec defines the desired state of OCIRepository
|
||||
type OCIRepositorySpec struct {
|
||||
// URL is a reference to an OCI artifact repository hosted
|
||||
// on a remote container registry.
|
||||
// +kubebuilder:validation:Pattern="^oci://.*$"
|
||||
// +required
|
||||
URL string `json:"url"`
|
||||
|
||||
// The OCI reference to pull and monitor for changes,
|
||||
// defaults to the latest tag.
|
||||
// +optional
|
||||
Reference *OCIRepositoryRef `json:"ref,omitempty"`
|
||||
|
||||
// LayerSelector specifies which layer should be extracted from the OCI artifact.
|
||||
// When not specified, the first layer found in the artifact is selected.
|
||||
// +optional
|
||||
LayerSelector *OCILayerSelector `json:"layerSelector,omitempty"`
|
||||
|
||||
// The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.
|
||||
// When not specified, defaults to 'generic'.
|
||||
// +kubebuilder:validation:Enum=generic;aws;azure;gcp
|
||||
// +kubebuilder:default:=generic
|
||||
// +optional
|
||||
Provider string `json:"provider,omitempty"`
|
||||
|
||||
// SecretRef contains the secret name containing the registry login
|
||||
// credentials to resolve image metadata.
|
||||
// The secret must be of type kubernetes.io/dockerconfigjson.
|
||||
// +optional
|
||||
SecretRef *meta.LocalObjectReference `json:"secretRef,omitempty"`
|
||||
|
||||
// Verify contains the secret name containing the trusted public keys
|
||||
// used to verify the signature and specifies which provider to use to check
|
||||
// whether OCI image is authentic.
|
||||
// +optional
|
||||
Verify *OCIRepositoryVerification `json:"verify,omitempty"`
|
||||
|
||||
// ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
|
||||
// the image pull if the service account has attached pull secrets. For more information:
|
||||
// https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account
|
||||
// +optional
|
||||
ServiceAccountName string `json:"serviceAccountName,omitempty"`
|
||||
|
||||
// CertSecretRef can be given the name of a Secret containing
|
||||
// either or both of
|
||||
//
|
||||
// - a PEM-encoded client certificate (`tls.crt`) and private
|
||||
// key (`tls.key`);
|
||||
// - a PEM-encoded CA certificate (`ca.crt`)
|
||||
//
|
||||
// and whichever are supplied, will be used for connecting to the
|
||||
// registry. The client cert and key are useful if you are
|
||||
// authenticating with a certificate; the CA cert is useful if
|
||||
// you are using a self-signed server certificate. The Secret must
|
||||
// be of type `Opaque` or `kubernetes.io/tls`.
|
||||
// +optional
|
||||
CertSecretRef *meta.LocalObjectReference `json:"certSecretRef,omitempty"`
|
||||
|
||||
// ProxySecretRef specifies the Secret containing the proxy configuration
|
||||
// to use while communicating with the container registry.
|
||||
// +optional
|
||||
ProxySecretRef *meta.LocalObjectReference `json:"proxySecretRef,omitempty"`
|
||||
|
||||
// Interval at which the OCIRepository URL is checked for updates.
|
||||
// This interval is approximate and may be subject to jitter to ensure
|
||||
// efficient use of resources.
|
||||
// +kubebuilder:validation:Type=string
|
||||
// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
|
||||
// +required
|
||||
Interval metav1.Duration `json:"interval"`
|
||||
|
||||
// The timeout for remote OCI Repository operations like pulling, defaults to 60s.
|
||||
// +kubebuilder:default="60s"
|
||||
// +kubebuilder:validation:Type=string
|
||||
// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m))+$"
|
||||
// +optional
|
||||
Timeout *metav1.Duration `json:"timeout,omitempty"`
|
||||
|
||||
// Ignore overrides the set of excluded patterns in the .sourceignore format
|
||||
// (which is the same as .gitignore). If not provided, a default will be used,
|
||||
// consult the documentation for your version to find out what those are.
|
||||
// +optional
|
||||
Ignore *string `json:"ignore,omitempty"`
|
||||
|
||||
// Insecure allows connecting to a non-TLS HTTP container registry.
|
||||
// +optional
|
||||
Insecure bool `json:"insecure,omitempty"`
|
||||
|
||||
// This flag tells the controller to suspend the reconciliation of this source.
|
||||
// +optional
|
||||
Suspend bool `json:"suspend,omitempty"`
|
||||
}
|
||||
|
||||
// OCIRepositoryRef defines the image reference for the OCIRepository's URL
|
||||
type OCIRepositoryRef struct {
|
||||
// Digest is the image digest to pull, takes precedence over SemVer.
|
||||
// The value should be in the format 'sha256:<HASH>'.
|
||||
// +optional
|
||||
Digest string `json:"digest,omitempty"`
|
||||
|
||||
// SemVer is the range of tags to pull selecting the latest within
|
||||
// the range, takes precedence over Tag.
|
||||
// +optional
|
||||
SemVer string `json:"semver,omitempty"`
|
||||
|
||||
// SemverFilter is a regex pattern to filter the tags within the SemVer range.
|
||||
// +optional
|
||||
SemverFilter string `json:"semverFilter,omitempty"`
|
||||
|
||||
// Tag is the image tag to pull, defaults to latest.
|
||||
// +optional
|
||||
Tag string `json:"tag,omitempty"`
|
||||
}
|
||||
|
||||
// OCILayerSelector specifies which layer should be extracted from an OCI Artifact
|
||||
type OCILayerSelector struct {
|
||||
// MediaType specifies the OCI media type of the layer
|
||||
// which should be extracted from the OCI Artifact. The
|
||||
// first layer matching this type is selected.
|
||||
// +optional
|
||||
MediaType string `json:"mediaType,omitempty"`
|
||||
|
||||
// Operation specifies how the selected layer should be processed.
|
||||
// By default, the layer compressed content is extracted to storage.
|
||||
// When the operation is set to 'copy', the layer compressed content
|
||||
// is persisted to storage as it is.
|
||||
// +kubebuilder:validation:Enum=extract;copy
|
||||
// +optional
|
||||
Operation string `json:"operation,omitempty"`
|
||||
}
|
||||
|
||||
// OCIRepositoryStatus defines the observed state of OCIRepository
|
||||
type OCIRepositoryStatus struct {
|
||||
// ObservedGeneration is the last observed generation.
|
||||
// +optional
|
||||
ObservedGeneration int64 `json:"observedGeneration,omitempty"`
|
||||
|
||||
// Conditions holds the conditions for the OCIRepository.
|
||||
// +optional
|
||||
Conditions []metav1.Condition `json:"conditions,omitempty"`
|
||||
|
||||
// URL is the download link for the artifact output of the last OCI Repository sync.
|
||||
// +optional
|
||||
URL string `json:"url,omitempty"`
|
||||
|
||||
// Artifact represents the output of the last successful OCI Repository sync.
|
||||
// +optional
|
||||
Artifact *Artifact `json:"artifact,omitempty"`
|
||||
|
||||
// ObservedIgnore is the observed exclusion patterns used for constructing
|
||||
// the source artifact.
|
||||
// +optional
|
||||
ObservedIgnore *string `json:"observedIgnore,omitempty"`
|
||||
|
||||
// ObservedLayerSelector is the observed layer selector used for constructing
|
||||
// the source artifact.
|
||||
// +optional
|
||||
ObservedLayerSelector *OCILayerSelector `json:"observedLayerSelector,omitempty"`
|
||||
|
||||
meta.ReconcileRequestStatus `json:",inline"`
|
||||
}
|
||||
|
||||
const (
|
||||
// OCIPullFailedReason signals that a pull operation failed.
|
||||
OCIPullFailedReason string = "OCIArtifactPullFailed"
|
||||
|
||||
// OCILayerOperationFailedReason signals that an OCI layer operation failed.
|
||||
OCILayerOperationFailedReason string = "OCIArtifactLayerOperationFailed"
|
||||
)
|
||||
|
||||
// GetConditions returns the status conditions of the object.
|
||||
func (in OCIRepository) GetConditions() []metav1.Condition {
|
||||
return in.Status.Conditions
|
||||
}
|
||||
|
||||
// SetConditions sets the status conditions on the object.
|
||||
func (in *OCIRepository) SetConditions(conditions []metav1.Condition) {
|
||||
in.Status.Conditions = conditions
|
||||
}
|
||||
|
||||
// GetRequeueAfter returns the duration after which the OCIRepository must be
|
||||
// reconciled again.
|
||||
func (in OCIRepository) GetRequeueAfter() time.Duration {
|
||||
return in.Spec.Interval.Duration
|
||||
}
|
||||
|
||||
// GetArtifact returns the latest Artifact from the OCIRepository if present in
|
||||
// the status sub-resource.
|
||||
func (in *OCIRepository) GetArtifact() *Artifact {
|
||||
return in.Status.Artifact
|
||||
}
|
||||
|
||||
// GetLayerMediaType returns the media type layer selector if found in spec.
|
||||
func (in *OCIRepository) GetLayerMediaType() string {
|
||||
if in.Spec.LayerSelector == nil {
|
||||
return ""
|
||||
}
|
||||
|
||||
return in.Spec.LayerSelector.MediaType
|
||||
}
|
||||
|
||||
// GetLayerOperation returns the layer selector operation (defaults to extract).
|
||||
func (in *OCIRepository) GetLayerOperation() string {
|
||||
if in.Spec.LayerSelector == nil || in.Spec.LayerSelector.Operation == "" {
|
||||
return OCILayerExtract
|
||||
}
|
||||
|
||||
return in.Spec.LayerSelector.Operation
|
||||
}
|
||||
|
||||
// +genclient
|
||||
// +kubebuilder:storageversion
|
||||
// +kubebuilder:object:root=true
|
||||
// +kubebuilder:resource:shortName=ocirepo
|
||||
// +kubebuilder:subresource:status
|
||||
// +kubebuilder:printcolumn:name="URL",type=string,JSONPath=`.spec.url`
|
||||
// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description=""
|
||||
// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].message",description=""
|
||||
// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description=""
|
||||
|
||||
// OCIRepository is the Schema for the ocirepositories API
|
||||
type OCIRepository struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
metav1.ObjectMeta `json:"metadata,omitempty"`
|
||||
|
||||
Spec OCIRepositorySpec `json:"spec,omitempty"`
|
||||
// +kubebuilder:default={"observedGeneration":-1}
|
||||
Status OCIRepositoryStatus `json:"status,omitempty"`
|
||||
}
|
||||
|
||||
// OCIRepositoryList contains a list of OCIRepository
|
||||
// +kubebuilder:object:root=true
|
||||
type OCIRepositoryList struct {
|
||||
metav1.TypeMeta `json:",inline"`
|
||||
metav1.ListMeta `json:"metadata,omitempty"`
|
||||
Items []OCIRepository `json:"items"`
|
||||
}
|
||||
|
||||
func init() {
|
||||
SchemeBuilder.Register(&OCIRepository{}, &OCIRepositoryList{})
|
||||
}
|
||||
|
|
@ -696,6 +696,189 @@ func (in *LocalHelmChartSourceReference) DeepCopy() *LocalHelmChartSourceReferen
|
|||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *OCILayerSelector) DeepCopyInto(out *OCILayerSelector) {
|
||||
*out = *in
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OCILayerSelector.
|
||||
func (in *OCILayerSelector) DeepCopy() *OCILayerSelector {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(OCILayerSelector)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *OCIRepository) DeepCopyInto(out *OCIRepository) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
|
||||
in.Spec.DeepCopyInto(&out.Spec)
|
||||
in.Status.DeepCopyInto(&out.Status)
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OCIRepository.
