From d8798bc17d25a6220a26518ff38764382d32ec48 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Tue, 20 May 2025 22:13:31 -0500 Subject: [PATCH 01/18] Remove isaiah-podman and docker-auth gitlab keys --- hosts/isaiah/default.nix | 38 ++---------------- secrets/gitlab/docker-auth.age | Bin 2208 -> 0 bytes secrets/gitlab/isaiah-podman-runner-reg.age | 42 -------------------- secrets/secrets.nix | 2 - 4 files changed, 3 insertions(+), 79 deletions(-) delete mode 100644 secrets/gitlab/docker-auth.age delete mode 100644 secrets/gitlab/isaiah-podman-runner-reg.age diff --git a/hosts/isaiah/default.nix b/hosts/isaiah/default.nix index 1315572..e2dca92 100644 --- a/hosts/isaiah/default.nix +++ b/hosts/isaiah/default.nix @@ -1,5 +1,5 @@ { - config, + #config, lib, top, ... @@ -11,8 +11,6 @@ ]; age.secrets = { - runner-reg.file = ../../secrets/gitlab/isaiah-podman-runner-reg.age; - docker-auth.file = ../../secrets/gitlab/docker-auth.age; runner-qemu.file = ../../secrets/gitlab/isaiah-qemu-runner-reg.age; }; @@ -82,34 +80,9 @@ settings = { concurrent = 5; }; - services = { - default = { - executor = "docker"; - authenticationTokenConfigFile = config.age.secrets.runner-reg.path; - dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest"; - dockerAllowedImages = [ - "alpine:*" - "debian:*" - "docker:*" - "fedora:*" - "python:*" - "ubuntu:*" - "registry.gitlab.com/gitlab-org/*" - "registry.thehellings.com/*/*/*:*" - "gitlab.shire-zebra.ts.net:5000/*/*/*:*" - ]; - dockerAllowedServices = [ - "docker:*" - "registry.thehellings.com/*/*/*:*" - "gitlab.shire-zebra.ts.net:5000/*/*/*:*" - ]; - dockerPrivileged = true; - dockerVolumes = [ - "/certs/client" - "/cache" - ]; + services = + { }; - }; }; k3s.clusterInit = true; # This is the first node in the cluster openssh = { @@ -118,11 +91,6 @@ }; }; - systemd.services.gitlab-runner = { - after = [ "network-online.target" ]; - requires = [ "network-online.target" ]; - }; - virtualisation = { libvirtd = { enable = true; diff --git a/secrets/gitlab/docker-auth.age b/secrets/gitlab/docker-auth.age deleted file mode 100644 index 8d47bccc1fdba8dcd507b7a933585024acec2cd2..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2208 zcmZXV$?GHs6@ZP0s4arv!Ndg{20x!Z3ts7h*+|{J3`IN6Y%Ys`7PzB)mok7XPsLd|c$ z7=jFQz=V6WT*(hXxZEFc!ed*%QX^6Em~OzyW~1y!!z9m{uUm{D>Lw_llwK}a2ax6n z>?++LMi>+Ujw6X_Qz(6DOe_!XtD-qj7T}oBt(z^z+GSXtwvy6v7b-D=iiLGdErHP{ zjw&3`gJzhN(%S1N61pN27MF`c@}s5))rI%nSct-vnQ0NIiv*aLZn0LkzL3wGb%5Q{ z&Nf0?6pmY7Vr}%W0io4`?SSw#sQ|6wp!V%!t&9X5jS#N)=9KKmc=9V_@+oB|wR!t>1&TtSGr-EzCgjjK1CTV54YWM0O z`JIiT+%W;ra?zvl9$8C_D|sW3R&_2b=QQYHNj4peHLRT#U0SC|&hGk_MygQ&hf8jU zZV%#U>rx}K*oL&C@(9yuN)=}b&QwZHjMcTO=Shbaxkr?QPwpv`2WyT6ea@Aq%0op8 z4=tqkHvLI+hEg$Ba&0 zX)zS+4i{C9=Bt-b9Dry(g$t?zImD)`iz`Eux3ql*;uE=?lDcN|+?CA%u`d9iWfhms zE1}b+M2XU4lOB&3*vvt5iJcLofP(77hpz6NBA5hf9IDanWV{%(9CVW=#umUCfM}WJJB* zQ8l&{BA;$!#yo9hdWTV&A^T{HyY%_1R_K+){0c%l5 z&MQTYvGs;c7rLr8p;)5_TsfQ~cYmN&gg14>s?n5n#+5a!8_dj=c(8BXxN7bLb-6OG zV`DiK6Z@u9>9v5)`L6fofDmMV#bSsn*rynCF0{NjWwHvm&SBCCO6TM=-%&!pLa()r z;N#}vf)~37^gULV_a>QohkjO&Xx3b8sDqLP%BOePxs;@Bb zY=aEi!*T&n+lvglL%;Tfjth^2UZ@DP2r`}H8=GgHiz%&XnW*8ioDmu)62A*WL9cXZ zOJ=#7+;gLgh=Ic8RnK`tbGTadW(Eh~eWnZ{Qsoz#547tBXp8GSM?}pU!Xn(Ia+vR^ zt7k{p}D=I24d>99gs_ySyF3hhGgIp$?B=Lm?H)kE9@KNl*_=sE! zLH5E%2P$MZ%pjodleBW$_KX0Z%I>m`H?YI%<4)R%5_$l5M0(!a z-Q6-HI*U}jy@E{DImajY%of|rw#eYVQ#uaPae9|C(d5bG;`_q4;@4kzWqEr0=l}TS zm*4r?v%mhxdFdOkJ^bqP27dPWr>`WhzyImCzf^qm_22y9PanPblP|vdr;RE z@K=9)ldk^#=a>IbzW<#E|M{)|>o-61;MEUv=e@7|{n67G-r>&5<&@z{Lh$B#ev P>|^Su?*(tY@r(Zh5Ovrq diff --git a/secrets/gitlab/isaiah-podman-runner-reg.age b/secrets/gitlab/isaiah-podman-runner-reg.age deleted file mode 100644 index 7ff27b5..0000000 --- a/secrets/gitlab/isaiah-podman-runner-reg.age +++ /dev/null @@ -1,42 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 64uajw eV9Zpp4/hT0/yqmxioNHFm4k8vcIYxUcut7IoDDyuA8 -f3UHC6bPtweXnJ6htSbHI9aGoFOekxSyP83jB8AXLJ4 --> ssh-ed25519 oyEmTw ncaobB5Yo3geYqqqGbgQAbL0ReboWV1Kd1VoaoUIqR8 -qgHrn4ecZ4/T1dBncpcXpx0+hQNS2RDxTD0w7UW7dQ0 --> ssh-ed25519 mOmPfg v0q7ExwR8khGaySaCBmWa2J6cte4kbzcJ/kzM63oFXI -vheRD95qqHoYHLKZwpajbavOECr0sM5o/P2aN9l7MU8 --> ssh-ed25519 YJiRbw ZUwjcDh2BgTiuZtg7HB7z3CDcaSWI6p00CdwSynM1Qo -Dj9E36auKUDim3+8Jyo8eOl7QD0JiGAyKJwGibiZRTg --> ssh-ed25519 aY2AXA 3OAFXfKEa17oKIvaLlqMIUt5ymogo/TjkNQq7a76tl0 -VVunUS5pgcRb6iarZKT1EpTV1fNJqR9GdMsoLOva1zI --> ssh-ed25519 xNtnoA Z9j4Y7Wf8vT5tJ87HEaYnjnklRrneHCo37pYUJ69bgc -0ZugVGxDqUT9Deq1Jf7f0mYnX3/mEYSgbgoburorUcc --> ssh-ed25519 AQhf1g cNcndnaIgUJh6J7+tgXey7MpYzOUoAp1p7TfAqmimEs -UkDmgozd1WjYh2EmL9gEKP/WLnG/ZuPRLttxKGLvBWA --> ssh-ed25519 B8wa7Q 9emGk7ySc9cqV5MWP4FMUgaokxsiaefV3BJLmQfIT3A -HcAfVurlttw8XECe3hl9LtcKsLypZZORKdzib6wUGJA --> ssh-ed25519 8UnW5Q U6vSV1xCzXM2pI730y7xPQOYeN6MP/cwv1C7kFE52lA -L9shhjUH1RBYkPr6VO/iZ5FhAAZ2fQm0ap3FyodYcfE --> ssh-ed25519 0/WsKg cAfTjIjq2NMz1mQVZ7Rzv2n+Uliv9STfX7Qk9Ixr8X8 -rFlWd+QGDPGnDRnI4zZEK/QvNrQgZPqRq8Ta1ZNXIbg --> ssh-ed25519 Nl/5yA asEF9vNOohQbne7nsuWo0mjne7JETHTGgXCPp5520m4 -fo745n2zSyLWcadThr53CPizcCw3IRs6MPdGoTz94oQ --> ssh-ed25519 GdLgCQ mUZSVAOzecIr1H8ekf/rrt6LLVxKZG5M3humVl22bww -CuJcm8Qy6TfH6HFJxlfFoOgl2K+4p4bpFSfmEb83wJI --> ssh-ed25519 tOH/HQ AtfEqYQ0aZMT11xRDBNS7vb55weHU4uIV/ztb8JmyCA -esNanLRi1FBWG7v27615uo5CxGW6yvqe/Je/nJ/UVwo --> ssh-ed25519 FpzvfQ MgdTAyCUMNTOOnYD7H0U60IxnOKRUbMO9yfKP1PArgc -/9ia4l8hI+yXb3N1sxTMBhEkkO0BTQRbG4IaGNZuUBs --> ssh-ed25519 kdPvzQ BZGH7Uuor0zXWb7HrzFTKkU9bmZtj6hTYlqggv8EV18 -p+Ix6dd5HqwVoZnliwvr18Tw7LMX/rLHBsyJeOR1Y4Q --> ssh-ed25519 onmXpg zJHDidsIEBbTLWH4EwHdd0kxpp2TKOIMYTTkn30pWWs -ZcoRMNxoJDi1w+ISUw3fRTOi3+NyuCgqVE7k8//UdUs --> ssh-ed25519 CnhD0g 6PMqxrnXVVPavFvgyEEgaj99G8GImfaQIZS6wIs5RQs -1z1plGxfj+Y1WWP46SkArNgHvK3izF3I3UGuLyGG+sA --> ssh-ed25519 4ep2UA +9czZVUs3NAJkZ/E8UDTsk1r95clfNzWkVxcBSNbfS4 -WQ5ZsO2mXPmWz71dX1K0ZJsEbVv4R0QfCSBPPWZ+cSQ ---- xEB5l1RXMXTk7nVXGag3x+jbkLAWzhAlR8CYtiOsfno -KKƷ4k5:Κx6S ;v}6CTg >Ge1TZKBȧ4Ϥ79-Ds>x1l (=3D>;D -gk\7Su:|;>"nw oM{{3 {HB AneGp(*3(B %jt_!TGT o4pk͖Tr Iұ)*.!R]H9v \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 76c4d72..9f48d29 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -94,10 +94,8 @@ in "gitlab/jeremiah-runner-reg.age".publicKeys = everyone; "gitlab/isaiah-qemu-runner-reg.age".publicKeys = everyone; "gitlab/isaiah-vbox-runner-reg.age".publicKeys = everyone; - "gitlab/isaiah-podman-runner-reg.age".publicKeys = everyone; "gitlab/isaiah-shell-runner-reg.age".publicKeys = everyone; "gitlab/linode-deployer-runner-reg.age".publicKeys = everyone; - "gitlab/docker-auth.age".publicKeys = everyone; "acme_password.age".publicKeys = everyone; "ca/intermediate_key.age".publicKeys = everyone; From 641c9fd7ac561a7205a4f656959327067e76b15c Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Tue, 20 May 2025 22:27:28 -0500 Subject: [PATCH 02/18] Rename Jeremiah key --- hosts/jeremiah/default.nix | 2 +- .../gitlab/{jeremiah-runner-reg.age => nixos-qemu-shell.age} | 0 secrets/secrets.nix | 2 +- 3 files changed, 2 insertions(+), 2 deletions(-) rename secrets/gitlab/{jeremiah-runner-reg.age => nixos-qemu-shell.age} (100%) diff --git a/hosts/jeremiah/default.nix b/hosts/jeremiah/default.nix index f741d72..5b26fd2 100644 --- a/hosts/jeremiah/default.nix +++ b/hosts/jeremiah/default.nix @@ -106,7 +106,7 @@ in ##################################################################################### #################### Virtualbox Runner ############################################## ##################################################################################### - age.secrets.runner-reg.file = ../../secrets/gitlab/jeremiah-runner-reg.age; + age.secrets.runner-reg.file = ../../secrets/gitlab/nixos-qemu-shell.age; services = { gitlab-runner = { diff --git a/secrets/gitlab/jeremiah-runner-reg.age b/secrets/gitlab/nixos-qemu-shell.age similarity index 100% rename from secrets/gitlab/jeremiah-runner-reg.age rename to secrets/gitlab/nixos-qemu-shell.age diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 9f48d29..9c6174d 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -91,7 +91,7 @@ in # Then pipe the resulting files to agenix -e "gitlab/key.age".publicKeys = everyone; "gitlab/cert.age".publicKeys = everyone; - "gitlab/jeremiah-runner-reg.age".publicKeys = everyone; + "gitlab/nixos-qemu-shell.age".publicKeys = everyone; "gitlab/isaiah-qemu-runner-reg.age".publicKeys = everyone; "gitlab/isaiah-vbox-runner-reg.age".publicKeys = everyone; "gitlab/isaiah-shell-runner-reg.age".publicKeys = everyone; From 4cd0de01097f5374e924d710b4a7aea4acd0f576 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Tue, 20 May 2025 22:51:22 -0500 Subject: [PATCH 03/18] Isaiah gets new kubernetes runner --- hosts/isaiah/default.nix | 11 +++++++---- secrets/gitlab/kubernetes-k3s-local.age | Bin 0 -> 2512 bytes secrets/secrets.nix | 6 +++--- 3 files changed, 10 insertions(+), 7 deletions(-) create mode 100644 secrets/gitlab/kubernetes-k3s-local.age diff --git a/hosts/isaiah/default.nix b/hosts/isaiah/default.nix index e2dca92..472c8dc 100644 --- a/hosts/isaiah/default.nix +++ b/hosts/isaiah/default.nix @@ -1,5 +1,5 @@ { - #config, + config, lib, top, ... @@ -11,7 +11,7 @@ ]; age.secrets = { - runner-qemu.file = ../../secrets/gitlab/isaiah-qemu-runner-reg.age; + runner-reg.file = ../../secrets/gitlab/kubernetes-k3s-local.age; }; boot = { @@ -80,9 +80,12 @@ settings = { concurrent = 5; }; - services = - { + services = { + kubernetes = { + authenticationTokenConfigFile = config.age.secrets.runner-reg.path; + executor = "shell"; }; + }; }; k3s.clusterInit = true; # This is the first node in the cluster openssh = { diff --git a/secrets/gitlab/kubernetes-k3s-local.age b/secrets/gitlab/kubernetes-k3s-local.age new file mode 100644 index 0000000000000000000000000000000000000000..b52ad17556e778a02aae255c55d697a63d84e04d GIT binary patch literal 2512 zcmZXUY3v*Y8OFsDHB0@#^`(KbLM5f+zjN)(>>AMQ?9A@$9J_Pu?CvaAcXnszK6Yky z=b!>DF%Ep(fNn&jna|FZSMisBErcPE}@m+TqYiLWFnq?AdLx_xV zsy^jgZc$1)u^5*r=NXP#h83^p&JTSI~$k#A)1cbqnhS zYGdRX$Qp38Y@*cjhVOTSK40RJV$;pdG{5hQ3$yCw{Y4qCTcx;w1f}2yp1#am%XudN zQGs1kfT+_(s;Z@5uQXyAs)J?f!2(6NE{us}5;PM;o9A-jFS-Ql^6kcK$_?wAX&P(G zdR8UrJhu>WLbX#WQCA)Wk}77r znmY@yKleBSP5gDgQ!vJu4u|e$+EhcD<7Tzj3I+>YTCuIkq>~bLSxXDvWa?QkEeE|i zlTCbTU1E91*DCG^4C-}|l7cph>eIduFJ<0XagG>HVU_n90y-IX?HWvIn`wD34Z>y> z(g3pNbwZRF4v~m;gj`xp3OP)3f`mvRE)mbg$8mQtFe?_X=?k$3TZt69o;B%1X*;(d z5~S(5Gox0$SvW7EMAJv-IN6k}1#DJ1Wzm|?oEikIMToXoS6D3@60fx9(=qIHk$J0} zjVU82NulEUM1Q&F$<;t+l{sGn)dyrsaNm%B31 z!?I>&O1ml04F?DnTN)U$rB2&5bimCmgF}{u;W~zpqswO3F*j?2z)`}PRU+oBd5;G* zj*Q1aJaMs_nmA5C(Q9B`4%W^Z96AlLpqa2@v1kp@h$SF(Ma@}Yw6CN~5LLnzf)#_a z$&J~-&Gndox|?Y|55$UQ)uCpbr|S5E?xuFs)0%af89Guw7)}60Z|eeXlr1=q$ULhc z%ZbqMB|OauBLXU;A-QzgGSitv)Q~gaHlhY@7&7{ZKgY?=oHtuiHH5@AlTtRrB(}a* z6N{dUEqGK617N)h4Fd{6fr1<#k;6(~o6DA%u3GL0Xv7{6xV<#aO$3Pug7*z;fyGF6 zwx{N#wpm-+XFx`(>fK?EORaI=3{a<8Yw)WKYgsjNma?&+jTF3G^2=obicP4(xuT4% z!J0EkkxqNj6DW>Ii~3q6z$VIKv8Hi`pmqDWch23~QMq17)%Fl&J9I6AO2lf7P>ltM zF4&i7WHql(CarwN)FF^bvqY^|7GhG!Wl^B&Op~YiP|lE*A~;JMk1&j$E>xV=2l%j$ zbKz!f?p$1#QgsTpij0v2PR?xDXfwuW0un=WrZs(&&<1!%u@Rb#m3FRGj0nhVK1!Xb zE2}CHcoCOGFfs~CMOH>i*ego`UAmd>&ovnnn`y1U zq9C(M=XUM{DFp}P&Ju$KPRJWc#t&B|JMT#Yelh}x{u91|~v4xcu$IUd_|OQXg(>(@(7pVz_y zqxD5cu8lI+Z&o@a;l&oWve%tKFwGNj>YLr}L|gmqXqYiQQzuJCS+7Bxu54^YivDnxc%J|cf385-uphv zo!Ecd(Z4Xq9yxZiyZZt2&9@F;_lW+dQ!j=m|J>bor?}0Ivmfu{qeP`vmi+0xz z9oT#Fg5y6w?LIHvy8V0-zUIaMJalUH`k~){`N$pj>^UynJNdx*>Qm1J4;w$O+(*e< ZE_o+@XzQ6vZjrCjoqf+k%VPr&`aj#VczXZ< literal 0 HcmV?d00001 diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 9c6174d..7c41616 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -83,6 +83,7 @@ in "dendrite.age".publicKeys = everyone; "dendrite_key.age".publicKeys = everyone; + "gitlab/secret.age".publicKeys = everyone; "gitlab/otp.age".publicKeys = everyone; "gitlab/db.age".publicKeys = everyone; @@ -92,9 +93,8 @@ in "gitlab/key.age".publicKeys = everyone; "gitlab/cert.age".publicKeys = everyone; "gitlab/nixos-qemu-shell.age".publicKeys = everyone; - "gitlab/isaiah-qemu-runner-reg.age".publicKeys = everyone; - "gitlab/isaiah-vbox-runner-reg.age".publicKeys = everyone; - "gitlab/isaiah-shell-runner-reg.age".publicKeys = everyone; + "gitlab/nixos-vbox-shell.age".publicKeys = everyone; + "gitlab/kubernetes-k3s-local.age".publicKeys = everyone; "gitlab/linode-deployer-runner-reg.age".publicKeys = everyone; "acme_password.age".publicKeys = everyone; From ffd2dd78bc6343ed66a460db760c55e08601b463 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Wed, 21 May 2025 22:25:11 -0500 Subject: [PATCH 04/18] Rework how gitlab-runners are defined --- hosts/jude/virt.nix | 61 ++++++++++++++++----- modules/nixos/vmdev.nix | 28 ---------- secrets/gitlab/isaiah-qemu-runner-reg.age | 40 -------------- secrets/gitlab/isaiah-shell-runner-reg.age | Bin 2388 -> 0 bytes secrets/gitlab/isaiah-vbox-runner-reg.age | 44 --------------- secrets/gitlab/nixos-vbox-shell.age | Bin 0 -> 2466 bytes 6 files changed, 46 insertions(+), 127 deletions(-) delete mode 100644 secrets/gitlab/isaiah-qemu-runner-reg.age delete mode 100644 secrets/gitlab/isaiah-shell-runner-reg.age delete mode 100644 secrets/gitlab/isaiah-vbox-runner-reg.age create mode 100644 secrets/gitlab/nixos-vbox-shell.age diff --git a/hosts/jude/virt.nix b/hosts/jude/virt.nix index 0b94f07..23a993a 100644 --- a/hosts/jude/virt.nix +++ b/hosts/jude/virt.nix @@ -14,9 +14,48 @@ let ]; in { - greg.vmdev.enable = true; + specialisation = { + vbox.configuration = { - age.secrets.runner-reg.file = ../../secrets/gitlab/isaiah-vbox-runner-reg.age; + greg = { + podman.enable = lib.mkForce false; + vmdev.enable = lib.mkForce false; + }; + + users.extraGroups.vboxusers.members = [ "greg" ]; + + virtualisation = { + virtualbox.host = { + enable = true; + enableExtensionPack = true; + }; + }; + + services.gitlab-runner.services = lib.mkForce { + vbox = { + authenticationTokenConfigFile = config.age.secrets.vbox.path; + environmentVariables = { + EFI_DIR = "${pkgs.OVMF.fd}/FV/"; + }; + executor = "shell"; + limit = 5; + }; + }; + + systemd.services.gitlab-runner = { + serviceConfig = { + DevicePolicy = lib.mkForce "auto"; + User = "root"; + DynamicUser = lib.mkForce false; + }; + }; + }; + }; + + age.secrets = { + qemu.file = ../../secrets/gitlab/nixos-qemu-shell.age; + vbox.file = ../../secrets/gitlab/nixos-vbox-shell.age; + }; # These options enable sharing of the GPU with the VM boot = { @@ -39,15 +78,18 @@ in ("vfio-pci.ids=" + (lib.concatStringsSep "," passthru)) ]; }; + + greg.vmdev.enable = true; + hardware.graphics.enable = true; services.gitlab-runner = { enable = true; settings.concurrent = 5; - services.vbox = { + services.qemu = { executor = "shell"; limit = 5; - authenticationTokenConfigFile = config.age.secrets.runner-reg.path; + authenticationTokenConfigFile = config.age.secrets.qemu.path; environmentVariables = { EFI_DIR = "${pkgs.OVMF.fd}/FV/"; }; @@ -55,17 +97,6 @@ in }; systemd.services = { - gitlab-runner = { - conflicts = [ "libvirtd.service" ]; - preStart = builtins.concatStringsSep "\n" [ - "${pkgs.kmod}/bin/modprobe vboxnetflt vboxdrv" - "${pkgs.kmod}/bin/modprobe vboxnetadp" - ]; - postStop = "${pkgs.kmod}/bin/rmmod vboxnetflt vboxnetadp vboxdrv"; - wantedBy = pkgs.lib.mkForce [ ]; - serviceConfig.User = "root"; - }; - "libvirt-nosleep@" = { description = "Prevent sleep while %i is running"; serviceConfig = { diff --git a/modules/nixos/vmdev.nix b/modules/nixos/vmdev.nix index b3e405c..66be451 100644 --- a/modules/nixos/vmdev.nix +++ b/modules/nixos/vmdev.nix @@ -58,36 +58,8 @@ with lib; }; }; }; - - virtualbox.host = { - enable = true; - enableExtensionPack = true; - }; }; - # Configuration for vbox user performance - users.extraGroups.vboxusers.members = [ cfg.user ]; - boot.extraModprobeConfig = "options kvm_${cfg.system} nested=1"; - - # Configure the services more - systemd.services = { - libvirtd = { - preStart = "${pkgs.kmod}/bin/modprobe kvm_${cfg.system}"; - postStop = "${pkgs.kmod}/bin/rmmod kvm_${cfg.system} kvm"; - conflicts = [ "vbox.service" ]; - #overrideStrategy = "asDropin"; - }; - vbox = { - preStart = "${pkgs.kmod}/bin/modprobe vboxdrv vboxnetadp vboxnetflt"; - postStop = "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv"; - script = "echo Started"; - conflicts = [ "libvirtd.service" ]; - unitConfig = { - Type = "oneshot"; - RemainAfterExit = "yes"; - }; - }; - }; }; } diff --git a/secrets/gitlab/isaiah-qemu-runner-reg.age b/secrets/gitlab/isaiah-qemu-runner-reg.age deleted file mode 100644 index 86f5a53..0000000 --- a/secrets/gitlab/isaiah-qemu-runner-reg.age +++ /dev/null @@ -1,40 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 64uajw Owu2iq5FOcCnfmc7WkPZjpje4+l/Y9JpadTmc8ChxW4 -kpN4BikG6+7GCSplNVFDrQtc0hKpVf7MGeLBdEtxvY4 --> ssh-ed25519 oyEmTw e0Irdtmkgx3pHkJKZ0M2wzfVmE+b/tsQ+a1mZTtW8XM -sjJNMwLtamfVYpM5nxvcTVverm41U3xpwTYQ63Q/N84 --> ssh-ed25519 mOmPfg On+SiDGuqOceWJOF8XZNWVHlseoJ7SWmrv2L7NXsjXQ -83KaBly8y4n8L9vclbojrKMTI71uuyvYgey0b9cxy4g --> ssh-ed25519 YJiRbw vdtkHgNYQsmiSqEQMAstt1mUIDQV8ZYd/zm6BJYpFGo -zFXmTVzZbPJTdM/hRPVXaIj0JSl9OuWY3Rb91/y0dBc --> ssh-ed25519 aY2AXA 9wbue2xbS4RCxt9Qv75oPDxc4ccCPdSnlRG758OGW0k -/5vK7IO8KafpczgAqtPx2wppxa6moy1/Lvnfxn5H02s --> ssh-ed25519 xNtnoA aVFWpqxsXmmzd8qGM2ZKM8PjYutfaYm/ZRgjMeCR9j8 -+xBg6M9RnnlsA1Ahb4gZOywOnWr+3bs3bRTYFVIKr38 --> ssh-ed25519 AQhf1g 7uTLGKz6PRaEypfKxVhHladHaTOxXzLDCwSaguVpEU0 -ruCZuzyZB2MzO8On2JYae3jycom0sTDoY8Bkh4ruQyo --> ssh-ed25519 B8wa7Q gxEB1ehbBnd4hcHWhSXKzXUfC8Nvkhis3c8FXtbfaQA -jHfJtyqB2kt0GqaRPtLc3gIcjh/YGhfgvGzXw3rm9DA --> ssh-ed25519 8UnW5Q wJF80kCk+LgGpYPTreA3iTwY/QrhR/rLagNyWKerGzw -eZnYt6N7Trr3J1WGB0Nv3zHJTnML+n+iNkvzdL3jm4w --> ssh-ed25519 0/WsKg bcN7gFP1Vm0MpWWuPW795gD8Q1E3xLr1CMycggtSqRA -6m1NXOBG/Wyz21hCRrj/VbfmhX7QzI8ekAQ+XXnyy38 --> ssh-ed25519 Nl/5yA PoO47KPvS1RXL3QA7PjQDdxL/Z5oYTPivx/gMBXOBWE -yTw7f+qbRyerQQ7JR6DqgkfKDTajkanhMlEmQIV0kCI --> ssh-ed25519 GdLgCQ gI8fo4YpyT/qIEZPn3XIa4R+38ICcTIG1BdTMP+iUH8 -RbU4uOP6RMQZ+DRKrEcZN+GwjLzjq+2pUdk9xm3Xlr4 --> ssh-ed25519 tOH/HQ mIrauZ8OfOElsomdivvcdgpsSSDPPjrlJ/YQmnf5g18 -Mq/vcFQ2mGIPVB0uZS/qtO13WMTcs4CLRwl4YWrreJg --> ssh-ed25519 FpzvfQ lC5aVnyJYH6t/PDDnQQNRqwOX4shQS3Ys1aOWfQ8sw4 -xgdHax+M3voH8OquVY0SqmSoODJCCVrWZJL1bPFlsp4 --> ssh-ed25519 kdPvzQ kHJVlbRYWqubO9xDybSQ1awWZW/OZRp76z/Hmny5dQY -B1n6XLWZ2KBfzN0qniNBMKdZM40fjDogKkpHfEEQnW4 --> ssh-ed25519 onmXpg fHjrAjDy5Ce/hg1WNJc7IWEk8IxYXdR6h2asJ+1Uajs -VxVISuHeVJ6NKTmGLNY7AbyGgdOVPIZoWkGNH8C7xJ0 --> ssh-ed25519 CnhD0g +JqkpM0pFRZiaNP49Y8IPDo9w5KqahsqJYugsYmIe3Y -M44lsxcLqBh6AW/sf8zMcOg2euOqOytmOTtFtfMFHHc --> ssh-ed25519 4ep2UA QvvgFgNihOAnItEV5W/MWkPOjrFALbTrQQf6PMO3CWw -rLJIh6PomyyT/nJXdi2WRIpzZymNqWQ4QuHp2olJI0M ---- m9Xw9hvo+ZLlW8pe2/YdH5rqL0cUFPcTicrExwC7DGQ -6`@{Xh œ10= RLw]hx6\1Ҩ)Լyoig)nY - gc:#q(_6I|,魞HB>)KB5ԋL札ylUekvZ )=BN̨wǬ0y[Ճ*'WꗯmGg -BUYkِ#R!] "gt^N q+Padw$0%*wi(T0 ?^$SBx7¢ u0JBFX'@dj6PxPnqma51 \ No newline at end of file diff --git a/secrets/gitlab/isaiah-shell-runner-reg.age b/secrets/gitlab/isaiah-shell-runner-reg.age deleted file mode 100644 index 1bcaafa9e7d8e834f6196358a5349503452adc58..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2388 zcmZXVYwYWE9mb8}z{!Ycym3jCC5RyN(93!ig7&hmTen`ec5SBydvDjRm$hrVMg4n8 zOw7>$#selsAiVI17(zrt6r-3B!6kS`%uhB;-_>6AVKq(hllWIMJgr<_vA-Fq+tP z+v|XR6-Wyj$SFldq@K;KA%ipwZdh1w18)=}W^I9iw7SJDWeLLHj# zk~s+3syZv8U{R3#a?tR)a#)*X!jwU^JN%$PTyn%kz7hls3kP zWmU1<$eJxkXyWw_YonCVhl2Ksoe$M1v)g$(77M8 z%Pa*4hqVz}qN7SX(<=eP@(xMC-LWB)u})ZZgHJNLuOmFII^Lv`wDE}Hh}PB>EXwGH z?26}wu$SuuxT6*ZDgGB`nbSUob7AXc;LBR+B~dH zTmtBpY8z?9FjFwamii<2q>S z%cEhWRb*&;0~0U%lGRIxk#mFD&;mx3S)LCWqZ$!5%{xv^F#wp;NLmTIakbn~hiRq61N?qV zI!ZMSr*WPOMJFRol4NL%rLw$KVXZ;z{$SE04QrM+gVtc&MMo1P6>-KlFuH>%J%wh* zW;T)b>&XKS$Vr0gFbSR>rg7P>@|E@wM#Dax`eeAnV?GnPnlPN1!1*4>F{C>PM5&vH zS+;88{pC`N5MyV~P{bqNca_z~2ectSn+Yr;p}p~jhJP%_oRSvP3k5-y4f)!6H@oI zrIYq{M73wsvLNhg*~BHUX{?bl#vBcRhkWI3=F*bxfrp)Bl8^=W35YYnQVoDtrLhGz zRE;A+7*8q;@c1!GM7APzasenpU2AO$Ys+;j16gMpuc3`jXas1Na>^+s)Fr*XF^js% zN{xBqFb(lCSfkphhXqg$aTE9!h=4jtP64I5pSqcUKOR>(7UJ#i9ww%;KE#2ho z1XAUdQ!`1a@xf$Y0YJWkBWR5Q#fqeEO*Hi{E|k_;Y`{{My&AKl=Vh zpR!M$MRh-AAJn(}YbeDUgAo_OTQzup+V za{By}zj^I`{Y@8L^_~k}HKhlOlkfWGrC)gIYhQkE6ELT3{l7N>v+Hkc!sw-^pLp!4 zxBTPHSN!{Z<#pI45P9Ucw|=_nfb=Q1#4DulyTv^8=i5#RKYX=Ot%-`a9_v%%KI;T`Hs)r{bYXKW8YpJzxS@QpStVpf8KrZ nlY_qxzkdgL>hV8+0T diff --git a/secrets/gitlab/isaiah-vbox-runner-reg.age b/secrets/gitlab/isaiah-vbox-runner-reg.age deleted file mode 100644 index 186fe99..0000000 --- a/secrets/gitlab/isaiah-vbox-runner-reg.age +++ /dev/null @@ -1,44 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 64uajw zaw1VrAOKf7WH+2V4MPaJ2NGfdRq2TPYV5LW10niQwI -yt3kmG5Pi13ALMjusVxuydh/j6xMLNJP5hLp/ePKxcs --> ssh-ed25519 oyEmTw a9q3TpbESuMSh2ut7D/JfgA4KV0e8c6/JQySA1uh3Wk -haasKx1ZqqMf4tP1upDtgw7LOIw7J1D699Dl75LQ8IQ --> ssh-ed25519 mOmPfg YDmQILepyMgtgVzriyRWks2QZpvt8zCsAhlrZI1Fl0o -scnIfvhOAVAHh31EIBqmFBNbqXleJ2pcFPuMjDEnZ/w --> ssh-ed25519 YJiRbw O6Ar5fSR+6OTZ/MMACKg+SOIRV4NtmMJ3MPexY/fAHs -sBGDGkW5vfZcyQ/Hv/5xdAlOz1hYGRWMcO7tgDrNlG4 --> ssh-ed25519 aY2AXA oE4aRUnvlKUkrXkLxqdlmSeTblfk9uTWGzoMU/D22EE -XaRuO3ORNgb0LRZKzRj0sMpJDFzyzhDIuXBYs/OxxWw --> ssh-ed25519 xNtnoA TLM/kPHULyiUEymgksLHLVhhCT5rIMRc9etjkINaE0c -JdDX25lXPXStWwoSWp1/WmgMeb3SDI8Z/OyiGyVF6mI --> ssh-ed25519 AQhf1g pNMD0U938a14qqiMUFxTw8073SNF25IDJfjXGm7q9Ss -Yuf5Z6AoHW9uj5hOWSc5eirqP+xH9wbuwknqh2JW4K0 --> ssh-ed25519 B8wa7Q KXIt7sQKcZpSnKbs30fT5ybgBwFghhmM/Ov8OjQsfxE -BtZysD+2DVUcivWXnJdlW4Y2pLCoXLF7jP4IGj12Xo8 --> ssh-ed25519 8UnW5Q nLn5gfsYNAxDl8GatHyEyQMhpy+A5XvykowBYlVbPQ8 -w+XlgXrE0KcfDWZC+ya0tnyDXshDw582B803CItqLFc --> ssh-ed25519 0/WsKg TbGuq0eETh1mVmsqtqkvhCiXAliz5WS7iqQ+OY01nXY -GTXIQZf44Sjg4mVxQtD7+VOSx1eAOIr0gBxhAjMXK5U --> ssh-ed25519 Nl/5yA fjC2SY379C5o9jBUetLXQApy00YVEa4A7Jr61yoCI0U -/350ThLM1JCvg1E8kJib2ESP9nXRUI5QqTTun0QQtO4 --> ssh-ed25519 GdLgCQ H7g+SuknwgOy8PDEwK8UqrNG82ZoLisCSSFTxaNS1EU -JVd1nDmgTSZ6oLdnp29Qlor39RHZN1q+hPEJl1RSw5s --> ssh-ed25519 tOH/HQ PFuIUIqN8K9GoLsLOIdRHaFj5KclCuwGoRSoyH9WRHQ -fkQNV36OpzgiufqmTyJYHsNlfa6THDrDzvVyaVVrtzI --> ssh-ed25519 FpzvfQ +HL0H1U9HYiMuyVjd9hosnTntjV3Bf8N/KhdfbZSgV4 -rd7CNDUSU5GYRVfuPy8aEVNdWAv1DektrVb+JES5vTk --> ssh-ed25519 kdPvzQ EsizsHpgHDbBWwDnRgPmSMy2Cmpvqpjd2wriSiW+xxg -tGd9x8NQMMLaqYDFKWWfJvvdPyTS63OZOZGWqvfj1+I --> ssh-ed25519 onmXpg u4zMl21Un8YqsRaH4STYGbI53K364RJ9fMDCKmUcbCY -XHtAV9Z9jpPPVYGOPq7/jS0ZiTy4E9As2Dv4fAJUSVM --> ssh-ed25519 CnhD0g 4VejzPLVJcGXdLQBY6/Fb4PKtrzvRpMltKBMjMM4UFk -4IwAQAJxOZA3EYa816SbQeM61y2yV23fIDPe7w2wGUw --> ssh-ed25519 4ep2UA PTIWvjuv8m66h8E6+QZJKxEmZ4RyoI4qwiMMrYhVDS4 -/28djh64HqyGhdOKzwFEseIH8BYGljkcQScV6rBx/Yk ---- UINMhgQK2hWVetzQg4cNYxksN4G+pOKGqvZ+Jl4Zl/k -]M>;I9oZ~/P*T5s58 WK -g -7<&ˎvLkQ=-0aRIEk}lxAJ}J` -/TlPv\S|tAHѺG{P@:3%Hmc?d$J.C3LzZ qzNEՇ¸ -ȹev7A o>eusu9ro~XyVU^6-ʟ2J ,&F^an}3ebsy_^2&{r =qa$UUVSQTH=N6;H zAPPcq7$nFUBOr$;8u1W+AS4J#{!w~T#8 zu!zbqS*?Tp>&ODLW^LcWdK}yPjAaW!ns^~Hl1TBjr#tA$f z6iX9UDH$cAhzK@lXHhF4&KNBhF`$_;idSjFB9w}E6$got&8j1gE7b1CRS(hK?X-1C z`Ep*@Tj)^tL3Y9peH2426=En^wKSts4B?MmF9Ih!hSpCi-e4l}b8M*op&8 z)aBDD$%itzsCDN_CX}6)zK(-*)m5|309>i^z%oms$*o}+rHeQ;n-HXIr_F{dQP1m| zLs$SFDKa*YqXFX2q=*xfDrN&%8V|w(uJB=@dD*bFuE|4wir4{^!r3grT~QW?sUoYG zD=%D6qgcs_#W~sZRHLz-HlMW!m8erTuOXolQY4Faz<#@%%@b-lnQ&ct8mNvgLm6VK zgl}4j~2vs8X?$b)2dhcM2u3iIgPLqSSe1@HlQZx2C<}s-O$1@w@4s7B>7&W z=JYeGnVS$AD6QFA={86Ss?dxu+VEhov6pySsiCHkaTDH7>tOl3E!1I}8MJ47K5f%* zqr1>o*@R4(abx5blAw>;$f!b+c0)BAvsyn4MnJ040|c;DzpWZwdl}6_X-*)+d;@0r zJRCR`NP#xBorWpF6cOrtj`M||O`Two8+PKYr`BrIb%;O+xNfNcShp=$5NwbHU8A}i z90hS~K6T=Ppc_df$9*C7Wzux!fF=@jr=%2q0nn%QtpQGB#;WHndE{EsWB~ihQuhcG zhL)yo$h~lkHL}j8gSjn{E@p+$s8PDma1$45uc{slM*zF#IKuBVQV1xdR_K(Lx9rej zQ(T{>ke2g6aVUK&Z=8X1*FA3fpq9w1>}in;{sVs;Uxip?(s#d3)J6J&NfnHCbY|8pgMaHD7L6 zS^|0wM(2fHDYMK6ovGzb)+*SMBlWbt^};GMg?b8&1rC~yS3EB{&6Q+#?5v_DGk=pC zIt8FBw^cGsoH?>k>m;cNwQQ4#rx{Ahsi_NXwWBOG&2h7;o0eJ%dw4M6@Y9ydUGiBa z)H8Y5Y9ap0=tRt9CKhFZw%dn-t8RM}Sl3K*)4icmPY}0)skBY$K8>z7 z1-B48&2q35#aT3*VcTzmjj*K<^{od5&e&p%VRnx${c>XfEsCRQf1a1N+;>+#fEQUR zbs@NxHzgKcAR(M*x#QIGeDtm>jvV~t;o9dv^6jrZ@Q=4{yzDa%CVMXU^O0vC zdHj~A9{BrrPQ2kM`;Y(ll52PVdgqmB-abY=mtFK1aM!m!cE*MGed6fBJ-g)-H@|XK z?aak@cbZRM_83^o-Hn z%YXjrtP}rw|Nh|q-A7(H=aoOc`SxqY?w5Ph4{!L{)rZ*~vj@NQLXw}4-^3~NC(9=e zUxe&?_TFo6J9*g%6_KKjfD c4=bxnkKcXHzpJzEIdAd9n38{g&7K4Q2Q=YOtpET3 literal 0 HcmV?d00001 From 635ff2926a387eb130dbcccb2be92b22ad898569 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Wed, 21 May 2025 22:55:59 -0500 Subject: [PATCH 05/18] Remove extra services from Genesis Remove ACME from Geneis, since I don't use it Remove Uptime Kuma since I also don't use it Fixes #6 --- hosts/genesis/acme.nix | 75 --------------------------------------- hosts/genesis/default.nix | 17 --------- 2 files changed, 92 deletions(-) delete mode 100644 hosts/genesis/acme.nix diff --git a/hosts/genesis/acme.nix b/hosts/genesis/acme.nix deleted file mode 100644 index 6eb15fd..0000000 --- a/hosts/genesis/acme.nix +++ /dev/null @@ -1,75 +0,0 @@ -{ - pkgs, - config, - lib, - ... -}: - -let - address = (builtins.elemAt config.networking.interfaces.ens18.ipv4.addresses 0).address; - root_ca = pkgs.writeText "root_ca.crt" (builtins.readFile ../../ca/root_ca.crt); - intermediate_ca = pkgs.writeText "intermediate_ca.crt" ( - builtins.readFile ../../ca/intermediate_ca.crt - ); -in -{ - age.secrets.acme_password = { - file = ../../secrets/acme_password.age; - }; - age.secrets.intermediate_ca_key = { - file = ../../secrets/ca/intermediate_key.age; - }; - age.secrets.root_ca_key.file = ../../secrets/ca/root_key.age; - systemd.services.step-ca.serviceConfig.Environment = lib.mkForce [ - "STEPDEBUG=1" - "HOME=%S/step-ca" - ]; - services.step-ca = { - inherit address; - enable = false; - intermediatePasswordFile = config.age.secrets.acme_password.path; - openFirewall = true; - port = 8443; - settings = { - root = root_ca; - federatedRoots = null; - cert = intermediate_ca; - key = config.age.secrets.intermediate_ca_key.path; - dnsNames = [ - "10.42.1.5" - "acme.thehellings.lan" - ]; - logger.format = "text"; - db = { - type = "badgerv2"; - dataSource = "/var/lib/step-ca/db"; - badgerFileLoadingMode = ""; - }; - authority.provisioners = [ - { - type = "JWK"; - name = "greg@thehellings.com"; - key = { - use = "sig"; - kty = "EC"; - kid = "1GOpOttYLZtx7XiG79ZycbGcG4ptL0czfohK35SZOEI"; - crv = "P-256"; - alg = "ES256"; - x = "YEWVj5CCoqWQXWqmL0UuORlFY9IEOLcg1jpG1o-wGx4"; - y = "MEpqnJp60VV-SpFtb6m8U-VAYut7R_PKFm07xl7MjBk"; - }; - encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoieWdfb0lfbWgwbHhPRXdjUTBsd0FnUSJ9.ivdQUFEhs2U8PUBYr8AhQl3hHdb4spF4jvXgqY_hiVgpjB-z3Nn9Uw.u7vrNht_3WD1G97q.mbydlpAQxjtKLkOmmDOUczqscRDPqrUyoPJ1uqXcJDH3vs4KiYlrKRcFLjPy9sWzEL1iIrqjwf3U-3AAx1KNAg7frs2D__MGfOO-U5SdQDVJVAND7KpWOJGJVSb0xioCA6-8ldlP_REqu4ENmkkdw0_6Is2b0p7ZFKqke_fqOOs7osqFAfbMb_WzEWrACLn5A5-Teh2rpEgR-z9zipN6MSEqE6VIQ2BXuv70aHWhslNe1MK1OgTYm9CqA47EMYvQ7HQLPDZAbP56WK84yJLktoXMmnkaKeTtvER0dh4ufyjJHBhecnEranbR5rHc_jV8_qvyWhlqbCrOU_8bWrk.a9SH_q3GKIUsOUSRWkDxQg"; - } - ]; - tls = { - cipherSuites = [ - "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" - ]; - minVersion = 1.2; - maxVersion = 1.3; - renegotiation = false; - }; - }; - }; -} diff --git a/hosts/genesis/default.nix b/hosts/genesis/default.nix index 32c50a4..209e6e2 100644 --- a/hosts/genesis/default.nix +++ b/hosts/genesis/default.nix @@ -7,12 +7,10 @@ let dashy_port = "8080"; speedtest_port = "19472"; - uptime_kuma_port = "4000"; in { imports = [ # Include the results of the hardware scan. - ./acme.nix ./hardware-configuration.nix ./home-assistant.nix ./networking.nix @@ -25,7 +23,6 @@ in "speed.home".target = "http://localhost:${speedtest_port}"; "speedtest.thehellings.lan".target = "http://localhost:${speedtest_port}"; "dashy.home".target = "http://localhost:${dashy_port}"; - "uptime.home".target = "http://localhost:${uptime_kuma_port}"; }; }; @@ -36,14 +33,6 @@ in useOSProber = true; }; - #boot.loader = { - # systemd-boot.enable = true; - # efi = { - # canTouchEfiVariables = true; - # efiSysMountPoint = "/boot/efi"; - # }; - #}; - environment.systemPackages = with pkgs; [ awscli2 create_ssl @@ -139,12 +128,6 @@ in ]; }; }; - uptime-kuma = { - enable = true; - settings = { - PORT = uptime_kuma_port; - }; - }; }; virtualisation.oci-containers.containers = { From a2c939d12e8af14d6e21af32388f5d43182b617e Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Wed, 21 May 2025 23:14:13 -0500 Subject: [PATCH 06/18] Fix jude gitlab-runner variables --- hosts/jude/virt.nix | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/hosts/jude/virt.nix b/hosts/jude/virt.nix index 23a993a..c04871d 100644 --- a/hosts/jude/virt.nix +++ b/hosts/jude/virt.nix @@ -6,6 +6,10 @@ }: let + environmentVariables = { + EFI_DIR = "${pkgs.OVMF.fd}/FV/"; + STORAGE_URL = "s3.thehellings.lan:9000"; + }; passthru = [ "1002:164e" # Raphael - embedded GPU "1002:1640" # Rembrandt - Audio @@ -33,10 +37,8 @@ in services.gitlab-runner.services = lib.mkForce { vbox = { + inherit environmentVariables; authenticationTokenConfigFile = config.age.secrets.vbox.path; - environmentVariables = { - EFI_DIR = "${pkgs.OVMF.fd}/FV/"; - }; executor = "shell"; limit = 5; }; @@ -87,12 +89,10 @@ in enable = true; settings.concurrent = 5; services.qemu = { + inherit environmentVariables; executor = "shell"; limit = 5; authenticationTokenConfigFile = config.age.secrets.qemu.path; - environmentVariables = { - EFI_DIR = "${pkgs.OVMF.fd}/FV/"; - }; }; }; From 8e0dbacf14772be0e7950f644609f29ac21d9103 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 22 May 2025 00:26:37 -0500 Subject: [PATCH 07/18] Add Jude binding IP --- hosts/jude/default.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/hosts/jude/default.nix b/hosts/jude/default.nix index be28498..7e4033c 100644 --- a/hosts/jude/default.nix +++ b/hosts/jude/default.nix @@ -118,7 +118,10 @@ # Let's do a sound thing services = { - k3s.extraFlags = [ "--tls-san 10.42.0.6" ]; + k3s.extraFlags = [ + "--tls-san 10.42.0.6" + "--bind-address 10.42.0.6" + ]; pipewire = { enable = true; alsa.enable = true; From 812b10e3f6170cdfdda33f03ccdb8bd763d04ab7 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 22 May 2025 00:27:14 -0500 Subject: [PATCH 08/18] Adding kubernetes packages to module --- modules/nixos/kubernetes.nix | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/modules/nixos/kubernetes.nix b/modules/nixos/kubernetes.nix index aed37e4..966a510 100644 --- a/modules/nixos/kubernetes.nix +++ b/modules/nixos/kubernetes.nix @@ -1,4 +1,9 @@ -{ config, lib, ... }: +{ + config, + lib, + pkgs, + ... +}: let cfg = config.greg.kubernetes; in @@ -17,6 +22,12 @@ in config = lib.mkIf cfg.enable { age.secrets.kubernetesToken.file = ../../secrets/kubernetes/kubernetesToken.age; + environment.systemPackages = [ + pkgs.kubernetes-helm + pkgs.kustomize + pkgs.k9s + ]; + networking.firewall = { allowedTCPPorts = [ From 7a60c58a74d06966c16629dc99e6a378eef3a09f Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Thu, 22 May 2025 23:21:40 -0500 Subject: [PATCH 09/18] Set Jude a static IP address Give both Jude interfaces their own IP addresses and use those to set the TLS name better Fixes #9 --- hosts/genesis/net/hosts | 2 ++ hosts/genesis/networking/dhcp.nix | 8 +++++++ hosts/jude/default.nix | 39 +++++++++++++++++++++++++++---- 3 files changed, 44 insertions(+), 5 deletions(-) diff --git a/hosts/genesis/net/hosts b/hosts/genesis/net/hosts index 4a76ff9..168dc70 100644 --- a/hosts/genesis/net/hosts +++ b/hosts/genesis/net/hosts @@ -13,6 +13,8 @@ 10.42.1.7 hosea hosea.thehellings.lan 10.42.1.8 jeremiah jeremiah.thehellings.lan minio-02.thehellings.lan 10.42.1.9 ivr ivr.thehellings.lan +10.42.1.10 jude jude.thehellings.lan +10.42.1.11 jude1 jude1.thehellings.lan 10.42.1.12 tv # VMs diff --git a/hosts/genesis/networking/dhcp.nix b/hosts/genesis/networking/dhcp.nix index fd03935..630f4ec 100644 --- a/hosts/genesis/networking/dhcp.nix +++ b/hosts/genesis/networking/dhcp.nix @@ -101,6 +101,14 @@ hw-address = "c8:5e:a9:54:9e:c6"; # IVR laptop Wi-Fi ip-address = "10.42.1.9"; } + { + hw-address = "c8:4b:d6:ca:20:8f"; + ip-address = "10.42.1.10"; # Jude - but maybe through the monitor? + } + { + hw-address = "04:7c:16:d5:60:6f"; + ip-address = "10.42.1.11"; # Jude - but straight in the motherboard + } ######################################## # VM servers # diff --git a/hosts/jude/default.nix b/hosts/jude/default.nix index 7e4033c..c998b8c 100644 --- a/hosts/jude/default.nix +++ b/hosts/jude/default.nix @@ -93,7 +93,32 @@ hostName = "jude"; networkmanager.enable = lib.mkForce true; enableIPv6 = false; - interfaces.enp12s0.useDHCP = true; + useDHCP = false; + interfaces = { + # This seems to be direct mother board interface + enp12s0.useDHCP = true; + #enp12s0.ipv4.addresses = [ + #{ + #address = "10.42.1.11"; + #prefixLength = 16; + #} + #]; + # This seems to be the one that comes through the monitor hookup + enp14s0u1u2.ipv4.addresses = [ + { + address = "10.42.1.10"; + prefixLength = 16; + } + ]; + }; + defaultGateway = { + address = "10.42.1.1"; + interface = "enp14s0u1u2"; + }; + nameservers = [ + "10.42.1.5" + "10.42.1.1" + ]; firewall = { enable = false; allowedTCPPorts = [ 21000 ]; @@ -118,10 +143,14 @@ # Let's do a sound thing services = { - k3s.extraFlags = [ - "--tls-san 10.42.0.6" - "--bind-address 10.42.0.6" - ]; + k3s.extraFlags = + let + ip = (builtins.head config.networking.interfaces.enp14s0u1u2.ipv4.addresses).address; + in + [ + "--tls-san ${ip}" + "--bind-address ${ip}" + ]; pipewire = { enable = true; alsa.enable = true; From 3110cff93ce519c7280ea45009a3534e2f9e7a7f Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Mon, 26 May 2025 12:18:57 -0500 Subject: [PATCH 10/18] Basic Kubernetes configuration up and running Add postgres operator and cluster Create gitlab database declaratively Update flake YES, YES, I KNOW THE PASSWORDS ARE DUMB AND WORLD READABLE --- .gitignore | 1 + .zed/settings.json | 7 ++ flake.lock | 92 +++++++---------- flake.nix | 2 +- hosts/genesis/net/hosts | 2 +- hosts/jude/default.nix | 2 +- manifests/README.md | 15 +++ manifests/apply.sh | 11 ++ manifests/databases/kustomization.yaml | 6 ++ manifests/databases/postgres-cluster.yaml | 26 +++++ manifests/databases/postgres-gitlab.yaml | 21 ++++ manifests/databases/postgres-pgadmin.yaml | 118 ++++++++++++++++++++++ manifests/kustomization.yaml | 3 + manifests/namespaces/db.yaml | 4 + manifests/namespaces/kustomization.yaml | 2 + manifests/postgres/kustomization.yaml | 13 +++ manifests/remove.sh | 11 ++ modules/nixos/kubernetes.nix | 1 + 18 files changed, 279 insertions(+), 58 deletions(-) create mode 100644 .zed/settings.json create mode 100644 manifests/README.md create mode 100755 manifests/apply.sh create mode 100644 manifests/databases/kustomization.yaml create mode 100644 manifests/databases/postgres-cluster.yaml create mode 100644 manifests/databases/postgres-gitlab.yaml create mode 100644 manifests/databases/postgres-pgadmin.yaml create mode 100644 manifests/kustomization.yaml create mode 100644 manifests/namespaces/db.yaml create mode 100644 manifests/namespaces/kustomization.yaml create mode 100644 manifests/postgres/kustomization.yaml create mode 100755 manifests/remove.sh diff --git a/.gitignore b/.gitignore index 7328b6a..fe79c61 100644 --- a/.gitignore +++ b/.gitignore @@ -5,3 +5,4 @@ result # On home-manager only installs, this is built into the same dir # where I am storing my repo nix.conf +manifests/postgres/charts diff --git a/.zed/settings.json b/.zed/settings.json new file mode 100644 index 0000000..cb8b973 --- /dev/null +++ b/.zed/settings.json @@ -0,0 +1,7 @@ +{ + "languages": { + "YAML": { + "tab_size": 2 + } + } +} diff --git a/flake.lock b/flake.lock index 04d5890..3ebcb74 100644 --- a/flake.lock +++ b/flake.lock @@ -93,11 +93,11 @@ ] }, "locked": { - "lastModified": 1747521943, - "narHash": "sha256-GMAJcB8oB9cC+TbYTE7QDfw9fwHZyloxUWnUpHnQRko=", + "lastModified": 1747964474, + "narHash": "sha256-i73u8NLiqewGy0iIriH4XizatLnAojXxzrBqHJEz49E=", "owner": "lnl7", "repo": "nix-darwin", - "rev": "b9b927dd1f24094b271e8ec5277a672dc4fc860d", + "rev": "93562b65cf68612a544779c9f77536f9dff01096", "type": "github" }, "original": { @@ -165,22 +165,6 @@ } }, "flake-compat_3": { - "flake": false, - "locked": { - "lastModified": 1696426674, - "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", - "owner": "edolstra", - "repo": "flake-compat", - "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33", - "type": "github" - }, - "original": { - "owner": "edolstra", - "repo": "flake-compat", - "type": "github" - } - }, - "flake-compat_4": { "flake": false, "locked": { "lastModified": 1733328505, @@ -315,11 +299,11 @@ "systems": "systems_6" }, "locked": { - "lastModified": 1710146030, - "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", + "lastModified": 1731533236, + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", "owner": "numtide", "repo": "flake-utils", - "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", "type": "github" }, "original": { @@ -356,11 +340,11 @@ ] }, "locked": { - "lastModified": 1747688838, - "narHash": "sha256-FZq4/3OtGV/cti9Vccsy2tGSUrxTO4hkDF9oeGRTen4=", + "lastModified": 1747955385, + "narHash": "sha256-AKoBFaEGN02tGvBlkwVIDOGXouHvrTTfOUcvBDGxkxQ=", "owner": "nix-community", "repo": "home-manager", - "rev": "45c2985644b60ab64de2a2d93a4d132ecb87cf66", + "rev": "a868570581f0dbdef7e33c8c9bb34b735dfcbacf", "type": "github" }, "original": { @@ -441,11 +425,11 @@ }, "nix-hardware": { "locked": { - "lastModified": 1747684167, - "narHash": "sha256-l6jbonaboCBlB8lCjBkrqgh2zEnvt6F3f4dOU/8CLd4=", + "lastModified": 1747900541, + "narHash": "sha256-dn64Pg9xLETjblwZs9Euu/SsjW80pd6lr5qSiyLY1pg=", "owner": "nixos", "repo": "nixos-hardware", - "rev": "e8f38b2c19c0647e39021c3d47172ff5469af8a9", + "rev": "11f2d9ea49c3e964315215d6baa73a8d42672f06", "type": "github" }, "original": { @@ -600,11 +584,11 @@ }, "nixpkgs_3": { "locked": { - "lastModified": 1747467164, - "narHash": "sha256-JBXbjJ0t6T6BbVc9iPVquQI9XSXCGQJD8c8SgnUquus=", + "lastModified": 1747885982, + "narHash": "sha256-rSuxACdwx5Ndr2thpjqcG89fj8mSSp96CFoCt0yrdkY=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "3fcbdcfc707e0aa42c541b7743e05820472bdaec", + "rev": "a16efe5d2fc7455d7328a01f4692bfec152965b3", "type": "github" }, "original": { @@ -616,11 +600,11 @@ }, "nixpkgs_4": { "locked": { - "lastModified": 1747542820, - "narHash": "sha256-GaOZntlJ6gPPbbkTLjbd8BMWaDYafhuuYRNrxCGnPJw=", + "lastModified": 1747744144, + "narHash": "sha256-W7lqHp0qZiENCDwUZ5EX/lNhxjMdNapFnbErcbnP11Q=", "owner": "nixos", "repo": "nixpkgs", - "rev": "292fa7d4f6519c074f0a50394dbbe69859bb6043", + "rev": "2795c506fe8fb7b03c36ccb51f75b6df0ab2553f", "type": "github" }, "original": { @@ -648,27 +632,27 @@ }, "nixpkgs_6": { "locked": { - "lastModified": 1713805509, - "narHash": "sha256-YgSEan4CcrjivCNO5ZNzhg7/8ViLkZ4CB/GrGBVSudo=", + "lastModified": 1744868846, + "narHash": "sha256-5RJTdUHDmj12Qsv7XOhuospjAjATNiTMElplWnJE9Hs=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "1e1dc66fe68972a76679644a5577828b6a7e8be4", + "rev": "ebe4301cbd8f81c4f8d3244b3632338bbeb6d49c", "type": "github" }, "original": { "owner": "NixOS", - "ref": "nixpkgs-unstable", "repo": "nixpkgs", + "rev": "ebe4301cbd8f81c4f8d3244b3632338bbeb6d49c", "type": "github" } }, "nixunstable": { "locked": { - "lastModified": 1747542820, - "narHash": "sha256-GaOZntlJ6gPPbbkTLjbd8BMWaDYafhuuYRNrxCGnPJw=", + "lastModified": 1747744144, + "narHash": "sha256-W7lqHp0qZiENCDwUZ5EX/lNhxjMdNapFnbErcbnP11Q=", "owner": "nixos", "repo": "nixpkgs", - "rev": "292fa7d4f6519c074f0a50394dbbe69859bb6043", + "rev": "2795c506fe8fb7b03c36ccb51f75b6df0ab2553f", "type": "github" }, "original": { @@ -686,11 +670,11 @@ "systems": "systems_4" }, "locked": { - "lastModified": 1747683610, - "narHash": "sha256-Jis9/4lnr3pn1AIRgCnoeiReKs2MGy6COWc6JtAEESo=", + "lastModified": 1747945641, + "narHash": "sha256-Ts16c+kptbC3YDwPcB/NqXFVMHPNYKeFD7LkiawbWCU=", "owner": "nix-community", "repo": "nixvim", - "rev": "14c7f5f8968940d1730b5e935dd1d9f3e461a2d3", + "rev": "46fd0b184cbc5f1bdc5a8325cb973fc54e49ab68", "type": "github" }, "original": { @@ -707,11 +691,11 @@ "treefmt-nix": "treefmt-nix" }, "locked": { - "lastModified": 1747683907, - "narHash": "sha256-dgEK4d1QPNFhv0s5s9lpvEWOVBlRZENp7TVh8V8qYDU=", + "lastModified": 1747973449, + "narHash": "sha256-e+DaBDI6xzd7KW+1u3jHhEzdF2Ajx5hP0bF2CFiS/F8=", "owner": "nix-community", "repo": "NUR", - "rev": "64046fedb710701f87e5e86390b4dbe77f1d733b", + "rev": "e4fcae418dde38789f3f59ea07ad289a4b9bcffe", "type": "github" }, "original": { @@ -931,28 +915,26 @@ }, "vsext": { "inputs": { - "flake-compat": "flake-compat_3", "flake-utils": "flake-utils_3", "nixpkgs": "nixpkgs_6" }, "locked": { - "lastModified": 1739984805, - "narHash": "sha256-cX3UzBy65e2CafN6a6WJr3aXQm4gvYD+Ym1epuY600k=", - "owner": "greg-hellings", + "lastModified": 1747965670, + "narHash": "sha256-O91kjsTL7xccgTQr2KITmGhhLTpX9zh+oRvvV8ScOrg=", + "owner": "nix-community", "repo": "nix-vscode-extensions", - "rev": "f5671be9dec0adee120e30436d6450abea4ced42", + "rev": "d3099346fa5e9e33d0989a4e6afc3e8dedd25311", "type": "github" }, "original": { - "owner": "greg-hellings", - "ref": "fix-json", + "owner": "nix-community", "repo": "nix-vscode-extensions", "type": "github" } }, "wsl": { "inputs": { - "flake-compat": "flake-compat_4", + "flake-compat": "flake-compat_3", "nixpkgs": [ "nixunstable" ] diff --git a/flake.nix b/flake.nix index 77224d7..f45d57e 100644 --- a/flake.nix +++ b/flake.nix @@ -42,7 +42,7 @@ nixvimunstable.url = "github:nix-community/nixvim/main"; nixunstable.url = "github:nixos/nixpkgs/nixos-unstable"; nurpkgs.url = "github:nix-community/NUR"; - vsext.url = "github:greg-hellings/nix-vscode-extensions/fix-json"; + vsext.url = "github:nix-community/nix-vscode-extensions"; wsl = { url = "github:nix-community/NixOS-WSL"; inputs.nixpkgs.follows = "nixunstable"; diff --git a/hosts/genesis/net/hosts b/hosts/genesis/net/hosts index 168dc70..e37869f 100644 --- a/hosts/genesis/net/hosts +++ b/hosts/genesis/net/hosts @@ -9,7 +9,7 @@ 10.42.1.3 printer.thehellings.lan 10.42.1.4 chronicles chronicles.thehellings.lan nas.thehellings.lan s3.thehellings.lan 10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan speedtest.thehellings.lan nixcache.thehellings.lan gitcache.thehellings.lan -10.42.1.6 isaiah isaiah.thehellings.lan minio-01.thehellings.lan +10.42.1.6 isaiah isaiah.thehellings.lan minio-01.thehellings.lan pgadmin.thehellings.lan 10.42.1.7 hosea hosea.thehellings.lan 10.42.1.8 jeremiah jeremiah.thehellings.lan minio-02.thehellings.lan 10.42.1.9 ivr ivr.thehellings.lan diff --git a/hosts/jude/default.nix b/hosts/jude/default.nix index c998b8c..35b6dd0 100644 --- a/hosts/jude/default.nix +++ b/hosts/jude/default.nix @@ -149,7 +149,7 @@ in [ "--tls-san ${ip}" - "--bind-address ${ip}" + #"--bind-address ${ip}" ]; pipewire = { enable = true; diff --git a/manifests/README.md b/manifests/README.md new file mode 100644 index 0000000..4f086a2 --- /dev/null +++ b/manifests/README.md @@ -0,0 +1,15 @@ +Stands up my personal infrastructure in a Kubernetes environment. + +To apply this you need to install kubectl, kustomize, and helm. It can then by applied +by simply invoking the command: + +```bash +# Working directory is assumed to be the manifests directory +./apply.sh +``` + +Once the basic cluster stuff is setup, you can just apply this directory with + +```bash +kubectl apply -k . +``` diff --git a/manifests/apply.sh b/manifests/apply.sh new file mode 100755 index 0000000..546b1e9 --- /dev/null +++ b/manifests/apply.sh @@ -0,0 +1,11 @@ +#!