|
||||
func (in *OCIRepository) DeepCopy() *OCIRepository {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(OCIRepository)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *OCIRepository) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *OCIRepositoryList) DeepCopyInto(out *OCIRepositoryList) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
in.ListMeta.DeepCopyInto(&out.ListMeta)
|
||||
if in.Items != nil {
|
||||
in, out := &in.Items, &out.Items
|
||||
*out = make([]OCIRepository, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OCIRepositoryList.
|
||||
func (in *OCIRepositoryList) DeepCopy() *OCIRepositoryList {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(OCIRepositoryList)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *OCIRepositoryList) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *OCIRepositoryRef) DeepCopyInto(out *OCIRepositoryRef) {
|
||||
*out = *in
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OCIRepositoryRef.
|
||||
func (in *OCIRepositoryRef) DeepCopy() *OCIRepositoryRef {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(OCIRepositoryRef)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *OCIRepositorySpec) DeepCopyInto(out *OCIRepositorySpec) {
|
||||
*out = *in
|
||||
if in.Reference != nil {
|
||||
in, out := &in.Reference, &out.Reference
|
||||
*out = new(OCIRepositoryRef)
|
||||
**out = **in
|
||||
}
|
||||
if in.LayerSelector != nil {
|
||||
in, out := &in.LayerSelector, &out.LayerSelector
|
||||
*out = new(OCILayerSelector)
|
||||
**out = **in
|
||||
}
|
||||
if in.SecretRef != nil {
|
||||
in, out := &in.SecretRef, &out.SecretRef
|
||||
*out = new(meta.LocalObjectReference)
|
||||
**out = **in
|
||||
}
|
||||
if in.Verify != nil {
|
||||
in, out := &in.Verify, &out.Verify
|
||||
*out = new(OCIRepositoryVerification)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.CertSecretRef != nil {
|
||||
in, out := &in.CertSecretRef, &out.CertSecretRef
|
||||
*out = new(meta.LocalObjectReference)
|
||||
**out = **in
|
||||
}
|
||||
if in.ProxySecretRef != nil {
|
||||
in, out := &in.ProxySecretRef, &out.ProxySecretRef
|
||||
*out = new(meta.LocalObjectReference)
|
||||
**out = **in
|
||||
}
|
||||
out.Interval = in.Interval
|
||||
if in.Timeout != nil {
|
||||
in, out := &in.Timeout, &out.Timeout
|
||||
*out = new(metav1.Duration)
|
||||
**out = **in
|
||||
}
|
||||
if in.Ignore != nil {
|
||||
in, out := &in.Ignore, &out.Ignore
|
||||
*out = new(string)
|
||||
**out = **in
|
||||
}
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OCIRepositorySpec.
|
||||
func (in *OCIRepositorySpec) DeepCopy() *OCIRepositorySpec {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(OCIRepositorySpec)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *OCIRepositoryStatus) DeepCopyInto(out *OCIRepositoryStatus) {
|
||||
*out = *in
|
||||
if in.Conditions != nil {
|
||||
in, out := &in.Conditions, &out.Conditions
|
||||
*out = make([]metav1.Condition, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
if in.Artifact != nil {
|
||||
in, out := &in.Artifact, &out.Artifact
|
||||
*out = new(Artifact)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.ObservedIgnore != nil {
|
||||
in, out := &in.ObservedIgnore, &out.ObservedIgnore
|
||||
*out = new(string)
|
||||
**out = **in
|
||||
}
|
||||
if in.ObservedLayerSelector != nil {
|
||||
in, out := &in.ObservedLayerSelector, &out.ObservedLayerSelector
|
||||
*out = new(OCILayerSelector)
|
||||
**out = **in
|
||||
}
|
||||
out.ReconcileRequestStatus = in.ReconcileRequestStatus
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OCIRepositoryStatus.
|
||||
func (in *OCIRepositoryStatus) DeepCopy() *OCIRepositoryStatus {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(OCIRepositoryStatus)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *OCIRepositoryVerification) DeepCopyInto(out *OCIRepositoryVerification) {
|
||||
*out = *in
|
||||
|
|
|
|||
|
|
@ -283,10 +283,10 @@ func (in *OCIRepository) GetLayerOperation() string {
|
|||
}
|
||||
|
||||
// +genclient
|
||||
// +kubebuilder:storageversion
|
||||
// +kubebuilder:object:root=true
|
||||
// +kubebuilder:resource:shortName=ocirepo
|
||||
// +kubebuilder:subresource:status
|
||||
// +kubebuilder:deprecatedversion:warning="v1beta2 OCIRepository is deprecated, upgrade to v1"
|
||||
// +kubebuilder:printcolumn:name="URL",type=string,JSONPath=`.spec.url`
|
||||
// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description=""
|
||||
// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].message",description=""
|
||||
|
|
|
|||
|
|
@ -29,6 +29,400 @@ spec:
|
|||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: OCIRepository is the Schema for the ocirepositories API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: OCIRepositorySpec defines the desired state of OCIRepository
|
||||
properties:
|
||||
certSecretRef:
|
||||
description: |-
|
||||
CertSecretRef can be given the name of a Secret containing
|
||||
either or both of
|
||||
|
||||
- a PEM-encoded client certificate (`tls.crt`) and private
|
||||
key (`tls.key`);
|
||||
- a PEM-encoded CA certificate (`ca.crt`)
|
||||
|
||||
and whichever are supplied, will be used for connecting to the
|
||||
registry. The client cert and key are useful if you are
|
||||
authenticating with a certificate; the CA cert is useful if
|
||||
you are using a self-signed server certificate. The Secret must
|
||||
be of type `Opaque` or `kubernetes.io/tls`.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the referent.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
ignore:
|
||||
description: |-
|
||||
Ignore overrides the set of excluded patterns in the .sourceignore format
|
||||
(which is the same as .gitignore). If not provided, a default will be used,
|
||||
consult the documentation for your version to find out what those are.
|
||||
type: string
|
||||
insecure:
|
||||
description: Insecure allows connecting to a non-TLS HTTP container
|
||||
registry.
|
||||
type: boolean
|
||||
interval:
|
||||
description: |-
|
||||
Interval at which the OCIRepository URL is checked for updates.
|
||||
This interval is approximate and may be subject to jitter to ensure
|
||||
efficient use of resources.
|
||||
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
|
||||
type: string
|
||||
layerSelector:
|
||||
description: |-
|
||||
LayerSelector specifies which layer should be extracted from the OCI artifact.
|
||||
When not specified, the first layer found in the artifact is selected.
|
||||
properties:
|
||||
mediaType:
|
||||
description: |-
|
||||
MediaType specifies the OCI media type of the layer
|
||||
which should be extracted from the OCI Artifact. The
|
||||
first layer matching this type is selected.
|
||||
type: string
|
||||
operation:
|
||||
description: |-
|
||||
Operation specifies how the selected layer should be processed.
|
||||
By default, the layer compressed content is extracted to storage.
|
||||
When the operation is set to 'copy', the layer compressed content
|
||||
is persisted to storage as it is.
|
||||
enum:
|
||||
- extract
|
||||
- copy
|
||||
type: string
|
||||
type: object
|
||||
provider:
|
||||
default: generic
|
||||
description: |-
|
||||
The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.
|
||||
When not specified, defaults to 'generic'.
|
||||
enum:
|
||||
- generic
|
||||
- aws
|
||||
- azure
|
||||
- gcp
|
||||
type: string
|
||||
proxySecretRef:
|
||||
description: |-
|
||||
ProxySecretRef specifies the Secret containing the proxy configuration
|
||||
to use while communicating with the container registry.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the referent.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
ref:
|
||||
description: |-
|
||||
The OCI reference to pull and monitor for changes,
|
||||
defaults to the latest tag.
|
||||
properties:
|
||||
digest:
|
||||
description: |-
|
||||
Digest is the image digest to pull, takes precedence over SemVer.
|
||||
The value should be in the format 'sha256:<HASH>'.
|
||||
type: string
|
||||
semver:
|
||||
description: |-
|
||||
SemVer is the range of tags to pull selecting the latest within
|
||||
the range, takes precedence over Tag.
|
||||
type: string
|
||||
semverFilter:
|
||||
description: SemverFilter is a regex pattern to filter the tags
|
||||
within the SemVer range.
|
||||
type: string
|
||||
tag:
|
||||
description: Tag is the image tag to pull, defaults to latest.
|
||||
type: string
|
||||
type: object
|
||||
secretRef:
|
||||
description: |-
|
||||
SecretRef contains the secret name containing the registry login
|
||||
credentials to resolve image metadata.
|
||||
The secret must be of type kubernetes.io/dockerconfigjson.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the referent.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
serviceAccountName:
|
||||
description: |-
|
||||
ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
|
||||
the image pull if the service account has attached pull secrets. For more information:
|
||||
https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account
|
||||
type: string
|
||||
suspend:
|
||||
description: This flag tells the controller to suspend the reconciliation
|
||||
of this source.
|
||||
type: boolean
|
||||
timeout:
|
||||
default: 60s
|
||||
description: The timeout for remote OCI Repository operations like
|
||||
pulling, defaults to 60s.
|
||||
pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$
|
||||
type: string
|
||||
url:
|
||||
description: |-
|
||||
URL is a reference to an OCI artifact repository hosted
|
||||
on a remote container registry.
|
||||
pattern: ^oci://.*$
|
||||
type: string
|
||||
verify:
|
||||
description: |-
|
||||
Verify contains the secret name containing the trusted public keys
|
||||
used to verify the signature and specifies which provider to use to check
|
||||
whether OCI image is authentic.
|
||||
properties:
|
||||
matchOIDCIdentity:
|
||||
description: |-
|
||||
MatchOIDCIdentity specifies the identity matching criteria to use
|
||||
while verifying an OCI artifact which was signed using Cosign keyless
|
||||
signing. The artifact's identity is deemed to be verified if any of the
|
||||
specified matchers match against the identity.
|
||||
items:
|
||||
description: |-
|
||||
OIDCIdentityMatch specifies options for verifying the certificate identity,
|
||||
i.e. the issuer and the subject of the certificate.
|
||||
properties:
|
||||
issuer:
|
||||
description: |-
|
||||
Issuer specifies the regex pattern to match against to verify
|
||||
the OIDC issuer in the Fulcio certificate. The pattern must be a
|
||||
valid Go regular expression.
|
||||
type: string
|
||||
subject:
|
||||
description: |-
|
||||
Subject specifies the regex pattern to match against to verify
|
||||
the identity subject in the Fulcio certificate. The pattern must
|
||||
be a valid Go regular expression.
|
||||
type: string
|
||||
required:
|
||||
- issuer
|
||||
- subject
|
||||
type: object
|
||||
type: array
|
||||
provider:
|
||||
default: cosign
|
||||
description: Provider specifies the technology used to sign the
|
||||
OCI Artifact.
|
||||
enum:
|
||||
- cosign
|
||||
- notation
|
||||
type: string
|
||||
secretRef:
|
||||
description: |-
|
||||
SecretRef specifies the Kubernetes Secret containing the
|
||||
trusted public keys.
|
||||
properties:
|
||||
name:
|
||||
description: Name of the referent.
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- provider
|
||||
type: object
|
||||
required:
|
||||
- interval
|
||||
- url
|
||||
type: object
|
||||
status:
|
||||
default:
|
||||
observedGeneration: -1
|
||||
description: OCIRepositoryStatus defines the observed state of OCIRepository
|
||||
properties:
|
||||
artifact:
|
||||
description: Artifact represents the output of the last successful
|
||||
OCI Repository sync.
|
||||
properties:
|
||||
digest:
|
||||
description: Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
|
||||
pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$
|
||||
type: string
|
||||
lastUpdateTime:
|
||||
description: |-
|
||||
LastUpdateTime is the timestamp corresponding to the last update of the
|
||||
Artifact.
|
||||
format: date-time
|
||||
type: string
|
||||
metadata:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Metadata holds upstream information such as OCI annotations.
|
||||
type: object
|
||||
path:
|
||||
description: |-
|
||||
Path is the relative file path of the Artifact. It can be used to locate
|
||||
the file in the root of the Artifact storage on the local file system of
|
||||
the controller managing the Source.
|
||||
type: string
|
||||
revision:
|
||||
description: |-
|
||||
Revision is a human-readable identifier traceable in the origin source
|
||||
system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
|
||||
type: string
|
||||
size:
|
||||
description: Size is the number of bytes in the file.
|
||||
format: int64
|
||||
type: integer
|
||||
url:
|
||||
description: |-
|
||||
URL is the HTTP address of the Artifact as exposed by the controller
|
||||
managing the Source. It can be used to retrieve the Artifact for
|
||||
consumption, e.g. by another controller applying the Artifact contents.
|
||||
type: string
|
||||
required:
|
||||
- lastUpdateTime
|
||||
- path
|
||||
- revision
|
||||
- url
|
||||
type: object
|
||||
conditions:
|
||||
description: Conditions holds the conditions for the OCIRepository.
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
lastHandledReconcileAt:
|
||||
description: |-
|
||||
LastHandledReconcileAt holds the value of the most recent
|
||||
reconcile request value, so a change of the annotation value
|
||||
can be detected.
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: ObservedGeneration is the last observed generation.
|
||||
format: int64
|
||||
type: integer
|
||||
observedIgnore:
|
||||
description: |-
|
||||
ObservedIgnore is the observed exclusion patterns used for constructing
|
||||
the source artifact.
|
||||
type: string
|
||||
observedLayerSelector:
|
||||
description: |-
|
||||
ObservedLayerSelector is the observed layer selector used for constructing
|
||||
the source artifact.
|
||||
properties:
|
||||
mediaType:
|
||||
description: |-
|
||||
MediaType specifies the OCI media type of the layer
|
||||
which should be extracted from the OCI Artifact. The
|
||||
first layer matching this type is selected.
|
||||
type: string
|
||||
operation:
|
||||
description: |-
|
||||
Operation specifies how the selected layer should be processed.
|
||||
By default, the layer compressed content is extracted to storage.
|
||||
When the operation is set to 'copy', the layer compressed content
|
||||
is persisted to storage as it is.
|
||||
enum:
|
||||
- extract
|
||||
- copy
|
||||
type: string
|
||||
type: object
|
||||
url:
|
||||
description: URL is the download link for the artifact output of the
|
||||
last OCI Repository sync.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.url
|
||||
name: URL
|
||||
type: string
|
||||
- jsonPath: .status.conditions[?(@.type=="Ready")].status
|
||||
name: Ready
|
||||
type: string
|
||||
- jsonPath: .status.conditions[?(@.type=="Ready")].message
|
||||
name: Status
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
deprecated: true
|
||||
deprecationWarning: v1beta2 OCIRepository is deprecated, upgrade to v1
|
||||
name: v1beta2
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
|
|
@ -422,6 +816,6 @@ spec:
|
|||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
storage: false
|
||||
subresources:
|
||||
status: {}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: OCIRepository
|
||||
metadata:
|
||||
name: ocirepository-sample
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: podinfo
|
||||
|
|
@ -8,7 +8,7 @@ spec:
|
|||
type: "oci"
|
||||
interval: 1m
|
||||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmChart
|
||||
metadata:
|
||||
name: podinfo
|
||||
|
|
@ -20,7 +20,7 @@ spec:
|
|||
version: '6.1.*'
|
||||
interval: 1m
|
||||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmChart
|
||||
metadata:
|
||||
name: podinfo-keyless
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: OCIRepository
|
||||
metadata:
|
||||
name: podinfo-deploy-signed-with-key
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: OCIRepository
|
||||
metadata:
|
||||
name: podinfo-deploy-signed-with-keyless
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: OCIRepository
|
||||
metadata:
|
||||
name: podinfo-deploy-signed-with-notation
|
||||
|
|
|
|||
|
|
@ -16,6 +16,8 @@ Resource Types:
|
|||
<a href="#source.toolkit.fluxcd.io/v1.HelmChart">HelmChart</a>
|
||||
</li><li>
|
||||
<a href="#source.toolkit.fluxcd.io/v1.HelmRepository">HelmRepository</a>
|
||||
</li><li>
|
||||
<a href="#source.toolkit.fluxcd.io/v1.OCIRepository">OCIRepository</a>
|
||||
</li></ul>
|
||||
<h3 id="source.toolkit.fluxcd.io/v1.Bucket">Bucket
|
||||
</h3>
|
||||
|
|
@ -1013,6 +1015,290 @@ HelmRepositoryStatus
|
|||
</table>
|
||||
</div>
|
||||
</div>
|
||||
<h3 id="source.toolkit.fluxcd.io/v1.OCIRepository">OCIRepository
|
||||
</h3>
|
||||
<p>OCIRepository is the Schema for the ocirepositories API</p>
|
||||
<div class="md-typeset__scrollwrap">
|
||||
<div class="md-typeset__table">
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Field</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>
|
||||
<code>apiVersion</code><br>
|
||||
string</td>
|
||||
<td>
|
||||
<code>source.toolkit.fluxcd.io/v1</code>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>kind</code><br>
|
||||
string
|
||||
</td>
|
||||
<td>
|
||||
<code>OCIRepository</code>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>metadata</code><br>
|
||||
<em>
|
||||
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/#objectmeta-v1-meta">
|
||||
Kubernetes meta/v1.ObjectMeta
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
Refer to the Kubernetes API documentation for the fields of the
|
||||
<code>metadata</code> field.
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>spec</code><br>
|
||||
<em>
|
||||
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositorySpec">
|
||||
OCIRepositorySpec
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<br/>
|
||||
<br/>
|
||||
<table>
|
||||
<tr>
|
||||
<td>
|
||||
<code>url</code><br>
|
||||
<em>
|
||||
string
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<p>URL is a reference to an OCI artifact repository hosted
|
||||
on a remote container registry.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>ref</code><br>
|
||||
<em>
|
||||
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositoryRef">
|
||||
OCIRepositoryRef
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>The OCI reference to pull and monitor for changes,
|
||||
defaults to the latest tag.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>layerSelector</code><br>
|
||||
<em>
|
||||
<a href="#source.toolkit.fluxcd.io/v1.OCILayerSelector">
|
||||
OCILayerSelector
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>LayerSelector specifies which layer should be extracted from the OCI artifact.
|
||||
When not specified, the first layer found in the artifact is selected.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>provider</code><br>
|
||||
<em>
|
||||
string
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>The provider used for authentication, can be ‘aws’, ‘azure’, ‘gcp’ or ‘generic’.
|
||||
When not specified, defaults to ‘generic’.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>secretRef</code><br>
|
||||
<em>
|
||||
<a href="https://pkg.go.dev/github.com/fluxcd/pkg/apis/meta#LocalObjectReference">
|
||||
github.com/fluxcd/pkg/apis/meta.LocalObjectReference
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>SecretRef contains the secret name containing the registry login
|
||||
credentials to resolve image metadata.
|
||||
The secret must be of type kubernetes.io/dockerconfigjson.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>verify</code><br>
|
||||
<em>
|
||||
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositoryVerification">
|
||||
OCIRepositoryVerification
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>Verify contains the secret name containing the trusted public keys
|
||||
used to verify the signature and specifies which provider to use to check
|
||||
whether OCI image is authentic.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>serviceAccountName</code><br>
|
||||
<em>
|
||||
string
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
|
||||
the image pull if the service account has attached pull secrets. For more information:
|
||||
<a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account">https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account</a></p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>certSecretRef</code><br>
|
||||
<em>
|
||||
<a href="https://pkg.go.dev/github.com/fluxcd/pkg/apis/meta#LocalObjectReference">
|
||||
github.com/fluxcd/pkg/apis/meta.LocalObjectReference
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>CertSecretRef can be given the name of a Secret containing
|
||||
either or both of</p>
|
||||
<ul>
|
||||
<li>a PEM-encoded client certificate (<code>tls.crt</code>) and private
|
||||
key (<code>tls.key</code>);</li>
|
||||
<li>a PEM-encoded CA certificate (<code>ca.crt</code>)</li>
|
||||
</ul>
|
||||
<p>and whichever are supplied, will be used for connecting to the
|
||||
registry. The client cert and key are useful if you are
|
||||
authenticating with a certificate; the CA cert is useful if
|
||||
you are using a self-signed server certificate. The Secret must
|
||||
be of type <code>Opaque</code> or <code>kubernetes.io/tls</code>.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>proxySecretRef</code><br>
|
||||
<em>
|
||||
<a href="https://pkg.go.dev/github.com/fluxcd/pkg/apis/meta#LocalObjectReference">
|
||||
github.com/fluxcd/pkg/apis/meta.LocalObjectReference
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>ProxySecretRef specifies the Secret containing the proxy configuration
|
||||
to use while communicating with the container registry.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>interval</code><br>
|
||||
<em>
|
||||
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
|
||||
Kubernetes meta/v1.Duration
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<p>Interval at which the OCIRepository URL is checked for updates.
|
||||
This interval is approximate and may be subject to jitter to ensure
|
||||
efficient use of resources.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>timeout</code><br>
|
||||
<em>
|
||||
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
|
||||
Kubernetes meta/v1.Duration
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>The timeout for remote OCI Repository operations like pulling, defaults to 60s.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>ignore</code><br>
|
||||
<em>
|
||||
string
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>Ignore overrides the set of excluded patterns in the .sourceignore format
|
||||
(which is the same as .gitignore). If not provided, a default will be used,
|
||||
consult the documentation for your version to find out what those are.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>insecure</code><br>
|
||||
<em>
|
||||
bool
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>Insecure allows connecting to a non-TLS HTTP container registry.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>suspend</code><br>
|
||||
<em>
|
||||
bool
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>This flag tells the controller to suspend the reconciliation of this source.</p>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>status</code><br>
|
||||
<em>
|
||||
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositoryStatus">
|
||||
OCIRepositoryStatus
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
<h3 id="source.toolkit.fluxcd.io/v1.Artifact">Artifact
|
||||
</h3>
|
||||
<p>
|
||||
|
|
@ -1020,7 +1306,8 @@ HelmRepositoryStatus
|
|||
<a href="#source.toolkit.fluxcd.io/v1.BucketStatus">BucketStatus</a>,
|
||||
<a href="#source.toolkit.fluxcd.io/v1.GitRepositoryStatus">GitRepositoryStatus</a>,
|
||||
<a href="#source.toolkit.fluxcd.io/v1.HelmChartStatus">HelmChartStatus</a>,
|
||||
<a href="#source.toolkit.fluxcd.io/v1.HelmRepositoryStatus">HelmRepositoryStatus</a>)
|
||||
<a href="#source.toolkit.fluxcd.io/v1.HelmRepositoryStatus">HelmRepositoryStatus</a>,
|
||||
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositoryStatus">OCIRepositoryStatus</a>)
|
||||
</p>
|
||||
<p>Artifact represents the output of a Source reconciliation.</p>
|
||||
<div class="md-typeset__scrollwrap">
|
||||
|
|
@ -2744,11 +3031,479 @@ string
|
|||
</table>
|
||||
</div>
|
||||
</div>
|
||||
<h3 id="source.toolkit.fluxcd.io/v1.OCILayerSelector">OCILayerSelector
|
||||
</h3>
|
||||
<p>
|
||||
(<em>Appears on:</em>
|
||||
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositorySpec">OCIRepositorySpec</a>,
|
||||
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositoryStatus">OCIRepositoryStatus</a>)
|
||||
</p>
|
||||
<p>OCILayerSelector specifies which layer should be extracted from an OCI Artifact</p>
|
||||
<div class="md-typeset__scrollwrap">
|
||||
<div class="md-typeset__table">
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Field</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>
|
||||
<code>mediaType</code><br>
|
||||
<em>
|
||||
string
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>MediaType specifies the OCI media type of the layer
|
||||
which should be extracted from the OCI Artifact. The
|
||||
first layer matching this type is selected.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>operation</code><br>
|
||||
<em>
|
||||
string
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>Operation specifies how the selected layer should be processed.