/usr/bin/env bash + +# Get the directory where the script is located +SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )" + +# Change to the script directory +cd "$SCRIPT_DIR" + +kubectl apply -k namespaces +kustomize build postgres --enable-helm | kubectl apply -f - --server-side --force-conflicts +kubectl apply -k . diff --git a/manifests/databases/kustomization.yaml b/manifests/databases/kustomization.yaml new file mode 100644 index 0000000..f06faf5 --- /dev/null +++ b/manifests/databases/kustomization.yaml @@ -0,0 +1,6 @@ +namespace: db + +resources: + - postgres-cluster.yaml + - postgres-gitlab.yaml + - postgres-pgadmin.yaml diff --git a/manifests/databases/postgres-cluster.yaml b/manifests/databases/postgres-cluster.yaml new file mode 100644 index 0000000..8ea4898 --- /dev/null +++ b/manifests/databases/postgres-cluster.yaml @@ -0,0 +1,26 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Cluster +metadata: + name: postgres +spec: + instances: 3 + storage: + size: 10Gi + primaryUpdateStrategy: unsupervised + + managed: + roles: + - name: gitlab + ensure: present + comment: Gitlab user + login: true + superuser: false + passwordSecret: + name: postgres-user-gitlab + - name: pgadmin + ensure: present + comment: PG Admin user + login: true + superuser: true + passwordSecret: + name: postgres-user-pgadmin diff --git a/manifests/databases/postgres-gitlab.yaml b/manifests/databases/postgres-gitlab.yaml new file mode 100644 index 0000000..6490dff --- /dev/null +++ b/manifests/databases/postgres-gitlab.yaml @@ -0,0 +1,21 @@ +apiVersion: v1 +kind: Secret +metadata: + name: postgres-user-gitlab + labels: + cnpg.io/reload: "true" +type: kubernetes.io/basic-auth +stringData: + # Currently this is set to "gitlab" + username: gitlab + password: gitlab +--- +apiVersion: postgresql.cnpg.io/v1 +kind: Database +metadata: + name: database-gitlab +spec: + name: gitlab + owner: gitlab + cluster: + name: postgres diff --git a/manifests/databases/postgres-pgadmin.yaml b/manifests/databases/postgres-pgadmin.yaml new file mode 100644 index 0000000..3ba206a --- /dev/null +++ b/manifests/databases/postgres-pgadmin.yaml @@ -0,0 +1,118 @@ +apiVersion: v1 +kind: Secret +metadata: + name: postgres-user-pgadmin + labels: + cnpg.io/reload: "true" +type: kubernetes.io/basic-auth +stringData: + username: pgadmin + password: pgadmin +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-pgadmin +data: + servers.json: | + { + "Servers": { + "1": { + "Name": "Postgres", + "Group": "Servers", + "Port": 5432, + "Username": "pgadmin", + "Host": "postgres-rw", + "SSLMode": "allow", + "MaintenanceDB": "postgres" + } + } + } +--- +apiVersion: v1 +kind: Service +metadata: + name: service-pgadmin +spec: + ports: + - protocol: TCP + port: 80 + targetPort: http + selector: + app: pgadmin + type: ClusterIP +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: pgadmin +spec: + serviceName: service-pgadmin + podManagementPolicy: Parallel + replicas: 1 + updateStrategy: + type: RollingUpdate + selector: + matchLabels: + app: pgadmin + template: + metadata: + labels: + app: pgadmin + spec: + terminationGracePeriodSeconds: 10 + containers: + - name: pgadmin + image: "dpage/pgadmin4:9.3" + imagePullPolicy: Always + env: + - name: PGADMIN_DEFAULT_EMAIL + value: greg@thehellings.com + - name: PGADMIN_DEFAULT_PASSWORD + valueFrom: + secretKeyRef: + name: postgres-user-pgadmin + key: password + - name: PGADMIN_SERVER_JSON_FILE + value: /config-pgadmin-vol/servers.json + ports: + - name: http + containerPort: 80 + protocol: TCP + volumeMounts: + - name: config-pgadmin-vol + mountPath: /config-pgadmin-vol/ + readOnly: true + - name: pgadmin-data + mountPath: /var/lib/pgadmin + volumes: + - name: config-pgadmin-vol + configMap: + name: config-pgadmin + volumeClaimTemplates: + - metadata: + name: pgadmin-data + spec: + accessModes: ["ReadWriteOnce"] + resources: + requests: + storage: 3Gi +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: ingress-pgadmin + annotations: + ingressClassName: traefik +spec: + rules: + - host: pgadmin.thehellings.lan + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: service-pgadmin + port: + number: 80 diff --git a/manifests/kustomization.yaml b/manifests/kustomization.yaml new file mode 100644 index 0000000..cf57688 --- /dev/null +++ b/manifests/kustomization.yaml @@ -0,0 +1,3 @@ +resources: + - namespaces + - databases diff --git a/manifests/namespaces/db.yaml b/manifests/namespaces/db.yaml new file mode 100644 index 0000000..bab604e --- /dev/null +++ b/manifests/namespaces/db.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: db diff --git a/manifests/namespaces/kustomization.yaml b/manifests/namespaces/kustomization.yaml new file mode 100644 index 0000000..46ae31c --- /dev/null +++ b/manifests/namespaces/kustomization.yaml @@ -0,0 +1,2 @@ +resources: + - db.yaml diff --git a/manifests/postgres/kustomization.yaml b/manifests/postgres/kustomization.yaml new file mode 100644 index 0000000..85f7b0d --- /dev/null +++ b/manifests/postgres/kustomization.yaml @@ -0,0 +1,13 @@ +namespace: db + +helmCharts: + # Install the operator first (with CRDs) + - name: cloudnative-pg + repo: "https://cloudnative-pg.github.io/charts/" + version: "0.23.2" + namespace: cnpg-system + releaseName: cnpg + includeCRDs: true + valuesInline: + crds: + create: true diff --git a/manifests/remove.sh b/manifests/remove.sh new file mode 100755 index 0000000..5799558 --- /dev/null +++ b/manifests/remove.sh @@ -0,0 +1,11 @@ +#!/usr/bin/env bash + +# Get the directory where the script is located +SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )" + +# Change to the script directory +cd "$SCRIPT_DIR" + +kubectl delete -k . +kustomize build postgres --enable-helm | kubectl delete -f - +kubectl delete -k namespaces diff --git a/modules/nixos/kubernetes.nix b/modules/nixos/kubernetes.nix index 966a510..a10c08a 100644 --- a/modules/nixos/kubernetes.nix +++ b/modules/nixos/kubernetes.nix @@ -23,6 +23,7 @@ in age.secrets.kubernetesToken.file = ../../secrets/kubernetes/kubernetesToken.age; environment.systemPackages = [ + pkgs.kubectl-cnpg pkgs.kubernetes-helm pkgs.kustomize pkgs.k9s From ce5f60463621cb97f021188dcf3f0fb90051b1ac Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Mon, 26 May 2025 17:10:01 -0500 Subject: [PATCH 11/18] External Secrets setup Setup the external secrets helm charts Convert hard coded secrets to external secrets Add BitWarden CLI for serving external secrets --- .gitignore | 1 + .gitlab-ci.yml | 13 ++++ manifests/README.md | 18 +++++ manifests/apply.sh | 5 ++ manifests/bitwarden/cluster-stores.yaml | 45 +++++++++++ manifests/bitwarden/deployment.yaml | 70 ++++++++++++++++++ manifests/bitwarden/kustomization.yaml | 6 ++ manifests/bitwarden/service.yaml | 18 +++++ manifests/databases/postgres-gitlab.yaml | 12 --- manifests/databases/postgres-pgadmin.yaml | 11 --- manifests/external-secrets/kustomization.yaml | 13 ++++ manifests/kustomization.yaml | 2 + manifests/namespaces/bitwarden.yaml | 4 + manifests/namespaces/external-secrets.yaml | 4 + manifests/namespaces/kustomization.yaml | 2 + manifests/secrets/kustomization.yaml | 3 + manifests/secrets/postgres-user-gitlab.yaml | 33 +++++++++ manifests/secrets/postgres-user-pgadmin.yaml | 33 +++++++++ modules/nixos/kubernetes.nix | 5 +- pkgs/default.nix | 1 + pkgs/img-bitwarden.nix | 44 +++++++++++ secrets/kubernetes/bw_secret.age | Bin 0 -> 2365 bytes secrets/secrets.nix | 1 + 23 files changed, 320 insertions(+), 24 deletions(-) create mode 100644 manifests/bitwarden/cluster-stores.yaml create mode 100644 manifests/bitwarden/deployment.yaml create mode 100644 manifests/bitwarden/kustomization.yaml create mode 100644 manifests/bitwarden/service.yaml create mode 100644 manifests/external-secrets/kustomization.yaml create mode 100644 manifests/namespaces/bitwarden.yaml create mode 100644 manifests/namespaces/external-secrets.yaml create mode 100644 manifests/secrets/kustomization.yaml create mode 100644 manifests/secrets/postgres-user-gitlab.yaml create mode 100644 manifests/secrets/postgres-user-pgadmin.yaml create mode 100644 pkgs/img-bitwarden.nix create mode 100644 secrets/kubernetes/bw_secret.age diff --git a/.gitignore b/.gitignore index fe79c61..12a76b9 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,4 @@ result # where I am storing my repo nix.conf manifests/postgres/charts +manifests/external-secrets/charts diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index a3b6eae..3d9e09b 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -21,3 +21,16 @@ default: job: "Evaluate for builds" variables: PARENT_PIPELINE_ID: $CI_PIPELINE_ID + +"Build image": + stage: build + parallel: + matrix: + - IMG: + - img-bitwarden + script: + - podman login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY" + - nix build ".#${IMG}" + - podman load -i result + - podman tag "localhost/${IMG}:latest" "$CI_REGISTRY/greg/ci-images/${IMG}:latest" + - podman push "$CI_REGISTRY/greg/ci-images/${IMG}:latest" diff --git a/manifests/README.md b/manifests/README.md index 4f086a2..e0aafec 100644 --- a/manifests/README.md +++ b/manifests/README.md @@ -1,5 +1,23 @@ Stands up my personal infrastructure in a Kubernetes environment. +# First Thing First + +In order to properly get things up and going, you will need to create a secret to allow +the external secrets to log into BitWarden Password Manager. For obvious reasont this +cannot be safely added to this repository. As such, it is suggested you create this +manually. + +```bash +kubectl create namespace bitwarden +kubectl create secret generic bitwarden-cli --namespace bitwarden --from-literal=BW_USERNAME=my_username --from-literal=BW_PASSWORD=my_password +# Alternative to the preceding line if you don't want the data in your shell history +kubectl create secret generic bitwarden-cli --namespace bitwarden --from-file=./BW_USERNAME.txt --from-file=./BW_PASSWORD.txt +# And yet an entirely other option, if I'm logged into my own systems +sudo cat /run/agenix/bw_secret | kubectl apply -f - +``` + +# Now Configure Cluster Services + To apply this you need to install kubectl, kustomize, and helm. It can then by applied by simply invoking the command: diff --git a/manifests/apply.sh b/manifests/apply.sh index 546b1e9..1419a56 100755 --- a/manifests/apply.sh +++ b/manifests/apply.sh @@ -7,5 +7,10 @@ SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )" cd "$SCRIPT_DIR" kubectl apply -k namespaces +kustomize build external-secrets --enable-helm | kubectl apply -f - +echo -e "\nPausing for a moment to allow the External Secrets stuff to get going\n" +sleep 5 kustomize build postgres --enable-helm | kubectl apply -f - --server-side --force-conflicts +echo -e "\nPausing for a moment to allow Postgres stuff to get going\n" +sleep 5 kubectl apply -k . diff --git a/manifests/bitwarden/cluster-stores.yaml b/manifests/bitwarden/cluster-stores.yaml new file mode 100644 index 0000000..32e1a93 --- /dev/null +++ b/manifests/bitwarden/cluster-stores.yaml @@ -0,0 +1,45 @@ +--- +apiVersion: external-secrets.io/v1 +kind: ClusterSecretStore +metadata: + name: bitwarden-login +spec: + provider: + webhook: + url: "http://bitwarden-cli.bitwarden.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}" + headers: + Content-Type: application/json + result: + jsonPath: "$.data.login.{{ .remoteRef.property }}" +--- +apiVersion: external-secrets.io/v1 +kind: ClusterSecretStore +metadata: + name: bitwarden-fields +spec: + provider: + webhook: + url: "http://bitwarden-cli.bitwarden.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}" + result: + jsonPath: '$.data.fields[?@.name=="{{ .remoteRef.property }}"].value' +--- +apiVersion: external-secrets.io/v1 +kind: ClusterSecretStore +metadata: + name: bitwarden-notes +spec: + provider: + webhook: + url: "http://bitwarden-cli.bitwarden.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}" + result: + jsonPath: "$.data.notes" +--- +apiVersion: external-secrets.io/v1 +kind: ClusterSecretStore +metadata: + name: bitwarden-attachments +spec: + provider: + webhook: + url: "http://bitwarden-cli.bitwarden.svc.cluster.local:8087/object/attachment/{{ .remoteRef.property }}?itemid={{ .remoteRef.key }}" + result: {} diff --git a/manifests/bitwarden/deployment.yaml b/manifests/bitwarden/deployment.yaml new file mode 100644 index 0000000..5c48996 --- /dev/null +++ b/manifests/bitwarden/deployment.yaml @@ -0,0 +1,70 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: bitwarden-cli + labels: + app.kubernetes.io/instance: bitwarden-cli + app.kubernetes.io/name: bitwarden-cli +spec: + replicas: 1 + strategy: + type: Recreate + selector: + matchLabels: + app.kubernetes.io/name: bitwarden-cli + app.kubernetes.io/instance: bitwarden-cli + template: + metadata: + labels: + app.kubernetes.io/name: bitwarden-cli + app.kubernetes.io/instance: bitwarden-cli + spec: + containers: + - name: bitwarden-cli + image: "registry.thehellings.com/greg/nixos-config/img-bitwarden:latest" + imagePullPolicy: Always + env: + - name: BW_CLIENTID + valueFrom: + secretKeyRef: + name: bitwarden-cli + key: BW_CLIENTID + - name: BW_CLIENTSECRET + valueFrom: + secretKeyRef: + name: bitwarden-cli + key: BW_CLIENTSECRET + - name: BW_PASSWORD + valueFrom: + secretKeyRef: + name: bitwarden-cli + key: BW_PASSWORD + ports: + - name: http + containerPort: 8087 + protocol: TCP + livenessProbe: + exec: + command: + - wget + - -q + - http://127.0.0.1:8087/sync?force=true + - --post-data='' + initialDelaySeconds: 20 + failureThreshold: 3 + timeoutSeconds: 10 + periodSeconds: 120 + readinessProbe: + tcpSocket: + port: 8087 + initialDelaySeconds: 20 + failureThreshold: 3 + timeoutSeconds: 1 + periodSeconds: 10 + startupProbe: + tcpSocket: + port: 8087 + initialDelaySeconds: 10 + failureThreshold: 30 + timeoutSeconds: 1 + periodSeconds: 5 diff --git a/manifests/bitwarden/kustomization.yaml b/manifests/bitwarden/kustomization.yaml new file mode 100644 index 0000000..6154c52 --- /dev/null +++ b/manifests/bitwarden/kustomization.yaml @@ -0,0 +1,6 @@ +namespace: bitwarden + +resources: + - deployment.yaml + - service.yaml + - cluster-stores.yaml diff --git a/manifests/bitwarden/service.yaml b/manifests/bitwarden/service.yaml new file mode 100644 index 0000000..ff3fd87 --- /dev/null +++ b/manifests/bitwarden/service.yaml @@ -0,0 +1,18 @@ +apiVersion: v1 +kind: Service +metadata: + name: bitwarden-cli + labels: + app.kubernetes.io/instance: bitwarden-cli + app.kubernetes.io/name: bitwarden-cli + annotations: +spec: + type: ClusterIP + ports: + - port: 8087 + targetPort: http + protocol: TCP + name: http + selector: + app.kubernetes.io/name: bitwarden-cli + app.kubernetes.io/instance: bitwarden-cli diff --git a/manifests/databases/postgres-gitlab.yaml b/manifests/databases/postgres-gitlab.yaml index 6490dff..f41796f 100644 --- a/manifests/databases/postgres-gitlab.yaml +++ b/manifests/databases/postgres-gitlab.yaml @@ -1,15 +1,3 @@ -apiVersion: v1 -kind: Secret -metadata: - name: postgres-user-gitlab - labels: - cnpg.io/reload: "true" -type: kubernetes.io/basic-auth -stringData: - # Currently this is set to "gitlab" - username: gitlab - password: gitlab ---- apiVersion: postgresql.cnpg.io/v1 kind: Database metadata: diff --git a/manifests/databases/postgres-pgadmin.yaml b/manifests/databases/postgres-pgadmin.yaml index 3ba206a..ab82d78 100644 --- a/manifests/databases/postgres-pgadmin.yaml +++ b/manifests/databases/postgres-pgadmin.yaml @@ -1,15 +1,4 @@ apiVersion: v1 -kind: Secret -metadata: - name: postgres-user-pgadmin - labels: - cnpg.io/reload: "true" -type: kubernetes.io/basic-auth -stringData: - username: pgadmin - password: pgadmin ---- -apiVersion: v1 kind: ConfigMap metadata: name: config-pgadmin diff --git a/manifests/external-secrets/kustomization.yaml b/manifests/external-secrets/kustomization.yaml new file mode 100644 index 0000000..917c23a --- /dev/null +++ b/manifests/external-secrets/kustomization.yaml @@ -0,0 +1,13 @@ +namespace: external-secrets + +helmCharts: + # Install the operator first (with CRDs) + - name: external-secrets + repo: "https://charts.external-secrets.io/" + version: "0.17.0" + namespace: external-secrets + releaseName: external-secrets + includeCRDs: true + valuesInline: + crds: + create: true diff --git a/manifests/kustomization.yaml b/manifests/kustomization.yaml index cf57688..0f54c5c 100644 --- a/manifests/kustomization.yaml +++ b/manifests/kustomization.yaml @@ -1,3 +1,5 @@ resources: - namespaces + - bitwarden + - secrets - databases diff --git a/manifests/namespaces/bitwarden.yaml b/manifests/namespaces/bitwarden.yaml new file mode 100644 index 0000000..04cf575 --- /dev/null +++ b/manifests/namespaces/bitwarden.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: bitwarden diff --git a/manifests/namespaces/external-secrets.yaml b/manifests/namespaces/external-secrets.yaml new file mode 100644 index 0000000..4ef398e --- /dev/null +++ b/manifests/namespaces/external-secrets.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: external-secrets diff --git a/manifests/namespaces/kustomization.yaml b/manifests/namespaces/kustomization.yaml index 46ae31c..4a33a16 100644 --- a/manifests/namespaces/kustomization.yaml +++ b/manifests/namespaces/kustomization.yaml @@ -1,2 +1,4 @@ resources: + - external-secrets.yaml + - bitwarden.yaml - db.yaml diff --git a/manifests/secrets/kustomization.yaml b/manifests/secrets/kustomization.yaml new file mode 100644 index 0000000..84079cc --- /dev/null +++ b/manifests/secrets/kustomization.yaml @@ -0,0 +1,3 @@ +resources: + - postgres-user-gitlab.yaml + - postgres-user-pgadmin.yaml diff --git a/manifests/secrets/postgres-user-gitlab.yaml b/manifests/secrets/postgres-user-gitlab.yaml new file mode 100644 index 0000000..fde4202 --- /dev/null +++ b/manifests/secrets/postgres-user-gitlab.yaml @@ -0,0 +1,33 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: postgres-user-gitlab + namespace: db +spec: + target: + name: postgres-user-gitlab + deletionPolicy: Delete + template: + type: Opaque + data: + username: |- + {{ .username }} + password: |- + {{ .password }} + data: + - secretKey: username + sourceRef: + storeRef: + name: bitwarden-login + kind: ClusterSecretStore + remoteRef: + key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57 + property: username + - secretKey: password + sourceRef: + storeRef: + name: bitwarden-login + kind: ClusterSecretStore + remoteRef: + key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57 + property: password diff --git a/manifests/secrets/postgres-user-pgadmin.yaml b/manifests/secrets/postgres-user-pgadmin.yaml new file mode 100644 index 0000000..0f2500a --- /dev/null +++ b/manifests/secrets/postgres-user-pgadmin.yaml @@ -0,0 +1,33 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: postgres-user-pgadmin + namespace: db +spec: + target: + name: postgres-user-pgadmin + deletionPolicy: Delete + template: + type: Opaque + data: + username: |- + {{ .username }} + password: |- + {{ .password }} + data: + - secretKey: username + sourceRef: + storeRef: + name: bitwarden-login + kind: ClusterSecretStore + remoteRef: + key: f333d637-1667-499d-b9a0-b2e9012bd8b7 + property: username + - secretKey: password + sourceRef: + storeRef: + name: bitwarden-login + kind: ClusterSecretStore + remoteRef: + key: f333d637-1667-499d-b9a0-b2e9012bd8b7 + property: password diff --git a/modules/nixos/kubernetes.nix b/modules/nixos/kubernetes.nix index a10c08a..15ac302 100644 --- a/modules/nixos/kubernetes.nix +++ b/modules/nixos/kubernetes.nix @@ -20,7 +20,10 @@ in }; config = lib.mkIf cfg.enable { - age.secrets.kubernetesToken.file = ../../secrets/kubernetes/kubernetesToken.age; + age.secrets = { + kubernetesToken.file = ../../secrets/kubernetes/kubernetesToken.age; + bw_secret.file = ../../secrets/kubernetes/bw_secret.age; + }; environment.systemPackages = [ pkgs.kubectl-cnpg diff --git a/pkgs/default.nix b/pkgs/default.nix index 2e2bf19..75f2738 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -14,6 +14,7 @@ in hms = c ./hms { }; inject-darwin = c ./inject-darwin.nix { }; inject = c ./inject.nix { }; + img-bitwarden = c ./img-bitwarden.nix { }; qemu-hook = c ./qemu-hook.nix { }; setup-ssh = c ./setup-ssh { }; upgrade-pg-cluster = c ./upgrade-pg-cluster.nix { }; diff --git a/pkgs/img-bitwarden.nix b/pkgs/img-bitwarden.nix new file mode 100644 index 0000000..d57e7d6 --- /dev/null +++ b/pkgs/img-bitwarden.nix @@ -0,0 +1,44 @@ +{ + bitwarden-cli, + cacert, + dockerTools, + lib, + writeShellApplication, + ... +}: +dockerTools.buildLayeredImage { + name = "img-bitwarden"; + tag = "latest"; + contents = [ + dockerTools.binSh + dockerTools.caCertificates + ]; + config = { + Cmd = [ + (lib.getExe (writeShellApplication { + name = "bitwarden-cli-entrypoint.sh"; + runtimeInputs = [ bitwarden-cli ]; + text = '' + set -ex + + # Uncomment if you need to hit a custom host + #bw config server ''${BW_HOST} + + echo "Using apikey to log in" + bw login --apikey --raw + BW_SESSION="$(bw unlock --passwordenv BW_PASSWORD --raw)" + export BW_SESSION + + echo 'Running "bw serve" on port 8087' + bw serve --hostname all --port 8087 + ''; + })) + ]; + Env = [ + "CURL_CA_BUNDLE=${cacert}/etc/ssl/certs/ca-bundle.crt" + ]; + ExposedPorts = { + "8087/tcp" = { }; + }; + }; +} diff --git a/secrets/kubernetes/bw_secret.age b/secrets/kubernetes/bw_secret.age new file mode 100644 index 0000000000000000000000000000000000000000..bfc8982de181d1e81ba93fefdd56bf1441ecca63 GIT binary patch literal 2365 zcmZY9>F?wO8NhKtgK_X!h{3Re8KW4a`O#zAX^Y6(W7_F8op#zzXB3lO({`rQnNIIw zRH7h66Eqv6xWofi6Y(GcP0$w@5iz0(N-)t7)-wbpM0M@&*Ox_ zQIL9vc3;H1^yb|m1S`0AbXz~qqocq_FbpR9L$q|(b$?PybOf6?86)gGwnuV9iqJ|9 z*xa3M9BHnOh8@oNdYEcGMlL``;A@_j=8H)@sR@1+9hMj+Wf9#>MO#?!T!|ZE6m?wN zwWF<3_vN5P46k7f%K;|qEQ4DyBxXWBEO8}+lr+(FeG;3}JP~?T=}x>Q9V-=WEZba~ zyQ&M1`K3t#Vzyk=0s%C<5qN?m9M`t$cDf4tGmH+fcxG+zd8rwChpHDi%~~2Q0945YTx&=26m$2~#mv8XY+(BqPEK+Di^}Tw92-?$&*Z z#YJYe-`SF8$5kq!plV3M7%WL{5<3~X5HoDe<~S89J$R&&MO*;IkS-?mMkMM1m=7|r zBJwV`>x4)a2FM#uBJ7T9&H|xqs_*b(WjZ?K1J1^4QG{9R<8(XO!G5`%gAro&q9G2GIL7Nh5wxUsZffbcyS&MEPbnqD8X6A9NnH1@c>L13b0m4Nf zrSW0!+Zk)m!Zife^+*!R#Fw^+G2>Bf33X`XU%xGO#B(h@A;b9u9Jo>pgL>n zeYsGmN#ip`1NDQd0e4s?E@q$F_0o`F*B!%x_7@>tCG1)Cy`QnjfQ6a4&Yi>^x$eVF= z8(-2!nCTqT`V3Tv;nb!a)picSqT(%%FxLxqho^K>)2q&dbkS;cCGmO$(KT#iwh0)o zN9jQyuOuUgH60%ytTEgus>bZrG_x-l<#-ze&T}d3@7TatlEESHT~|;9m?0%m3Xr8a zM}-zBt&(UDk)GjQYW6b8^!0X^d-*J;^rFfzP{Hak!|=+$z^P70M%*x`#}$7`+av+8 zmg-N38?X`QQ*kDu3u7{9!35B>k-Z7`sXC)_4}zunpaBRD>an^BB(}a#@O(a8Y*qAt z4Z5*u`BXcW^C`Pc+?3$0YCo%wxADFlGFo2;*EA%PiM$A%GL$8Ct%z1fHG?_KSz04{ zgauIZ(P7W;dLGhFmA#5KzMcpL#s$L=E0e)wJv9jmhMW{g@_o$MGTz0{KQq#!rtbZkJqtV3sXlp+XO(y>EL^p1ijE)dON znGFCmg7XTUb?qv@IQ3&+ncH{OO6$|GXHN%`c5yDUXG#-f;MN(F$0-wIgqO5Dw6{G$ znEM;0H+98mXc9XR*&kvy2oz%=llx_;q(MxvOS7UmUQeOIB=h6i#-CQ*#WtHz#$&D0 zI397Kv`T%&v?&GKjxO#)#@h7k6{e!FYx_LMB?>M~r<69rlpJ56RiM*B zqwtt-!NI7wWG8p&*4~HxL>g8ShpDn0Ete2vmTPD^bpUw{>#pOMWYw`~z$zUwM|+7w zlUTOF8VlN%>5f^DChe{b%t(VJtQy|71c%|pliI0^<84eDu~69GVB^D5D;1>cQX8;V zX==OH$ZblO2eC#mQZM3(Mg{c{?UigOv9-AcW>Jj~E0bNe)pnR{2G~kdnGv$G1}=xO z^mKkn8yf5pljY`;lW4%O{Bu_`9t%WWolPKj}X45-5I_gU;CLX3*1~Jhx18Pq8HKYq zHe3|=Yz+kIIFTf?cW?du;?rL~`HN@U)9f4bqOuk1c?{_MA| z0$=*nCts|tyB@Y)x#!NS=k=@Ky+bx$KX?DBTiO#R-l05H6WQIRxcd3|C$D_;b1$Cx z$WKARj(VrBe>pjP{kp08;JfkZca0{Iq`>YQn#HVMpGKU=>hp8fEJ#~!i8f7}b- z{@0H^{M-YQeEFXr@4fu!eZT(DsTZm^x%GR`{p;-AzkS?%%On51@YAli@@#F8o&-{IxCf*NM?|Sv_%l`fJWqCo|4n6^+b{{a^x94`O> literal 0 HcmV?d00001 diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 7c41616..2d8392a 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -104,6 +104,7 @@ in "minio_secret_access_key.age".publicKeys = everyone; "minio_access_key_id.age".publicKeys = everyone; + "kubernetes/bw_secret.age".publicKeys = everyone; "kubernetes/kubernetesToken.age".publicKeys = [ isaiah jeremiah From 26d4e9b77130f36a23bc57f518ca5ef5a47c1a41 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Mon, 26 May 2025 23:37:24 -0500 Subject: [PATCH 12/18] Configure Dendrite on kubernetes Configure a matrix database Configure Dendrite into Kubernetes Update vps configuration to new settings --- home/modules/baseline/xonsh_footer.xsh | 12 +- hosts/genesis/net/hosts | 6 +- hosts/linode/matrix.nix | 12 +- manifests/databases/kustomization.yaml | 1 + manifests/databases/postgres-cluster.yaml | 7 + manifests/databases/postgres-matrix.yaml | 9 + manifests/databases/postgres-pgadmin.yaml | 2 +- manifests/kustomization.yaml | 1 + manifests/matrix/dendrite-config.yaml | 189 ++++++++++++++++++++ manifests/matrix/deployment.yaml | 29 +++ manifests/matrix/ingress.yaml | 21 +++ manifests/matrix/kustomization.yaml | 7 + manifests/matrix/service.yaml | 14 ++ manifests/namespaces/kustomization.yaml | 1 + manifests/namespaces/matrix.yaml | 4 + manifests/secrets/kustomization.yaml | 1 + manifests/secrets/postgres-user-matrix.yaml | 33 ++++ modules/nix-conf.nix | 4 +- modules/nixos/kubernetes.nix | 3 +- secrets/dendrite_key.age | Bin 2219 -> 2323 bytes 20 files changed, 338 insertions(+), 18 deletions(-) create mode 100644 manifests/databases/postgres-matrix.yaml create mode 100644 manifests/matrix/dendrite-config.yaml create mode 100644 manifests/matrix/deployment.yaml create mode 100644 manifests/matrix/ingress.yaml create mode 100644 manifests/matrix/kustomization.yaml create mode 100644 manifests/matrix/service.yaml create mode 100644 manifests/namespaces/matrix.yaml create mode 100644 manifests/secrets/postgres-user-matrix.yaml diff --git a/home/modules/baseline/xonsh_footer.xsh b/home/modules/baseline/xonsh_footer.xsh index 6663435..b6e393d 100644 --- a/home/modules/baseline/xonsh_footer.xsh +++ b/home/modules/baseline/xonsh_footer.xsh @@ -7,14 +7,10 @@ def bw_unlock(): current environment variables. Also returns the code for them.""" if "BW_SESSION" in ${...}: return $BW_SESSION - result = $(bw unlock) - while "BW_SESSION" not in result: - result = $(bw unlock) - lines = result.split("\n") - l = [k for k in lines if 'BW_SESSION="' in k][0] - left, right = l.split("=", 1) - token = right[1:-1] - $BW_SESSION = token + result = !(bw unlock --raw) + while result.returncode != 0: + result = !(bw unlock --raw) + $BW_SESSION = result.output.strip() return token def vpn(con, bwname): diff --git a/hosts/genesis/net/hosts b/hosts/genesis/net/hosts index e37869f..9041681 100644 --- a/hosts/genesis/net/hosts +++ b/hosts/genesis/net/hosts @@ -9,7 +9,7 @@ 10.42.1.3 printer.thehellings.lan 10.42.1.4 chronicles chronicles.thehellings.lan nas.thehellings.lan s3.thehellings.lan 10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan speedtest.thehellings.lan nixcache.thehellings.lan gitcache.thehellings.lan -10.42.1.6 isaiah isaiah.thehellings.lan minio-01.thehellings.lan pgadmin.thehellings.lan +10.42.1.6 isaiah isaiah.thehellings.lan minio-01.thehellings.lan 10.42.1.7 hosea hosea.thehellings.lan 10.42.1.8 jeremiah jeremiah.thehellings.lan minio-02.thehellings.lan 10.42.1.9 ivr ivr.thehellings.lan @@ -32,8 +32,8 @@ 100.88.91.27 genesis.home smart.home zwave.home nixcache.home gitcache.home dashy.home uptime.home speed.home 100.91.131.66 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan git.thehellings.lan 100.68.203.1 hosea.home hosea.shire-zebra.ts.net -100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net -100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net +100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes +100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes 100.90.74.19 jude.home 100.115.57.8 linode.home 100.65.5.38 matrix.home matrix.shire-zebra.ts.net diff --git a/hosts/linode/matrix.nix b/hosts/linode/matrix.nix index 41dc922..d91fde8 100644 --- a/hosts/linode/matrix.nix +++ b/hosts/linode/matrix.nix @@ -14,7 +14,6 @@ in "${domain}" = { enableACME = true; forceSSL = true; - # This is needed so that servers contacting hellings.com can find # the actual application server at matrix.thehellings.com locations."= /.well-known/matrix/server".extraConfig = @@ -51,11 +50,20 @@ in enableACME = true; forceSSL = true; + extraConfig = '' + error_log /var/log/nginx/debug.log debug; + ''; + # Not the appropriate place for the chat client locations = (builtins.listToAttrs ( builtins.map - (val: lib.nameValuePair "/_${val}" { proxyPass = "http://matrix.shire-zebra.ts.net:8448"; }) + ( + val: + lib.nameValuePair "/_${val}" { + proxyPass = "http://matrix.kubernetes"; + } + ) [ "matrix" "synapse" diff --git a/manifests/databases/kustomization.yaml b/manifests/databases/kustomization.yaml index f06faf5..f6f06b6 100644 --- a/manifests/databases/kustomization.yaml +++ b/manifests/databases/kustomization.yaml @@ -4,3 +4,4 @@ resources: - postgres-cluster.yaml - postgres-gitlab.yaml - postgres-pgadmin.yaml + - postgres-matrix.yaml diff --git a/manifests/databases/postgres-cluster.yaml b/manifests/databases/postgres-cluster.yaml index 8ea4898..23c61ca 100644 --- a/manifests/databases/postgres-cluster.yaml +++ b/manifests/databases/postgres-cluster.yaml @@ -24,3 +24,10 @@ spec: superuser: true passwordSecret: name: postgres-user-pgadmin + - name: matrix + ensure: present + comment: Matrix DB user + login: true + superuser: false + passwordSecret: + name: postgres-user-matrix diff --git a/manifests/databases/postgres-matrix.yaml b/manifests/databases/postgres-matrix.yaml new file mode 100644 index 0000000..ac52c97 --- /dev/null +++ b/manifests/databases/postgres-matrix.yaml @@ -0,0 +1,9 @@ +apiVersion: postgresql.cnpg.io/v1 +kind: Database +metadata: + name: database-matrix +spec: + name: matrix + owner: matrix + cluster: + name: postgres diff --git a/manifests/databases/postgres-pgadmin.yaml b/manifests/databases/postgres-pgadmin.yaml index ab82d78..0a4ce1f 100644 --- a/manifests/databases/postgres-pgadmin.yaml +++ b/manifests/databases/postgres-pgadmin.yaml @@ -95,7 +95,7 @@ metadata: ingressClassName: traefik spec: rules: - - host: pgadmin.thehellings.lan + - host: pgadmin.kubernetes http: paths: - path: / diff --git a/manifests/kustomization.yaml b/manifests/kustomization.yaml index 0f54c5c..ad3955c 100644 --- a/manifests/kustomization.yaml +++ b/manifests/kustomization.yaml @@ -3,3 +3,4 @@ resources: - bitwarden - secrets - databases + - matrix diff --git a/manifests/matrix/dendrite-config.yaml b/manifests/matrix/dendrite-config.yaml new file mode 100644 index 0000000..50d3b49 --- /dev/null +++ b/manifests/matrix/dendrite-config.yaml @@ -0,0 +1,189 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: dendrite-config +spec: + data: + - &secret + secretKey: username + sourceRef: + storeRef: + name: bitwarden-login + kind: ClusterSecretStore + remoteRef: &remoteRef + key: 36d1046b-727e-4e09-a391-b2e90171d3d0 + property: username + - <<: *secret + secretKey: password + remoteRef: + <<: *remoteRef + property: password + - secretKey: matrix_pem + sourceRef: + storeRef: + name: bitwarden-notes + kind: ClusterSecretStore + remoteRef: + key: 6de3500c-7c6e-4419-b4f5-b2ea0018ff28 + target: + name: dendrite-config + deletionPolicy: Delete + template: + engineVersion: v2 + data: + matrix.pem: "{{ .matrix_pem }}" + dendrite.yaml: | + version: 2 + global: + server_name: thehellings.com + key_id: ed25519:auto + private_key: /etc/dendrite/matrix.pem + database: + connection_string: "postgres://{{ .username | urlquery }}:{{ .password | urlquery }}@postgres-rw.db.svc.cluster.local/matrix?sslmode=disable" + max_open_conns: 90 + max_idle_conns: 2 + conn_max_lifetime: -1 + well_known_server_name: "http://matrix.thehellings.com" + well_known_client_name: "http://matrix.thehellings.com" + well_known_sliding_sync_proxy: "" + disable_federation: false + presence: + enable_inbound: false + enable_outbound: false + trusted_third_party_id_servers: + - matrix.org + - vector.im + jetstream: + storage_path: /var/dendrite + addresses: [] + topic_prefix: Dendrite + in_memory: false + disable_tls_validation: true + credentials_path: "" + metrics: + enabled: false + basic_auth: + username: metrics + password: metrics + sentry: + enabled: false + dsn: "" + environment: "" + dns_cache: + enabled: false + cache_size: 256 + cache_lifetime: 5m0s + server_notices: + enabled: true + local_part: _server + display_name: Server Alert + avatar_url: "" + room_name: Server Alert + report_stats: + enabled: false + endpoint: https://panopticon.matrix.org/push + cache: + max_size_estimated: 1073741824 + max_age: 1h0m0s + app_service_api: + disable_tls_validation: false + legacy_auth: false + legacy_paths: false + config_files: [] + client_api: + registration_disabled: true + registration_requires_token: false + registration_shared_secret: "" + guests_disabled: false + enable_registration_captcha: false + recaptcha_api_js_url: "" + recaptcha_sitekey_class: "" + recaptcha_form_field: "" + recaptcha_public_key: "" + recaptcha_private_key: "" + recaptcha_bypass_secret: "" + recaptcha_siteverify_api: "" + turn: + turn_user_lifetime: "" + turn_uris: [] + turn_shared_secret: "" + turn_username: "" + turn_password: "" + rate_limiting: + enabled: true + threshold: 5 + cooloff_ms: 500 + exempt_user_ids: [] + federation_api: + send_max_retries: 16 + enable_relays: false + p2p_retries_until_assumed_offline: 1 + disable_tls_validation: false + disable_http_keepalives: false + key_perspectives: + - server_name: matrix.org + keys: + - key_id: ed25519:auto + public_key: Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw + - key_id: ed25519:a_RXGa + public_key: l8Hft5qXKn1vfHrg3p4+W8gELQVo8N13JkluMfmn2sQ + prefer_direct_fetch: false + deny_networks: + - 127.0.0.1/8 + - 10.0.0.0/8 + - 172.16.0.0/12 + - 192.168.0.0/16 + - 100.64.0.0/10 + - 169.254.0.0/16 + - ::1/128 + - fe80::/64 + - fc00::/7 + allow_networks: + - 0.0.0.0/0 + key_server: {} + media_api: + base_path: /var/dendrite/media + max_file_size_bytes: 10485760 + dynamic_thumbnails: false + max_thumbnail_generators: 10 + thumbnail_sizes: + - width: 32 + height: 32 + method: crop + - width: 96 + height: 96 + method: crop + - width: 640 + height: 480 + method: scale + room_server: + default_room_version: "10" + sync_api: + real_ip_header: "" + search: + enabled: false + index_path: /var/dendrite/searchindex + in_memory: false + language: en + user_api: + bcrypt_cost: 10 + openid_token_lifetime_ms: 3600000 + push_gateway_disable_tls_validation: false + auto_join_rooms: [] + worker_count: 8 + relay_api: {} + mscs: + mscs: [] + tracing: + enabled: false + jaeger: + serviceName: "" + disabled: false + rpc_metrics: false + traceid_128bit: false + tags: [] + sampler: null + reporter: null + headers: null + baggage_restrictions: null + throttler: null diff --git a/manifests/matrix/deployment.yaml b/manifests/matrix/deployment.yaml new file mode 100644 index 0000000..f951193 --- /dev/null +++ b/manifests/matrix/deployment.yaml @@ -0,0 +1,29 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: dendrite + labels: + app: dendrite +spec: + replicas: 1 + selector: + matchLabels: + app: dendrite + template: + metadata: + labels: + app: dendrite + spec: + containers: + - name: dendrite + image: ghcr.io/element-hq/dendrite-monolith:latest + ports: + - containerPort: 8008 + name: http + volumeMounts: + - name: config-volume + mountPath: /etc/dendrite + volumes: + - name: config-volume + secret: + secretName: dendrite-config diff --git a/manifests/matrix/ingress.yaml b/manifests/matrix/ingress.yaml new file mode 100644 index 0000000..450bc05 --- /dev/null +++ b/manifests/matrix/ingress.yaml @@ -0,0 +1,21 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: dendrite-ingress + annotations: + ingressClassName: traefik +spec: + rules: + - &host + host: matrix.kubernetes + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: dendrite + port: + number: 8008 + - <<: *host + host: matrix.thehellings.com diff --git a/manifests/matrix/kustomization.yaml b/manifests/matrix/kustomization.yaml new file mode 100644 index 0000000..34b5e68 --- /dev/null +++ b/manifests/matrix/kustomization.yaml @@ -0,0 +1,7 @@ +namespace: matrix + +resources: + - dendrite-config.yaml + - deployment.yaml + - service.yaml + - ingress.yaml diff --git a/manifests/matrix/service.yaml b/manifests/matrix/service.yaml new file mode 100644 index 0000000..94a6076 --- /dev/null +++ b/manifests/matrix/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: dendrite + labels: + app: dendrite +spec: + selector: + app: dendrite + ports: + - port: 8008 + targetPort: http + protocol: TCP + type: ClusterIP diff --git a/manifests/namespaces/kustomization.yaml b/manifests/namespaces/kustomization.yaml index 4a33a16..5631712 100644 --- a/manifests/namespaces/kustomization.yaml +++ b/manifests/namespaces/kustomization.yaml @@ -2,3 +2,4 @@ resources: - external-secrets.yaml - bitwarden.yaml - db.yaml + - matrix.yaml diff --git a/manifests/namespaces/matrix.yaml b/manifests/namespaces/matrix.yaml new file mode 100644 index 0000000..b88de94 --- /dev/null +++ b/manifests/namespaces/matrix.