|
||||
By default, the layer compressed content is extracted to storage.
|
||||
When the operation is set to ‘copy’, the layer compressed content
|
||||
is persisted to storage as it is.</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
<h3 id="source.toolkit.fluxcd.io/v1.OCIRepositoryRef">OCIRepositoryRef
|
||||
</h3>
|
||||
<p>
|
||||
(<em>Appears on:</em>
|
||||
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositorySpec">OCIRepositorySpec</a>)
|
||||
</p>
|
||||
<p>OCIRepositoryRef defines the image reference for the OCIRepository’s URL</p>
|
||||
<div class="md-typeset__scrollwrap">
|
||||
<div class="md-typeset__table">
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Field</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>
|
||||
<code>digest</code><br>
|
||||
<em>
|
||||
string
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>Digest is the image digest to pull, takes precedence over SemVer.
|
||||
The value should be in the format ‘sha256:<HASH>’.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>semver</code><br>
|
||||
<em>
|
||||
string
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>SemVer is the range of tags to pull selecting the latest within
|
||||
the range, takes precedence over Tag.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>semverFilter</code><br>
|
||||
<em>
|
||||
string
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>SemverFilter is a regex pattern to filter the tags within the SemVer range.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>tag</code><br>
|
||||
<em>
|
||||
string
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>Tag is the image tag to pull, defaults to latest.</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
<h3 id="source.toolkit.fluxcd.io/v1.OCIRepositorySpec">OCIRepositorySpec
|
||||
</h3>
|
||||
<p>
|
||||
(<em>Appears on:</em>
|
||||
<a href="#source.toolkit.fluxcd.io/v1.OCIRepository">OCIRepository</a>)
|
||||
</p>
|
||||
<p>OCIRepositorySpec defines the desired state of OCIRepository</p>
|
||||
<div class="md-typeset__scrollwrap">
|
||||
<div class="md-typeset__table">
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Field</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>
|
||||
<code>url</code><br>
|
||||
<em>
|
||||
string
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<p>URL is a reference to an OCI artifact repository hosted
|
||||
on a remote container registry.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>ref</code><br>
|
||||
<em>
|
||||
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositoryRef">
|
||||
OCIRepositoryRef
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>The OCI reference to pull and monitor for changes,
|
||||
defaults to the latest tag.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>layerSelector</code><br>
|
||||
<em>
|
||||
<a href="#source.toolkit.fluxcd.io/v1.OCILayerSelector">
|
||||
OCILayerSelector
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>LayerSelector specifies which layer should be extracted from the OCI artifact.
|
||||
When not specified, the first layer found in the artifact is selected.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>provider</code><br>
|
||||
<em>
|
||||
string
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>The provider used for authentication, can be ‘aws’, ‘azure’, ‘gcp’ or ‘generic’.
|
||||
When not specified, defaults to ‘generic’.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>secretRef</code><br>
|
||||
<em>
|
||||
<a href="https://pkg.go.dev/github.com/fluxcd/pkg/apis/meta#LocalObjectReference">
|
||||
github.com/fluxcd/pkg/apis/meta.LocalObjectReference
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>SecretRef contains the secret name containing the registry login
|
||||
credentials to resolve image metadata.
|
||||
The secret must be of type kubernetes.io/dockerconfigjson.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>verify</code><br>
|
||||
<em>
|
||||
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositoryVerification">
|
||||
OCIRepositoryVerification
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>Verify contains the secret name containing the trusted public keys
|
||||
used to verify the signature and specifies which provider to use to check
|
||||
whether OCI image is authentic.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>serviceAccountName</code><br>
|
||||
<em>
|
||||
string
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
|
||||
the image pull if the service account has attached pull secrets. For more information:
|
||||
<a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account">https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account</a></p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>certSecretRef</code><br>
|
||||
<em>
|
||||
<a href="https://pkg.go.dev/github.com/fluxcd/pkg/apis/meta#LocalObjectReference">
|
||||
github.com/fluxcd/pkg/apis/meta.LocalObjectReference
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>CertSecretRef can be given the name of a Secret containing
|
||||
either or both of</p>
|
||||
<ul>
|
||||
<li>a PEM-encoded client certificate (<code>tls.crt</code>) and private
|
||||
key (<code>tls.key</code>);</li>
|
||||
<li>a PEM-encoded CA certificate (<code>ca.crt</code>)</li>
|
||||
</ul>
|
||||
<p>and whichever are supplied, will be used for connecting to the
|
||||
registry. The client cert and key are useful if you are
|
||||
authenticating with a certificate; the CA cert is useful if
|
||||
you are using a self-signed server certificate. The Secret must
|
||||
be of type <code>Opaque</code> or <code>kubernetes.io/tls</code>.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>proxySecretRef</code><br>
|
||||
<em>
|
||||
<a href="https://pkg.go.dev/github.com/fluxcd/pkg/apis/meta#LocalObjectReference">
|
||||
github.com/fluxcd/pkg/apis/meta.LocalObjectReference
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>ProxySecretRef specifies the Secret containing the proxy configuration
|
||||
to use while communicating with the container registry.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>interval</code><br>
|
||||
<em>
|
||||
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
|
||||
Kubernetes meta/v1.Duration
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<p>Interval at which the OCIRepository URL is checked for updates.
|
||||
This interval is approximate and may be subject to jitter to ensure
|
||||
efficient use of resources.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>timeout</code><br>
|
||||
<em>
|
||||
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
|
||||
Kubernetes meta/v1.Duration
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>The timeout for remote OCI Repository operations like pulling, defaults to 60s.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>ignore</code><br>
|
||||
<em>
|
||||
string
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>Ignore overrides the set of excluded patterns in the .sourceignore format
|
||||
(which is the same as .gitignore). If not provided, a default will be used,
|
||||
consult the documentation for your version to find out what those are.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>insecure</code><br>
|
||||
<em>
|
||||
bool
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>Insecure allows connecting to a non-TLS HTTP container registry.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>suspend</code><br>
|
||||
<em>
|
||||
bool
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>This flag tells the controller to suspend the reconciliation of this source.</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
<h3 id="source.toolkit.fluxcd.io/v1.OCIRepositoryStatus">OCIRepositoryStatus
|
||||
</h3>
|
||||
<p>
|
||||
(<em>Appears on:</em>
|
||||
<a href="#source.toolkit.fluxcd.io/v1.OCIRepository">OCIRepository</a>)
|
||||
</p>
|
||||
<p>OCIRepositoryStatus defines the observed state of OCIRepository</p>
|
||||
<div class="md-typeset__scrollwrap">
|
||||
<div class="md-typeset__table">
|
||||
<table>
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Field</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>
|
||||
<code>observedGeneration</code><br>
|
||||
<em>
|
||||
int64
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>ObservedGeneration is the last observed generation.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>conditions</code><br>
|
||||
<em>
|
||||
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Condition">
|
||||
[]Kubernetes meta/v1.Condition
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>Conditions holds the conditions for the OCIRepository.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>url</code><br>
|
||||
<em>
|
||||
string
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>URL is the download link for the artifact output of the last OCI Repository sync.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>artifact</code><br>
|
||||
<em>
|
||||
<a href="#source.toolkit.fluxcd.io/v1.Artifact">
|
||||
Artifact
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>Artifact represents the output of the last successful OCI Repository sync.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>observedIgnore</code><br>
|
||||
<em>
|
||||
string
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>ObservedIgnore is the observed exclusion patterns used for constructing
|
||||
the source artifact.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>observedLayerSelector</code><br>
|
||||
<em>
|
||||
<a href="#source.toolkit.fluxcd.io/v1.OCILayerSelector">
|
||||
OCILayerSelector
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<em>(Optional)</em>
|
||||
<p>ObservedLayerSelector is the observed layer selector used for constructing
|
||||
the source artifact.</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>
|
||||
<code>ReconcileRequestStatus</code><br>
|
||||
<em>
|
||||
<a href="https://pkg.go.dev/github.com/fluxcd/pkg/apis/meta#ReconcileRequestStatus">
|
||||
github.com/fluxcd/pkg/apis/meta.ReconcileRequestStatus
|
||||
</a>
|
||||
</em>
|
||||
</td>
|
||||
<td>
|
||||
<p>
|
||||
(Members of <code>ReconcileRequestStatus</code> are embedded into this type.)
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
<h3 id="source.toolkit.fluxcd.io/v1.OCIRepositoryVerification">OCIRepositoryVerification
|
||||
</h3>
|
||||
<p>
|
||||
(<em>Appears on:</em>
|
||||
<a href="#source.toolkit.fluxcd.io/v1.HelmChartSpec">HelmChartSpec</a>)
|
||||
<a href="#source.toolkit.fluxcd.io/v1.HelmChartSpec">HelmChartSpec</a>,
|
||||
<a href="#source.toolkit.fluxcd.io/v1.OCIRepositorySpec">OCIRepositorySpec</a>)
|
||||
</p>
|
||||
<p>OCIRepositoryVerification verifies the authenticity of an OCI Artifact</p>
|
||||
<div class="md-typeset__scrollwrap">
|
||||
|
|
|
|||
|
|
@ -6,6 +6,7 @@ This is the v1 API specification for defining the desired state sources of Kuber
|
|||
|
||||
* Source kinds:
|
||||
+ [GitRepository](gitrepositories.md)
|
||||
+ [OCIRepository](ocirepositories.md)
|
||||
+ [HelmRepository](helmrepositories.md)
|
||||
+ [HelmChart](helmcharts.md)
|
||||
+ [Bucket](buckets.md)
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load Diff
|
|
@ -77,7 +77,7 @@ import (
|
|||
const maxConcurrentBucketFetches = 100
|
||||
|
||||
// bucketReadyCondition contains the information required to summarize a
|
||||
// v1beta2.Bucket Ready Condition.
|
||||
// v1.Bucket Ready Condition.
|
||||
var bucketReadyCondition = summarize.Conditions{
|
||||
Target: meta.ReadyCondition,
|
||||
Owned: []string{
|
||||
|
|
@ -117,7 +117,7 @@ var bucketFailConditions = []string{
|
|||
// +kubebuilder:rbac:groups=source.toolkit.fluxcd.io,resources=buckets/finalizers,verbs=get;create;update;patch;delete
|
||||
// +kubebuilder:rbac:groups="",resources=secrets,verbs=get;list;watch
|
||||
|
||||
// BucketReconciler reconciles a v1beta2.Bucket object.
|
||||
// BucketReconciler reconciles a v1.Bucket object.
|
||||
type BucketReconciler struct {
|
||||
client.Client
|
||||
kuberecorder.EventRecorder
|
||||
|
|
@ -155,7 +155,7 @@ type BucketProvider interface {
|
|||
Close(context.Context)
|
||||
}
|
||||
|
||||
// bucketReconcileFunc is the function type for all the v1beta2.Bucket
|
||||
// bucketReconcileFunc is the function type for all the v1.Bucket
|
||||
// (sub)reconcile functions. The type implementations are grouped and
|
||||
// executed serially to perform the complete reconcile of the object.
|
||||
type bucketReconcileFunc func(ctx context.Context, sp *patch.SerialPatcher, obj *sourcev1.Bucket, index *index.Digester, dir string) (sreconcile.Result, error)
|
||||
|
|
@ -418,7 +418,7 @@ func (r *BucketReconciler) reconcileStorage(ctx context.Context, sp *patch.Seria
|
|||
// reconcileSource fetches the upstream bucket contents with the client for the
|
||||
// given object's Provider, and returns the result.
|
||||
// When a SecretRef is defined, it attempts to fetch the Secret before calling
|
||||
// the provider. If this fails, it records v1beta2.FetchFailedCondition=True on
|
||||
// the provider. If this fails, it records v1.FetchFailedCondition=True on
|
||||
// the object and returns early.
|
||||
func (r *BucketReconciler) reconcileSource(ctx context.Context, sp *patch.SerialPatcher, obj *sourcev1.Bucket, index *index.Digester, dir string) (sreconcile.Result, error) {
|
||||
secret, err := r.getSecret(ctx, obj.Spec.SecretRef, obj.GetNamespace())
|
||||
|
|
@ -588,7 +588,7 @@ func (r *BucketReconciler) reconcileSource(ctx context.Context, sp *patch.Serial
|
|||
// (Status) data on the object does not match the given.
|
||||
//
|
||||
// The inspection of the given data to the object is differed, ensuring any
|
||||
// stale observations like v1beta2.ArtifactOutdatedCondition are removed.
|
||||
// stale observations like v1.ArtifactOutdatedCondition are removed.
|
||||
// If the given Artifact does not differ from the object's current, it returns
|
||||
// early.
|
||||
// On a successful archive, the Artifact in the Status of the object is set,
|
||||
|
|
|
|||
|
|
@ -70,7 +70,7 @@ import (
|
|||
)
|
||||
|
||||
// gitRepositoryReadyCondition contains the information required to summarize a
|
||||
// v1beta2.GitRepository Ready Condition.
|
||||
// v1.GitRepository Ready Condition.
|
||||
var gitRepositoryReadyCondition = summarize.Conditions{
|
||||
Target: meta.ReadyCondition,
|
||||
Owned: []string{
|
||||
|
|
@ -125,7 +125,7 @@ func getPatchOptions(ownedConditions []string, controllerName string) []patch.Op
|
|||
// +kubebuilder:rbac:groups=source.toolkit.fluxcd.io,resources=gitrepositories/finalizers,verbs=get;create;update;patch;delete
|
||||
// +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
|
||||
|
||||
// GitRepositoryReconciler reconciles a v1beta2.GitRepository object.
|
||||
// GitRepositoryReconciler reconciles a v1.GitRepository object.
|
||||
type GitRepositoryReconciler struct {
|
||||
client.Client
|
||||
kuberecorder.EventRecorder
|
||||
|
|
@ -147,7 +147,7 @@ type GitRepositoryReconcilerOptions struct {
|
|||
}
|
||||
|
||||
// gitRepositoryReconcileFunc is the function type for all the
|
||||
// v1beta2.GitRepository (sub)reconcile functions.
|
||||
// v1.GitRepository (sub)reconcile functions.
|
||||
type gitRepositoryReconcileFunc func(ctx context.Context, sp *patch.SerialPatcher, obj *sourcev1.GitRepository, commit *git.Commit, includes *artifactSet, dir string) (sreconcile.Result, error)
|
||||
|
||||
func (r *GitRepositoryReconciler) SetupWithManager(mgr ctrl.Manager) error {
|
||||
|
|
@ -447,23 +447,23 @@ func (r *GitRepositoryReconciler) reconcileStorage(ctx context.Context, sp *patc
|
|||
//
|
||||
// The included repositories are fetched and their metadata are stored. In case
|
||||
// one of the included repositories isn't ready, it records
|
||||
// v1beta2.IncludeUnavailableCondition=True and returns early. When all the
|
||||
// v1.IncludeUnavailableCondition=True and returns early. When all the
|
||||
// included repositories are ready, it removes
|
||||
// v1beta2.IncludeUnavailableCondition from the object.
|
||||
// v1.IncludeUnavailableCondition from the object.
|
||||
// When the included artifactSet differs from the current set in the Status of
|
||||
// the object, it marks the object with v1beta2.ArtifactOutdatedCondition=True.
|
||||
// the object, it marks the object with v1.ArtifactOutdatedCondition=True.
|
||||
// The repository is cloned to the given dir, using the specified configuration
|
||||
// to check out the reference. In case of an error during this process
|
||||
// (including transient errors), it records v1beta2.FetchFailedCondition=True
|
||||
// (including transient errors), it records v1.FetchFailedCondition=True
|
||||
// and returns early.
|
||||
// On a successful checkout, it removes v1beta2.FetchFailedCondition and
|
||||
// On a successful checkout, it removes v1.FetchFailedCondition and
|
||||
// compares the current revision of HEAD to the revision of the Artifact in the
|
||||
// Status of the object. It records v1beta2.ArtifactOutdatedCondition=True when
|
||||
// Status of the object. It records v1.ArtifactOutdatedCondition=True when
|
||||
// they differ.
|
||||
// If specified, the signature of the Git commit is verified. If the signature
|
||||
// can not be verified or the verification fails, it records
|
||||
// v1beta2.SourceVerifiedCondition=False and returns early. When successful,
|
||||
// it records v1beta2.SourceVerifiedCondition=True.
|
||||
// v1.SourceVerifiedCondition=False and returns early. When successful,
|
||||
// it records v1.SourceVerifiedCondition=True.
|
||||
// When all the above is successful, the given Commit pointer is set to the
|
||||
// commit of the checked out Git repository.
|
||||
//
|
||||
|
|
@ -787,7 +787,7 @@ func (r *GitRepositoryReconciler) getSecretData(ctx context.Context, name, names
|
|||
// (Status) data on the object does not match the given.
|
||||
//
|
||||
// The inspection of the given data to the object is differed, ensuring any
|
||||
// stale observations like v1beta2.ArtifactOutdatedCondition are removed.
|
||||
// stale observations like v1.ArtifactOutdatedCondition are removed.
|
||||
// If the given Artifact and/or artifactSet (includes) and observed artifact
|
||||
// content config do not differ from the object's current, it returns early.
|
||||
// Source ignore patterns are loaded, and the given directory is archived while
|
||||
|
|
@ -903,15 +903,15 @@ func (r *GitRepositoryReconciler) reconcileArtifact(ctx context.Context, sp *pat
|
|||
}
|
||||
|
||||
// reconcileInclude reconciles the on the object specified
|
||||
// v1beta2.GitRepositoryInclude list by copying their Artifact (sub)contents to
|
||||
// v1.GitRepositoryInclude list by copying their Artifact (sub)contents to
|
||||
// the specified paths in the given directory.
|
||||
//
|
||||
// When one of the includes is unavailable, it marks the object with
|
||||
// v1beta2.IncludeUnavailableCondition=True and returns early.
|
||||
// v1.IncludeUnavailableCondition=True and returns early.
|
||||
// When the copy operations are successful, it removes the
|
||||
// v1beta2.IncludeUnavailableCondition from the object.
|
||||
// v1.IncludeUnavailableCondition from the object.
|
||||
// When the composed artifactSet differs from the current set in the Status of
|
||||
// the object, it marks the object with v1beta2.ArtifactOutdatedCondition=True.
|
||||
// the object, it marks the object with v1.ArtifactOutdatedCondition=True.
|
||||
func (r *GitRepositoryReconciler) reconcileInclude(ctx context.Context, sp *patch.SerialPatcher,
|
||||
obj *sourcev1.GitRepository, _ *git.Commit, includes *artifactSet, dir string) (sreconcile.Result, error) {
|
||||
|
||||
|
|
@ -1060,10 +1060,10 @@ func (r *GitRepositoryReconciler) fetchIncludes(ctx context.Context, obj *source
|
|||
// verifySignature verifies the signature of the given Git commit and/or its referencing tag
|
||||
// depending on the verification mode specified on the object.
|
||||
// If the signature can not be verified or the verification fails, it records
|
||||
// v1beta2.SourceVerifiedCondition=False and returns.
|
||||
// When successful, it records v1beta2.SourceVerifiedCondition=True.
|
||||
// v1.SourceVerifiedCondition=False and returns.
|
||||
// When successful, it records v1.SourceVerifiedCondition=True.
|
||||
// If no verification mode is specified on the object, the
|
||||
// v1beta2.SourceVerifiedCondition Condition is removed.
|
||||
// v1.SourceVerifiedCondition Condition is removed.
|
||||
func (r *GitRepositoryReconciler) verifySignature(ctx context.Context, obj *sourcev1.GitRepository, commit git.Commit) (sreconcile.Result, error) {
|
||||
// Check if there is a commit verification is configured and remove any old
|
||||
// observations if there is none
|
||||
|
|
|
|||
|
|
@ -67,7 +67,6 @@ import (
|
|||
"github.com/fluxcd/pkg/testserver"
|
||||
|
||||
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
||||
sourcev1beta2 "github.com/fluxcd/source-controller/api/v1beta2"
|
||||
serror "github.com/fluxcd/source-controller/internal/error"
|
||||
"github.com/fluxcd/source-controller/internal/helm/chart"
|
||||
"github.com/fluxcd/source-controller/internal/helm/chart/secureloader"
|
||||
|
|
@ -1366,7 +1365,7 @@ func TestHelmChartReconciler_buildFromOCIHelmRepository(t *testing.T) {
|
|||
Spec: sourcev1.HelmRepositorySpec{
|
||||
URL: fmt.Sprintf("oci://%s/testrepo", testRegistryServer.registryHost),
|
||||
Timeout: &metav1.Duration{Duration: timeout},
|
||||
Provider: sourcev1beta2.GenericOCIProvider,
|
||||
Provider: sourcev1.GenericOCIProvider,
|
||||
Type: sourcev1.HelmRepositoryTypeOCI,
|
||||
Insecure: true,
|
||||
},
|
||||
|
|
@ -2595,7 +2594,7 @@ func TestHelmChartReconciler_reconcileSourceFromOCI_authStrategy(t *testing.T) {
|
|||
Interval: metav1.Duration{Duration: interval},
|
||||
Timeout: &metav1.Duration{Duration: timeout},
|
||||
Type: sourcev1.HelmRepositoryTypeOCI,
|
||||
Provider: sourcev1beta2.GenericOCIProvider,
|
||||
Provider: sourcev1.GenericOCIProvider,
|
||||
URL: fmt.Sprintf("oci://%s/testrepo", server.registryHost),
|
||||
Insecure: tt.insecure,
|
||||
},
|
||||
|
|
@ -2798,7 +2797,7 @@ func TestHelmChartRepository_reconcileSource_verifyOCISourceSignature_keyless(t
|
|||
Spec: sourcev1.HelmRepositorySpec{
|
||||
URL: "oci://ghcr.io/stefanprodan/charts",
|
||||
Timeout: &metav1.Duration{Duration: timeout},
|
||||
Provider: sourcev1beta2.GenericOCIProvider,
|
||||
Provider: sourcev1.GenericOCIProvider,
|
||||
Type: sourcev1.HelmRepositoryTypeOCI,
|
||||
},
|
||||
}
|
||||
|
|
@ -3059,7 +3058,7 @@ func TestHelmChartReconciler_reconcileSourceFromOCI_verifySignatureNotation(t *t
|
|||
Spec: sourcev1.HelmRepositorySpec{
|
||||
URL: fmt.Sprintf("oci://%s/testrepo", server.registryHost),
|
||||
Timeout: &metav1.Duration{Duration: timeout},
|
||||
Provider: sourcev1beta2.GenericOCIProvider,
|
||||
Provider: sourcev1.GenericOCIProvider,
|
||||
Type: sourcev1.HelmRepositoryTypeOCI,
|
||||
Insecure: true,
|
||||
},
|
||||
|
|
@ -3332,7 +3331,7 @@ func TestHelmChartReconciler_reconcileSourceFromOCI_verifySignatureCosign(t *tes
|
|||
Spec: sourcev1.HelmRepositorySpec{
|
||||
URL: fmt.Sprintf("oci://%s/testrepo", server.registryHost),
|
||||
Timeout: &metav1.Duration{Duration: timeout},
|
||||
Provider: sourcev1beta2.GenericOCIProvider,
|
||||
Provider: sourcev1.GenericOCIProvider,
|
||||
Type: sourcev1.HelmRepositoryTypeOCI,
|
||||
Insecure: true,
|
||||
},
|
||||
|
|
|
|||
|
|
@ -71,7 +71,6 @@ import (
|
|||
"sigs.k8s.io/controller-runtime/pkg/predicate"
|
||||
|
||||
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
||||
ociv1 "github.com/fluxcd/source-controller/api/v1beta2"
|
||||
serror "github.com/fluxcd/source-controller/internal/error"
|
||||
soci "github.com/fluxcd/source-controller/internal/oci"
|
||||
scosign "github.com/fluxcd/source-controller/internal/oci/cosign"
|
||||
|
|
@ -83,7 +82,7 @@ import (
|
|||
)
|
||||
|
||||
// ociRepositoryReadyCondition contains the information required to summarize a
|
||||
// v1beta2.OCIRepository Ready Condition.
|
||||
// v1.OCIRepository Ready Condition.
|
||||
var ociRepositoryReadyCondition = summarize.Conditions{
|
||||
Target: meta.ReadyCondition,
|
||||
Owned: []string{
|
||||
|
|
@ -130,12 +129,12 @@ func (e invalidOCIURLError) Error() string {
|
|||
return e.err.Error()
|
||||
}
|
||||
|
||||
// ociRepositoryReconcileFunc is the function type for all the v1beta2.OCIRepository
|
||||
// ociRepositoryReconcileFunc is the function type for all the v1.OCIRepository
|
||||
// (sub)reconcile functions. The type implementations are grouped and
|
||||
// executed serially to perform the complete reconcile of the object.
|
||||
type ociRepositoryReconcileFunc func(ctx context.Context, sp *patch.SerialPatcher, obj *ociv1.OCIRepository, metadata *sourcev1.Artifact, dir string) (sreconcile.Result, error)
|
||||
type ociRepositoryReconcileFunc func(ctx context.Context, sp *patch.SerialPatcher, obj *sourcev1.OCIRepository, metadata *sourcev1.Artifact, dir string) (sreconcile.Result, error)
|
||||
|
||||
// OCIRepositoryReconciler reconciles a v1beta2.OCIRepository object
|
||||
// OCIRepositoryReconciler reconciles a v1.OCIRepository object
|
||||
type OCIRepositoryReconciler struct {
|
||||
client.Client
|
||||
helper.Metrics
|
||||
|
|
@ -165,7 +164,7 @@ func (r *OCIRepositoryReconciler) SetupWithManagerAndOptions(mgr ctrl.Manager, o
|
|||
r.requeueDependency = opts.DependencyRequeueInterval
|
||||
|
||||
return ctrl.NewControllerManagedBy(mgr).
|
||||
For(&ociv1.OCIRepository{}, builder.WithPredicates(
|
||||
For(&sourcev1.OCIRepository{}, builder.WithPredicates(
|
||||
predicate.Or(predicate.GenerationChangedPredicate{}, predicates.ReconcileRequestedPredicate{}),
|
||||
)).
|
||||
WithOptions(controller.Options{
|
||||
|
|
@ -185,7 +184,7 @@ func (r *OCIRepositoryReconciler) Reconcile(ctx context.Context, req ctrl.Reques
|
|||
log := ctrl.LoggerFrom(ctx)
|
||||
|
||||
// Fetch the OCIRepository
|
||||
obj := &ociv1.OCIRepository{}
|
||||
obj := &sourcev1.OCIRepository{}
|
||||
if err := r.Get(ctx, req.NamespacedName, obj); err != nil {
|
||||
return ctrl.Result{}, client.IgnoreNotFound(err)
|
||||
}
|
||||
|
|
@ -257,7 +256,7 @@ func (r *OCIRepositoryReconciler) Reconcile(ctx context.Context, req ctrl.Reques
|
|||
// reconcile iterates through the ociRepositoryReconcileFunc tasks for the
|
||||
// object. It returns early on the first call that returns
|
||||
// reconcile.ResultRequeue, or produces an error.
|
||||
func (r *OCIRepositoryReconciler) reconcile(ctx context.Context, sp *patch.SerialPatcher, obj *ociv1.OCIRepository, reconcilers []ociRepositoryReconcileFunc) (sreconcile.Result, error) {
|
||||
func (r *OCIRepositoryReconciler) reconcile(ctx context.Context, sp *patch.SerialPatcher, obj *sourcev1.OCIRepository, reconcilers []ociRepositoryReconcileFunc) (sreconcile.Result, error) {
|
||||
oldObj := obj.DeepCopy()
|
||||
|
||||
rreconcile.ProgressiveStatus(false, obj, meta.ProgressingReason, "reconciliation in progress")
|
||||
|
|
@ -329,9 +328,9 @@ func (r *OCIRepositoryReconciler) reconcile(ctx context.Context, sp *patch.Seria
|
|||
}
|
||||
|
||||
// reconcileSource fetches the upstream OCI artifact metadata and content.
|
||||
// If this fails, it records v1beta2.FetchFailedCondition=True on the object and returns early.
|
||||
// If this fails, it records v1.FetchFailedCondition=True on the object and returns early.
|
||||
func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch.SerialPatcher,
|
||||
obj *ociv1.OCIRepository, metadata *sourcev1.Artifact, dir string) (sreconcile.Result, error) {
|
||||
obj *sourcev1.OCIRepository, metadata *sourcev1.Artifact, dir string) (sreconcile.Result, error) {
|
||||
var authenticator authn.Authenticator
|
||||
|
||||
ctxTimeout, cancel := context.WithTimeout(ctx, obj.Spec.Timeout.Duration)
|
||||
|
|
@ -366,7 +365,7 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
|
|||
return sreconcile.ResultEmpty, e
|
||||
}
|
||||
|
||||
if _, ok := keychain.(soci.Anonymous); obj.Spec.Provider != ociv1.GenericOCIProvider && ok {
|
||||
if _, ok := keychain.(soci.Anonymous); obj.Spec.Provider != sourcev1.GenericOCIProvider && ok {
|
||||
var opts []auth.Option
|
||||
if obj.Spec.ServiceAccountName != "" {
|
||||
// Check object-level workload identity feature gate.
|
||||
|
|
@ -384,7 +383,7 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
|
|||
}
|
||||
if r.TokenCache != nil {
|
||||
involvedObject := cache.InvolvedObject{
|
||||
Kind: ociv1.OCIRepositoryKind,
|
||||
Kind: sourcev1.OCIRepositoryKind,
|
||||
Name: obj.GetName(),
|
||||
Namespace: obj.GetNamespace(),
|
||||
Operation: cache.OperationReconcile,
|
||||
|
|
@ -443,7 +442,7 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
|
|||
if err != nil {
|
||||
e := serror.NewGeneric(
|
||||
fmt.Errorf("failed to determine artifact digest: %w", err),
|
||||
ociv1.OCIPullFailedReason,
|
||||
sourcev1.OCIPullFailedReason,
|
||||
)
|
||||
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
||||
return sreconcile.ResultEmpty, e
|
||||
|
|
@ -508,7 +507,7 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
|
|||
if err != nil {
|
||||
e := serror.NewGeneric(
|
||||
fmt.Errorf("failed to pull artifact from '%s': %w", obj.Spec.URL, err),
|
||||
ociv1.OCIPullFailedReason,
|
||||
sourcev1.OCIPullFailedReason,
|
||||
)
|
||||
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
||||
return sreconcile.ResultEmpty, e
|
||||
|
|
@ -519,7 +518,7 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
|
|||
if err != nil {
|
||||
e := serror.NewGeneric(
|
||||
fmt.Errorf("failed to parse artifact manifest: %w", err),
|
||||
ociv1.OCILayerOperationFailedReason,
|
||||
sourcev1.OCILayerOperationFailedReason,
|
||||
)
|
||||
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
||||
return sreconcile.ResultEmpty, e
|
||||
|
|
@ -529,29 +528,29 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
|
|||
// Extract the compressed content from the selected layer
|
||||
blob, err := r.selectLayer(obj, img)
|
||||
if err != nil {
|
||||
e := serror.NewGeneric(err, ociv1.OCILayerOperationFailedReason)
|
||||
e := serror.NewGeneric(err, sourcev1.OCILayerOperationFailedReason)
|
||||
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
||||
return sreconcile.ResultEmpty, e
|
||||
}
|
||||
|
||||
// Persist layer content to storage using the specified operation
|
||||
switch obj.GetLayerOperation() {
|
||||
case ociv1.OCILayerExtract:
|
||||
case sourcev1.OCILayerExtract:
|
||||
if err = tar.Untar(blob, dir, tar.WithMaxUntarSize(-1), tar.WithSkipSymlinks()); err != nil {
|
||||
e := serror.NewGeneric(
|
||||
fmt.Errorf("failed to extract layer contents from artifact: %w", err),
|
||||
ociv1.OCILayerOperationFailedReason,
|
||||
sourcev1.OCILayerOperationFailedReason,
|
||||
)
|
||||
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
||||
return sreconcile.ResultEmpty, e
|
||||
}
|
||||
case ociv1.OCILayerCopy:
|
||||
case sourcev1.OCILayerCopy:
|
||||
metadata.Path = fmt.Sprintf("%s.tgz", r.digestFromRevision(metadata.Revision))
|
||||
file, err := os.Create(filepath.Join(dir, metadata.Path))
|
||||
if err != nil {
|
||||
e := serror.NewGeneric(
|
||||
fmt.Errorf("failed to create file to copy layer to: %w", err),
|
||||
ociv1.OCILayerOperationFailedReason,
|
||||
sourcev1.OCILayerOperationFailedReason,
|
||||
)
|
||||
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
||||
return sreconcile.ResultEmpty, e
|
||||
|
|
@ -562,7 +561,7 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
|
|||
if err != nil {
|
||||
e := serror.NewGeneric(
|
||||
fmt.Errorf("failed to copy layer from artifact: %w", err),
|
||||
ociv1.OCILayerOperationFailedReason,
|
||||
sourcev1.OCILayerOperationFailedReason,
|
||||
)
|
||||
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
||||
return sreconcile.ResultEmpty, e
|
||||
|
|
@ -570,7 +569,7 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
|
|||
default:
|
||||
e := serror.NewGeneric(
|
||||
fmt.Errorf("unsupported layer operation: %s", obj.GetLayerOperation()),
|
||||
ociv1.OCILayerOperationFailedReason,
|
||||
sourcev1.OCILayerOperationFailedReason,
|
||||
)
|
||||
conditions.MarkTrue(obj, sourcev1.FetchFailedCondition, e.Reason, "%s", e)
|
||||
return sreconcile.ResultEmpty, e
|
||||
|
|
@ -582,7 +581,7 @@ func (r *OCIRepositoryReconciler) reconcileSource(ctx context.Context, sp *patch
|
|||
|
||||
// selectLayer finds the matching layer and returns its compressed contents.
|
||||
// If no layer selector was provided, we pick the first layer from the OCI artifact.
|
||||
func (r *OCIRepositoryReconciler) selectLayer(obj *ociv1.OCIRepository, image gcrv1.Image) (io.ReadCloser, error) {
|
||||
func (r *OCIRepositoryReconciler) selectLayer(obj *sourcev1.OCIRepository, image gcrv1.Image) (io.ReadCloser, error) {
|
||||
layers, err := image.Layers()
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to parse artifact layers: %w", err)
|
||||
|
|
@ -663,7 +662,7 @@ func (r *OCIRepositoryReconciler) digestFromRevision(revision string) string {
|
|||
// If not, when using cosign it falls back to a keyless approach for verification.
|
||||
// When notation is used, a trust policy is required to verify the image.
|
||||
// The verification result is returned as a VerificationResult and any error encountered.
|
||||
func (r *OCIRepositoryReconciler) verifySignature(ctx context.Context, obj *ociv1.OCIRepository,
|
||||
func (r *OCIRepositoryReconciler) verifySignature(ctx context.Context, obj *sourcev1.OCIRepository,
|
||||
ref name.Reference, keychain authn.Keychain, auth authn.Authenticator,
|
||||
transport *http.Transport, opt ...remote.Option) (soci.VerificationResult, error) {
|
||||
|
||||
|
|
@ -831,12 +830,12 @@ func (r *OCIRepositoryReconciler) retrieveSecret(ctx context.Context, verifySecr
|
|||
}
|
||||
|
||||
// parseRepository validates and extracts the repository URL.
|
||||
func (r *OCIRepositoryReconciler) parseRepository(obj *ociv1.OCIRepository) (name.Repository, error) {
|
||||
if !strings.HasPrefix(obj.Spec.URL, ociv1.OCIRepositoryPrefix) {
|
||||
func (r *OCIRepositoryReconciler) parseRepository(obj *sourcev1.OCIRepository) (name.Repository, error) {
|
||||
if !strings.HasPrefix(obj.Spec.URL, sourcev1.OCIRepositoryPrefix) {
|
||||
return name.Repository{}, fmt.Errorf("URL must be in format 'oci://<domain>/<org>/<repo>'")
|
||||
}
|
||||
|
||||
url := strings.TrimPrefix(obj.Spec.URL, ociv1.OCIRepositoryPrefix)
|
||||
url := strings.TrimPrefix(obj.Spec.URL, sourcev1.OCIRepositoryPrefix)
|
||||
|
||||
options := []name.Option{}
|
||||
if obj.Spec.Insecure {
|
||||
|
|
@ -856,7 +855,7 @@ func (r *OCIRepositoryReconciler) parseRepository(obj *ociv1.OCIRepository) (nam
|
|||
}
|
||||
|
||||
// getArtifactRef determines which tag or revision should be used and returns the OCI artifact FQN.
|
||||
func (r *OCIRepositoryReconciler) getArtifactRef(obj *ociv1.OCIRepository, options []remote.Option) (name.Reference, error) {
|
||||
func (r *OCIRepositoryReconciler) getArtifactRef(obj *sourcev1.OCIRepository, options []remote.Option) (name.Reference, error) {
|
||||
repo, err := r.parseRepository(obj)
|
||||
if err != nil {
|
||||
return nil, invalidOCIURLError{err}
|
||||
|
|
@ -920,7 +919,7 @@ func (r *OCIRepositoryReconciler) getTagBySemver(repo name.Repository, exp strin
|
|||
// keychain generates the credential keychain based on the resource
|
||||
// configuration. If no auth is specified a default keychain with
|
||||
// anonymous access is returned
|
||||
func (r *OCIRepositoryReconciler) keychain(ctx context.Context, obj *ociv1.OCIRepository) (authn.Keychain, error) {
|
||||
func (r *OCIRepositoryReconciler) keychain(ctx context.Context, obj *sourcev1.OCIRepository) (authn.Keychain, error) {
|
||||
pullSecretNames := sets.NewString()
|
||||
|
||||
// lookup auth secret
|
||||
|
|
@ -966,7 +965,7 @@ func (r *OCIRepositoryReconciler) keychain(ctx context.Context, obj *ociv1.OCIRe
|
|||
// the returned transport will include the TLS client and/or CA certificates.
|
||||
// If the insecure flag is set, the transport will skip the verification of the server's certificate.
|
||||
// Additionally, if a proxy is specified, transport will use it.
|
||||
func (r *OCIRepositoryReconciler) transport(ctx context.Context, obj *ociv1.OCIRepository, proxyURL *url.URL) (*http.Transport, error) {
|
||||
func (r *OCIRepositoryReconciler) transport(ctx context.Context, obj *sourcev1.OCIRepository, proxyURL *url.URL) (*http.Transport, error) {
|
||||
transport := remote.DefaultTransport.(*http.Transport).Clone()
|
||||
|
||||
tlsConfig, err := r.getTLSConfig(ctx, obj)
|
||||
|
|
@ -986,7 +985,7 @@ func (r *OCIRepositoryReconciler) transport(ctx context.Context, obj *ociv1.OCIR
|
|||
|
||||
// getTLSConfig gets the TLS configuration for the transport based on the
|
||||
// specified secret reference in the OCIRepository object, or the insecure flag.
|
||||
func (r *OCIRepositoryReconciler) getTLSConfig(ctx context.Context, obj *ociv1.OCIRepository) (*cryptotls.Config, error) {
|
||||
func (r *OCIRepositoryReconciler) getTLSConfig(ctx context.Context, obj *sourcev1.OCIRepository) (*cryptotls.Config, error) {
|
||||
if obj.Spec.CertSecretRef == nil || obj.Spec.CertSecretRef.Name == "" {
|
||||
if obj.Spec.Insecure {
|
||||
return &cryptotls.Config{
|
||||
|
|
@ -1025,7 +1024,7 @@ func (r *OCIRepositoryReconciler) getTLSConfig(ctx context.Context, obj *ociv1.O
|
|||
|
||||
// getProxyURL gets the proxy configuration for the transport based on the
|
||||
// specified proxy secret reference in the OCIRepository object.
|
||||
func (r *OCIRepositoryReconciler) getProxyURL(ctx context.Context, obj *ociv1.OCIRepository) (*url.URL, error) {
|
||||
func (r *OCIRepositoryReconciler) getProxyURL(ctx context.Context, obj *sourcev1.OCIRepository) (*url.URL, error) {
|
||||
if obj.Spec.ProxySecretRef == nil || obj.Spec.ProxySecretRef.Name == "" {
|
||||
return nil, nil
|
||||
}
|
||||
|
|
@ -1070,7 +1069,7 @@ func (r *OCIRepositoryReconciler) getProxyURL(ctx context.Context, obj *ociv1.OC
|
|||
// The hostname of any URL in the Status of the object are updated, to ensure
|
||||
// they match the Storage server hostname of current runtime.
|
||||
func (r *OCIRepositoryReconciler) reconcileStorage(ctx context.Context, sp *patch.SerialPatcher,
|
||||
obj *ociv1.OCIRepository, _ *sourcev1.Artifact, _ string) (sreconcile.Result, error) {
|
||||
obj *sourcev1.OCIRepository, _ *sourcev1.Artifact, _ string) (sreconcile.Result, error) {
|
||||
// Garbage collect previous advertised artifact(s) from storage
|
||||
_ = r.garbageCollect(ctx, obj)
|
||||
|
||||
|
|
@ -1127,13 +1126,13 @@ func (r *OCIRepositoryReconciler) reconcileStorage(ctx context.Context, sp *patc
|
|||
// (Status) data on the object does not match the given.
|
||||
//
|
||||
// The inspection of the given data to the object is differed, ensuring any
|
||||
// stale observations like v1beta2.ArtifactOutdatedCondition are removed.
|
||||
// stale observations like v1.ArtifactOutdatedCondition are removed.
|
||||
// If the given Artifact does not differ from the object's current, it returns
|
||||
// early.
|
||||
// On a successful archive, the Artifact in the Status of the object is set,
|
||||
// and the symlink in the Storage is updated to its path.
|
||||
func (r *OCIRepositoryReconciler) reconcileArtifact(ctx context.Context, sp *patch.SerialPatcher,
|
||||
obj *ociv1.OCIRepository, metadata *sourcev1.Artifact, dir string) (sreconcile.Result, error) {
|
||||
obj *sourcev1.OCIRepository, metadata *sourcev1.Artifact, dir string) (sreconcile.Result, error) {
|
||||
// Create artifact
|
||||
artifact := r.Storage.NewArtifactFor(obj.Kind, obj, metadata.Revision,
|
||||
fmt.Sprintf("%s.tar.gz", r.digestFromRevision(metadata.Revision)))
|
||||
|
|
@ -1190,7 +1189,7 @@ func (r *OCIRepositoryReconciler) reconcileArtifact(ctx context.Context, sp *pat
|
|||
defer unlock()
|
||||
|
||||
switch obj.GetLayerOperation() {
|
||||
case ociv1.OCILayerCopy:
|
||||
case sourcev1.OCILayerCopy:
|
||||
if err = r.Storage.CopyFromPath(&artifact, filepath.Join(dir, metadata.Path)); err != nil {
|
||||
e := serror.NewGeneric(
|
||||
fmt.Errorf("unable to copy artifact to storage: %w", err),
|
||||
|
|
@ -1226,7 +1225,6 @@ func (r *OCIRepositoryReconciler) reconcileArtifact(ctx context.Context, sp *pat
|
|||
// Record the observations on the object.
|
||||
obj.Status.Artifact = artifact.DeepCopy()
|
||||
obj.Status.Artifact.Metadata = metadata.Metadata
|
||||
obj.Status.ContentConfigChecksum = "" // To be removed in the next API version.
|
||||
obj.Status.ObservedIgnore = obj.Spec.Ignore
|
||||
obj.Status.ObservedLayerSelector = obj.Spec.LayerSelector
|
||||
|
||||
|
|
@ -1246,7 +1244,7 @@ func (r *OCIRepositoryReconciler) reconcileArtifact(ctx context.Context, sp *pat
|
|||
// reconcileDelete handles the deletion of the object.
|
||||
// It first garbage collects all Artifacts for the object from the Storage.
|
||||
// Removing the finalizer from the object if successful.
|
||||
func (r *OCIRepositoryReconciler) reconcileDelete(ctx context.Context, obj *ociv1.OCIRepository) (sreconcile.Result, error) {
|
||||
func (r *OCIRepositoryReconciler) reconcileDelete(ctx context.Context, obj *sourcev1.OCIRepository) (sreconcile.Result, error) {
|
||||
// Garbage collect the resource's artifacts
|
||||
if err := r.garbageCollect(ctx, obj); err != nil {
|
||||
// Return the error so we retry the failed garbage collection
|
||||
|
|
@ -1257,7 +1255,7 @@ func (r *OCIRepositoryReconciler) reconcileDelete(ctx context.Context, obj *ociv
|
|||
controllerutil.RemoveFinalizer(obj, sourcev1.SourceFinalizer)
|
||||
|
||||
// Cleanup caches.
|
||||
r.TokenCache.DeleteEventsForObject(ociv1.OCIRepositoryKind,
|
||||
r.TokenCache.DeleteEventsForObject(sourcev1.OCIRepositoryKind,
|
||||
obj.GetName(), obj.GetNamespace(), cache.OperationReconcile)
|
||||
|
||||
// Stop reconciliation as the object is being deleted
|
||||
|
|
@ -1269,7 +1267,7 @@ func (r *OCIRepositoryReconciler) reconcileDelete(ctx context.Context, obj *ociv
|
|||
// It removes all but the current Artifact from the Storage, unless the
|
||||
// deletion timestamp on the object is set. Which will result in the
|
||||
// removal of all Artifacts for the objects.
|
||||
func (r *OCIRepositoryReconciler) garbageCollect(ctx context.Context, obj *ociv1.OCIRepository) error {
|
||||
func (r *OCIRepositoryReconciler) garbageCollect(ctx context.Context, obj *sourcev1.OCIRepository) error {
|
||||
if !obj.DeletionTimestamp.IsZero() {
|
||||
if deleted, err := r.Storage.RemoveAll(r.Storage.NewArtifactFor(obj.Kind, obj.GetObjectMeta(), "", "*")); err != nil {
|
||||
return serror.NewGeneric(
|
||||
|
|
@ -1317,7 +1315,7 @@ func (r *OCIRepositoryReconciler) eventLogf(ctx context.Context, obj runtime.Obj
|
|||
}
|
||||
|
||||
// notify emits notification related to the reconciliation.
|
||||
func (r *OCIRepositoryReconciler) notify(ctx context.Context, oldObj, newObj *ociv1.OCIRepository, res sreconcile.Result, resErr error) {
|
||||
func (r *OCIRepositoryReconciler) notify(ctx context.Context, oldObj, newObj *sourcev1.OCIRepository, res sreconcile.Result, resErr error) {
|
||||
// Notify successful reconciliation for new artifact and recovery from any
|
||||
// failure.
|
||||
if resErr == nil && res == sreconcile.ResultSuccess && newObj.Status.Artifact != nil {
|
||||
|
|
@ -1383,7 +1381,7 @@ type remoteOptions []remote.Option
|
|||
// ociContentConfigChanged evaluates the current spec with the observations
|
||||
// of the artifact in the status to determine if artifact content configuration
|
||||
// has changed and requires rebuilding the artifact.
|
||||
func ociContentConfigChanged(obj *ociv1.OCIRepository) bool {
|
||||
func ociContentConfigChanged(obj *sourcev1.OCIRepository) bool {
|
||||
if !ptr.Equal(obj.Spec.Ignore, obj.Status.ObservedIgnore) {
|
||||
return true
|
||||
}
|
||||
|
|
@ -1398,7 +1396,7 @@ func ociContentConfigChanged(obj *ociv1.OCIRepository) bool {
|
|||
// Returns true if both arguments are nil or both arguments
|
||||
// dereference to the same value.
|
||||
// Based on k8s.io/utils/pointer/pointer.go pointer value equality.
|
||||
func layerSelectorEqual(a, b *ociv1.OCILayerSelector) bool {
|
||||
func layerSelectorEqual(a, b *sourcev1.OCILayerSelector) bool {
|
||||
if (a == nil) != (b == nil) {
|
||||
return false
|
||||
}
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load Diff
|
|
@ -56,7 +56,6 @@ import (
|
|||
"github.com/fluxcd/pkg/testserver"
|
||||
|
||||
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
||||
sourcev1beta2 "github.com/fluxcd/source-controller/api/v1beta2"
|
||||
"github.com/fluxcd/source-controller/internal/cache"
|
||||
// +kubebuilder:scaffold:imports
|
||||
)
|
||||
|
|
@ -274,7 +273,6 @@ func TestMain(m *testing.M) {
|
|||
initTestTLS()
|
||||
|
||||
utilruntime.Must(sourcev1.AddToScheme(scheme.Scheme))
|
||||
utilruntime.Must(sourcev1beta2.AddToScheme(scheme.Scheme))
|
||||
|
||||
testEnv = testenv.New(
|
||||
testenv.WithCRDPath(filepath.Join("..", "..", "config", "crd", "bases")),
|
||||
|
|
@ -454,7 +452,7 @@ func int64p(i int64) *int64 {
|
|||
return &i
|
||||
}
|
||||
|
||||
func logOCIRepoStatus(t *testing.T, obj *sourcev1beta2.OCIRepository) {
|
||||
func logOCIRepoStatus(t *testing.T, obj *sourcev1.OCIRepository) {
|
||||
sts, _ := yaml.Marshal(obj.Status)
|
||||
t.Log(string(sts))
|
||||
}
|
||||
|
|
|
|||
|
|
@ -32,7 +32,6 @@ import (
|
|||
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||
|
||||
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
||||
sourcev1beta2 "github.com/fluxcd/source-controller/api/v1beta2"
|
||||
"github.com/fluxcd/source-controller/internal/helm/registry"
|
||||
soci "github.com/fluxcd/source-controller/internal/oci"
|
||||
stls "github.com/fluxcd/source-controller/internal/tls"
|
||||
|
|
@ -135,7 +134,7 @@ func GetClientOpts(ctx context.Context, c client.Client, obj *sourcev1.HelmRepos
|
|||
return nil, "", fmt.Errorf("failed to configure login options: %w", err)
|
||||
}
|
||||
}
|
||||
} else if obj.Spec.Provider != sourcev1beta2.GenericOCIProvider && obj.Spec.Type == sourcev1.HelmRepositoryTypeOCI && ociRepo {
|
||||
} else if obj.Spec.Provider != sourcev1.GenericOCIProvider && obj.Spec.Type == sourcev1.HelmRepositoryTypeOCI && ociRepo {
|
||||
authenticator, authErr := soci.OIDCAuth(ctx, obj.Spec.URL, obj.Spec.Provider)
|
||||
if authErr != nil {
|
||||
return nil, "", fmt.Errorf("failed to get credential from '%s': %w", obj.Spec.Provider, authErr)
|
||||
|
|
|
|||
|
|
@ -25,7 +25,7 @@ import (
|
|||
"github.com/fluxcd/pkg/auth"
|
||||
authutils "github.com/fluxcd/pkg/auth/utils"
|
||||
|
||||
sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
|
||||
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
||||
)
|
||||
|
||||
// Anonymous is an authn.AuthConfig that always returns an anonymous
|
||||
|
|
|
|||
|
|
@ -29,7 +29,7 @@ import (
|
|||
"github.com/fluxcd/pkg/runtime/conditions"
|
||||
"github.com/fluxcd/pkg/runtime/patch"
|
||||
|
||||
sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
|
||||
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
||||
serror "github.com/fluxcd/source-controller/internal/error"
|
||||
)
|
||||
|
||||
|
|
|
|||
|
|
@ -26,7 +26,8 @@ import (
|
|||
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||
|
||||
"github.com/fluxcd/pkg/apis/meta"
|
||||
sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
|
||||
|
||||
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
||||
"github.com/fluxcd/source-controller/internal/object"
|
||||
"github.com/fluxcd/source-controller/internal/reconcile"
|
||||
)
|
||||
|
|
|
|||
29
main.go
29
main.go
|
|
@ -53,9 +53,7 @@ import (
|
|||
"github.com/fluxcd/pkg/runtime/pprof"
|
||||
"github.com/fluxcd/pkg/runtime/probes"
|
||||
|
||||
v1 "github.com/fluxcd/source-controller/api/v1"
|
||||
"github.com/fluxcd/source-controller/api/v1beta2"
|
||||
|
||||
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
||||
// +kubebuilder:scaffold:imports
|
||||
|
||||
"github.com/fluxcd/source-controller/internal/cache"
|
||||
|
|
@ -86,8 +84,7 @@ var (
|
|||
func init() {
|
||||
utilruntime.Must(clientgoscheme.AddToScheme(scheme))
|
||||
|
||||
utilruntime.Must(v1beta2.AddToScheme(scheme))
|
||||
utilruntime.Must(v1.AddToScheme(scheme))
|
||||
utilruntime.Must(sourcev1.AddToScheme(scheme))
|
||||
// +kubebuilder:scaffold:scheme
|
||||
}
|
||||
|
||||
|
|
@ -196,7 +193,7 @@ func main() {
|
|||
|
||||
probes.SetupChecks(mgr, setupLog)
|
||||
|
||||
metrics := helper.NewMetrics(mgr, metrics.MustMakeRecorder(), v1.SourceFinalizer)
|
||||
metrics := helper.NewMetrics(mgr, metrics.MustMakeRecorder(), sourcev1.SourceFinalizer)
|
||||
cacheRecorder := cache.MustMakeMetrics()
|
||||
eventRecorder := mustSetupEventRecorder(mgr, eventsAddr, controllerName)
|
||||
storage := mustInitStorage(storagePath, storageAdvAddr, artifactRetentionTTL, artifactRetentionRecords, artifactDigestAlgo)
|
||||
|
|
@ -230,7 +227,7 @@ func main() {
|
|||
DependencyRequeueInterval: requeueDependency,
|
||||
RateLimiter: helper.GetRateLimiter(rateLimiterOptions),
|
||||
}); err != nil {
|
||||
setupLog.Error(err, "unable to create controller", "controller", v1.GitRepositoryKind)
|
||||
setupLog.Error(err, "unable to create controller", "controller", sourcev1.GitRepositoryKind)
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
|
|
@ -247,7 +244,7 @@ func main() {
|
|||
}).SetupWithManagerAndOptions(mgr, controller.HelmRepositoryReconcilerOptions{
|
||||
RateLimiter: helper.GetRateLimiter(rateLimiterOptions),
|
||||
}); err != nil {
|
||||
setupLog.Error(err, "unable to create controller", "controller", v1.HelmRepositoryKind)
|
||||
setupLog.Error(err, "unable to create controller", "controller", sourcev1.HelmRepositoryKind)
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
|
|
@ -265,7 +262,7 @@ func main() {
|
|||
}).SetupWithManagerAndOptions(ctx, mgr, controller.HelmChartReconcilerOptions{
|
||||
RateLimiter: helper.GetRateLimiter(rateLimiterOptions),
|
||||
}); err != nil {
|
||||
setupLog.Error(err, "unable to create controller", "controller", v1.HelmChartKind)
|
||||
setupLog.Error(err, "unable to create controller", "controller", sourcev1.HelmChartKind)
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
|
|
@ -278,7 +275,7 @@ func main() {
|
|||
}).SetupWithManagerAndOptions(mgr, controller.BucketReconcilerOptions{
|
||||
RateLimiter: helper.GetRateLimiter(rateLimiterOptions),
|
||||
}); err != nil {
|
||||
setupLog.Error(err, "unable to create controller", "controller", v1.BucketKind)
|
||||
setupLog.Error(err, "unable to create controller", "controller", sourcev1.BucketKind)
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
|
|
@ -292,7 +289,7 @@ func main() {
|
|||
}).SetupWithManagerAndOptions(mgr, controller.OCIRepositoryReconcilerOptions{
|
||||
RateLimiter: helper.GetRateLimiter(rateLimiterOptions),
|
||||
}); err != nil {
|
||||
setupLog.Error(err, "unable to create controller", "controller", v1beta2.OCIRepositoryKind)
|
||||
setupLog.Error(err, "unable to create controller", "controller", sourcev1.OCIRepositoryKind)
|
||||
os.Exit(1)
|
||||
}
|
||||
// +kubebuilder:scaffold:builder
|
||||
|
|
@ -380,11 +377,11 @@ func mustSetupManager(metricsAddr, healthAddr string, maxConcurrent int,
|
|||
},
|
||||
Cache: ctrlcache.Options{
|
||||
ByObject: map[ctrlclient.Object]ctrlcache.ByObject{
|
||||
&v1.GitRepository{}: {Label: watchSelector},
|
||||
&v1.HelmRepository{}: {Label: watchSelector},
|
||||
&v1.HelmChart{}: {Label: watchSelector},
|
||||
&v1.Bucket{}: {Label: watchSelector},
|
||||
&v1beta2.OCIRepository{}: {Label: watchSelector},
|
||||
&sourcev1.GitRepository{}: {Label: watchSelector},
|
||||
&sourcev1.HelmRepository{}: {Label: watchSelector},
|
||||
&sourcev1.HelmChart{}: {Label: watchSelector},
|
||||
&sourcev1.Bucket{}: {Label: watchSelector},
|
||||
&sourcev1.OCIRepository{}: {Label: watchSelector},
|
||||
},
|
||||
},
|
||||
Metrics: metricsserver.Options{
|
||||
|
|
|
|||
|
|
@ -52,7 +52,7 @@ import (
|
|||
|
||||
const (
|
||||
objectName string = "test.yaml"
|
||||
objectEtag string = "2020beab5f1711919157756379622d1d"
|
||||
objectEtag string = "b07bba5a280b58791bc78fb9fc414b09"
|
||||
)
|
||||
|
||||
var (
|
||||
|
|
@ -801,7 +801,7 @@ func removeObjectFromBucket(ctx context.Context) {
|
|||
|
||||
func getObjectFile() string {
|
||||
return `
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: Bucket
|
||||
metadata:
|
||||
name: podinfo
|
||||
|
|
|
|||
Loading…
Reference in New Issue