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: matrix diff --git a/manifests/secrets/kustomization.yaml b/manifests/secrets/kustomization.yaml index 84079cc..3ea41b4 100644 --- a/manifests/secrets/kustomization.yaml +++ b/manifests/secrets/kustomization.yaml @@ -1,3 +1,4 @@ resources: - postgres-user-gitlab.yaml - postgres-user-pgadmin.yaml + - postgres-user-matrix.yaml diff --git a/manifests/secrets/postgres-user-matrix.yaml b/manifests/secrets/postgres-user-matrix.yaml new file mode 100644 index 0000000..dff00b2 --- /dev/null +++ b/manifests/secrets/postgres-user-matrix.yaml @@ -0,0 +1,33 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: postgres-user-matrix + namespace: db +spec: + target: + name: postgres-user-matrix + deletionPolicy: Delete + template: + type: Opaque + data: + username: |- + {{ .username }} + password: |- + {{ .password }} + data: + - secretKey: username + sourceRef: + storeRef: + name: bitwarden-login + kind: ClusterSecretStore + remoteRef: + key: 36d1046b-727e-4e09-a391-b2e90171d3d0 + property: username + - secretKey: password + sourceRef: + storeRef: + name: bitwarden-login + kind: ClusterSecretStore + remoteRef: + key: 36d1046b-727e-4e09-a391-b2e90171d3d0 + property: password diff --git a/modules/nix-conf.nix b/modules/nix-conf.nix index c94c061..4086fbb 100644 --- a/modules/nix-conf.nix +++ b/modules/nix-conf.nix @@ -30,7 +30,6 @@ ]; # For home and for work machines substituters = (lib.optionals cache [ - "http://nas.thehellings.lan:9000/binary-cache/" "http://nas.home:9000/binary-cache/" ]) ++ [ @@ -41,8 +40,7 @@ "https://cache.nixos.org" ]; trusted-public-keys = [ - "nix.thehellings.lan:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8=" - "nix.home:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8=" + "nas.home:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8=" "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc=" "nixpkgs-python.cachix.org-1:hxjI7pFxTyuTHn2NkvWCrAUcNZLNS3ZAvfYNuYifcEU=" "greg-hellings.cachix.org-1:y01Jl/L5evlhxdnUW6n56AiI1k8g1wxWhTxJCe7XSco=" diff --git a/modules/nixos/kubernetes.nix b/modules/nixos/kubernetes.nix index 15ac302..23e14ad 100644 --- a/modules/nixos/kubernetes.nix +++ b/modules/nixos/kubernetes.nix @@ -21,8 +21,9 @@ in config = lib.mkIf cfg.enable { age.secrets = { - kubernetesToken.file = ../../secrets/kubernetes/kubernetesToken.age; bw_secret.file = ../../secrets/kubernetes/bw_secret.age; + dendrite_key.file = ../../secrets/dendrite_key.age; + kubernetesToken.file = ../../secrets/kubernetes/kubernetesToken.age; }; environment.systemPackages = [ diff --git a/secrets/dendrite_key.age b/secrets/dendrite_key.age index ede84b9d41dac35c87559c7d1d48c0e37aa581b6..b1088ffb56de4fec564f45cf6fc09ff31e3e09f4 100644 GIT binary patch literal 2323 zcmZXU+3Vy60mnVoibE|e^+~oe1zR7&ubE^fGZ|deB$G@glVoyCCdqg}?o94GlX(y- zQdrhjx~)QGm$v%gLm!H(;I2@rP%9LvU>6sDtW~5-TLr6l^r3WhpMSr<;KTPcJm<(s ztfI@RU79?S79Q9@y`wMn%hEq`Y#2eHX@5MbjiBupA-9`vRfn|Y$#ld(D!H%*?cApW zlIlpv*SOBb3MNnjvZtA4ik93?fy*v3%|kiMp=~l^gw4zzH1j5?u*lsb7&A{#($bEM z*KOYoP=VW;q>6MF=#9zY%HOl*9GofRIVdyxN~&9H(Q<)r^}=|@jXjBjjku2DiBE$y zKN01@6vR`K8@URb1iP_9t?=?BEndZf>-B|cAS`zw#39QA!KBW3%N4o`xVD5!fgR$Y zwI|xcoIqo}hvV4>MeQjv8IFyB$ti1|bVX`W3riZ5%0!?s(;>M~4VHl4T{OaLUszJ9-OD?id3#N#&SLP*0Ww zsq_Gq>41Xp9uu zv@~#)Hbs>gsq3a9h)G7K$WY=72^a-F+2i$U;5W;FjPo!MluXb(L>L0RKjuM{+7d=# z1cA+p;_8$(O!QsI>+?!hV>`z4A~(+PP$arWz;{s1?pbLlwHYq9)q#qv1?KfMnaQ@( zqF$9I0(!OoHGO(QMl z6*S@Lt#BA-8ADi-fQ}d7!B2Z|&Udz_2zIg9#kQ7pYkL7&hPNAgn_cUz2#h!DF|+rY zQ#4dbR7C9CW{mn{BgrZ;inRu|=ZhK?K+_7wj7izSP}PV{tI7^h_WT6hRZxM*YrGg5 zyuQptvu;%?W{8cMj5A4>9e|t7T;tT<2B2Cly?$o^IIvyrYi|RLAYF23t2#_vkDQUE zfES!=w-Qn$2}BQiYP{U*;DB5;^0F8u`bDQ-Dv5y91jm*|=l|_}Rpmnr|(VCaF2nf4%w&FmJ zWm8yKH=D9&m}#-L7@Wk6we3g3U`bW7oG;9lT!oT4M#sA`zuUl^c*@CYMT4~1F9p4u zdo2ycFqJgwd|4J9PC1NeS_Q}$ka!%P)JA28#ufWS>+w#zgoMT!qLoYuTx1q7OQ4mMOnfb)V69qMY~bQt zZ)oR3C$;d@UoByGiH0<)4kC+Yj6!Z&C&8(G!!d%J&QIkQ+Cp=<*X=|XN2YvOijq~W*3^Ly7X<)eQ^O)D zO`8%xcgo2$iM7n@iz}*vOrF=!!vLH{ie33MvQS5)0_stR!Gm5Ick4ZQwj*>>1;xDGrE7zm`x2wM}( zm~HGJ_SzTc4LjNIXM%2bkyIE0>a3b8bT;r3|`PPK~Vrr;XF-XbxF(1 zk#=Y0;Lx|x9(4a14OpEkU;O%e4-C!GPp;kj;F5J#Sa{GnP=a-M4A3XEg zcW>VR_xRH zQ{MGoJb2;Jvy0nz|NP-+a^>oU&;5q`$9eOiHzt31{>+Uxdas;&>g*Gje)Z#D|5m#B z_Ftd8Z~yM`y{jGj+-JXY?Q7rq$j7!9FZ|m%_rOcI_svJL+dup8iCfz1FY<3b{_dY{ z{PPd5P`}GBy+ZUmq23Kyqb9@~JAHV#= z8yCO#zWJjkgDXIL&kwGC_>JqI{Nj~Y{~Uh*vEwh?cX!`@>%DuhUzV?46YpwYTYm5~ F_J2v|7{34j literal 2219 zcmZXU$;Zk{y*h`hsdNO=XCVMVolF3Z=J(J~@$)3qFlXWuiA-2|&)PrqL zdeVXliu zW`n{pOBiF3Ie;Z~Gzjxx+X$ecy!tl4uLmosmU&VVCJ*D9fNg;SGk z>wxWDTCLT3nyvfXJ#3wsk4qKlBvL$pxp-#a<2mzrA@JfZp-{0xTz8wT%%R2^D+I@j zPGVZ?g6VDsxXe|=J!g#&5_KlVAGf1*$nMg7u`rMG8uTRu8hRMg0xs!979zuB!`pDQ z$E6*O>Hw{@ReQKbFtlnX!5l~bhKMNN5T;R{4yw-Ztm2~uadGIy*|B5U%;tQ$OACFN z_ULuuKx#KD6+bw~ZL<{|+mDIM+1j-`gpY?@2`Eppnu0uKD?%m;K~4AJG4++JD%fRY z3360;mnnlJwi&z1a6RIbApTw2RUMj^UXSyPi>=IdfXZMZU~ePgY^zmEa|t;gK|Id_ zVjIeOZk<+fNzffjp9N6|Kx)~RJE`QZksFo;zLl3?KQcUm?cDZq&l1|m(@nO{_8cRy z8Ev~f;KdWq98VnMc%pa$PN@_)S90OYh5_dSS~&+PCmT<#u`A(vt#VPfTS~JPJQ}^& ziijEvxrQSy4ROyBhMYsfSf{~)$61C8{6-sRKpxNy7Nr7LppHcGo)?T*PVfPAW#|ra2QEF(m-rAQ5X}bxUVBU)Jm>KBxVj>*UKl8tF7HW~@yG%DHIK8i}IV2=lG- z5Rnrr(tC%k(<0it4hw*n0Wg%+W^!?h=$M#ngDTWK5wbf8CGc}%;M-pFTknM7xxi&( zfA=>CbbBdVA4$p;2g8>PF&w3SDw7g9%Defd?QGh%Jn2w`G=|lFbz0qOTOURbu1mW= zt3zvv0oo=4?#kJ~WN1kN#)gwxyFA@TRDNVh=uS9gCGnL&(e0NS_LON zdz{h>0dBfNRWfen9`h-1Abo@a5Fhr?zydrS9Os3>4u+Zww;fP{o3l0G!rg8ASk72u z-7DgaBD}4Df;TMk%tp(uSt=okor|>>n5vL^s2=ZadS0=*NtIHc2hwplxw0gW8n0na zK;?;VfFhVFqm!vc90vD(8#Er|jdc;hG`>HXmYUF2?%y~bBD_%p)5S?<8AaQ?bVyl( zHHKT!S72k6mUZ(xoxyjAaq)%)PDZpb93nnR0MSNMw}9~J9&LBNO{uZId0{Y6X6s4= z+3x_Jp*Bm5R;p!^HR)XY&^peu9@ka|tv28Vnoau=AZ+b-;OJ}V z(i`bB8QZFv*V zE;E1NB0L$Mzf(o*AOV2mj42Yp%r&~}B$}LIhhAF?v57-V(lskPtL_MCTXI)7sf(aR zGW4;lTqosNk3|`+d~G68(13R%ixgvsY7)XKQ_Bc>PXsxDE~845MN?+Xyn689!J4`x z=Kc)%Q`YWp=0?4==RwyX<>*FXRfc_zJICoz&HlMv74N?B`LBHX3;yvn_oJWriT>u3 z_TQiU?FfG2bI<*#dgpf^`}xE6*Zrs7`0)>3>en*$_<8h+cb(TC|M7+Ap68$Xn)T=( zPyCA?eAt?&Nx(Mu0M^q&s=ul>z0J*|FQ zd+YeipS}3XQ?*0ZuZe$tW&@?~J^kvxxo^DvMdc6jFWyhT_rsSz{Qh5R?H%aNXFvYJ V|ESNt_qSKS55MyJhxlLR{{xI9*xdjC From ee5389baea90609bd941846c23c3e19e15d756c2 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Tue, 27 May 2025 19:16:11 -0500 Subject: [PATCH 13/18] Install Helm as objects Rather than running helm on the client and passing it to kubectl, just install Flux and set the Helm repos on the server side Add resolv.conf to the Kubernetes config so that the hosts can resolve hostnames in order to pull down the Helm repositories Add backups to the database configurations --- manifests/apply.sh | 8 +- manifests/databases/postgres-cluster.yaml | 25 + manifests/external-secrets/kustomization.yaml | 13 - manifests/helm/cloudnative-pg.yaml | 33 + manifests/helm/external-secrets.yaml | 33 + manifests/helm/flux.yaml | 12810 ++++++++++++++++ manifests/helm/kustomization.yaml | 4 + manifests/kustomization.yaml | 1 + manifests/namespaces/external-secrets.yaml | 4 - manifests/namespaces/kustomization.yaml | 1 - manifests/postgres/kustomization.yaml | 13 - manifests/secrets/k3sbackup.yaml | 33 + manifests/secrets/kustomization.yaml | 1 + modules/nixos/kubernetes.nix | 2 + 14 files changed, 12945 insertions(+), 36 deletions(-) delete mode 100644 manifests/external-secrets/kustomization.yaml create mode 100644 manifests/helm/cloudnative-pg.yaml create mode 100644 manifests/helm/external-secrets.yaml create mode 100644 manifests/helm/flux.yaml create mode 100644 manifests/helm/kustomization.yaml delete mode 100644 manifests/namespaces/external-secrets.yaml delete mode 100644 manifests/postgres/kustomization.yaml create mode 100644 manifests/secrets/k3sbackup.yaml diff --git a/manifests/apply.sh b/manifests/apply.sh index 1419a56..f8189eb 100755 --- a/manifests/apply.sh +++ b/manifests/apply.sh @@ -7,10 +7,8 @@ SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )" cd "$SCRIPT_DIR" kubectl apply -k namespaces -kustomize build external-secrets --enable-helm | kubectl apply -f - -echo -e "\nPausing for a moment to allow the External Secrets stuff to get going\n" +kubectl apply -f helm/flux.yaml sleep 5 -kustomize build postgres --enable-helm | kubectl apply -f - --server-side --force-conflicts -echo -e "\nPausing for a moment to allow Postgres stuff to get going\n" +kubectl apply -k helm sleep 5 -kubectl apply -k . +kubectl apply . diff --git a/manifests/databases/postgres-cluster.yaml b/manifests/databases/postgres-cluster.yaml index 23c61ca..74efbf5 100644 --- a/manifests/databases/postgres-cluster.yaml +++ b/manifests/databases/postgres-cluster.yaml @@ -31,3 +31,28 @@ spec: superuser: false passwordSecret: name: postgres-user-matrix + backup: + retentionPolicy: "30d" + barmanObjectStore: + destinationPath: "s3://k3sbackup/postgres" + endpointURL: "http://s3.thehellings.lan:9000/" + s3Credentials: + accessKeyId: + name: k3sbackup + key: username + secretAccessKey: + name: k3sbackup + key: password + wal: + compression: gzip +--- +apiVersion: postgresql.cnpg.io/v1 +kind: ScheduledBackup +metadata: + name: postgres-backup +spec: + immediate: true # Create one when this is added to the cluster + schedule: "0 0 0 * * *" # Midnight, nightly + backupOwnerReference: self + cluster: + name: postgres diff --git a/manifests/external-secrets/kustomization.yaml b/manifests/external-secrets/kustomization.yaml deleted file mode 100644 index 917c23a..0000000 --- a/manifests/external-secrets/kustomization.yaml +++ /dev/null @@ -1,13 +0,0 @@ -namespace: external-secrets - -helmCharts: - # Install the operator first (with CRDs) - - name: external-secrets - repo: "https://charts.external-secrets.io/" - version: "0.17.0" - namespace: external-secrets - releaseName: external-secrets - includeCRDs: true - valuesInline: - crds: - create: true diff --git a/manifests/helm/cloudnative-pg.yaml b/manifests/helm/cloudnative-pg.yaml new file mode 100644 index 0000000..46fe07d --- /dev/null +++ b/manifests/helm/cloudnative-pg.yaml @@ -0,0 +1,33 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: cnpg-system +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: cloudnative-pg + namespace: cnpg-system +spec: + interval: "24h" + url: "https://cloudnative-pg.github.io/charts/" +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: cnpg + namespace: cnpg-system +spec: + interval: 10m + chart: + spec: + chart: cloudnative-pg + version: "0.23.2" + sourceRef: + kind: HelmRepository + name: cloudnative-pg + interval: "1h" + values: + crds: + create: true + includeCRDs: true diff --git a/manifests/helm/external-secrets.yaml b/manifests/helm/external-secrets.yaml new file mode 100644 index 0000000..7287ccf --- /dev/null +++ b/manifests/helm/external-secrets.yaml @@ -0,0 +1,33 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: external-secrets +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: external-secrets + namespace: external-secrets +spec: + interval: "24h" + url: "https://charts.external-secrets.io/" +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: external-secrets + namespace: external-secrets +spec: + interval: 10m + chart: + spec: + chart: external-secrets + version: "0.17.0" + sourceRef: + kind: HelmRepository + name: external-secrets + interval: "1h" + values: + crds: + create: true + includeCRDs: true diff --git a/manifests/helm/flux.yaml b/manifests/helm/flux.yaml new file mode 100644 index 0000000..ceba2d2 --- /dev/null +++ b/manifests/helm/flux.yaml @@ -0,0 +1,12810 @@ +--- +# This manifest was generated by flux. DO NOT EDIT. +# Flux Version: v2.5.1 +# Components: source-controller,kustomize-controller,helm-controller,notification-controller +apiVersion: v1 +kind: Namespace +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + pod-security.kubernetes.io/warn: restricted + pod-security.kubernetes.io/warn-version: latest + name: flux-system +--- +apiVersion: v1 +kind: ResourceQuota +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + name: critical-pods-flux-system + namespace: flux-system +spec: + hard: + pods: "1000" + scopeSelector: + matchExpressions: + - operator: In + scopeName: PriorityClass + values: + - system-node-critical + - system-cluster-critical +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + name: crd-controller-flux-system +rules: + - apiGroups: + - source.toolkit.fluxcd.io + resources: + - "*" + verbs: + - "*" + - apiGroups: + - kustomize.toolkit.fluxcd.io + resources: + - "*" + verbs: + - "*" + - apiGroups: + - helm.toolkit.fluxcd.io + resources: + - "*" + verbs: + - "*" + - apiGroups: + - notification.toolkit.fluxcd.io + resources: + - "*" + verbs: + - "*" + - apiGroups: + - image.toolkit.fluxcd.io + resources: + - "*" + verbs: + - "*" + - apiGroups: + - "" + resources: + - namespaces + - secrets + - configmaps + - serviceaccounts + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - configmaps/status + verbs: + - get + - update + - patch + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - nonResourceURLs: + - /livez/ping + verbs: + - head +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + rbac.authorization.k8s.io/aggregate-to-admin: "true" + rbac.authorization.k8s.io/aggregate-to-edit: "true" + name: flux-edit-flux-system +rules: + - apiGroups: + - notification.toolkit.fluxcd.io + - source.toolkit.fluxcd.io + - helm.toolkit.fluxcd.io + - image.toolkit.fluxcd.io + - kustomize.toolkit.fluxcd.io + resources: + - "*" + verbs: + - create + - delete + - deletecollection + - patch + - update +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + rbac.authorization.k8s.io/aggregate-to-admin: "true" + rbac.authorization.k8s.io/aggregate-to-edit: "true" + rbac.authorization.k8s.io/aggregate-to-view: "true" + name: flux-view-flux-system +rules: + - apiGroups: + - notification.toolkit.fluxcd.io + - source.toolkit.fluxcd.io + - helm.toolkit.fluxcd.io + - image.toolkit.fluxcd.io + - kustomize.toolkit.fluxcd.io + resources: + - "*" + verbs: + - get + - list + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + name: cluster-reconciler-flux-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: + - kind: ServiceAccount + name: kustomize-controller + namespace: flux-system + - kind: ServiceAccount + name: helm-controller + namespace: flux-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + name: crd-controller-flux-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: crd-controller-flux-system +subjects: + - kind: ServiceAccount + name: kustomize-controller + namespace: flux-system + - kind: ServiceAccount + name: helm-controller + namespace: flux-system + - kind: ServiceAccount + name: source-controller + namespace: flux-system + - kind: ServiceAccount + name: notification-controller + namespace: flux-system + - kind: ServiceAccount + name: image-reflector-controller + namespace: flux-system + - kind: ServiceAccount + name: image-automation-controller + namespace: flux-system +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + labels: + app.kubernetes.io/component: source-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + name: buckets.source.toolkit.fluxcd.io +spec: + group: source.toolkit.fluxcd.io + names: + kind: Bucket + listKind: BucketList + plural: buckets + singular: bucket + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.endpoint + name: Endpoint + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1 + schema: + openAPIV3Schema: + description: Bucket is the Schema for the buckets API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + BucketSpec specifies the required configuration to produce an Artifact for + an object storage bucket. + properties: + bucketName: + description: BucketName is the name of the object storage bucket. + type: string + certSecretRef: + description: |- + CertSecretRef can be given the name of a Secret containing + either or both of + + - a PEM-encoded client certificate (`tls.crt`) and private + key (`tls.key`); + - a PEM-encoded CA certificate (`ca.crt`) + + and whichever are supplied, will be used for connecting to the + bucket. The client cert and key are useful if you are + authenticating with a certificate; the CA cert is useful if + you are using a self-signed server certificate. The Secret must + be of type `Opaque` or `kubernetes.io/tls`. + + This field is only supported for the `generic` provider. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + endpoint: + description: + Endpoint is the object storage address the BucketName + is located at. + type: string + ignore: + description: |- + Ignore overrides the set of excluded patterns in the .sourceignore format + (which is the same as .gitignore). If not provided, a default will be used, + consult the documentation for your version to find out what those are. + type: string + insecure: + description: Insecure allows connecting to a non-TLS HTTP Endpoint. + type: boolean + interval: + description: |- + Interval at which the Bucket Endpoint is checked for updates. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + prefix: + description: + Prefix to use for server-side filtering of files in the + Bucket. + type: string + provider: + default: generic + description: |- + Provider of the object storage bucket. + Defaults to 'generic', which expects an S3 (API) compatible object + storage. + enum: + - generic + - aws + - gcp + - azure + type: string + proxySecretRef: + description: |- + ProxySecretRef specifies the Secret containing the proxy configuration + to use while communicating with the Bucket server. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + region: + description: + Region of the Endpoint where the BucketName is located + in. + type: string + secretRef: + description: |- + SecretRef specifies the Secret containing authentication credentials + for the Bucket. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + sts: + description: |- + STS specifies the required configuration to use a Security Token + Service for fetching temporary credentials to authenticate in a + Bucket provider. + + This field is only supported for the `aws` and `generic` providers. + properties: + certSecretRef: + description: |- + CertSecretRef can be given the name of a Secret containing + either or both of + + - a PEM-encoded client certificate (`tls.crt`) and private + key (`tls.key`); + - a PEM-encoded CA certificate (`ca.crt`) + + and whichever are supplied, will be used for connecting to the + STS endpoint. The client cert and key are useful if you are + authenticating with a certificate; the CA cert is useful if + you are using a self-signed server certificate. The Secret must + be of type `Opaque` or `kubernetes.io/tls`. + + This field is only supported for the `ldap` provider. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + endpoint: + description: |- + Endpoint is the HTTP/S endpoint of the Security Token Service from + where temporary credentials will be fetched. + pattern: ^(http|https)://.*$ + type: string + provider: + description: Provider of the Security Token Service. + enum: + - aws + - ldap + type: string + secretRef: + description: |- + SecretRef specifies the Secret containing authentication credentials + for the STS endpoint. This Secret must contain the fields `username` + and `password` and is supported only for the `ldap` provider. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - endpoint + - provider + type: object + suspend: + description: |- + Suspend tells the controller to suspend the reconciliation of this + Bucket. + type: boolean + timeout: + default: 60s + description: Timeout for fetch operations, defaults to 60s. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + required: + - bucketName + - endpoint + - interval + type: object + x-kubernetes-validations: + - message: + STS configuration is only supported for the 'aws' and 'generic' + Bucket providers + rule: self.provider == 'aws' || self.provider == 'generic' || !has(self.sts) + - message: + "'aws' is the only supported STS provider for the 'aws' + Bucket provider" + rule: + self.provider != 'aws' || !has(self.sts) || self.sts.provider + == 'aws' + - message: + "'ldap' is the only supported STS provider for the 'generic' + Bucket provider" + rule: + self.provider != 'generic' || !has(self.sts) || self.sts.provider + == 'ldap' + - message: spec.sts.secretRef is not required for the 'aws' STS provider + rule: "!has(self.sts) || self.sts.provider != 'aws' || !has(self.sts.secretRef)" + - message: spec.sts.certSecretRef is not required for the 'aws' STS provider + rule: "!has(self.sts) || self.sts.provider != 'aws' || !has(self.sts.certSecretRef)" + status: + default: + observedGeneration: -1 + description: BucketStatus records the observed state of a Bucket. + properties: + artifact: + description: Artifact represents the last successful Bucket reconciliation. + properties: + digest: + description: Digest is the digest of the file in the form of ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds upstream information such as OCI annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + conditions: + description: Conditions holds the conditions for the Bucket. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: + ObservedGeneration is the last observed generation of + the Bucket object. + format: int64 + type: integer + observedIgnore: + description: |- + ObservedIgnore is the observed exclusion patterns used for constructing + the source artifact. + type: string + url: + description: |- + URL is the dynamic fetch link for the latest Artifact. + It is provided on a "best effort" basis, and using the precise + BucketStatus.Artifact data is recommended. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.endpoint + name: Endpoint + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + deprecated: true + deprecationWarning: v1beta1 Bucket is deprecated, upgrade to v1 + name: v1beta1 + schema: + openAPIV3Schema: + description: Bucket is the Schema for the buckets API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: + BucketSpec defines the desired state of an S3 compatible + bucket + properties: + accessFrom: + description: + AccessFrom defines an Access Control List for allowing + cross-namespace references to this object. + properties: + namespaceSelectors: + description: |- + NamespaceSelectors is the list of namespace selectors to which this ACL applies. + Items in this list are evaluated using a logical OR operation. + items: + description: |- + NamespaceSelector selects the namespaces to which this ACL applies. + An empty map of MatchLabels matches all namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + bucketName: + description: The bucket name. + type: string + endpoint: + description: The bucket endpoint address. + type: string + ignore: + description: |- + Ignore overrides the set of excluded patterns in the .sourceignore format + (which is the same as .gitignore). If not provided, a default will be used, + consult the documentation for your version to find out what those are. + type: string + insecure: + description: Insecure allows connecting to a non-TLS S3 HTTP endpoint. + type: boolean + interval: + description: The interval at which to check for bucket updates. + type: string + provider: + default: generic + description: The S3 compatible storage provider name, default ('generic'). + enum: + - generic + - aws + - gcp + type: string + region: + description: The bucket region. + type: string + secretRef: + description: |- + The name of the secret containing authentication credentials + for the Bucket. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: + This flag tells the controller to suspend the reconciliation + of this source. + type: boolean + timeout: + default: 60s + description: The timeout for download operations, defaults to 60s. + type: string + required: + - bucketName + - endpoint + - interval + type: object + status: + default: + observedGeneration: -1 + description: BucketStatus defines the observed state of a bucket + properties: + artifact: + description: + Artifact represents the output of the last successful + Bucket sync. + properties: + checksum: + description: Checksum is the SHA256 checksum of the artifact. + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of this + artifact. + format: date-time + type: string + path: + description: Path is the relative file path of this artifact. + type: string + revision: + description: |- + Revision is a human readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm + chart version, etc. + type: string + url: + description: URL is the HTTP address of this artifact. + type: string + required: + - lastUpdateTime + - path + - url + type: object + conditions: + description: Conditions holds the conditions for the Bucket. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + url: + description: + URL is the download link for the artifact output of the + last Bucket sync. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.endpoint + name: Endpoint + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta2 Bucket is deprecated, upgrade to v1 + name: v1beta2 + schema: + openAPIV3Schema: + description: Bucket is the Schema for the buckets API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + BucketSpec specifies the required configuration to produce an Artifact for + an object storage bucket. + properties: + accessFrom: + description: |- + AccessFrom specifies an Access Control List for allowing cross-namespace + references to this object. + NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092 + properties: + namespaceSelectors: + description: |- + NamespaceSelectors is the list of namespace selectors to which this ACL applies. + Items in this list are evaluated using a logical OR operation. + items: + description: |- + NamespaceSelector selects the namespaces to which this ACL applies. + An empty map of MatchLabels matches all namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + bucketName: + description: BucketName is the name of the object storage bucket. + type: string + certSecretRef: + description: |- + CertSecretRef can be given the name of a Secret containing + either or both of + + - a PEM-encoded client certificate (`tls.crt`) and private + key (`tls.key`); + - a PEM-encoded CA certificate (`ca.crt`) + + and whichever are supplied, will be used for connecting to the + bucket. The client cert and key are useful if you are + authenticating with a certificate; the CA cert is useful if + you are using a self-signed server certificate. The Secret must + be of type `Opaque` or `kubernetes.io/tls`. + + This field is only supported for the `generic` provider. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + endpoint: + description: + Endpoint is the object storage address the BucketName + is located at. + type: string + ignore: + description: |- + Ignore overrides the set of excluded patterns in the .sourceignore format + (which is the same as .gitignore). If not provided, a default will be used, + consult the documentation for your version to find out what those are. + type: string + insecure: + description: Insecure allows connecting to a non-TLS HTTP Endpoint. + type: boolean + interval: + description: |- + Interval at which the Bucket Endpoint is checked for updates. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + prefix: + description: + Prefix to use for server-side filtering of files in the + Bucket. + type: string + provider: + default: generic + description: |- + Provider of the object storage bucket. + Defaults to 'generic', which expects an S3 (API) compatible object + storage. + enum: + - generic + - aws + - gcp + - azure + type: string + proxySecretRef: + description: |- + ProxySecretRef specifies the Secret containing the proxy configuration + to use while communicating with the Bucket server. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + region: + description: + Region of the Endpoint where the BucketName is located + in. + type: string + secretRef: + description: |- + SecretRef specifies the Secret containing authentication credentials + for the Bucket. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + sts: + description: |- + STS specifies the required configuration to use a Security Token + Service for fetching temporary credentials to authenticate in a + Bucket provider. + + This field is only supported for the `aws` and `generic` providers. + properties: + certSecretRef: + description: |- + CertSecretRef can be given the name of a Secret containing + either or both of + + - a PEM-encoded client certificate (`tls.crt`) and private + key (`tls.key`); + - a PEM-encoded CA certificate (`ca.crt`) + + and whichever are supplied, will be used for connecting to the + STS endpoint. The client cert and key are useful if you are + authenticating with a certificate; the CA cert is useful if + you are using a self-signed server certificate. The Secret must + be of type `Opaque` or `kubernetes.io/tls`. + + This field is only supported for the `ldap` provider. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + endpoint: + description: |- + Endpoint is the HTTP/S endpoint of the Security Token Service from + where temporary credentials will be fetched. + pattern: ^(http|https)://.*$ + type: string + provider: + description: Provider of the Security Token Service. + enum: + - aws + - ldap + type: string + secretRef: + description: |- + SecretRef specifies the Secret containing authentication credentials + for the STS endpoint. This Secret must contain the fields `username` + and `password` and is supported only for the `ldap` provider. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - endpoint + - provider + type: object + suspend: + description: |- + Suspend tells the controller to suspend the reconciliation of this + Bucket. + type: boolean + timeout: + default: 60s + description: Timeout for fetch operations, defaults to 60s. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + required: + - bucketName + - endpoint + - interval + type: object + x-kubernetes-validations: + - message: + STS configuration is only supported for the 'aws' and 'generic' + Bucket providers + rule: self.provider == 'aws' || self.provider == 'generic' || !has(self.sts) + - message: + "'aws' is the only supported STS provider for the 'aws' + Bucket provider" + rule: + self.provider != 'aws' || !has(self.sts) || self.sts.provider + == 'aws' + - message: + "'ldap' is the only supported STS provider for the 'generic' + Bucket provider" + rule: + self.provider != 'generic' || !has(self.sts) || self.sts.provider + == 'ldap' + - message: spec.sts.secretRef is not required for the 'aws' STS provider + rule: "!has(self.sts) || self.sts.provider != 'aws' || !has(self.sts.secretRef)" + - message: spec.sts.certSecretRef is not required for the 'aws' STS provider + rule: "!has(self.sts) || self.sts.provider != 'aws' || !has(self.sts.certSecretRef)" + status: + default: + observedGeneration: -1 + description: BucketStatus records the observed state of a Bucket. + properties: + artifact: + description: Artifact represents the last successful Bucket reconciliation. + properties: + digest: + description: Digest is the digest of the file in the form of ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds upstream information such as OCI annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + conditions: + description: Conditions holds the conditions for the Bucket. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: + ObservedGeneration is the last observed generation of + the Bucket object. + format: int64 + type: integer + observedIgnore: + description: |- + ObservedIgnore is the observed exclusion patterns used for constructing + the source artifact. + type: string + url: + description: |- + URL is the dynamic fetch link for the latest Artifact. + It is provided on a "best effort" basis, and using the precise + BucketStatus.Artifact data is recommended. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + labels: + app.kubernetes.io/component: source-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + name: gitrepositories.source.toolkit.fluxcd.io +spec: + group: source.toolkit.fluxcd.io + names: + kind: GitRepository + listKind: GitRepositoryList + plural: gitrepositories + shortNames: + - gitrepo + singular: gitrepository + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.url + name: URL + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1 + schema: + openAPIV3Schema: + description: GitRepository is the Schema for the gitrepositories API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + GitRepositorySpec specifies the required configuration to produce an + Artifact for a Git repository. + properties: + ignore: + description: |- + Ignore overrides the set of excluded patterns in the .sourceignore format + (which is the same as .gitignore). If not provided, a default will be used, + consult the documentation for your version to find out what those are. + type: string + include: + description: |- + Include specifies a list of GitRepository resources which Artifacts + should be included in the Artifact produced for this GitRepository. + items: + description: |- + GitRepositoryInclude specifies a local reference to a GitRepository which + Artifact (sub-)contents must be included, and where they should be placed. + properties: + fromPath: + description: |- + FromPath specifies the path to copy contents from, defaults to the root + of the Artifact. + type: string + repository: + description: |- + GitRepositoryRef specifies the GitRepository which Artifact contents + must be included. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + toPath: + description: |- + ToPath specifies the path to copy contents to, defaults to the name of + the GitRepositoryRef. + type: string + required: + - repository + type: object + type: array + interval: + description: |- + Interval at which the GitRepository URL is checked for updates. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + provider: + description: |- + Provider used for authentication, can be 'azure', 'github', 'generic'. + When not specified, defaults to 'generic'. + enum: + - generic + - azure + - github + type: string + proxySecretRef: + description: |- + ProxySecretRef specifies the Secret containing the proxy configuration + to use while communicating with the Git server. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + recurseSubmodules: + description: |- + RecurseSubmodules enables the initialization of all submodules within + the GitRepository as cloned from the URL, using their default settings. + type: boolean + ref: + description: |- + Reference specifies the Git reference to resolve and monitor for + changes, defaults to the 'master' branch. + properties: + branch: + description: + Branch to check out, defaults to 'master' if no other + field is defined. + type: string + commit: + description: |- + Commit SHA to check out, takes precedence over all reference fields. + + This can be combined with Branch to shallow clone the branch, in which + the commit is expected to exist. + type: string + name: + description: |- + Name of the reference to check out; takes precedence over Branch, Tag and SemVer. + + It must be a valid Git reference: https://git-scm.com/docs/git-check-ref-format#_description + Examples: "refs/heads/main", "refs/tags/v0.1.0", "refs/pull/420/head", "refs/merge-requests/1/head" + type: string + semver: + description: + SemVer tag expression to check out, takes precedence + over Tag. + type: string + tag: + description: Tag to check out, takes precedence over Branch. + type: string + type: object + secretRef: + description: |- + SecretRef specifies the Secret containing authentication credentials for + the GitRepository. + For HTTPS repositories the Secret must contain 'username' and 'password' + fields for basic auth or 'bearerToken' field for token auth. + For SSH repositories the Secret must contain 'identity' + and 'known_hosts' fields. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend the reconciliation of this + GitRepository. + type: boolean + timeout: + default: 60s + description: + Timeout for Git operations like cloning, defaults to + 60s. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + url: + description: + URL specifies the Git repository URL, it can be an HTTP/S + or SSH address. + pattern: ^(http|https|ssh)://.*$ + type: string + verify: + description: |- + Verification specifies the configuration to verify the Git commit + signature(s). + properties: + mode: + default: HEAD + description: |- + Mode specifies which Git object(s) should be verified. + + The variants "head" and "HEAD" both imply the same thing, i.e. verify + the commit that the HEAD of the Git repository points to. The variant + "head" solely exists to ensure backwards compatibility. + enum: + - head + - HEAD + - Tag + - TagAndHEAD + type: string + secretRef: + description: |- + SecretRef specifies the Secret containing the public keys of trusted Git + authors. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - secretRef + type: object + required: + - interval + - url + type: object + status: + default: + observedGeneration: -1 + description: GitRepositoryStatus records the observed state of a Git repository. + properties: + artifact: + description: + Artifact represents the last successful GitRepository + reconciliation. + properties: + digest: + description: Digest is the digest of the file in the form of ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds upstream information such as OCI annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + conditions: + description: Conditions holds the conditions for the GitRepository. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + includedArtifacts: + description: |- + IncludedArtifacts contains a list of the last successfully included + Artifacts as instructed by GitRepositorySpec.Include. + items: + description: Artifact represents the output of a Source reconciliation. + properties: + digest: + description: + Digest is the digest of the file in the form of + ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: + Metadata holds upstream information such as OCI + annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: |- + ObservedGeneration is the last observed generation of the GitRepository + object. + format: int64 + type: integer + observedIgnore: + description: |- + ObservedIgnore is the observed exclusion patterns used for constructing + the source artifact. + type: string + observedInclude: + description: |- + ObservedInclude is the observed list of GitRepository resources used to + produce the current Artifact. + items: + description: |- + GitRepositoryInclude specifies a local reference to a GitRepository which + Artifact (sub-)contents must be included, and where they should be placed. + properties: + fromPath: + description: |- + FromPath specifies the path to copy contents from, defaults to the root + of the Artifact. + type: string + repository: + description: |- + GitRepositoryRef specifies the GitRepository which Artifact contents + must be included. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + toPath: + description: |- + ToPath specifies the path to copy contents to, defaults to the name of + the GitRepositoryRef. + type: string + required: + - repository + type: object + type: array + observedRecurseSubmodules: + description: |- + ObservedRecurseSubmodules is the observed resource submodules + configuration used to produce the current Artifact. + type: boolean + sourceVerificationMode: + description: |- + SourceVerificationMode is the last used verification mode indicating + which Git object(s) have been verified. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.url + name: URL + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + deprecated: true + deprecationWarning: v1beta1 GitRepository is deprecated, upgrade to v1 + name: v1beta1 + schema: + openAPIV3Schema: + description: GitRepository is the Schema for the gitrepositories API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: GitRepositorySpec defines the desired state of a Git repository. + properties: + accessFrom: + description: + AccessFrom defines an Access Control List for allowing + cross-namespace references to this object. + properties: + namespaceSelectors: + description: |- + NamespaceSelectors is the list of namespace selectors to which this ACL applies. + Items in this list are evaluated using a logical OR operation. + items: + description: |- + NamespaceSelector selects the namespaces to which this ACL applies. + An empty map of MatchLabels matches all namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + gitImplementation: + default: go-git + description: |- + Determines which git client library to use. + Defaults to go-git, valid values are ('go-git', 'libgit2'). + enum: + - go-git + - libgit2 + type: string + ignore: + description: |- + Ignore overrides the set of excluded patterns in the .sourceignore format + (which is the same as .gitignore). If not provided, a default will be used, + consult the documentation for your version to find out what those are. + type: string + include: + description: Extra git repositories to map into the repository + items: + description: + GitRepositoryInclude defines a source with a from and + to path. + properties: + fromPath: + description: + The path to copy contents from, defaults to the + root directory. + type: string + repository: + description: Reference to a GitRepository to include. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + toPath: + description: + The path to copy contents to, defaults to the name + of the source ref. + type: string + required: + - repository + type: object + type: array + interval: + description: The interval at which to check for repository updates. + type: string + recurseSubmodules: + description: |- + When enabled, after the clone is created, initializes all submodules within, + using their default settings. + This option is available only when using the 'go-git' GitImplementation. + type: boolean + ref: + description: |- + The Git reference to checkout and monitor for changes, defaults to + master branch. + properties: + branch: + description: The Git branch to checkout, defaults to master. + type: string + commit: + description: + The Git commit SHA to checkout, if specified Tag + filters will be ignored. + type: string + semver: + description: + The Git tag semver expression, takes precedence over + Tag. + type: string + tag: + description: The Git tag to checkout, takes precedence over Branch. + type: string + type: object + secretRef: + description: |- + The secret name containing the Git credentials. + For HTTPS repositories the secret must contain username and password + fields. + For SSH repositories the secret must contain identity and known_hosts + fields. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: + This flag tells the controller to suspend the reconciliation + of this source. + type: boolean + timeout: + default: 60s + description: + The timeout for remote Git operations like cloning, defaults + to 60s. + type: string + url: + description: The repository URL, can be a HTTP/S or SSH address. + pattern: ^(http|https|ssh)://.*$ + type: string + verify: + description: + Verify OpenPGP signature for the Git commit HEAD points + to. + properties: + mode: + description: + Mode describes what git object should be verified, + currently ('head'). + enum: + - head + type: string + secretRef: + description: + The secret name containing the public keys of all + trusted Git authors. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - mode + type: object + required: + - interval + - url + type: object + status: + default: + observedGeneration: -1 + description: GitRepositoryStatus defines the observed state of a Git repository. + properties: + artifact: + description: + Artifact represents the output of the last successful + repository sync. + properties: + checksum: + description: Checksum is the SHA256 checksum of the artifact. + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of this + artifact. + format: date-time + type: string + path: + description: Path is the relative file path of this artifact. + type: string + revision: + description: |- + Revision is a human readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm + chart version, etc. + type: string + url: + description: URL is the HTTP address of this artifact. + type: string + required: + - lastUpdateTime + - path + - url + type: object + conditions: + description: Conditions holds the conditions for the GitRepository. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + includedArtifacts: + description: + IncludedArtifacts represents the included artifacts from + the last successful repository sync. + items: + description: Artifact represents the output of a source synchronisation. + properties: + checksum: + description: Checksum is the SHA256 checksum of the artifact. + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of this + artifact. + format: date-time + type: string + path: + description: Path is the relative file path of this artifact. + type: string + revision: + description: |- + Revision is a human readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm + chart version, etc. + type: string + url: + description: URL is the HTTP address of this artifact. + type: string + required: + - lastUpdateTime + - path + - url + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + url: + description: |- + URL is the download link for the artifact output of the last repository + sync. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.url + name: URL + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta2 GitRepository is deprecated, upgrade to v1 + name: v1beta2 + schema: + openAPIV3Schema: + description: GitRepository is the Schema for the gitrepositories API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + GitRepositorySpec specifies the required configuration to produce an + Artifact for a Git repository. + properties: + accessFrom: + description: |- + AccessFrom specifies an Access Control List for allowing cross-namespace + references to this object. + NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092 + properties: + namespaceSelectors: + description: |- + NamespaceSelectors is the list of namespace selectors to which this ACL applies. + Items in this list are evaluated using a logical OR operation. + items: + description: |- + NamespaceSelector selects the namespaces to which this ACL applies. + An empty map of MatchLabels matches all namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + gitImplementation: + default: go-git + description: |- + GitImplementation specifies which Git client library implementation to + use. Defaults to 'go-git', valid values are ('go-git', 'libgit2'). + Deprecated: gitImplementation is deprecated now that 'go-git' is the + only supported implementation. + enum: + - go-git + - libgit2 + type: string + ignore: + description: |- + Ignore overrides the set of excluded patterns in the .sourceignore format + (which is the same as .gitignore). If not provided, a default will be used, + consult the documentation for your version to find out what those are. + type: string + include: + description: |- + Include specifies a list of GitRepository resources which Artifacts + should be included in the Artifact produced for this GitRepository. + items: + description: |- + GitRepositoryInclude specifies a local reference to a GitRepository which + Artifact (sub-)contents must be included, and where they should be placed. + properties: + fromPath: + description: |- + FromPath specifies the path to copy contents from, defaults to the root + of the Artifact. + type: string + repository: + description: |- + GitRepositoryRef specifies the GitRepository which Artifact contents + must be included. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + toPath: + description: |- + ToPath specifies the path to copy contents to, defaults to the name of + the GitRepositoryRef. + type: string + required: + - repository + type: object + type: array + interval: + description: Interval at which to check the GitRepository for updates. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + recurseSubmodules: + description: |- + RecurseSubmodules enables the initialization of all submodules within + the GitRepository as cloned from the URL, using their default settings. + type: boolean + ref: + description: |- + Reference specifies the Git reference to resolve and monitor for + changes, defaults to the 'master' branch. + properties: + branch: + description: + Branch to check out, defaults to 'master' if no other + field is defined. + type: string + commit: + description: |- + Commit SHA to check out, takes precedence over all reference fields. + + This can be combined with Branch to shallow clone the branch, in which + the commit is expected to exist. + type: string + name: + description: |- + Name of the reference to check out; takes precedence over Branch, Tag and SemVer. + + It must be a valid Git reference: https://git-scm.com/docs/git-check-ref-format#_description + Examples: "refs/heads/main", "refs/tags/v0.1.0", "refs/pull/420/head", "refs/merge-requests/1/head" + type: string + semver: + description: + SemVer tag expression to check out, takes precedence + over Tag. + type: string + tag: + description: Tag to check out, takes precedence over Branch. + type: string + type: object + secretRef: + description: |- + SecretRef specifies the Secret containing authentication credentials for + the GitRepository. + For HTTPS repositories the Secret must contain 'username' and 'password' + fields for basic auth or 'bearerToken' field for token auth. + For SSH repositories the Secret must contain 'identity' + and 'known_hosts' fields. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend the reconciliation of this + GitRepository. + type: boolean + timeout: + default: 60s + description: + Timeout for Git operations like cloning, defaults to + 60s. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + url: + description: + URL specifies the Git repository URL, it can be an HTTP/S + or SSH address. + pattern: ^(http|https|ssh)://.*$ + type: string + verify: + description: |- + Verification specifies the configuration to verify the Git commit + signature(s). + properties: + mode: + description: + Mode specifies what Git object should be verified, + currently ('head'). + enum: + - head + type: string + secretRef: + description: |- + SecretRef specifies the Secret containing the public keys of trusted Git + authors. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - mode + - secretRef + type: object + required: + - interval + - url + type: object + status: + default: + observedGeneration: -1 + description: GitRepositoryStatus records the observed state of a Git repository. + properties: + artifact: + description: + Artifact represents the last successful GitRepository + reconciliation. + properties: + digest: + description: Digest is the digest of the file in the form of ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds upstream information such as OCI annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + conditions: + description: Conditions holds the conditions for the GitRepository. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + contentConfigChecksum: + description: |- + ContentConfigChecksum is a checksum of all the configurations related to + the content of the source artifact: + - .spec.ignore + - .spec.recurseSubmodules + - .spec.included and the checksum of the included artifacts + observed in .status.observedGeneration version of the object. This can + be used to determine if the content of the included repository has + changed. + It has the format of `:`, for example: `sha256:`. + + Deprecated: Replaced with explicit fields for observed artifact content + config in the status. + type: string + includedArtifacts: + description: |- + IncludedArtifacts contains a list of the last successfully included + Artifacts as instructed by GitRepositorySpec.Include. + items: + description: Artifact represents the output of a Source reconciliation. + properties: + digest: + description: + Digest is the digest of the file in the form of + ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: + Metadata holds upstream information such as OCI + annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: |- + ObservedGeneration is the last observed generation of the GitRepository + object. + format: int64 + type: integer + observedIgnore: + description: |- + ObservedIgnore is the observed exclusion patterns used for constructing + the source artifact. + type: string + observedInclude: + description: |- + ObservedInclude is the observed list of GitRepository resources used to + to produce the current Artifact. + items: + description: |- + GitRepositoryInclude specifies a local reference to a GitRepository which + Artifact (sub-)contents must be included, and where they should be placed. + properties: + fromPath: + description: |- + FromPath specifies the path to copy contents from, defaults to the root + of the Artifact. + type: string + repository: + description: |- + GitRepositoryRef specifies the GitRepository which Artifact contents + must be included. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + toPath: + description: |- + ToPath specifies the path to copy contents to, defaults to the name of + the GitRepositoryRef. + type: string + required: + - repository + type: object + type: array + observedRecurseSubmodules: + description: |- + ObservedRecurseSubmodules is the observed resource submodules + configuration used to produce the current Artifact. + type: boolean + url: + description: |- + URL is the dynamic fetch link for the latest Artifact. + It is provided on a "best effort" basis, and using the precise + GitRepositoryStatus.Artifact data is recommended. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + labels: + app.kubernetes.io/component: source-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + name: helmcharts.source.toolkit.fluxcd.io +spec: + group: source.toolkit.fluxcd.io + names: + kind: HelmChart + listKind: HelmChartList + plural: helmcharts + shortNames: + - hc + singular: helmchart + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.chart + name: Chart + type: string + - jsonPath: .spec.version + name: Version + type: string + - jsonPath: .spec.sourceRef.kind + name: Source Kind + type: string + - jsonPath: .spec.sourceRef.name + name: Source Name + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1 + schema: + openAPIV3Schema: + description: HelmChart is the Schema for the helmcharts API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: HelmChartSpec specifies the desired state of a Helm chart. + properties: + chart: + description: |- + Chart is the name or path the Helm chart is available at in the + SourceRef. + type: string + ignoreMissingValuesFiles: + description: |- + IgnoreMissingValuesFiles controls whether to silently ignore missing values + files rather than failing. + type: boolean + interval: + description: |- + Interval at which the HelmChart SourceRef is checked for updates. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + reconcileStrategy: + default: ChartVersion + description: |- + ReconcileStrategy determines what enables the creation of a new artifact. + Valid values are ('ChartVersion', 'Revision'). + See the documentation of the values for an explanation on their behavior. + Defaults to ChartVersion when omitted. + enum: + - ChartVersion + - Revision + type: string + sourceRef: + description: + SourceRef is the reference to the Source the chart is + available at. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: |- + Kind of the referent, valid values are ('HelmRepository', 'GitRepository', + 'Bucket'). + enum: + - HelmRepository + - GitRepository + - Bucket + type: string + name: + description: Name of the referent. + type: string + required: + - kind + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend the reconciliation of this + source. + type: boolean + valuesFiles: + description: |- + ValuesFiles is an alternative list of values files to use as the chart + values (values.yaml is not included by default), expected to be a + relative path in the SourceRef. + Values files are merged in the order of this list with the last file + overriding the first. Ignored when omitted. + items: + type: string + type: array + verify: + description: |- + Verify contains the secret name containing the trusted public keys + used to verify the signature and specifies which provider to use to check + whether OCI image is authentic. + This field is only supported when using HelmRepository source with spec.type 'oci'. + Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified. + properties: + matchOIDCIdentity: + description: |- + MatchOIDCIdentity specifies the identity matching criteria to use + while verifying an OCI artifact which was signed using Cosign keyless + signing. The artifact's identity is deemed to be verified if any of the + specified matchers match against the identity. + items: + description: |- + OIDCIdentityMatch specifies options for verifying the certificate identity, + i.e. the issuer and the subject of the certificate. + properties: + issuer: + description: |- + Issuer specifies the regex pattern to match against to verify + the OIDC issuer in the Fulcio certificate. The pattern must be a + valid Go regular expression. + type: string + subject: + description: |- + Subject specifies the regex pattern to match against to verify + the identity subject in the Fulcio certificate. The pattern must + be a valid Go regular expression. + type: string + required: + - issuer + - subject + type: object + type: array + provider: + default: cosign + description: + Provider specifies the technology used to sign the + OCI Artifact. + enum: + - cosign + - notation + type: string + secretRef: + description: |- + SecretRef specifies the Kubernetes Secret containing the + trusted public keys. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - provider + type: object + version: + default: "*" + description: |- + Version is the chart version semver expression, ignored for charts from + GitRepository and Bucket sources. Defaults to latest when omitted. + type: string + required: + - chart + - interval + - sourceRef + type: object + status: + default: + observedGeneration: -1 + description: HelmChartStatus records the observed state of the HelmChart. + properties: + artifact: + description: + Artifact represents the output of the last successful + reconciliation. + properties: + digest: + description: Digest is the digest of the file in the form of ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds upstream information such as OCI annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + conditions: + description: Conditions holds the conditions for the HelmChart. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedChartName: + description: |- + ObservedChartName is the last observed chart name as specified by the + resolved chart reference. + type: string + observedGeneration: + description: |- + ObservedGeneration is the last observed generation of the HelmChart + object. + format: int64 + type: integer + observedSourceArtifactRevision: + description: |- + ObservedSourceArtifactRevision is the last observed Artifact.Revision + of the HelmChartSpec.SourceRef. + type: string + observedValuesFiles: + description: |- + ObservedValuesFiles are the observed value files of the last successful + reconciliation. + It matches the chart in the last successfully reconciled artifact. + items: + type: string + type: array + url: + description: |- + URL is the dynamic fetch link for the latest Artifact. + It is provided on a "best effort" basis, and using the precise + BucketStatus.Artifact data is recommended. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.chart + name: Chart + type: string + - jsonPath: .spec.version + name: Version + type: string + - jsonPath: .spec.sourceRef.kind + name: Source Kind + type: string + - jsonPath: .spec.sourceRef.name + name: Source Name + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + deprecated: true + deprecationWarning: v1beta1 HelmChart is deprecated, upgrade to v1 + name: v1beta1 + schema: + openAPIV3Schema: + description: HelmChart is the Schema for the helmcharts API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: HelmChartSpec defines the desired state of a Helm chart. + properties: + accessFrom: + description: + AccessFrom defines an Access Control List for allowing + cross-namespace references to this object. + properties: + namespaceSelectors: + description: |- + NamespaceSelectors is the list of namespace selectors to which this ACL applies. + Items in this list are evaluated using a logical OR operation. + items: + description: |- + NamespaceSelector selects the namespaces to which this ACL applies. + An empty map of MatchLabels matches all namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + chart: + description: + The name or path the Helm chart is available at in the + SourceRef. + type: string + interval: + description: The interval at which to check the Source for updates. + type: string + reconcileStrategy: + default: ChartVersion + description: |- + Determines what enables the creation of a new artifact. Valid values are + ('ChartVersion', 'Revision'). + See the documentation of the values for an explanation on their behavior. + Defaults to ChartVersion when omitted. + enum: + - ChartVersion + - Revision + type: string + sourceRef: + description: The reference to the Source the chart is available at. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: |- + Kind of the referent, valid values are ('HelmRepository', 'GitRepository', + 'Bucket'). + enum: + - HelmRepository + - GitRepository + - Bucket + type: string + name: + description: Name of the referent. + type: string + required: + - kind + - name + type: object + suspend: + description: + This flag tells the controller to suspend the reconciliation + of this source. + type: boolean + valuesFile: + description: |- + Alternative values file to use as the default chart values, expected to + be a relative path in the SourceRef. Deprecated in favor of ValuesFiles, + for backwards compatibility the file defined here is merged before the + ValuesFiles items. Ignored when omitted. + type: string + valuesFiles: + description: |- + Alternative list of values files to use as the chart values (values.yaml + is not included by default), expected to be a relative path in the SourceRef. + Values files are merged in the order of this list with the last file overriding + the first. Ignored when omitted. + items: + type: string + type: array + version: + default: "*" + description: |- + The chart version semver expression, ignored for charts from GitRepository + and Bucket sources. Defaults to latest when omitted. + type: string + required: + - chart + - interval + - sourceRef + type: object + status: + default: + observedGeneration: -1 + description: HelmChartStatus defines the observed state of the HelmChart. + properties: + artifact: + description: + Artifact represents the output of the last successful + chart sync. + properties: + checksum: + description: Checksum is the SHA256 checksum of the artifact. + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of this + artifact. + format: date-time + type: string + path: + description: Path is the relative file path of this artifact. + type: string + revision: + description: |- + Revision is a human readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm + chart version, etc. + type: string + url: + description: URL is the HTTP address of this artifact. + type: string + required: + - lastUpdateTime + - path + - url + type: object + conditions: + description: Conditions holds the conditions for the HelmChart. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + url: + description: URL is the download link for the last chart pulled. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.chart + name: Chart + type: string + - jsonPath: .spec.version + name: Version + type: string + - jsonPath: .spec.sourceRef.kind + name: Source Kind + type: string + - jsonPath: .spec.sourceRef.name + name: Source Name + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta2 HelmChart is deprecated, upgrade to v1 + name: v1beta2 + schema: + openAPIV3Schema: + description: HelmChart is the Schema for the helmcharts API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: HelmChartSpec specifies the desired state of a Helm chart. + properties: + accessFrom: + description: |- + AccessFrom specifies an Access Control List for allowing cross-namespace + references to this object. + NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092 + properties: + namespaceSelectors: + description: |- + NamespaceSelectors is the list of namespace selectors to which this ACL applies. + Items in this list are evaluated using a logical OR operation. + items: + description: |- + NamespaceSelector selects the namespaces to which this ACL applies. + An empty map of MatchLabels matches all namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + chart: + description: |- + Chart is the name or path the Helm chart is available at in the + SourceRef. + type: string + ignoreMissingValuesFiles: + description: |- + IgnoreMissingValuesFiles controls whether to silently ignore missing values + files rather than failing. + type: boolean + interval: + description: |- + Interval at which the HelmChart SourceRef is checked for updates. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + reconcileStrategy: + default: ChartVersion + description: |- + ReconcileStrategy determines what enables the creation of a new artifact. + Valid values are ('ChartVersion', 'Revision'). + See the documentation of the values for an explanation on their behavior. + Defaults to ChartVersion when omitted. + enum: + - ChartVersion + - Revision + type: string + sourceRef: + description: + SourceRef is the reference to the Source the chart is + available at. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: |- + Kind of the referent, valid values are ('HelmRepository', 'GitRepository', + 'Bucket'). + enum: + - HelmRepository + - GitRepository + - Bucket + type: string + name: + description: Name of the referent. + type: string + required: + - kind + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend the reconciliation of this + source. + type: boolean + valuesFile: + description: |- + ValuesFile is an alternative values file to use as the default chart + values, expected to be a relative path in the SourceRef. Deprecated in + favor of ValuesFiles, for backwards compatibility the file specified here + is merged before the ValuesFiles items. Ignored when omitted. + type: string + valuesFiles: + description: |- + ValuesFiles is an alternative list of values files to use as the chart + values (values.yaml is not included by default), expected to be a + relative path in the SourceRef. + Values files are merged in the order of this list with the last file + overriding the first. Ignored when omitted. + items: + type: string + type: array + verify: + description: |- + Verify contains the secret name containing the trusted public keys + used to verify the signature and specifies which provider to use to check + whether OCI image is authentic. + This field is only supported when using HelmRepository source with spec.type 'oci'. + Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified. + properties: + matchOIDCIdentity: + description: |- + MatchOIDCIdentity specifies the identity matching criteria to use + while verifying an OCI artifact which was signed using Cosign keyless + signing. The artifact's identity is deemed to be verified if any of the + specified matchers match against the identity. + items: + description: |- + OIDCIdentityMatch specifies options for verifying the certificate identity, + i.e. the issuer and the subject of the certificate. + properties: + issuer: + description: |- + Issuer specifies the regex pattern to match against to verify + the OIDC issuer in the Fulcio certificate. The pattern must be a + valid Go regular expression. + type: string + subject: + description: |- + Subject specifies the regex pattern to match against to verify + the identity subject in the Fulcio certificate. The pattern must + be a valid Go regular expression. + type: string + required: + - issuer + - subject + type: object + type: array + provider: + default: cosign + description: + Provider specifies the technology used to sign the + OCI Artifact. + enum: + - cosign + - notation + type: string + secretRef: + description: |- + SecretRef specifies the Kubernetes Secret containing the + trusted public keys. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - provider + type: object + version: + default: "*" + description: |- + Version is the chart version semver expression, ignored for charts from + GitRepository and Bucket sources. Defaults to latest when omitted. + type: string + required: + - chart + - interval + - sourceRef + type: object + status: + default: + observedGeneration: -1 + description: HelmChartStatus records the observed state of the HelmChart. + properties: + artifact: + description: + Artifact represents the output of the last successful + reconciliation. + properties: + digest: + description: Digest is the digest of the file in the form of ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds upstream information such as OCI annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + conditions: + description: Conditions holds the conditions for the HelmChart. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedChartName: + description: |- + ObservedChartName is the last observed chart name as specified by the + resolved chart reference. + type: string + observedGeneration: + description: |- + ObservedGeneration is the last observed generation of the HelmChart + object. + format: int64 + type: integer + observedSourceArtifactRevision: + description: |- + ObservedSourceArtifactRevision is the last observed Artifact.Revision + of the HelmChartSpec.SourceRef. + type: string + observedValuesFiles: + description: |- + ObservedValuesFiles are the observed value files of the last successful + reconciliation. + It matches the chart in the last successfully reconciled artifact. + items: + type: string + type: array + url: + description: |- + URL is the dynamic fetch link for the latest Artifact. + It is provided on a "best effort" basis, and using the precise + BucketStatus.Artifact data is recommended. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + labels: + app.kubernetes.io/component: source-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + name: helmrepositories.source.toolkit.fluxcd.io +spec: + group: source.toolkit.fluxcd.io + names: + kind: HelmRepository + listKind: HelmRepositoryList + plural: helmrepositories + shortNames: + - helmrepo + singular: helmrepository + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.url + name: URL + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1 + schema: + openAPIV3Schema: + description: HelmRepository is the Schema for the helmrepositories API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + HelmRepositorySpec specifies the required configuration to produce an + Artifact for a Helm repository index YAML. + properties: + accessFrom: + description: |- + AccessFrom specifies an Access Control List for allowing cross-namespace + references to this object. + NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092 + properties: + namespaceSelectors: + description: |- + NamespaceSelectors is the list of namespace selectors to which this ACL applies. + Items in this list are evaluated using a logical OR operation. + items: + description: |- + NamespaceSelector selects the namespaces to which this ACL applies. + An empty map of MatchLabels matches all namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + certSecretRef: + description: |- + CertSecretRef can be given the name of a Secret containing + either or both of + + - a PEM-encoded client certificate (`tls.crt`) and private + key (`tls.key`); + - a PEM-encoded CA certificate (`ca.crt`) + + and whichever are supplied, will be used for connecting to the + registry. The client cert and key are useful if you are + authenticating with a certificate; the CA cert is useful if + you are using a self-signed server certificate. The Secret must + be of type `Opaque` or `kubernetes.io/tls`. + + It takes precedence over the values specified in the Secret referred + to by `.spec.secretRef`. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + insecure: + description: |- + Insecure allows connecting to a non-TLS HTTP container registry. + This field is only taken into account if the .spec.type field is set to 'oci'. + type: boolean + interval: + description: |- + Interval at which the HelmRepository URL is checked for updates. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + passCredentials: + description: |- + PassCredentials allows the credentials from the SecretRef to be passed + on to a host that does not match the host as defined in URL. + This may be required if the host of the advertised chart URLs in the + index differ from the defined URL. + Enabling this should be done with caution, as it can potentially result + in credentials getting stolen in a MITM-attack. + type: boolean + provider: + default: generic + description: |- + Provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'. + This field is optional, and only taken into account if the .spec.type field is set to 'oci'. + When not specified, defaults to 'generic'. + enum: + - generic + - aws + - azure + - gcp + type: string + secretRef: + description: |- + SecretRef specifies the Secret containing authentication credentials + for the HelmRepository. + For HTTP/S basic auth the secret must contain 'username' and 'password' + fields. + Support for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile' + keys is deprecated. Please use `.spec.certSecretRef` instead. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend the reconciliation of this + HelmRepository. + type: boolean + timeout: + description: |- + Timeout is used for the index fetch operation for an HTTPS helm repository, + and for remote OCI Repository operations like pulling for an OCI helm + chart by the associated HelmChart. + Its default value is 60s. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + type: + description: |- + Type of the HelmRepository. + When this field is set to "oci", the URL field value must be prefixed with "oci://". + enum: + - default + - oci + type: string + url: + description: |- + URL of the Helm repository, a valid URL contains at least a protocol and + host. + pattern: ^(http|https|oci)://.*$ + type: string + required: + - url + type: object + status: + default: + observedGeneration: -1 + description: HelmRepositoryStatus records the observed state of the HelmRepository. + properties: + artifact: + description: + Artifact represents the last successful HelmRepository + reconciliation. + properties: + digest: + description: Digest is the digest of the file in the form of ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds upstream information such as OCI annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + conditions: + description: Conditions holds the conditions for the HelmRepository. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: |- + ObservedGeneration is the last observed generation of the HelmRepository + object. + format: int64 + type: integer + url: + description: |- + URL is the dynamic fetch link for the latest Artifact. + It is provided on a "best effort" basis, and using the precise + HelmRepositoryStatus.Artifact data is recommended. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.url + name: URL + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + deprecated: true + deprecationWarning: v1beta1 HelmRepository is deprecated, upgrade to v1 + name: v1beta1 + schema: + openAPIV3Schema: + description: HelmRepository is the Schema for the helmrepositories API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: HelmRepositorySpec defines the reference to a Helm repository. + properties: + accessFrom: + description: + AccessFrom defines an Access Control List for allowing + cross-namespace references to this object. + properties: + namespaceSelectors: + description: |- + NamespaceSelectors is the list of namespace selectors to which this ACL applies. + Items in this list are evaluated using a logical OR operation. + items: + description: |- + NamespaceSelector selects the namespaces to which this ACL applies. + An empty map of MatchLabels matches all namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + interval: + description: The interval at which to check the upstream for updates. + type: string + passCredentials: + description: |- + PassCredentials allows the credentials from the SecretRef to be passed on to + a host that does not match the host as defined in URL. + This may be required if the host of the advertised chart URLs in the index + differ from the defined URL. + Enabling this should be done with caution, as it can potentially result in + credentials getting stolen in a MITM-attack. + type: boolean + secretRef: + description: |- + The name of the secret containing authentication credentials for the Helm + repository. + For HTTP/S basic auth the secret must contain username and + password fields. + For TLS the secret must contain a certFile and keyFile, and/or + caFile fields. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: + This flag tells the controller to suspend the reconciliation + of this source. + type: boolean + timeout: + default: 60s + description: The timeout of index downloading, defaults to 60s. + type: string + url: + description: + The Helm repository URL, a valid URL contains at least + a protocol and host. + type: string + required: + - interval + - url + type: object + status: + default: + observedGeneration: -1 + description: HelmRepositoryStatus defines the observed state of the HelmRepository. + properties: + artifact: + description: + Artifact represents the output of the last successful + repository sync. + properties: + checksum: + description: Checksum is the SHA256 checksum of the artifact. + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of this + artifact. + format: date-time + type: string + path: + description: Path is the relative file path of this artifact. + type: string + revision: + description: |- + Revision is a human readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm + chart version, etc. + type: string + url: + description: URL is the HTTP address of this artifact. + type: string + required: + - lastUpdateTime + - path + - url + type: object + conditions: + description: Conditions holds the conditions for the HelmRepository. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + url: + description: URL is the download link for the last index fetched. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.url + name: URL + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta2 HelmRepository is deprecated, upgrade to v1 + name: v1beta2 + schema: + openAPIV3Schema: + description: HelmRepository is the Schema for the helmrepositories API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + HelmRepositorySpec specifies the required configuration to produce an + Artifact for a Helm repository index YAML. + properties: + accessFrom: + description: |- + AccessFrom specifies an Access Control List for allowing cross-namespace + references to this object. + NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092 + properties: + namespaceSelectors: + description: |- + NamespaceSelectors is the list of namespace selectors to which this ACL applies. + Items in this list are evaluated using a logical OR operation. + items: + description: |- + NamespaceSelector selects the namespaces to which this ACL applies. + An empty map of MatchLabels matches all namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + certSecretRef: + description: |- + CertSecretRef can be given the name of a Secret containing + either or both of + + - a PEM-encoded client certificate (`tls.crt`) and private + key (`tls.key`); + - a PEM-encoded CA certificate (`ca.crt`) + + and whichever are supplied, will be used for connecting to the + registry. The client cert and key are useful if you are + authenticating with a certificate; the CA cert is useful if + you are using a self-signed server certificate. The Secret must + be of type `Opaque` or `kubernetes.io/tls`. + + It takes precedence over the values specified in the Secret referred + to by `.spec.secretRef`. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + insecure: + description: |- + Insecure allows connecting to a non-TLS HTTP container registry. + This field is only taken into account if the .spec.type field is set to 'oci'. + type: boolean + interval: + description: |- + Interval at which the HelmRepository URL is checked for updates. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + passCredentials: + description: |- + PassCredentials allows the credentials from the SecretRef to be passed + on to a host that does not match the host as defined in URL. + This may be required if the host of the advertised chart URLs in the + index differ from the defined URL. + Enabling this should be done with caution, as it can potentially result + in credentials getting stolen in a MITM-attack. + type: boolean + provider: + default: generic + description: |- + Provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'. + This field is optional, and only taken into account if the .spec.type field is set to 'oci'. + When not specified, defaults to 'generic'. + enum: + - generic + - aws + - azure + - gcp + type: string + secretRef: + description: |- + SecretRef specifies the Secret containing authentication credentials + for the HelmRepository. + For HTTP/S basic auth the secret must contain 'username' and 'password' + fields. + Support for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile' + keys is deprecated. Please use `.spec.certSecretRef` instead. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend the reconciliation of this + HelmRepository. + type: boolean + timeout: + description: |- + Timeout is used for the index fetch operation for an HTTPS helm repository, + and for remote OCI Repository operations like pulling for an OCI helm + chart by the associated HelmChart. + Its default value is 60s. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + type: + description: |- + Type of the HelmRepository. + When this field is set to "oci", the URL field value must be prefixed with "oci://". + enum: + - default + - oci + type: string + url: + description: |- + URL of the Helm repository, a valid URL contains at least a protocol and + host. + pattern: ^(http|https|oci)://.*$ + type: string + required: + - url + type: object + status: + default: + observedGeneration: -1 + description: HelmRepositoryStatus records the observed state of the HelmRepository. + properties: + artifact: + description: + Artifact represents the last successful HelmRepository + reconciliation. + properties: + digest: + description: Digest is the digest of the file in the form of ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds upstream information such as OCI annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + conditions: + description: Conditions holds the conditions for the HelmRepository. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: |- + ObservedGeneration is the last observed generation of the HelmRepository + object. + format: int64 + type: integer + url: + description: |- + URL is the dynamic fetch link for the latest Artifact. + It is provided on a "best effort" basis, and using the precise + HelmRepositoryStatus.Artifact data is recommended. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + labels: + app.kubernetes.io/component: source-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + name: ocirepositories.source.toolkit.fluxcd.io +spec: + group: source.toolkit.fluxcd.io + names: + kind: OCIRepository + listKind: OCIRepositoryList + plural: ocirepositories + shortNames: + - ocirepo + singular: ocirepository + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.url + name: URL + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta2 + schema: + openAPIV3Schema: + description: OCIRepository is the Schema for the ocirepositories API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: OCIRepositorySpec defines the desired state of OCIRepository + properties: + certSecretRef: + description: |- + CertSecretRef can be given the name of a Secret containing + either or both of + + - a PEM-encoded client certificate (`tls.crt`) and private + key (`tls.key`); + - a PEM-encoded CA certificate (`ca.crt`) + + and whichever are supplied, will be used for connecting to the + registry. The client cert and key are useful if you are + authenticating with a certificate; the CA cert is useful if + you are using a self-signed server certificate. The Secret must + be of type `Opaque` or `kubernetes.io/tls`. + + Note: Support for the `caFile`, `certFile` and `keyFile` keys have + been deprecated. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + ignore: + description: |- + Ignore overrides the set of excluded patterns in the .sourceignore format + (which is the same as .gitignore). If not provided, a default will be used, + consult the documentation for your version to find out what those are. + type: string + insecure: + description: + Insecure allows connecting to a non-TLS HTTP container + registry. + type: boolean + interval: + description: |- + Interval at which the OCIRepository URL is checked for updates. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + layerSelector: + description: |- + LayerSelector specifies which layer should be extracted from the OCI artifact. + When not specified, the first layer found in the artifact is selected. + properties: + mediaType: + description: |- + MediaType specifies the OCI media type of the layer + which should be extracted from the OCI Artifact. The + first layer matching this type is selected. + type: string + operation: + description: |- + Operation specifies how the selected layer should be processed. + By default, the layer compressed content is extracted to storage. + When the operation is set to 'copy', the layer compressed content + is persisted to storage as it is. + enum: + - extract + - copy + type: string + type: object + provider: + default: generic + description: |- + The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'. + When not specified, defaults to 'generic'. + enum: + - generic + - aws + - azure + - gcp + type: string + proxySecretRef: + description: |- + ProxySecretRef specifies the Secret containing the proxy configuration + to use while communicating with the container registry. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + ref: + description: |- + The OCI reference to pull and monitor for changes, + defaults to the latest tag. + properties: + digest: + description: |- + Digest is the image digest to pull, takes precedence over SemVer. + The value should be in the format 'sha256:'. + type: string + semver: + description: |- + SemVer is the range of tags to pull selecting the latest within + the range, takes precedence over Tag. + type: string + semverFilter: + description: + SemverFilter is a regex pattern to filter the tags + within the SemVer range. + type: string + tag: + description: Tag is the image tag to pull, defaults to latest. + type: string + type: object + secretRef: + description: |- + SecretRef contains the secret name containing the registry login + credentials to resolve image metadata. + The secret must be of type kubernetes.io/dockerconfigjson. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + serviceAccountName: + description: |- + ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate + the image pull if the service account has attached pull secrets. For more information: + https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account + type: string + suspend: + description: + This flag tells the controller to suspend the reconciliation + of this source. + type: boolean + timeout: + default: 60s + description: + The timeout for remote OCI Repository operations like + pulling, defaults to 60s. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + url: + description: |- + URL is a reference to an OCI artifact repository hosted + on a remote container registry. + pattern: ^oci://.*$ + type: string + verify: + description: |- + Verify contains the secret name containing the trusted public keys + used to verify the signature and specifies which provider to use to check + whether OCI image is authentic. + properties: + matchOIDCIdentity: + description: |- + MatchOIDCIdentity specifies the identity matching criteria to use + while verifying an OCI artifact which was signed using Cosign keyless + signing. The artifact's identity is deemed to be verified if any of the + specified matchers match against the identity. + items: + description: |- + OIDCIdentityMatch specifies options for verifying the certificate identity, + i.e. the issuer and the subject of the certificate. + properties: + issuer: + description: |- + Issuer specifies the regex pattern to match against to verify + the OIDC issuer in the Fulcio certificate. The pattern must be a + valid Go regular expression. + type: string + subject: + description: |- + Subject specifies the regex pattern to match against to verify + the identity subject in the Fulcio certificate. The pattern must + be a valid Go regular expression. + type: string + required: + - issuer + - subject + type: object + type: array + provider: + default: cosign + description: + Provider specifies the technology used to sign the + OCI Artifact. + enum: + - cosign + - notation + type: string + secretRef: + description: |- + SecretRef specifies the Kubernetes Secret containing the + trusted public keys. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - provider + type: object + required: + - interval + - url + type: object + status: + default: + observedGeneration: -1 + description: OCIRepositoryStatus defines the observed state of OCIRepository + properties: + artifact: + description: + Artifact represents the output of the last successful + OCI Repository sync. + properties: + digest: + description: Digest is the digest of the file in the form of ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds upstream information such as OCI annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + conditions: + description: Conditions holds the conditions for the OCIRepository. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + contentConfigChecksum: + description: |- + ContentConfigChecksum is a checksum of all the configurations related to + the content of the source artifact: + - .spec.ignore + - .spec.layerSelector + observed in .status.observedGeneration version of the object. This can + be used to determine if the content configuration has changed and the + artifact needs to be rebuilt. + It has the format of `:`, for example: `sha256:`. + + Deprecated: Replaced with explicit fields for observed artifact content + config in the status. + type: string + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + observedIgnore: + description: |- + ObservedIgnore is the observed exclusion patterns used for constructing + the source artifact. + type: string + observedLayerSelector: + description: |- + ObservedLayerSelector is the observed layer selector used for constructing + the source artifact. + properties: + mediaType: + description: |- + MediaType specifies the OCI media type of the layer + which should be extracted from the OCI Artifact. The + first layer matching this type is selected. + type: string + operation: + description: |- + Operation specifies how the selected layer should be processed. + By default, the layer compressed content is extracted to storage. + When the operation is set to 'copy', the layer compressed content + is persisted to storage as it is. + enum: + - extract + - copy + type: string + type: object + url: + description: + URL is the download link for the artifact output of the + last OCI Repository sync. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: source-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + name: source-controller + namespace: flux-system +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: source-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + control-plane: controller + name: source-controller + namespace: flux-system +spec: + ports: + - name: http + port: 80 + protocol: TCP + targetPort: http + selector: + app: source-controller + type: ClusterIP +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: source-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + control-plane: controller + name: source-controller + namespace: flux-system +spec: + replicas: 1 + selector: + matchLabels: + app: source-controller + strategy: + type: Recreate + template: + metadata: + annotations: + prometheus.io/port: "8080" + prometheus.io/scrape: "true" + labels: + app: source-controller + spec: + containers: + - args: + - --events-addr=http://notification-controller.flux-system.svc.cluster.local./ + - --watch-all-namespaces=true + - --log-level=info + - --log-encoding=json + - --enable-leader-election + - --storage-path=/data + - --storage-adv-addr=source-controller.$(RUNTIME_NAMESPACE).svc.cluster.local. + env: + - name: RUNTIME_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: TUF_ROOT + value: /tmp/.sigstore + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + containerName: manager + resource: limits.cpu + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + containerName: manager + resource: limits.memory + image: ghcr.io/fluxcd/source-controller:v1.5.0 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 9090 + name: http + protocol: TCP + - containerPort: 8080 + name: http-prom + protocol: TCP + - containerPort: 9440 + name: healthz + protocol: TCP + readinessProbe: + httpGet: + path: / + port: http + resources: + limits: + cpu: 1000m + memory: 1Gi + requests: + cpu: 50m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /data + name: data + - mountPath: /tmp + name: tmp + nodeSelector: + kubernetes.io/os: linux + priorityClassName: system-cluster-critical + securityContext: + fsGroup: 1337 + serviceAccountName: source-controller + terminationGracePeriodSeconds: 10 + volumes: + - emptyDir: {} + name: data + - emptyDir: {} + name: tmp +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + labels: + app.kubernetes.io/component: kustomize-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + name: kustomizations.kustomize.toolkit.fluxcd.io +spec: + group: kustomize.toolkit.fluxcd.io + names: + kind: Kustomization + listKind: KustomizationList + plural: kustomizations + shortNames: + - ks + singular: kustomization + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1 + schema: + openAPIV3Schema: + description: Kustomization is the Schema for the kustomizations API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + KustomizationSpec defines the configuration to calculate the desired state + from a Source using Kustomize. + properties: + commonMetadata: + description: |- + CommonMetadata specifies the common labels and annotations that are + applied to all resources. Any existing label or annotation will be + overridden if its key matches a common one. + properties: + annotations: + additionalProperties: + type: string + description: Annotations to be added to the object's metadata. + type: object + labels: + additionalProperties: + type: string + description: Labels to be added to the object's metadata. + type: object + type: object + components: + description: + Components specifies relative paths to specifications + of other Components. + items: + type: string + type: array + decryption: + description: + Decrypt Kubernetes secrets before applying them on the + cluster. + properties: + provider: + description: Provider is the name of the decryption engine. + enum: + - sops + type: string + secretRef: + description: + The secret name containing the private OpenPGP keys + used for decryption. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - provider + type: object + deletionPolicy: + description: |- + DeletionPolicy can be used to control garbage collection when this + Kustomization is deleted. Valid values are ('MirrorPrune', 'Delete', + 'Orphan'). 'MirrorPrune' mirrors the Prune field (orphan if false, + delete if true). Defaults to 'MirrorPrune'. + enum: + - MirrorPrune + - Delete + - Orphan + type: string + dependsOn: + description: |- + DependsOn may contain a meta.NamespacedObjectReference slice + with references to Kustomization resources that must be ready before this + Kustomization can be reconciled. + items: + description: |- + NamespacedObjectReference contains enough information to locate the referenced Kubernetes resource object in any + namespace. + properties: + name: + description: Name of the referent. + type: string + namespace: + description: + Namespace of the referent, when not specified it + acts as LocalObjectReference. + type: string + required: + - name + type: object + type: array + force: + default: false + description: |- + Force instructs the controller to recreate resources + when patching fails due to an immutable field change. + type: boolean + healthCheckExprs: + description: |- + HealthCheckExprs is a list of healthcheck expressions for evaluating the + health of custom resources using Common Expression Language (CEL). + The expressions are evaluated only when Wait or HealthChecks are specified. + items: + description: + CustomHealthCheck defines the health check for custom + resources. + properties: + apiVersion: + description: APIVersion of the custom resource under evaluation. + type: string + current: + description: |- + Current is the CEL expression that determines if the status + of the custom resource has reached the desired state. + type: string + failed: + description: |- + Failed is the CEL expression that determines if the status + of the custom resource has failed to reach the desired state. + type: string + inProgress: + description: |- + InProgress is the CEL expression that determines if the status + of the custom resource has not yet reached the desired state. + type: string + kind: + description: Kind of the custom resource under evaluation. + type: string + required: + - apiVersion + - current + - kind + type: object + type: array + healthChecks: + description: A list of resources to be included in the health assessment. + items: + description: |- + NamespacedObjectKindReference contains enough information to locate the typed referenced Kubernetes resource object + in any namespace. + properties: + apiVersion: + description: + API version of the referent, if not specified the + Kubernetes preferred version will be used. + type: string + kind: + description: Kind of the referent. + type: string + name: + description: Name of the referent. + type: string + namespace: + description: + Namespace of the referent, when not specified it + acts as LocalObjectReference. + type: string + required: + - kind + - name + type: object + type: array + images: + description: |- + Images is a list of (image name, new name, new tag or digest) + for changing image names, tags or digests. This can also be achieved with a + patch, but this operator is simpler to specify. + items: + description: + Image contains an image name, a new name, a new tag + or digest, which will replace the original name and tag. + properties: + digest: + description: |- + Digest is the value used to replace the original image tag. + If digest is present NewTag value is ignored. + type: string + name: + description: Name is a tag-less image name. + type: string + newName: + description: + NewName is the value used to replace the original + name. + type: string + newTag: + description: + NewTag is the value used to replace the original + tag. + type: string + required: + - name + type: object + type: array + interval: + description: |- + The interval at which to reconcile the Kustomization. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + kubeConfig: + description: |- + The KubeConfig for reconciling the Kustomization on a remote cluster. + When used in combination with KustomizationSpec.ServiceAccountName, + forces the controller to act on behalf of that Service Account at the + target cluster. + If the --default-service-account flag is set, its value will be used as + a controller level fallback for when KustomizationSpec.ServiceAccountName + is empty. + properties: + secretRef: + description: |- + SecretRef holds the name of a secret that contains a key with + the kubeconfig file as the value. If no key is set, the key will default + to 'value'. + It is recommended that the kubeconfig is self-contained, and the secret + is regularly updated if credentials such as a cloud-access-token expire. + Cloud specific `cmd-path` auth helpers will not function without adding + binaries and credentials to the Pod that is responsible for reconciling + Kubernetes resources. + properties: + key: + description: + Key in the Secret, when not specified an implementation-specific + default key is used. + type: string + name: + description: Name of the Secret. + type: string + required: + - name + type: object + required: + - secretRef + type: object + namePrefix: + description: NamePrefix will prefix the names of all managed resources. + maxLength: 200 + minLength: 1 + type: string + nameSuffix: + description: NameSuffix will suffix the names of all managed resources. + maxLength: 200 + minLength: 1 + type: string + patches: + description: |- + Strategic merge and JSON patches, defined as inline YAML objects, + capable of targeting objects based on kind, label and annotation selectors. + items: + description: |- + Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should + be applied to. + properties: + patch: + description: |- + Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with + an array of operation objects. + type: string + target: + description: + Target points to the resources that the patch document + should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + type: object + type: array + path: + description: |- + Path to the directory containing the kustomization.yaml file, or the + set of plain YAMLs a kustomization.yaml should be generated for. + Defaults to 'None', which translates to the root path of the SourceRef. + type: string + postBuild: + description: |- + PostBuild describes which actions to perform on the YAML manifest + generated by building the kustomize overlay. + properties: + substitute: + additionalProperties: + type: string + description: |- + Substitute holds a map of key/value pairs. + The variables defined in your YAML manifests that match any of the keys + defined in the map will be substituted with the set value. + Includes support for bash string replacement functions + e.g. ${var:=default}, ${var:position} and ${var/substring/replacement}. + type: object + substituteFrom: + description: |- + SubstituteFrom holds references to ConfigMaps and Secrets containing + the variables and their values to be substituted in the YAML manifests. + The ConfigMap and the Secret data keys represent the var names, and they + must match the vars declared in the manifests for the substitution to + happen. + items: + description: |- + SubstituteReference contains a reference to a resource containing + the variables name and value. + properties: + kind: + description: + Kind of the values referent, valid values are + ('Secret', 'ConfigMap'). + enum: + - Secret + - ConfigMap + type: string + name: + description: |- + Name of the values referent. Should reside in the same namespace as the + referring resource. + maxLength: 253 + minLength: 1 + type: string + optional: + default: false + description: |- + Optional indicates whether the referenced resource must exist, or whether to + tolerate its absence. If true and the referenced resource is absent, proceed + as if the resource was present but empty, without any variables defined. + type: boolean + required: + - kind + - name + type: object + type: array + type: object + prune: + description: Prune enables garbage collection. + type: boolean + retryInterval: + description: |- + The interval at which to retry a previously failed reconciliation. + When not specified, the controller uses the KustomizationSpec.Interval + value to retry failures. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + serviceAccountName: + description: |- + The name of the Kubernetes service account to impersonate + when reconciling this Kustomization. + type: string + sourceRef: + description: + Reference of the source where the kustomization file + is. + properties: + apiVersion: + description: API version of the referent. + type: string + kind: + description: Kind of the referent. + enum: + - OCIRepository + - GitRepository + - Bucket + type: string + name: + description: Name of the referent. + type: string + namespace: + description: |- + Namespace of the referent, defaults to the namespace of the Kubernetes + resource object that contains the reference. + type: string + required: + - kind + - name + type: object + suspend: + description: |- + This flag tells the controller to suspend subsequent kustomize executions, + it does not apply to already started executions. Defaults to false. + type: boolean + targetNamespace: + description: |- + TargetNamespace sets or overrides the namespace in the + kustomization.yaml file. + maxLength: 63 + minLength: 1 + type: string + timeout: + description: |- + Timeout for validation, apply and health checking operations. + Defaults to 'Interval' duration. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + wait: + description: |- + Wait instructs the controller to check the health of all the reconciled + resources. When enabled, the HealthChecks are ignored. Defaults to false. + type: boolean + required: + - interval + - prune + - sourceRef + type: object + status: + default: + observedGeneration: -1 + description: KustomizationStatus defines the observed state of a kustomization. + properties: + conditions: + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + inventory: + description: |- + Inventory contains the list of Kubernetes resource object references that + have been successfully applied. + properties: + entries: + description: Entries of Kubernetes resource object references. + items: + description: + ResourceRef contains the information necessary + to locate a resource within a cluster. + properties: + id: + description: |- + ID is the string representation of the Kubernetes resource object's metadata, + in the format '___'. + type: string + v: + description: + Version is the API version of the Kubernetes + resource object's kind. + type: string + required: + - id + - v + type: object + type: array + required: + - entries + type: object + lastAppliedOriginRevision: + description: |- + The last successfully applied origin revision. + Equals the origin revision of the applied Artifact from the referenced Source. + Usually present on the Metadata of the applied Artifact and depends on the + Source type, e.g. for OCI it's the value associated with the key + "org.opencontainers.image.revision". + type: string + lastAppliedRevision: + description: |- + The last successfully applied revision. + Equals the Revision of the applied Artifact from the referenced Source. + type: string + lastAttemptedRevision: + description: + LastAttemptedRevision is the revision of the last reconciliation + attempt. + type: string + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last reconciled generation. + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + deprecated: true + deprecationWarning: v1beta1 Kustomization is deprecated, upgrade to v1 + name: v1beta1 + schema: + openAPIV3Schema: + description: Kustomization is the Schema for the kustomizations API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: KustomizationSpec defines the desired state of a kustomization. + properties: + decryption: + description: + Decrypt Kubernetes secrets before applying them on the + cluster. + properties: + provider: + description: Provider is the name of the decryption engine. + enum: + - sops + type: string + secretRef: + description: + The secret name containing the private OpenPGP keys + used for decryption. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - provider + type: object + dependsOn: + description: |- + DependsOn may contain a meta.NamespacedObjectReference slice + with references to Kustomization resources that must be ready before this + Kustomization can be reconciled. + items: + description: |- + NamespacedObjectReference contains enough information to locate the referenced Kubernetes resource object in any + namespace. + properties: + name: + description: Name of the referent. + type: string + namespace: + description: + Namespace of the referent, when not specified it + acts as LocalObjectReference. + type: string + required: + - name + type: object + type: array + force: + default: false + description: |- + Force instructs the controller to recreate resources + when patching fails due to an immutable field change. + type: boolean + healthChecks: + description: A list of resources to be included in the health assessment. + items: + description: |- + NamespacedObjectKindReference contains enough information to locate the typed referenced Kubernetes resource object + in any namespace. + properties: + apiVersion: + description: + API version of the referent, if not specified the + Kubernetes preferred version will be used. + type: string + kind: + description: Kind of the referent. + type: string + name: + description: Name of the referent. + type: string + namespace: + description: + Namespace of the referent, when not specified it + acts as LocalObjectReference. + type: string + required: + - kind + - name + type: object + type: array + images: + description: |- + Images is a list of (image name, new name, new tag or digest) + for changing image names, tags or digests. This can also be achieved with a + patch, but this operator is simpler to specify. + items: + description: + Image contains an image name, a new name, a new tag + or digest, which will replace the original name and tag. + properties: + digest: + description: |- + Digest is the value used to replace the original image tag. + If digest is present NewTag value is ignored. + type: string + name: + description: Name is a tag-less image name. + type: string + newName: + description: + NewName is the value used to replace the original + name. + type: string + newTag: + description: + NewTag is the value used to replace the original + tag. + type: string + required: + - name + type: object + type: array + interval: + description: The interval at which to reconcile the Kustomization. + type: string + kubeConfig: + description: |- + The KubeConfig for reconciling the Kustomization on a remote cluster. + When specified, KubeConfig takes precedence over ServiceAccountName. + properties: + secretRef: + description: |- + SecretRef holds the name to a secret that contains a 'value' key with + the kubeconfig file as the value. It must be in the same namespace as + the Kustomization. + It is recommended that the kubeconfig is self-contained, and the secret + is regularly updated if credentials such as a cloud-access-token expire. + Cloud specific `cmd-path` auth helpers will not function without adding + binaries and credentials to the Pod that is responsible for reconciling + the Kustomization. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - secretRef + type: object + patches: + description: |- + Strategic merge and JSON patches, defined as inline YAML objects, + capable of targeting objects based on kind, label and annotation selectors. + items: + description: |- + Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should + be applied to. + properties: + patch: + description: |- + Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with + an array of operation objects. + type: string + target: + description: + Target points to the resources that the patch document + should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + type: object + type: array + patchesJson6902: + description: JSON 6902 patches, defined as inline YAML objects. + items: + description: + JSON6902Patch contains a JSON6902 patch and the target + the patch should be applied to. + properties: + patch: + description: + Patch contains the JSON6902 patch document with + an array of operation objects. + items: + description: |- + JSON6902 is a JSON6902 operation object. + https://datatracker.ietf.org/doc/html/rfc6902#section-4 + properties: + from: + description: |- + From contains a JSON-pointer value that references a location within the target document where the operation is + performed. The meaning of the value depends on the value of Op, and is NOT taken into account by all operations. + type: string + op: + description: |- + Op indicates the operation to perform. Its value MUST be one of "add", "remove", "replace", "move", "copy", or + "test". + https://datatracker.ietf.org/doc/html/rfc6902#section-4 + enum: + - test + - remove + - add + - replace + - move + - copy + type: string + path: + description: |- + Path contains the JSON-pointer value that references a location within the target document where the operation + is performed. The meaning of the value depends on the value of Op. + type: string + value: + description: |- + Value contains a valid JSON structure. The meaning of the value depends on the value of Op, and is NOT taken into + account by all operations. + x-kubernetes-preserve-unknown-fields: true + required: + - op + - path + type: object + type: array + target: + description: + Target points to the resources that the patch document + should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + - target + type: object + type: array + patchesStrategicMerge: + description: Strategic merge patches, defined as inline YAML objects. + items: + x-kubernetes-preserve-unknown-fields: true + type: array + path: + description: |- + Path to the directory containing the kustomization.yaml file, or the + set of plain YAMLs a kustomization.yaml should be generated for. + Defaults to 'None', which translates to the root path of the SourceRef. + type: string + postBuild: + description: |- + PostBuild describes which actions to perform on the YAML manifest + generated by building the kustomize overlay. + properties: + substitute: + additionalProperties: + type: string + description: |- + Substitute holds a map of key/value pairs. + The variables defined in your YAML manifests + that match any of the keys defined in the map + will be substituted with the set value. + Includes support for bash string replacement functions + e.g. ${var:=default}, ${var:position} and ${var/substring/replacement}. + type: object + substituteFrom: + description: |- + SubstituteFrom holds references to ConfigMaps and Secrets containing + the variables and their values to be substituted in the YAML manifests. + The ConfigMap and the Secret data keys represent the var names and they + must match the vars declared in the manifests for the substitution to happen. + items: + description: |- + SubstituteReference contains a reference to a resource containing + the variables name and value. + properties: + kind: + description: + Kind of the values referent, valid values are + ('Secret', 'ConfigMap'). + enum: + - Secret + - ConfigMap + type: string + name: + description: |- + Name of the values referent. Should reside in the same namespace as the + referring resource. + maxLength: 253 + minLength: 1 + type: string + required: + - kind + - name + type: object + type: array + type: object + prune: + description: Prune enables garbage collection. + type: boolean + retryInterval: + description: |- + The interval at which to retry a previously failed reconciliation. + When not specified, the controller uses the KustomizationSpec.Interval + value to retry failures. + type: string + serviceAccountName: + description: |- + The name of the Kubernetes service account to impersonate + when reconciling this Kustomization. + type: string + sourceRef: + description: + Reference of the source where the kustomization file + is. + properties: + apiVersion: + description: API version of the referent + type: string + kind: + description: Kind of the referent + enum: + - GitRepository + - Bucket + type: string + name: + description: Name of the referent + type: string + namespace: + description: + Namespace of the referent, defaults to the Kustomization + namespace + type: string + required: + - kind + - name + type: object + suspend: + description: |- + This flag tells the controller to suspend subsequent kustomize executions, + it does not apply to already started executions. Defaults to false. + type: boolean + targetNamespace: + description: |- + TargetNamespace sets or overrides the namespace in the + kustomization.yaml file. + maxLength: 63 + minLength: 1 + type: string + timeout: + description: |- + Timeout for validation, apply and health checking operations. + Defaults to 'Interval' duration. + type: string + validation: + description: |- + Validate the Kubernetes objects before applying them on the cluster. + The validation strategy can be 'client' (local dry-run), 'server' + (APIServer dry-run) or 'none'. + When 'Force' is 'true', validation will fallback to 'client' if set to + 'server' because server-side validation is not supported in this scenario. + enum: + - none + - client + - server + type: string + required: + - interval + - prune + - sourceRef + type: object + status: + default: + observedGeneration: -1 + description: KustomizationStatus defines the observed state of a kustomization. + properties: + conditions: + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastAppliedRevision: + description: |- + The last successfully applied revision. + The revision format for Git sources is /. + type: string + lastAttemptedRevision: + description: + LastAttemptedRevision is the revision of the last reconciliation + attempt. + type: string + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last reconciled generation. + format: int64 + type: integer + snapshot: + description: The last successfully applied revision metadata. + properties: + checksum: + description: The manifests sha1 checksum. + type: string + entries: + description: A list of Kubernetes kinds grouped by namespace. + items: + description: |- + Snapshot holds the metadata of namespaced + Kubernetes objects + properties: + kinds: + additionalProperties: + type: string + description: The list of Kubernetes kinds. + type: object + namespace: + description: The namespace of this entry. + type: string + required: + - kinds + type: object + type: array + required: + - checksum + - entries + type: object + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta2 Kustomization is deprecated, upgrade to v1 + name: v1beta2 + schema: + openAPIV3Schema: + description: Kustomization is the Schema for the kustomizations API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: + KustomizationSpec defines the configuration to calculate + the desired state from a Source using Kustomize. + properties: + commonMetadata: + description: |- + CommonMetadata specifies the common labels and annotations that are applied to all resources. + Any existing label or annotation will be overridden if its key matches a common one. + properties: + annotations: + additionalProperties: + type: string + description: Annotations to be added to the object's metadata. + type: object + labels: + additionalProperties: + type: string + description: Labels to be added to the object's metadata. + type: object + type: object + components: + description: + Components specifies relative paths to specifications + of other Components. + items: + type: string + type: array + decryption: + description: + Decrypt Kubernetes secrets before applying them on the + cluster. + properties: + provider: + description: Provider is the name of the decryption engine. + enum: + - sops + type: string + secretRef: + description: + The secret name containing the private OpenPGP keys + used for decryption. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - provider + type: object + dependsOn: + description: |- + DependsOn may contain a meta.NamespacedObjectReference slice + with references to Kustomization resources that must be ready before this + Kustomization can be reconciled. + items: + description: |- + NamespacedObjectReference contains enough information to locate the referenced Kubernetes resource object in any + namespace. + properties: + name: + description: Name of the referent. + type: string + namespace: + description: + Namespace of the referent, when not specified it + acts as LocalObjectReference. + type: string + required: + - name + type: object + type: array + force: + default: false + description: |- + Force instructs the controller to recreate resources + when patching fails due to an immutable field change. + type: boolean + healthChecks: + description: A list of resources to be included in the health assessment. + items: + description: |- + NamespacedObjectKindReference contains enough information to locate the typed referenced Kubernetes resource object + in any namespace. + properties: + apiVersion: + description: + API version of the referent, if not specified the + Kubernetes preferred version will be used. + type: string + kind: + description: Kind of the referent. + type: string + name: + description: Name of the referent. + type: string + namespace: + description: + Namespace of the referent, when not specified it + acts as LocalObjectReference. + type: string + required: + - kind + - name + type: object + type: array + images: + description: |- + Images is a list of (image name, new name, new tag or digest) + for changing image names, tags or digests. This can also be achieved with a + patch, but this operator is simpler to specify. + items: + description: + Image contains an image name, a new name, a new tag + or digest, which will replace the original name and tag. + properties: + digest: + description: |- + Digest is the value used to replace the original image tag. + If digest is present NewTag value is ignored. + type: string + name: + description: Name is a tag-less image name. + type: string + newName: + description: + NewName is the value used to replace the original + name. + type: string + newTag: + description: + NewTag is the value used to replace the original + tag. + type: string + required: + - name + type: object + type: array + interval: + description: The interval at which to reconcile the Kustomization. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + kubeConfig: + description: |- + The KubeConfig for reconciling the Kustomization on a remote cluster. + When used in combination with KustomizationSpec.ServiceAccountName, + forces the controller to act on behalf of that Service Account at the + target cluster. + If the --default-service-account flag is set, its value will be used as + a controller level fallback for when KustomizationSpec.ServiceAccountName + is empty. + properties: + secretRef: + description: |- + SecretRef holds the name of a secret that contains a key with + the kubeconfig file as the value. If no key is set, the key will default + to 'value'. + It is recommended that the kubeconfig is self-contained, and the secret + is regularly updated if credentials such as a cloud-access-token expire. + Cloud specific `cmd-path` auth helpers will not function without adding + binaries and credentials to the Pod that is responsible for reconciling + Kubernetes resources. + properties: + key: + description: + Key in the Secret, when not specified an implementation-specific + default key is used. + type: string + name: + description: Name of the Secret. + type: string + required: + - name + type: object + required: + - secretRef + type: object + patches: + description: |- + Strategic merge and JSON patches, defined as inline YAML objects, + capable of targeting objects based on kind, label and annotation selectors. + items: + description: |- + Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should + be applied to. + properties: + patch: + description: |- + Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with + an array of operation objects. + type: string + target: + description: + Target points to the resources that the patch document + should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + type: object + type: array + patchesJson6902: + description: |- + JSON 6902 patches, defined as inline YAML objects. + Deprecated: Use Patches instead. + items: + description: + JSON6902Patch contains a JSON6902 patch and the target + the patch should be applied to. + properties: + patch: + description: + Patch contains the JSON6902 patch document with + an array of operation objects. + items: + description: |- + JSON6902 is a JSON6902 operation object. + https://datatracker.ietf.org/doc/html/rfc6902#section-4 + properties: + from: + description: |- + From contains a JSON-pointer value that references a location within the target document where the operation is + performed. The meaning of the value depends on the value of Op, and is NOT taken into account by all operations. + type: string + op: + description: |- + Op indicates the operation to perform. Its value MUST be one of "add", "remove", "replace", "move", "copy", or + "test". + https://datatracker.ietf.org/doc/html/rfc6902#section-4 + enum: + - test + - remove + - add + - replace + - move + - copy + type: string + path: + description: |- + Path contains the JSON-pointer value that references a location within the target document where the operation + is performed. The meaning of the value depends on the value of Op. + type: string + value: + description: |- + Value contains a valid JSON structure. The meaning of the value depends on the value of Op, and is NOT taken into + account by all operations. + x-kubernetes-preserve-unknown-fields: true + required: + - op + - path + type: object + type: array + target: + description: + Target points to the resources that the patch document + should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + - target + type: object + type: array + patchesStrategicMerge: + description: |- + Strategic merge patches, defined as inline YAML objects. + Deprecated: Use Patches instead. + items: + x-kubernetes-preserve-unknown-fields: true + type: array + path: + description: |- + Path to the directory containing the kustomization.yaml file, or the + set of plain YAMLs a kustomization.yaml should be generated for. + Defaults to 'None', which translates to the root path of the SourceRef. + type: string + postBuild: + description: |- + PostBuild describes which actions to perform on the YAML manifest + generated by building the kustomize overlay. + properties: + substitute: + additionalProperties: + type: string + description: |- + Substitute holds a map of key/value pairs. + The variables defined in your YAML manifests + that match any of the keys defined in the map + will be substituted with the set value. + Includes support for bash string replacement functions + e.g. ${var:=default}, ${var:position} and ${var/substring/replacement}. + type: object + substituteFrom: + description: |- + SubstituteFrom holds references to ConfigMaps and Secrets containing + the variables and their values to be substituted in the YAML manifests. + The ConfigMap and the Secret data keys represent the var names and they + must match the vars declared in the manifests for the substitution to happen. + items: + description: |- + SubstituteReference contains a reference to a resource containing + the variables name and value. + properties: + kind: + description: + Kind of the values referent, valid values are + ('Secret', 'ConfigMap'). + enum: + - Secret + - ConfigMap + type: string + name: + description: |- + Name of the values referent. Should reside in the same namespace as the + referring resource. + maxLength: 253 + minLength: 1 + type: string + optional: + default: false + description: |- + Optional indicates whether the referenced resource must exist, or whether to + tolerate its absence. If true and the referenced resource is absent, proceed + as if the resource was present but empty, without any variables defined. + type: boolean + required: + - kind + - name + type: object + type: array + type: object + prune: + description: Prune enables garbage collection. + type: boolean + retryInterval: + description: |- + The interval at which to retry a previously failed reconciliation. + When not specified, the controller uses the KustomizationSpec.Interval + value to retry failures. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + serviceAccountName: + description: |- + The name of the Kubernetes service account to impersonate + when reconciling this Kustomization. + type: string + sourceRef: + description: + Reference of the source where the kustomization file + is. + properties: + apiVersion: + description: API version of the referent. + type: string + kind: + description: Kind of the referent. + enum: + - OCIRepository + - GitRepository + - Bucket + type: string + name: + description: Name of the referent. + type: string + namespace: + description: + Namespace of the referent, defaults to the namespace + of the Kubernetes resource object that contains the reference. + type: string + required: + - kind + - name + type: object + suspend: + description: |- + This flag tells the controller to suspend subsequent kustomize executions, + it does not apply to already started executions. Defaults to false. + type: boolean + targetNamespace: + description: |- + TargetNamespace sets or overrides the namespace in the + kustomization.yaml file. + maxLength: 63 + minLength: 1 + type: string + timeout: + description: |- + Timeout for validation, apply and health checking operations. + Defaults to 'Interval' duration. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + validation: + description: "Deprecated: Not used in v1beta2." + enum: + - none + - client + - server + type: string + wait: + description: |- + Wait instructs the controller to check the health of all the reconciled resources. + When enabled, the HealthChecks are ignored. Defaults to false. + type: boolean + required: + - interval + - prune + - sourceRef + type: object + status: + default: + observedGeneration: -1 + description: KustomizationStatus defines the observed state of a kustomization. + properties: + conditions: + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + inventory: + description: + Inventory contains the list of Kubernetes resource object + references that have been successfully applied. + properties: + entries: + description: Entries of Kubernetes resource object references. + items: + description: + ResourceRef contains the information necessary + to locate a resource within a cluster. + properties: + id: + description: |- + ID is the string representation of the Kubernetes resource object's metadata, + in the format '___'. + type: string + v: + description: + Version is the API version of the Kubernetes + resource object's kind. + type: string + required: + - id + - v + type: object + type: array + required: + - entries + type: object + lastAppliedRevision: + description: |- + The last successfully applied revision. + Equals the Revision of the applied Artifact from the referenced Source. + type: string + lastAttemptedRevision: + description: + LastAttemptedRevision is the revision of the last reconciliation + attempt. + type: string + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last reconciled generation. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: kustomize-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + name: kustomize-controller + namespace: flux-system +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: kustomize-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + control-plane: controller + name: kustomize-controller + namespace: flux-system +spec: + replicas: 1 + selector: + matchLabels: + app: kustomize-controller + template: + metadata: + annotations: + prometheus.io/port: "8080" + prometheus.io/scrape: "true" + labels: + app: kustomize-controller + spec: + containers: + - args: + - --events-addr=http://notification-controller.flux-system.svc.cluster.local./ + - --watch-all-namespaces=true + - --log-level=info + - --log-encoding=json + - --enable-leader-election + env: + - name: RUNTIME_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + containerName: manager + resource: limits.cpu + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + containerName: manager + resource: limits.memory + image: ghcr.io/fluxcd/kustomize-controller:v1.5.1 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 8080 + name: http-prom + protocol: TCP + - containerPort: 9440 + name: healthz + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + resources: + limits: + cpu: 1000m + memory: 1Gi + requests: + cpu: 100m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /tmp + name: temp + nodeSelector: + kubernetes.io/os: linux + priorityClassName: system-cluster-critical + securityContext: + fsGroup: 1337 + serviceAccountName: kustomize-controller + terminationGracePeriodSeconds: 60 + volumes: + - emptyDir: {} + name: temp +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + labels: + app.kubernetes.io/component: helm-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + name: helmreleases.helm.toolkit.fluxcd.io +spec: + group: helm.toolkit.fluxcd.io + names: + kind: HelmRelease + listKind: HelmReleaseList + plural: helmreleases + shortNames: + - hr + singular: helmrelease + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v2 + schema: + openAPIV3Schema: + description: HelmRelease is the Schema for the helmreleases API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: HelmReleaseSpec defines the desired state of a Helm release. + properties: + chart: + description: |- + Chart defines the template of the v1.HelmChart that should be created + for this HelmRelease. + properties: + metadata: + description: + ObjectMeta holds the template for metadata like labels + and annotations. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + type: object + labels: + additionalProperties: + type: string + description: |- + Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + type: object + type: object + spec: + description: + Spec holds the template for the v1.HelmChartSpec + for this HelmRelease. + properties: + chart: + description: + The name or path the Helm chart is available + at in the SourceRef. + maxLength: 2048 + minLength: 1 + type: string + ignoreMissingValuesFiles: + description: + IgnoreMissingValuesFiles controls whether to + silently ignore missing values files rather than failing. + type: boolean + interval: + description: |- + Interval at which to check the v1.Source for updates. Defaults to + 'HelmReleaseSpec.Interval'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + reconcileStrategy: + default: ChartVersion + description: |- + Determines what enables the creation of a new artifact. Valid values are + ('ChartVersion', 'Revision'). + See the documentation of the values for an explanation on their behavior. + Defaults to ChartVersion when omitted. + enum: + - ChartVersion + - Revision + type: string + sourceRef: + description: + The name and namespace of the v1.Source the chart + is available at. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: Kind of the referent. + enum: + - HelmRepository + - GitRepository + - Bucket + type: string + name: + description: Name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: Namespace of the referent. + maxLength: 63 + minLength: 1 + type: string + required: + - kind + - name + type: object + valuesFiles: + description: |- + Alternative list of values files to use as the chart values (values.yaml + is not included by default), expected to be a relative path in the SourceRef. + Values files are merged in the order of this list with the last file overriding + the first. Ignored when omitted. + items: + type: string + type: array + verify: + description: |- + Verify contains the secret name containing the trusted public keys + used to verify the signature and specifies which provider to use to check + whether OCI image is authentic. + This field is only supported for OCI sources. + Chart dependencies, which are not bundled in the umbrella chart artifact, + are not verified. + properties: + provider: + default: cosign + description: + Provider specifies the technology used to + sign the OCI Helm chart. + enum: + - cosign + - notation + type: string + secretRef: + description: |- + SecretRef specifies the Kubernetes Secret containing the + trusted public keys. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - provider + type: object + version: + default: "*" + description: |- + Version semver expression, ignored for charts from v1.GitRepository and + v1beta2.Bucket sources. Defaults to latest when omitted. + type: string + required: + - chart + - sourceRef + type: object + required: + - spec + type: object + chartRef: + description: |- + ChartRef holds a reference to a source controller resource containing the + Helm chart artifact. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: Kind of the referent. + enum: + - OCIRepository + - HelmChart + type: string + name: + description: Name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace of the referent, defaults to the namespace of the Kubernetes + resource object that contains the reference. + maxLength: 63 + minLength: 1 + type: string + required: + - kind + - name + type: object + dependsOn: + description: |- + DependsOn may contain a meta.NamespacedObjectReference slice with + references to HelmRelease resources that must be ready before this HelmRelease + can be reconciled. + items: + description: |- + NamespacedObjectReference contains enough information to locate the referenced Kubernetes resource object in any + namespace. + properties: + name: + description: Name of the referent. + type: string + namespace: + description: + Namespace of the referent, when not specified it + acts as LocalObjectReference. + type: string + required: + - name + type: object + type: array + driftDetection: + description: |- + DriftDetection holds the configuration for detecting and handling + differences between the manifest in the Helm storage and the resources + currently existing in the cluster. + properties: + ignore: + description: |- + Ignore contains a list of rules for specifying which changes to ignore + during diffing. + items: + description: |- + IgnoreRule defines a rule to selectively disregard specific changes during + the drift detection process. + properties: + paths: + description: |- + Paths is a list of JSON Pointer (RFC 6901) paths to be excluded from + consideration in a Kubernetes object. + items: + type: string + type: array + target: + description: |- + Target is a selector for specifying Kubernetes objects to which this + rule applies. + If Target is not set, the Paths will be ignored for all Kubernetes + objects within the manifest of the Helm release. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - paths + type: object + type: array + mode: + description: |- + Mode defines how differences should be handled between the Helm manifest + and the manifest currently applied to the cluster. + If not explicitly set, it defaults to DiffModeDisabled. + enum: + - enabled + - warn + - disabled + type: string + type: object + install: + description: + Install holds the configuration for Helm install actions + for this HelmRelease. + properties: + crds: + description: |- + CRDs upgrade CRDs from the Helm Chart's crds directory according + to the CRD upgrade policy provided here. Valid values are `Skip`, + `Create` or `CreateReplace`. Default is `Create` and if omitted + CRDs are installed but not updated. + + Skip: do neither install nor replace (update) any CRDs. + + Create: new CRDs are created, existing CRDs are neither updated nor deleted. + + CreateReplace: new CRDs are created, existing CRDs are updated (replaced) + but not deleted. + + By default, CRDs are applied (installed) during Helm install action. + With this option users can opt in to CRD replace existing CRDs on Helm + install actions, which is not (yet) natively supported by Helm. + https://helm.sh/docs/chart_best_practices/custom_resource_definitions. + enum: + - Skip + - Create + - CreateReplace + type: string + createNamespace: + description: |- + CreateNamespace tells the Helm install action to create the + HelmReleaseSpec.TargetNamespace if it does not exist yet. + On uninstall, the namespace will not be garbage collected. + type: boolean + disableHooks: + description: + DisableHooks prevents hooks from running during the + Helm install action. + type: boolean + disableOpenAPIValidation: + description: |- + DisableOpenAPIValidation prevents the Helm install action from validating + rendered templates against the Kubernetes OpenAPI Schema. + type: boolean + disableSchemaValidation: + description: |- + DisableSchemaValidation prevents the Helm install action from validating + the values against the JSON Schema. + type: boolean + disableTakeOwnership: + description: |- + DisableTakeOwnership disables taking ownership of existing resources + during the Helm install action. Defaults to false. + type: boolean + disableWait: + description: |- + DisableWait disables the waiting for resources to be ready after a Helm + install has been performed. + type: boolean + disableWaitForJobs: + description: |- + DisableWaitForJobs disables waiting for jobs to complete after a Helm + install has been performed. + type: boolean + remediation: + description: |- + Remediation holds the remediation configuration for when the Helm install + action for the HelmRelease fails. The default is to not perform any action. + properties: + ignoreTestFailures: + description: |- + IgnoreTestFailures tells the controller to skip remediation when the Helm + tests are run after an install action but fail. Defaults to + 'Test.IgnoreFailures'. + type: boolean + remediateLastFailure: + description: |- + RemediateLastFailure tells the controller to remediate the last failure, when + no retries remain. Defaults to 'false'. + type: boolean + retries: + description: |- + Retries is the number of retries that should be attempted on failures before + bailing. Remediation, using an uninstall, is performed between each attempt. + Defaults to '0', a negative integer equals to unlimited retries. + type: integer + type: object + replace: + description: |- + Replace tells the Helm install action to re-use the 'ReleaseName', but only + if that name is a deleted release which remains in the history. + type: boolean + skipCRDs: + description: |- + SkipCRDs tells the Helm install action to not install any CRDs. By default, + CRDs are installed if not already present. + + Deprecated use CRD policy (`crds`) attribute with value `Skip` instead. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm install action. Defaults to + 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + interval: + description: Interval at which to reconcile the Helm release. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + kubeConfig: + description: |- + KubeConfig for reconciling the HelmRelease on a remote cluster. + When used in combination with HelmReleaseSpec.ServiceAccountName, + forces the controller to act on behalf of that Service Account at the + target cluster. + If the --default-service-account flag is set, its value will be used as + a controller level fallback for when HelmReleaseSpec.ServiceAccountName + is empty. + properties: + secretRef: + description: |- + SecretRef holds the name of a secret that contains a key with + the kubeconfig file as the value. If no key is set, the key will default + to 'value'. + It is recommended that the kubeconfig is self-contained, and the secret + is regularly updated if credentials such as a cloud-access-token expire. + Cloud specific `cmd-path` auth helpers will not function without adding + binaries and credentials to the Pod that is responsible for reconciling + Kubernetes resources. + properties: + key: + description: + Key in the Secret, when not specified an implementation-specific + default key is used. + type: string + name: + description: Name of the Secret. + type: string + required: + - name + type: object + required: + - secretRef + type: object + maxHistory: + description: |- + MaxHistory is the number of revisions saved by Helm for this HelmRelease. + Use '0' for an unlimited number of revisions; defaults to '5'. + type: integer + persistentClient: + description: |- + PersistentClient tells the controller to use a persistent Kubernetes + client for this release. When enabled, the client will be reused for the + duration of the reconciliation, instead of being created and destroyed + for each (step of a) Helm action. + + This can improve performance, but may cause issues with some Helm charts + that for example do create Custom Resource Definitions during installation + outside Helm's CRD lifecycle hooks, which are then not observed to be + available by e.g. post-install hooks. + + If not set, it defaults to true. + type: boolean + postRenderers: + description: |- + PostRenderers holds an array of Helm PostRenderers, which will be applied in order + of their definition. + items: + description: PostRenderer contains a Helm PostRenderer specification. + properties: + kustomize: + description: Kustomization to apply as PostRenderer. + properties: + images: + description: |- + Images is a list of (image name, new name, new tag or digest) + for changing image names, tags or digests. This can also be achieved with a + patch, but this operator is simpler to specify. + items: + description: + Image contains an image name, a new name, + a new tag or digest, which will replace the original + name and tag. + properties: + digest: + description: |- + Digest is the value used to replace the original image tag. + If digest is present NewTag value is ignored. + type: string + name: + description: Name is a tag-less image name. + type: string + newName: + description: + NewName is the value used to replace + the original name. + type: string + newTag: + description: + NewTag is the value used to replace the + original tag. + type: string + required: + - name + type: object + type: array + patches: + description: |- + Strategic merge and JSON patches, defined as inline YAML objects, + capable of targeting objects based on kind, label and annotation selectors. + items: + description: |- + Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should + be applied to. + properties: + patch: + description: |- + Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with + an array of operation objects. + type: string + target: + description: + Target points to the resources that the + patch document should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + type: object + type: array + type: object + type: object + type: array + releaseName: + description: |- + ReleaseName used for the Helm release. Defaults to a composition of + '[TargetNamespace-]Name'. + maxLength: 53 + minLength: 1 + type: string + rollback: + description: + Rollback holds the configuration for Helm rollback actions + for this HelmRelease. + properties: + cleanupOnFail: + description: |- + CleanupOnFail allows deletion of new resources created during the Helm + rollback action when it fails. + type: boolean + disableHooks: + description: + DisableHooks prevents hooks from running during the + Helm rollback action. + type: boolean + disableWait: + description: |- + DisableWait disables the waiting for resources to be ready after a Helm + rollback has been performed. + type: boolean + disableWaitForJobs: + description: |- + DisableWaitForJobs disables waiting for jobs to complete after a Helm + rollback has been performed. + type: boolean + force: + description: + Force forces resource updates through a replacement + strategy. + type: boolean + recreate: + description: + Recreate performs pod restarts for the resource if + applicable. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm rollback action. Defaults to + 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + serviceAccountName: + description: |- + The name of the Kubernetes service account to impersonate + when reconciling this HelmRelease. + maxLength: 253 + minLength: 1 + type: string + storageNamespace: + description: |- + StorageNamespace used for the Helm storage. + Defaults to the namespace of the HelmRelease. + maxLength: 63 + minLength: 1 + type: string + suspend: + description: |- + Suspend tells the controller to suspend reconciliation for this HelmRelease, + it does not apply to already started reconciliations. Defaults to false. + type: boolean + targetNamespace: + description: |- + TargetNamespace to target when performing operations for the HelmRelease. + Defaults to the namespace of the HelmRelease. + maxLength: 63 + minLength: 1 + type: string + test: + description: + Test holds the configuration for Helm test actions for + this HelmRelease. + properties: + enable: + description: |- + Enable enables Helm test actions for this HelmRelease after an Helm install + or upgrade action has been performed. + type: boolean + filters: + description: + Filters is a list of tests to run or exclude from + running. + items: + description: + Filter holds the configuration for individual Helm + test filters. + properties: + exclude: + description: + Exclude specifies whether the named test should + be excluded. + type: boolean + name: + description: Name is the name of the test. + maxLength: 253 + minLength: 1 + type: string + required: + - name + type: object + type: array + ignoreFailures: + description: |- + IgnoreFailures tells the controller to skip remediation when the Helm tests + are run but fail. Can be overwritten for tests run after install or upgrade + actions in 'Install.IgnoreTestFailures' and 'Upgrade.IgnoreTestFailures'. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation during + the performance of a Helm test action. Defaults to 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like Jobs + for hooks) during the performance of a Helm action. Defaults to '5m0s'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + uninstall: + description: + Uninstall holds the configuration for Helm uninstall + actions for this HelmRelease. + properties: + deletionPropagation: + default: background + description: |- + DeletionPropagation specifies the deletion propagation policy when + a Helm uninstall is performed. + enum: + - background + - foreground + - orphan + type: string + disableHooks: + description: + DisableHooks prevents hooks from running during the + Helm rollback action. + type: boolean + disableWait: + description: |- + DisableWait disables waiting for all the resources to be deleted after + a Helm uninstall is performed. + type: boolean + keepHistory: + description: |- + KeepHistory tells Helm to remove all associated resources and mark the + release as deleted, but retain the release history. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm uninstall action. Defaults + to 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + upgrade: + description: + Upgrade holds the configuration for Helm upgrade actions + for this HelmRelease. + properties: + cleanupOnFail: + description: |- + CleanupOnFail allows deletion of new resources created during the Helm + upgrade action when it fails. + type: boolean + crds: + description: |- + CRDs upgrade CRDs from the Helm Chart's crds directory according + to the CRD upgrade policy provided here. Valid values are `Skip`, + `Create` or `CreateReplace`. Default is `Skip` and if omitted + CRDs are neither installed nor upgraded. + + Skip: do neither install nor replace (update) any CRDs. + + Create: new CRDs are created, existing CRDs are neither updated nor deleted. + + CreateReplace: new CRDs are created, existing CRDs are updated (replaced) + but not deleted. + + By default, CRDs are not applied during Helm upgrade action. With this + option users can opt-in to CRD upgrade, which is not (yet) natively supported by Helm. + https://helm.sh/docs/chart_best_practices/custom_resource_definitions. + enum: + - Skip + - Create + - CreateReplace + type: string + disableHooks: + description: + DisableHooks prevents hooks from running during the + Helm upgrade action. + type: boolean + disableOpenAPIValidation: + description: |- + DisableOpenAPIValidation prevents the Helm upgrade action from validating + rendered templates against the Kubernetes OpenAPI Schema. + type: boolean + disableSchemaValidation: + description: |- + DisableSchemaValidation prevents the Helm upgrade action from validating + the values against the JSON Schema. + type: boolean + disableTakeOwnership: + description: |- + DisableTakeOwnership disables taking ownership of existing resources + during the Helm upgrade action. Defaults to false. + type: boolean + disableWait: + description: |- + DisableWait disables the waiting for resources to be ready after a Helm + upgrade has been performed. + type: boolean + disableWaitForJobs: + description: |- + DisableWaitForJobs disables waiting for jobs to complete after a Helm + upgrade has been performed. + type: boolean + force: + description: + Force forces resource updates through a replacement + strategy. + type: boolean + preserveValues: + description: |- + PreserveValues will make Helm reuse the last release's values and merge in + overrides from 'Values'. Setting this flag makes the HelmRelease + non-declarative. + type: boolean + remediation: + description: |- + Remediation holds the remediation configuration for when the Helm upgrade + action for the HelmRelease fails. The default is to not perform any action. + properties: + ignoreTestFailures: + description: |- + IgnoreTestFailures tells the controller to skip remediation when the Helm + tests are run after an upgrade action but fail. + Defaults to 'Test.IgnoreFailures'. + type: boolean + remediateLastFailure: + description: |- + RemediateLastFailure tells the controller to remediate the last failure, when + no retries remain. Defaults to 'false' unless 'Retries' is greater than 0. + type: boolean + retries: + description: |- + Retries is the number of retries that should be attempted on failures before + bailing. Remediation, using 'Strategy', is performed between each attempt. + Defaults to '0', a negative integer equals to unlimited retries. + type: integer + strategy: + description: + Strategy to use for failure remediation. Defaults + to 'rollback'. + enum: + - rollback + - uninstall + type: string + type: object + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm upgrade action. Defaults to + 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + values: + description: Values holds the values for this Helm release. + x-kubernetes-preserve-unknown-fields: true + valuesFrom: + description: |- + ValuesFrom holds references to resources containing Helm values for this HelmRelease, + and information about how they should be merged. + items: + description: |- + ValuesReference contains a reference to a resource containing Helm values, + and optionally the key they can be found at. + properties: + kind: + description: + Kind of the values referent, valid values are ('Secret', + 'ConfigMap'). + enum: + - Secret + - ConfigMap + type: string + name: + description: |- + Name of the values referent. Should reside in the same namespace as the + referring resource. + maxLength: 253 + minLength: 1 + type: string + optional: + description: |- + Optional marks this ValuesReference as optional. When set, a not found error + for the values reference is ignored, but any ValuesKey, TargetPath or + transient error will still result in a reconciliation failure. + type: boolean + targetPath: + description: |- + TargetPath is the YAML dot notation path the value should be merged at. When + set, the ValuesKey is expected to be a single flat value. Defaults to 'None', + which results in the values getting merged at the root. + maxLength: 250 + pattern: ^([a-zA-Z0-9_\-.\\\/]|\[[0-9]{1,5}\])+$ + type: string + valuesKey: + description: |- + ValuesKey is the data key where the values.yaml or a specific value can be + found at. Defaults to 'values.yaml'. + maxLength: 253 + pattern: ^[\-._a-zA-Z0-9]+$ + type: string + required: + - kind + - name + type: object + type: array + required: + - interval + type: object + x-kubernetes-validations: + - message: either chart or chartRef must be set + rule: + (has(self.chart) && !has(self.chartRef)) || (!has(self.chart) + && has(self.chartRef)) + status: + default: + observedGeneration: -1 + description: HelmReleaseStatus defines the observed state of a HelmRelease. + properties: + conditions: + description: Conditions holds the conditions for the HelmRelease. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + failures: + description: |- + Failures is the reconciliation failure count against the latest desired + state. It is reset after a successful reconciliation. + format: int64 + type: integer + helmChart: + description: |- + HelmChart is the namespaced name of the HelmChart resource created by + the controller for the HelmRelease. + type: string + history: + description: |- + History holds the history of Helm releases performed for this HelmRelease + up to the last successfully completed release. + items: + description: |- + Snapshot captures a point-in-time copy of the status information for a Helm release, + as managed by the controller. + properties: + apiVersion: + description: |- + APIVersion is the API version of the Snapshot. + Provisional: when the calculation method of the Digest field is changed, + this field will be used to distinguish between the old and new methods. + type: string + appVersion: + description: + AppVersion is the chart app version of the release + object in storage. + type: string + chartName: + description: + ChartName is the chart name of the release object + in storage. + type: string + chartVersion: + description: |- + ChartVersion is the chart version of the release object in + storage. + type: string + configDigest: + description: |- + ConfigDigest is the checksum of the config (better known as + "values") of the release object in storage. + It has the format of `:`. + type: string + deleted: + description: Deleted is when the release was deleted. + format: date-time + type: string + digest: + description: |- + Digest is the checksum of the release object in storage. + It has the format of `:`. + type: string + firstDeployed: + description: FirstDeployed is when the release was first deployed. + format: date-time + type: string + lastDeployed: + description: LastDeployed is when the release was last deployed. + format: date-time + type: string + name: + description: Name is the name of the release. + type: string + namespace: + description: + Namespace is the namespace the release is deployed + to. + type: string + ociDigest: + description: + OCIDigest is the digest of the OCI artifact associated + with the release. + type: string + status: + description: Status is the current state of the release. + type: string + testHooks: + additionalProperties: + description: |- + TestHookStatus holds the status information for a test hook as observed + to be run by the controller. + properties: + lastCompleted: + description: + LastCompleted is the time the test hook last + completed. + format: date-time + type: string + lastStarted: + description: + LastStarted is the time the test hook was + last started. + format: date-time + type: string + phase: + description: Phase the test hook was observed to be in. + type: string + type: object + description: |- + TestHooks is the list of test hooks for the release as observed to be + run by the controller. + type: object + version: + description: + Version is the version of the release object in + storage. + type: integer + required: + - chartName + - chartVersion + - configDigest + - digest + - firstDeployed + - lastDeployed + - name + - namespace + - status + - version + type: object + type: array + installFailures: + description: |- + InstallFailures is the install failure count against the latest desired + state. It is reset after a successful reconciliation. + format: int64 + type: integer + lastAttemptedConfigDigest: + description: |- + LastAttemptedConfigDigest is the digest for the config (better known as + "values") of the last reconciliation attempt. + type: string + lastAttemptedGeneration: + description: |- + LastAttemptedGeneration is the last generation the controller attempted + to reconcile. + format: int64 + type: integer + lastAttemptedReleaseAction: + description: |- + LastAttemptedReleaseAction is the last release action performed for this + HelmRelease. It is used to determine the active remediation strategy. + enum: + - install + - upgrade + type: string + lastAttemptedRevision: + description: |- + LastAttemptedRevision is the Source revision of the last reconciliation + attempt. For OCIRepository sources, the 12 first characters of the digest are + appended to the chart version e.g. "1.2.3+1234567890ab". + type: string + lastAttemptedRevisionDigest: + description: |- + LastAttemptedRevisionDigest is the digest of the last reconciliation attempt. + This is only set for OCIRepository sources. + type: string + lastAttemptedValuesChecksum: + description: |- + LastAttemptedValuesChecksum is the SHA1 checksum for the values of the last + reconciliation attempt. + Deprecated: Use LastAttemptedConfigDigest instead. + type: string + lastHandledForceAt: + description: |- + LastHandledForceAt holds the value of the most recent force request + value, so a change of the annotation value can be detected. + type: string + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + lastHandledResetAt: + description: |- + LastHandledResetAt holds the value of the most recent reset request + value, so a change of the annotation value can be detected. + type: string + lastReleaseRevision: + description: |- + LastReleaseRevision is the revision of the last successful Helm release. + Deprecated: Use History instead. + type: integer + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + observedPostRenderersDigest: + description: |- + ObservedPostRenderersDigest is the digest for the post-renderers of + the last successful reconciliation attempt. + type: string + storageNamespace: + description: |- + StorageNamespace is the namespace of the Helm release storage for the + current release. + maxLength: 63 + minLength: 1 + type: string + upgradeFailures: + description: |- + UpgradeFailures is the upgrade failure count against the latest desired + state. It is reset after a successful reconciliation. + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v2beta1 HelmRelease is deprecated, upgrade to v2 + name: v2beta1 + schema: + openAPIV3Schema: + description: HelmRelease is the Schema for the helmreleases API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: HelmReleaseSpec defines the desired state of a Helm release. + properties: + chart: + description: |- + Chart defines the template of the v1beta2.HelmChart that should be created + for this HelmRelease. + properties: + metadata: + description: + ObjectMeta holds the template for metadata like labels + and annotations. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + type: object + labels: + additionalProperties: + type: string + description: |- + Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + type: object + type: object + spec: + description: + Spec holds the template for the v1beta2.HelmChartSpec + for this HelmRelease. + properties: + chart: + description: + The name or path the Helm chart is available + at in the SourceRef. + type: string + interval: + description: |- + Interval at which to check the v1beta2.Source for updates. Defaults to + 'HelmReleaseSpec.Interval'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + reconcileStrategy: + default: ChartVersion + description: |- + Determines what enables the creation of a new artifact. Valid values are + ('ChartVersion', 'Revision'). + See the documentation of the values for an explanation on their behavior. + Defaults to ChartVersion when omitted. + enum: + - ChartVersion + - Revision + type: string + sourceRef: + description: + The name and namespace of the v1beta2.Source + the chart is available at. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: Kind of the referent. + enum: + - HelmRepository + - GitRepository + - Bucket + type: string + name: + description: Name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: Namespace of the referent. + maxLength: 63 + minLength: 1 + type: string + required: + - kind + - name + type: object + valuesFile: + description: |- + Alternative values file to use as the default chart values, expected to + be a relative path in the SourceRef. Deprecated in favor of ValuesFiles, + for backwards compatibility the file defined here is merged before the + ValuesFiles items. Ignored when omitted. + type: string + valuesFiles: + description: |- + Alternative list of values files to use as the chart values (values.yaml + is not included by default), expected to be a relative path in the SourceRef. + Values files are merged in the order of this list with the last file overriding + the first. Ignored when omitted. + items: + type: string + type: array + verify: + description: |- + Verify contains the secret name containing the trusted public keys + used to verify the signature and specifies which provider to use to check + whether OCI image is authentic. + This field is only supported for OCI sources. + Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified. + properties: + provider: + default: cosign + description: + Provider specifies the technology used to + sign the OCI Helm chart. + enum: + - cosign + type: string + secretRef: + description: |- + SecretRef specifies the Kubernetes Secret containing the + trusted public keys. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - provider + type: object + version: + default: "*" + description: |- + Version semver expression, ignored for charts from v1beta2.GitRepository and + v1beta2.Bucket sources. Defaults to latest when omitted. + type: string + required: + - chart + - sourceRef + type: object + required: + - spec + type: object + chartRef: + description: |- + ChartRef holds a reference to a source controller resource containing the + Helm chart artifact. + + Note: this field is provisional to the v2 API, and not actively used + by v2beta1 HelmReleases. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: Kind of the referent. + enum: + - OCIRepository + - HelmChart + type: string + name: + description: Name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace of the referent, defaults to the namespace of the Kubernetes + resource object that contains the reference. + maxLength: 63 + minLength: 1 + type: string + required: + - kind + - name + type: object + dependsOn: + description: |- + DependsOn may contain a meta.NamespacedObjectReference slice with + references to HelmRelease resources that must be ready before this HelmRelease + can be reconciled. + items: + description: |- + NamespacedObjectReference contains enough information to locate the referenced Kubernetes resource object in any + namespace. + properties: + name: + description: Name of the referent. + type: string + namespace: + description: + Namespace of the referent, when not specified it + acts as LocalObjectReference. + type: string + required: + - name + type: object + type: array + driftDetection: + description: |- + DriftDetection holds the configuration for detecting and handling + differences between the manifest in the Helm storage and the resources + currently existing in the cluster. + + Note: this field is provisional to the v2beta2 API, and not actively used + by v2beta1 HelmReleases. + properties: + ignore: + description: |- + Ignore contains a list of rules for specifying which changes to ignore + during diffing. + items: + description: |- + IgnoreRule defines a rule to selectively disregard specific changes during + the drift detection process. + properties: + paths: + description: |- + Paths is a list of JSON Pointer (RFC 6901) paths to be excluded from + consideration in a Kubernetes object. + items: + type: string + type: array + target: + description: |- + Target is a selector for specifying Kubernetes objects to which this + rule applies. + If Target is not set, the Paths will be ignored for all Kubernetes + objects within the manifest of the Helm release. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - paths + type: object + type: array + mode: + description: |- + Mode defines how differences should be handled between the Helm manifest + and the manifest currently applied to the cluster. + If not explicitly set, it defaults to DiffModeDisabled. + enum: + - enabled + - warn + - disabled + type: string + type: object + install: + description: + Install holds the configuration for Helm install actions + for this HelmRelease. + properties: + crds: + description: |- + CRDs upgrade CRDs from the Helm Chart's crds directory according + to the CRD upgrade policy provided here. Valid values are `Skip`, + `Create` or `CreateReplace`. Default is `Create` and if omitted + CRDs are installed but not updated. + + Skip: do neither install nor replace (update) any CRDs. + + Create: new CRDs are created, existing CRDs are neither updated nor deleted. + + CreateReplace: new CRDs are created, existing CRDs are updated (replaced) + but not deleted. + + By default, CRDs are applied (installed) during Helm install action. + With this option users can opt-in to CRD replace existing CRDs on Helm + install actions, which is not (yet) natively supported by Helm. + https://helm.sh/docs/chart_best_practices/custom_resource_definitions. + enum: + - Skip + - Create + - CreateReplace + type: string + createNamespace: + description: |- + CreateNamespace tells the Helm install action to create the + HelmReleaseSpec.TargetNamespace if it does not exist yet. + On uninstall, the namespace will not be garbage collected. + type: boolean + disableHooks: + description: + DisableHooks prevents hooks from running during the + Helm install action. + type: boolean + disableOpenAPIValidation: + description: |- + DisableOpenAPIValidation prevents the Helm install action from validating + rendered templates against the Kubernetes OpenAPI Schema. + type: boolean + disableWait: + description: |- + DisableWait disables the waiting for resources to be ready after a Helm + install has been performed. + type: boolean + disableWaitForJobs: + description: |- + DisableWaitForJobs disables waiting for jobs to complete after a Helm + install has been performed. + type: boolean + remediation: + description: |- + Remediation holds the remediation configuration for when the Helm install + action for the HelmRelease fails. The default is to not perform any action. + properties: + ignoreTestFailures: + description: |- + IgnoreTestFailures tells the controller to skip remediation when the Helm + tests are run after an install action but fail. Defaults to + 'Test.IgnoreFailures'. + type: boolean + remediateLastFailure: + description: |- + RemediateLastFailure tells the controller to remediate the last failure, when + no retries remain. Defaults to 'false'. + type: boolean + retries: + description: |- + Retries is the number of retries that should be attempted on failures before + bailing. Remediation, using an uninstall, is performed between each attempt. + Defaults to '0', a negative integer equals to unlimited retries. + type: integer + type: object + replace: + description: |- + Replace tells the Helm install action to re-use the 'ReleaseName', but only + if that name is a deleted release which remains in the history. + type: boolean + skipCRDs: + description: |- + SkipCRDs tells the Helm install action to not install any CRDs. By default, + CRDs are installed if not already present. + + Deprecated use CRD policy (`crds`) attribute with value `Skip` instead. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm install action. Defaults to + 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + interval: + description: |- + Interval at which to reconcile the Helm release. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + kubeConfig: + description: |- + KubeConfig for reconciling the HelmRelease on a remote cluster. + When used in combination with HelmReleaseSpec.ServiceAccountName, + forces the controller to act on behalf of that Service Account at the + target cluster. + If the --default-service-account flag is set, its value will be used as + a controller level fallback for when HelmReleaseSpec.ServiceAccountName + is empty. + properties: + secretRef: + description: |- + SecretRef holds the name of a secret that contains a key with + the kubeconfig file as the value. If no key is set, the key will default + to 'value'. + It is recommended that the kubeconfig is self-contained, and the secret + is regularly updated if credentials such as a cloud-access-token expire. + Cloud specific `cmd-path` auth helpers will not function without adding + binaries and credentials to the Pod that is responsible for reconciling + Kubernetes resources. + properties: + key: + description: + Key in the Secret, when not specified an implementation-specific + default key is used. + type: string + name: + description: Name of the Secret. + type: string + required: + - name + type: object + required: + - secretRef + type: object + maxHistory: + description: |- + MaxHistory is the number of revisions saved by Helm for this HelmRelease. + Use '0' for an unlimited number of revisions; defaults to '10'. + type: integer + persistentClient: + description: |- + PersistentClient tells the controller to use a persistent Kubernetes + client for this release. When enabled, the client will be reused for the + duration of the reconciliation, instead of being created and destroyed + for each (step of a) Helm action. + + This can improve performance, but may cause issues with some Helm charts + that for example do create Custom Resource Definitions during installation + outside Helm's CRD lifecycle hooks, which are then not observed to be + available by e.g. post-install hooks. + + If not set, it defaults to true. + type: boolean + postRenderers: + description: |- + PostRenderers holds an array of Helm PostRenderers, which will be applied in order + of their definition. + items: + description: PostRenderer contains a Helm PostRenderer specification. + properties: + kustomize: + description: Kustomization to apply as PostRenderer. + properties: + images: + description: |- + Images is a list of (image name, new name, new tag or digest) + for changing image names, tags or digests. This can also be achieved with a + patch, but this operator is simpler to specify. + items: + description: + Image contains an image name, a new name, + a new tag or digest, which will replace the original + name and tag. + properties: + digest: + description: |- + Digest is the value used to replace the original image tag. + If digest is present NewTag value is ignored. + type: string + name: + description: Name is a tag-less image name. + type: string + newName: + description: + NewName is the value used to replace + the original name. + type: string + newTag: + description: + NewTag is the value used to replace the + original tag. + type: string + required: + - name + type: object + type: array + patches: + description: |- + Strategic merge and JSON patches, defined as inline YAML objects, + capable of targeting objects based on kind, label and annotation selectors. + items: + description: |- + Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should + be applied to. + properties: + patch: + description: |- + Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with + an array of operation objects. + type: string + target: + description: + Target points to the resources that the + patch document should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + type: object + type: array + patchesJson6902: + description: JSON 6902 patches, defined as inline YAML objects. + items: + description: + JSON6902Patch contains a JSON6902 patch and + the target the patch should be applied to. + properties: + patch: + description: + Patch contains the JSON6902 patch document + with an array of operation objects. + items: + description: |- + JSON6902 is a JSON6902 operation object. + https://datatracker.ietf.org/doc/html/rfc6902#section-4 + properties: + from: + description: |- + From contains a JSON-pointer value that references a location within the target document where the operation is + performed. The meaning of the value depends on the value of Op, and is NOT taken into account by all operations. + type: string + op: + description: |- + Op indicates the operation to perform. Its value MUST be one of "add", "remove", "replace", "move", "copy", or + "test". + https://datatracker.ietf.org/doc/html/rfc6902#section-4 + enum: + - test + - remove + - add + - replace + - move + - copy + type: string + path: + description: |- + Path contains the JSON-pointer value that references a location within the target document where the operation + is performed. The meaning of the value depends on the value of Op. + type: string + value: + description: |- + Value contains a valid JSON structure. The meaning of the value depends on the value of Op, and is NOT taken into + account by all operations. + x-kubernetes-preserve-unknown-fields: true + required: + - op + - path + type: object + type: array + target: + description: + Target points to the resources that the + patch document should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + - target + type: object + type: array + patchesStrategicMerge: + description: + Strategic merge patches, defined as inline + YAML objects. + items: + x-kubernetes-preserve-unknown-fields: true + type: array + type: object + type: object + type: array + releaseName: + description: |- + ReleaseName used for the Helm release. Defaults to a composition of + '[TargetNamespace-]Name'. + maxLength: 53 + minLength: 1 + type: string + rollback: + description: + Rollback holds the configuration for Helm rollback actions + for this HelmRelease. + properties: + cleanupOnFail: + description: |- + CleanupOnFail allows deletion of new resources created during the Helm + rollback action when it fails. + type: boolean + disableHooks: + description: + DisableHooks prevents hooks from running during the + Helm rollback action. + type: boolean + disableWait: + description: |- + DisableWait disables the waiting for resources to be ready after a Helm + rollback has been performed. + type: boolean + disableWaitForJobs: + description: |- + DisableWaitForJobs disables waiting for jobs to complete after a Helm + rollback has been performed. + type: boolean + force: + description: + Force forces resource updates through a replacement + strategy. + type: boolean + recreate: + description: + Recreate performs pod restarts for the resource if + applicable. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm rollback action. Defaults to + 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + serviceAccountName: + description: |- + The name of the Kubernetes service account to impersonate + when reconciling this HelmRelease. + type: string + storageNamespace: + description: |- + StorageNamespace used for the Helm storage. + Defaults to the namespace of the HelmRelease. + maxLength: 63 + minLength: 1 + type: string + suspend: + description: |- + Suspend tells the controller to suspend reconciliation for this HelmRelease, + it does not apply to already started reconciliations. Defaults to false. + type: boolean + targetNamespace: + description: |- + TargetNamespace to target when performing operations for the HelmRelease. + Defaults to the namespace of the HelmRelease. + maxLength: 63 + minLength: 1 + type: string + test: + description: + Test holds the configuration for Helm test actions for + this HelmRelease. + properties: + enable: + description: |- + Enable enables Helm test actions for this HelmRelease after an Helm install + or upgrade action has been performed. + type: boolean + ignoreFailures: + description: |- + IgnoreFailures tells the controller to skip remediation when the Helm tests + are run but fail. Can be overwritten for tests run after install or upgrade + actions in 'Install.IgnoreTestFailures' and 'Upgrade.IgnoreTestFailures'. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation during + the performance of a Helm test action. Defaults to 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like Jobs + for hooks) during the performance of a Helm action. Defaults to '5m0s'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + uninstall: + description: + Uninstall holds the configuration for Helm uninstall + actions for this HelmRelease. + properties: + deletionPropagation: + default: background + description: |- + DeletionPropagation specifies the deletion propagation policy when + a Helm uninstall is performed. + enum: + - background + - foreground + - orphan + type: string + disableHooks: + description: + DisableHooks prevents hooks from running during the + Helm rollback action. + type: boolean + disableWait: + description: |- + DisableWait disables waiting for all the resources to be deleted after + a Helm uninstall is performed. + type: boolean + keepHistory: + description: |- + KeepHistory tells Helm to remove all associated resources and mark the + release as deleted, but retain the release history. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm uninstall action. Defaults + to 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + upgrade: + description: + Upgrade holds the configuration for Helm upgrade actions + for this HelmRelease. + properties: + cleanupOnFail: + description: |- + CleanupOnFail allows deletion of new resources created during the Helm + upgrade action when it fails. + type: boolean + crds: + description: |- + CRDs upgrade CRDs from the Helm Chart's crds directory according + to the CRD upgrade policy provided here. Valid values are `Skip`, + `Create` or `CreateReplace`. Default is `Skip` and if omitted + CRDs are neither installed nor upgraded. + + Skip: do neither install nor replace (update) any CRDs. + + Create: new CRDs are created, existing CRDs are neither updated nor deleted. + + CreateReplace: new CRDs are created, existing CRDs are updated (replaced) + but not deleted. + + By default, CRDs are not applied during Helm upgrade action. With this + option users can opt-in to CRD upgrade, which is not (yet) natively supported by Helm. + https://helm.sh/docs/chart_best_practices/custom_resource_definitions. + enum: + - Skip + - Create + - CreateReplace + type: string + disableHooks: + description: + DisableHooks prevents hooks from running during the + Helm upgrade action. + type: boolean + disableOpenAPIValidation: + description: |- + DisableOpenAPIValidation prevents the Helm upgrade action from validating + rendered templates against the Kubernetes OpenAPI Schema. + type: boolean + disableWait: + description: |- + DisableWait disables the waiting for resources to be ready after a Helm + upgrade has been performed. + type: boolean + disableWaitForJobs: + description: |- + DisableWaitForJobs disables waiting for jobs to complete after a Helm + upgrade has been performed. + type: boolean + force: + description: + Force forces resource updates through a replacement + strategy. + type: boolean + preserveValues: + description: |- + PreserveValues will make Helm reuse the last release's values and merge in + overrides from 'Values'. Setting this flag makes the HelmRelease + non-declarative. + type: boolean + remediation: + description: |- + Remediation holds the remediation configuration for when the Helm upgrade + action for the HelmRelease fails. The default is to not perform any action. + properties: + ignoreTestFailures: + description: |- + IgnoreTestFailures tells the controller to skip remediation when the Helm + tests are run after an upgrade action but fail. + Defaults to 'Test.IgnoreFailures'. + type: boolean + remediateLastFailure: + description: |- + RemediateLastFailure tells the controller to remediate the last failure, when + no retries remain. Defaults to 'false' unless 'Retries' is greater than 0. + type: boolean + retries: + description: |- + Retries is the number of retries that should be attempted on failures before + bailing. Remediation, using 'Strategy', is performed between each attempt. + Defaults to '0', a negative integer equals to unlimited retries. + type: integer + strategy: + description: + Strategy to use for failure remediation. Defaults + to 'rollback'. + enum: + - rollback + - uninstall + type: string + type: object + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm upgrade action. Defaults to + 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + values: + description: Values holds the values for this Helm release. + x-kubernetes-preserve-unknown-fields: true + valuesFrom: + description: |- + ValuesFrom holds references to resources containing Helm values for this HelmRelease, + and information about how they should be merged. + items: + description: |- + ValuesReference contains a reference to a resource containing Helm values, + and optionally the key they can be found at. + properties: + kind: + description: + Kind of the values referent, valid values are ('Secret', + 'ConfigMap'). + enum: + - Secret + - ConfigMap + type: string + name: + description: |- + Name of the values referent. Should reside in the same namespace as the + referring resource. + maxLength: 253 + minLength: 1 + type: string + optional: + description: |- + Optional marks this ValuesReference as optional. When set, a not found error + for the values reference is ignored, but any ValuesKey, TargetPath or + transient error will still result in a reconciliation failure. + type: boolean + targetPath: + description: |- + TargetPath is the YAML dot notation path the value should be merged at. When + set, the ValuesKey is expected to be a single flat value. Defaults to 'None', + which results in the values getting merged at the root. + maxLength: 250 + pattern: ^([a-zA-Z0-9_\-.\\\/]|\[[0-9]{1,5}\])+$ + type: string + valuesKey: + description: |- + ValuesKey is the data key where the values.yaml or a specific value can be + found at. Defaults to 'values.yaml'. + When set, must be a valid Data Key, consisting of alphanumeric characters, + '-', '_' or '.'. + maxLength: 253 + pattern: ^[\-._a-zA-Z0-9]+$ + type: string + required: + - kind + - name + type: object + type: array + required: + - chart + - interval + type: object + status: + default: + observedGeneration: -1 + description: HelmReleaseStatus defines the observed state of a HelmRelease. + properties: + conditions: + description: Conditions holds the conditions for the HelmRelease. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + failures: + description: |- + Failures is the reconciliation failure count against the latest desired + state. It is reset after a successful reconciliation. + format: int64 + type: integer + helmChart: + description: |- + HelmChart is the namespaced name of the HelmChart resource created by + the controller for the HelmRelease. + type: string + history: + description: |- + History holds the history of Helm releases performed for this HelmRelease + up to the last successfully completed release. + + Note: this field is provisional to the v2beta2 API, and not actively used + by v2beta1 HelmReleases. + items: + description: |- + Snapshot captures a point-in-time copy of the status information for a Helm release, + as managed by the controller. + properties: + apiVersion: + description: |- + APIVersion is the API version of the Snapshot. + Provisional: when the calculation method of the Digest field is changed, + this field will be used to distinguish between the old and new methods. + type: string + appVersion: + description: + AppVersion is the chart app version of the release + object in storage. + type: string + chartName: + description: + ChartName is the chart name of the release object + in storage. + type: string + chartVersion: + description: |- + ChartVersion is the chart version of the release object in + storage. + type: string + configDigest: + description: |- + ConfigDigest is the checksum of the config (better known as + "values") of the release object in storage. + It has the format of `:`. + type: string + deleted: + description: Deleted is when the release was deleted. + format: date-time + type: string + digest: + description: |- + Digest is the checksum of the release object in storage. + It has the format of `:`. + type: string + firstDeployed: + description: FirstDeployed is when the release was first deployed. + format: date-time + type: string + lastDeployed: + description: LastDeployed is when the release was last deployed. + format: date-time + type: string + name: + description: Name is the name of the release. + type: string + namespace: + description: + Namespace is the namespace the release is deployed + to. + type: string + ociDigest: + description: + OCIDigest is the digest of the OCI artifact associated + with the release. + type: string + status: + description: Status is the current state of the release. + type: string + testHooks: + additionalProperties: + description: |- + TestHookStatus holds the status information for a test hook as observed + to be run by the controller. + properties: + lastCompleted: + description: + LastCompleted is the time the test hook last + completed. + format: date-time + type: string + lastStarted: + description: + LastStarted is the time the test hook was + last started. + format: date-time + type: string + phase: + description: Phase the test hook was observed to be in. + type: string + type: object + description: |- + TestHooks is the list of test hooks for the release as observed to be + run by the controller. + type: object + version: + description: + Version is the version of the release object in + storage. + type: integer + required: + - chartName + - chartVersion + - configDigest + - digest + - firstDeployed + - lastDeployed + - name + - namespace + - status + - version + type: object + type: array + installFailures: + description: |- + InstallFailures is the install failure count against the latest desired + state. It is reset after a successful reconciliation. + format: int64 + type: integer + lastAppliedRevision: + description: + LastAppliedRevision is the revision of the last successfully + applied source. + type: string + lastAttemptedConfigDigest: + description: |- + LastAttemptedConfigDigest is the digest for the config (better known as + "values") of the last reconciliation attempt. + + Note: this field is provisional to the v2beta2 API, and not actively used + by v2beta1 HelmReleases. + type: string + lastAttemptedGeneration: + description: |- + LastAttemptedGeneration is the last generation the controller attempted + to reconcile. + + Note: this field is provisional to the v2beta2 API, and not actively used + by v2beta1 HelmReleases. + format: int64 + type: integer + lastAttemptedReleaseAction: + description: |- + LastAttemptedReleaseAction is the last release action performed for this + HelmRelease. It is used to determine the active remediation strategy. + + Note: this field is provisional to the v2beta2 API, and not actively used + by v2beta1 HelmReleases. + type: string + lastAttemptedRevision: + description: + LastAttemptedRevision is the revision of the last reconciliation + attempt. + type: string + lastAttemptedValuesChecksum: + description: |- + LastAttemptedValuesChecksum is the SHA1 checksum of the values of the last + reconciliation attempt. + type: string + lastHandledForceAt: + description: |- + LastHandledForceAt holds the value of the most recent force request + value, so a change of the annotation value can be detected. + + Note: this field is provisional to the v2beta2 API, and not actively used + by v2beta1 HelmReleases. + type: string + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + lastHandledResetAt: + description: |- + LastHandledResetAt holds the value of the most recent reset request + value, so a change of the annotation value can be detected. + + Note: this field is provisional to the v2beta2 API, and not actively used + by v2beta1 HelmReleases. + type: string + lastReleaseRevision: + description: + LastReleaseRevision is the revision of the last successful + Helm release. + type: integer + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + observedPostRenderersDigest: + description: |- + ObservedPostRenderersDigest is the digest for the post-renderers of + the last successful reconciliation attempt. + type: string + storageNamespace: + description: |- + StorageNamespace is the namespace of the Helm release storage for the + current release. + + Note: this field is provisional to the v2beta2 API, and not actively used + by v2beta1 HelmReleases. + type: string + upgradeFailures: + description: |- + UpgradeFailures is the upgrade failure count against the latest desired + state. It is reset after a successful reconciliation. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v2beta2 HelmRelease is deprecated, upgrade to v2 + name: v2beta2 + schema: + openAPIV3Schema: + description: HelmRelease is the Schema for the helmreleases API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: HelmReleaseSpec defines the desired state of a Helm release. + properties: + chart: + description: |- + Chart defines the template of the v1beta2.HelmChart that should be created + for this HelmRelease. + properties: + metadata: + description: + ObjectMeta holds the template for metadata like labels + and annotations. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + type: object + labels: + additionalProperties: + type: string + description: |- + Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + type: object + type: object + spec: + description: + Spec holds the template for the v1beta2.HelmChartSpec + for this HelmRelease. + properties: + chart: + description: + The name or path the Helm chart is available + at in the SourceRef. + maxLength: 2048 + minLength: 1 + type: string + ignoreMissingValuesFiles: + description: + IgnoreMissingValuesFiles controls whether to + silently ignore missing values files rather than failing. + type: boolean + interval: + description: |- + Interval at which to check the v1.Source for updates. Defaults to + 'HelmReleaseSpec.Interval'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + reconcileStrategy: + default: ChartVersion + description: |- + Determines what enables the creation of a new artifact. Valid values are + ('ChartVersion', 'Revision'). + See the documentation of the values for an explanation on their behavior. + Defaults to ChartVersion when omitted. + enum: + - ChartVersion + - Revision + type: string + sourceRef: + description: + The name and namespace of the v1.Source the chart + is available at. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: Kind of the referent. + enum: + - HelmRepository + - GitRepository + - Bucket + type: string + name: + description: Name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: Namespace of the referent. + maxLength: 63 + minLength: 1 + type: string + required: + - kind + - name + type: object + valuesFile: + description: |- + Alternative values file to use as the default chart values, expected to + be a relative path in the SourceRef. Deprecated in favor of ValuesFiles, + for backwards compatibility the file defined here is merged before the + ValuesFiles items. Ignored when omitted. + type: string + valuesFiles: + description: |- + Alternative list of values files to use as the chart values (values.yaml + is not included by default), expected to be a relative path in the SourceRef. + Values files are merged in the order of this list with the last file overriding + the first. Ignored when omitted. + items: + type: string + type: array + verify: + description: |- + Verify contains the secret name containing the trusted public keys + used to verify the signature and specifies which provider to use to check + whether OCI image is authentic. + This field is only supported for OCI sources. + Chart dependencies, which are not bundled in the umbrella chart artifact, + are not verified. + properties: + provider: + default: cosign + description: + Provider specifies the technology used to + sign the OCI Helm chart. + enum: + - cosign + - notation + type: string + secretRef: + description: |- + SecretRef specifies the Kubernetes Secret containing the + trusted public keys. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - provider + type: object + version: + default: "*" + description: |- + Version semver expression, ignored for charts from v1beta2.GitRepository and + v1beta2.Bucket sources. Defaults to latest when omitted. + type: string + required: + - chart + - sourceRef + type: object + required: + - spec + type: object + chartRef: + description: |- + ChartRef holds a reference to a source controller resource containing the + Helm chart artifact. + + Note: this field is provisional to the v2 API, and not actively used + by v2beta2 HelmReleases. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: Kind of the referent. + enum: + - OCIRepository + - HelmChart + type: string + name: + description: Name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace of the referent, defaults to the namespace of the Kubernetes + resource object that contains the reference. + maxLength: 63 + minLength: 1 + type: string + required: + - kind + - name + type: object + dependsOn: + description: |- + DependsOn may contain a meta.NamespacedObjectReference slice with + references to HelmRelease resources that must be ready before this HelmRelease + can be reconciled. + items: + description: |- + NamespacedObjectReference contains enough information to locate the referenced Kubernetes resource object in any + namespace. + properties: + name: + description: Name of the referent. + type: string + namespace: + description: + Namespace of the referent, when not specified it + acts as LocalObjectReference. + type: string + required: + - name + type: object + type: array + driftDetection: + description: |- + DriftDetection holds the configuration for detecting and handling + differences between the manifest in the Helm storage and the resources + currently existing in the cluster. + properties: + ignore: + description: |- + Ignore contains a list of rules for specifying which changes to ignore + during diffing. + items: + description: |- + IgnoreRule defines a rule to selectively disregard specific changes during + the drift detection process. + properties: + paths: + description: |- + Paths is a list of JSON Pointer (RFC 6901) paths to be excluded from + consideration in a Kubernetes object. + items: + type: string + type: array + target: + description: |- + Target is a selector for specifying Kubernetes objects to which this + rule applies. + If Target is not set, the Paths will be ignored for all Kubernetes + objects within the manifest of the Helm release. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - paths + type: object + type: array + mode: + description: |- + Mode defines how differences should be handled between the Helm manifest + and the manifest currently applied to the cluster. + If not explicitly set, it defaults to DiffModeDisabled. + enum: + - enabled + - warn + - disabled + type: string + type: object + install: + description: + Install holds the configuration for Helm install actions + for this HelmRelease. + properties: + crds: + description: |- + CRDs upgrade CRDs from the Helm Chart's crds directory according + to the CRD upgrade policy provided here. Valid values are `Skip`, + `Create` or `CreateReplace`. Default is `Create` and if omitted + CRDs are installed but not updated. + + Skip: do neither install nor replace (update) any CRDs. + + Create: new CRDs are created, existing CRDs are neither updated nor deleted. + + CreateReplace: new CRDs are created, existing CRDs are updated (replaced) + but not deleted. + + By default, CRDs are applied (installed) during Helm install action. + With this option users can opt in to CRD replace existing CRDs on Helm + install actions, which is not (yet) natively supported by Helm. + https://helm.sh/docs/chart_best_practices/custom_resource_definitions. + enum: + - Skip + - Create + - CreateReplace + type: string + createNamespace: + description: |- + CreateNamespace tells the Helm install action to create the + HelmReleaseSpec.TargetNamespace if it does not exist yet. + On uninstall, the namespace will not be garbage collected. + type: boolean + disableHooks: + description: + DisableHooks prevents hooks from running during the + Helm install action. + type: boolean + disableOpenAPIValidation: + description: |- + DisableOpenAPIValidation prevents the Helm install action from validating + rendered templates against the Kubernetes OpenAPI Schema. + type: boolean + disableWait: + description: |- + DisableWait disables the waiting for resources to be ready after a Helm + install has been performed. + type: boolean + disableWaitForJobs: + description: |- + DisableWaitForJobs disables waiting for jobs to complete after a Helm + install has been performed. + type: boolean + remediation: + description: |- + Remediation holds the remediation configuration for when the Helm install + action for the HelmRelease fails. The default is to not perform any action. + properties: + ignoreTestFailures: + description: |- + IgnoreTestFailures tells the controller to skip remediation when the Helm + tests are run after an install action but fail. Defaults to + 'Test.IgnoreFailures'. + type: boolean + remediateLastFailure: + description: |- + RemediateLastFailure tells the controller to remediate the last failure, when + no retries remain. Defaults to 'false'. + type: boolean + retries: + description: |- + Retries is the number of retries that should be attempted on failures before + bailing. Remediation, using an uninstall, is performed between each attempt. + Defaults to '0', a negative integer equals to unlimited retries. + type: integer + type: object + replace: + description: |- + Replace tells the Helm install action to re-use the 'ReleaseName', but only + if that name is a deleted release which remains in the history. + type: boolean + skipCRDs: + description: |- + SkipCRDs tells the Helm install action to not install any CRDs. By default, + CRDs are installed if not already present. + + Deprecated use CRD policy (`crds`) attribute with value `Skip` instead. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm install action. Defaults to + 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + interval: + description: Interval at which to reconcile the Helm release. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + kubeConfig: + description: |- + KubeConfig for reconciling the HelmRelease on a remote cluster. + When used in combination with HelmReleaseSpec.ServiceAccountName, + forces the controller to act on behalf of that Service Account at the + target cluster. + If the --default-service-account flag is set, its value will be used as + a controller level fallback for when HelmReleaseSpec.ServiceAccountName + is empty. + properties: + secretRef: + description: |- + SecretRef holds the name of a secret that contains a key with + the kubeconfig file as the value. If no key is set, the key will default + to 'value'. + It is recommended that the kubeconfig is self-contained, and the secret + is regularly updated if credentials such as a cloud-access-token expire. + Cloud specific `cmd-path` auth helpers will not function without adding + binaries and credentials to the Pod that is responsible for reconciling + Kubernetes resources. + properties: + key: + description: + Key in the Secret, when not specified an implementation-specific + default key is used. + type: string + name: + description: Name of the Secret. + type: string + required: + - name + type: object + required: + - secretRef + type: object + maxHistory: + description: |- + MaxHistory is the number of revisions saved by Helm for this HelmRelease. + Use '0' for an unlimited number of revisions; defaults to '5'. + type: integer + persistentClient: + description: |- + PersistentClient tells the controller to use a persistent Kubernetes + client for this release. When enabled, the client will be reused for the + duration of the reconciliation, instead of being created and destroyed + for each (step of a) Helm action. + + This can improve performance, but may cause issues with some Helm charts + that for example do create Custom Resource Definitions during installation + outside Helm's CRD lifecycle hooks, which are then not observed to be + available by e.g. post-install hooks. + + If not set, it defaults to true. + type: boolean + postRenderers: + description: |- + PostRenderers holds an array of Helm PostRenderers, which will be applied in order + of their definition. + items: + description: PostRenderer contains a Helm PostRenderer specification. + properties: + kustomize: + description: Kustomization to apply as PostRenderer. + properties: + images: + description: |- + Images is a list of (image name, new name, new tag or digest) + for changing image names, tags or digests. This can also be achieved with a + patch, but this operator is simpler to specify. + items: + description: + Image contains an image name, a new name, + a new tag or digest, which will replace the original + name and tag. + properties: + digest: + description: |- + Digest is the value used to replace the original image tag. + If digest is present NewTag value is ignored. + type: string + name: + description: Name is a tag-less image name. + type: string + newName: + description: + NewName is the value used to replace + the original name. + type: string + newTag: + description: + NewTag is the value used to replace the + original tag. + type: string + required: + - name + type: object + type: array + patches: + description: |- + Strategic merge and JSON patches, defined as inline YAML objects, + capable of targeting objects based on kind, label and annotation selectors. + items: + description: |- + Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should + be applied to. + properties: + patch: + description: |- + Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with + an array of operation objects. + type: string + target: + description: + Target points to the resources that the + patch document should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + type: object + type: array + patchesJson6902: + description: |- + JSON 6902 patches, defined as inline YAML objects. + Deprecated: use Patches instead. + items: + description: + JSON6902Patch contains a JSON6902 patch and + the target the patch should be applied to. + properties: + patch: + description: + Patch contains the JSON6902 patch document + with an array of operation objects. + items: + description: |- + JSON6902 is a JSON6902 operation object. + https://datatracker.ietf.org/doc/html/rfc6902#section-4 + properties: + from: + description: |- + From contains a JSON-pointer value that references a location within the target document where the operation is + performed. The meaning of the value depends on the value of Op, and is NOT taken into account by all operations. + type: string + op: + description: |- + Op indicates the operation to perform. Its value MUST be one of "add", "remove", "replace", "move", "copy", or + "test". + https://datatracker.ietf.org/doc/html/rfc6902#section-4 + enum: + - test + - remove + - add + - replace + - move + - copy + type: string + path: + description: |- + Path contains the JSON-pointer value that references a location within the target document where the operation + is performed. The meaning of the value depends on the value of Op. + type: string + value: + description: |- + Value contains a valid JSON structure. The meaning of the value depends on the value of Op, and is NOT taken into + account by all operations. + x-kubernetes-preserve-unknown-fields: true + required: + - op + - path + type: object + type: array + target: + description: + Target points to the resources that the + patch document should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + - target + type: object + type: array + patchesStrategicMerge: + description: |- + Strategic merge patches, defined as inline YAML objects. + Deprecated: use Patches instead. + items: + x-kubernetes-preserve-unknown-fields: true + type: array + type: object + type: object + type: array + releaseName: + description: |- + ReleaseName used for the Helm release. Defaults to a composition of + '[TargetNamespace-]Name'. + maxLength: 53 + minLength: 1 + type: string + rollback: + description: + Rollback holds the configuration for Helm rollback actions + for this HelmRelease. + properties: + cleanupOnFail: + description: |- + CleanupOnFail allows deletion of new resources created during the Helm + rollback action when it fails. + type: boolean + disableHooks: + description: + DisableHooks prevents hooks from running during the + Helm rollback action. + type: boolean + disableWait: + description: |- + DisableWait disables the waiting for resources to be ready after a Helm + rollback has been performed. + type: boolean + disableWaitForJobs: + description: |- + DisableWaitForJobs disables waiting for jobs to complete after a Helm + rollback has been performed. + type: boolean + force: + description: + Force forces resource updates through a replacement + strategy. + type: boolean + recreate: + description: + Recreate performs pod restarts for the resource if + applicable. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm rollback action. Defaults to + 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + serviceAccountName: + description: |- + The name of the Kubernetes service account to impersonate + when reconciling this HelmRelease. + maxLength: 253 + minLength: 1 + type: string + storageNamespace: + description: |- + StorageNamespace used for the Helm storage. + Defaults to the namespace of the HelmRelease. + maxLength: 63 + minLength: 1 + type: string + suspend: + description: |- + Suspend tells the controller to suspend reconciliation for this HelmRelease, + it does not apply to already started reconciliations. Defaults to false. + type: boolean + targetNamespace: + description: |- + TargetNamespace to target when performing operations for the HelmRelease. + Defaults to the namespace of the HelmRelease. + maxLength: 63 + minLength: 1 + type: string + test: + description: + Test holds the configuration for Helm test actions for + this HelmRelease. + properties: + enable: + description: |- + Enable enables Helm test actions for this HelmRelease after an Helm install + or upgrade action has been performed. + type: boolean + filters: + description: + Filters is a list of tests to run or exclude from + running. + items: + description: + Filter holds the configuration for individual Helm + test filters. + properties: + exclude: + description: + Exclude specifies whether the named test should + be excluded. + type: boolean + name: + description: Name is the name of the test. + maxLength: 253 + minLength: 1 + type: string + required: + - name + type: object + type: array + ignoreFailures: + description: |- + IgnoreFailures tells the controller to skip remediation when the Helm tests + are run but fail. Can be overwritten for tests run after install or upgrade + actions in 'Install.IgnoreTestFailures' and 'Upgrade.IgnoreTestFailures'. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation during + the performance of a Helm test action. Defaults to 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like Jobs + for hooks) during the performance of a Helm action. Defaults to '5m0s'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + uninstall: + description: + Uninstall holds the configuration for Helm uninstall + actions for this HelmRelease. + properties: + deletionPropagation: + default: background + description: |- + DeletionPropagation specifies the deletion propagation policy when + a Helm uninstall is performed. + enum: + - background + - foreground + - orphan + type: string + disableHooks: + description: + DisableHooks prevents hooks from running during the + Helm rollback action. + type: boolean + disableWait: + description: |- + DisableWait disables waiting for all the resources to be deleted after + a Helm uninstall is performed. + type: boolean + keepHistory: + description: |- + KeepHistory tells Helm to remove all associated resources and mark the + release as deleted, but retain the release history. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm uninstall action. Defaults + to 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + upgrade: + description: + Upgrade holds the configuration for Helm upgrade actions + for this HelmRelease. + properties: + cleanupOnFail: + description: |- + CleanupOnFail allows deletion of new resources created during the Helm + upgrade action when it fails. + type: boolean + crds: + description: |- + CRDs upgrade CRDs from the Helm Chart's crds directory according + to the CRD upgrade policy provided here. Valid values are `Skip`, + `Create` or `CreateReplace`. Default is `Skip` and if omitted + CRDs are neither installed nor upgraded. + + Skip: do neither install nor replace (update) any CRDs. + + Create: new CRDs are created, existing CRDs are neither updated nor deleted. + + CreateReplace: new CRDs are created, existing CRDs are updated (replaced) + but not deleted. + + By default, CRDs are not applied during Helm upgrade action. With this + option users can opt-in to CRD upgrade, which is not (yet) natively supported by Helm. + https://helm.sh/docs/chart_best_practices/custom_resource_definitions. + enum: + - Skip + - Create + - CreateReplace + type: string + disableHooks: + description: + DisableHooks prevents hooks from running during the + Helm upgrade action. + type: boolean + disableOpenAPIValidation: + description: |- + DisableOpenAPIValidation prevents the Helm upgrade action from validating + rendered templates against the Kubernetes OpenAPI Schema. + type: boolean + disableWait: + description: |- + DisableWait disables the waiting for resources to be ready after a Helm + upgrade has been performed. + type: boolean + disableWaitForJobs: + description: |- + DisableWaitForJobs disables waiting for jobs to complete after a Helm + upgrade has been performed. + type: boolean + force: + description: + Force forces resource updates through a replacement + strategy. + type: boolean + preserveValues: + description: |- + PreserveValues will make Helm reuse the last release's values and merge in + overrides from 'Values'. Setting this flag makes the HelmRelease + non-declarative. + type: boolean + remediation: + description: |- + Remediation holds the remediation configuration for when the Helm upgrade + action for the HelmRelease fails. The default is to not perform any action. + properties: + ignoreTestFailures: + description: |- + IgnoreTestFailures tells the controller to skip remediation when the Helm + tests are run after an upgrade action but fail. + Defaults to 'Test.IgnoreFailures'. + type: boolean + remediateLastFailure: + description: |- + RemediateLastFailure tells the controller to remediate the last failure, when + no retries remain. Defaults to 'false' unless 'Retries' is greater than 0. + type: boolean + retries: + description: |- + Retries is the number of retries that should be attempted on failures before + bailing. Remediation, using 'Strategy', is performed between each attempt. + Defaults to '0', a negative integer equals to unlimited retries. + type: integer + strategy: + description: + Strategy to use for failure remediation. Defaults + to 'rollback'. + enum: + - rollback + - uninstall + type: string + type: object + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm upgrade action. Defaults to + 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + values: + description: Values holds the values for this Helm release. + x-kubernetes-preserve-unknown-fields: true + valuesFrom: + description: |- + ValuesFrom holds references to resources containing Helm values for this HelmRelease, + and information about how they should be merged. + items: + description: |- + ValuesReference contains a reference to a resource containing Helm values, + and optionally the key they can be found at. + properties: + kind: + description: + Kind of the values referent, valid values are ('Secret', + 'ConfigMap'). + enum: + - Secret + - ConfigMap + type: string + name: + description: |- + Name of the values referent. Should reside in the same namespace as the + referring resource. + maxLength: 253 + minLength: 1 + type: string + optional: + description: |- + Optional marks this ValuesReference as optional. When set, a not found error + for the values reference is ignored, but any ValuesKey, TargetPath or + transient error will still result in a reconciliation failure. + type: boolean + targetPath: + description: |- + TargetPath is the YAML dot notation path the value should be merged at. When + set, the ValuesKey is expected to be a single flat value. Defaults to 'None', + which results in the values getting merged at the root. + maxLength: 250 + pattern: ^([a-zA-Z0-9_\-.\\\/]|\[[0-9]{1,5}\])+$ + type: string + valuesKey: + description: |- + ValuesKey is the data key where the values.yaml or a specific value can be + found at. Defaults to 'values.yaml'. + maxLength: 253 + pattern: ^[\-._a-zA-Z0-9]+$ + type: string + required: + - kind + - name + type: object + type: array + required: + - interval + type: object + x-kubernetes-validations: + - message: either chart or chartRef must be set + rule: + (has(self.chart) && !has(self.chartRef)) || (!has(self.chart) + && has(self.chartRef)) + status: + default: + observedGeneration: -1 + description: HelmReleaseStatus defines the observed state of a HelmRelease. + properties: + conditions: + description: Conditions holds the conditions for the HelmRelease. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + failures: + description: |- + Failures is the reconciliation failure count against the latest desired + state. It is reset after a successful reconciliation. + format: int64 + type: integer + helmChart: + description: |- + HelmChart is the namespaced name of the HelmChart resource created by + the controller for the HelmRelease. + type: string + history: + description: |- + History holds the history of Helm releases performed for this HelmRelease + up to the last successfully completed release. + items: + description: |- + Snapshot captures a point-in-time copy of the status information for a Helm release, + as managed by the controller. + properties: + apiVersion: + description: |- + APIVersion is the API version of the Snapshot. + Provisional: when the calculation method of the Digest field is changed, + this field will be used to distinguish between the old and new methods. + type: string + appVersion: + description: + AppVersion is the chart app version of the release + object in storage. + type: string + chartName: + description: + ChartName is the chart name of the release object + in storage. + type: string + chartVersion: + description: |- + ChartVersion is the chart version of the release object in + storage. + type: string + configDigest: + description: |- + ConfigDigest is the checksum of the config (better known as + "values") of the release object in storage. + It has the format of `:`. + type: string + deleted: + description: Deleted is when the release was deleted. + format: date-time + type: string + digest: + description: |- + Digest is the checksum of the release object in storage. + It has the format of `:`. + type: string + firstDeployed: + description: FirstDeployed is when the release was first deployed. + format: date-time + type: string + lastDeployed: + description: LastDeployed is when the release was last deployed. + format: date-time + type: string + name: + description: Name is the name of the release. + type: string + namespace: + description: + Namespace is the namespace the release is deployed + to. + type: string + ociDigest: + description: + OCIDigest is the digest of the OCI artifact associated + with the release. + type: string + status: + description: Status is the current state of the release. + type: string + testHooks: + additionalProperties: + description: |- + TestHookStatus holds the status information for a test hook as observed + to be run by the controller. + properties: + lastCompleted: + description: + LastCompleted is the time the test hook last + completed. + format: date-time + type: string + lastStarted: + description: + LastStarted is the time the test hook was + last started. + format: date-time + type: string + phase: + description: Phase the test hook was observed to be in. + type: string + type: object + description: |- + TestHooks is the list of test hooks for the release as observed to be + run by the controller. + type: object + version: + description: + Version is the version of the release object in + storage. + type: integer + required: + - chartName + - chartVersion + - configDigest + - digest + - firstDeployed + - lastDeployed + - name + - namespace + - status + - version + type: object + type: array + installFailures: + description: |- + InstallFailures is the install failure count against the latest desired + state. It is reset after a successful reconciliation. + format: int64 + type: integer + lastAppliedRevision: + description: |- + LastAppliedRevision is the revision of the last successfully applied + source. + Deprecated: the revision can now be found in the History. + type: string + lastAttemptedConfigDigest: + description: |- + LastAttemptedConfigDigest is the digest for the config (better known as + "values") of the last reconciliation attempt. + type: string + lastAttemptedGeneration: + description: |- + LastAttemptedGeneration is the last generation the controller attempted + to reconcile. + format: int64 + type: integer + lastAttemptedReleaseAction: + description: |- + LastAttemptedReleaseAction is the last release action performed for this + HelmRelease. It is used to determine the active remediation strategy. + enum: + - install + - upgrade + type: string + lastAttemptedRevision: + description: |- + LastAttemptedRevision is the Source revision of the last reconciliation + attempt. For OCIRepository sources, the 12 first characters of the digest are + appended to the chart version e.g. "1.2.3+1234567890ab". + type: string + lastAttemptedRevisionDigest: + description: |- + LastAttemptedRevisionDigest is the digest of the last reconciliation attempt. + This is only set for OCIRepository sources. + type: string + lastAttemptedValuesChecksum: + description: |- + LastAttemptedValuesChecksum is the SHA1 checksum for the values of the last + reconciliation attempt. + Deprecated: Use LastAttemptedConfigDigest instead. + type: string + lastHandledForceAt: + description: |- + LastHandledForceAt holds the value of the most recent force request + value, so a change of the annotation value can be detected. + type: string + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + lastHandledResetAt: + description: |- + LastHandledResetAt holds the value of the most recent reset request + value, so a change of the annotation value can be detected. + type: string + lastReleaseRevision: + description: |- + LastReleaseRevision is the revision of the last successful Helm release. + Deprecated: Use History instead. + type: integer + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + observedPostRenderersDigest: + description: |- + ObservedPostRenderersDigest is the digest for the post-renderers of + the last successful reconciliation attempt. + type: string + storageNamespace: + description: |- + StorageNamespace is the namespace of the Helm release storage for the + current release. + maxLength: 63 + minLength: 1 + type: string + upgradeFailures: + description: |- + UpgradeFailures is the upgrade failure count against the latest desired + state. It is reset after a successful reconciliation. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: helm-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + name: helm-controller + namespace: flux-system +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: helm-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + control-plane: controller + name: helm-controller + namespace: flux-system +spec: + replicas: 1 + selector: + matchLabels: + app: helm-controller + template: + metadata: + annotations: + prometheus.io/port: "8080" + prometheus.io/scrape: "true" + labels: + app: helm-controller + spec: + containers: + - args: + - --events-addr=http://notification-controller.flux-system.svc.cluster.local./ + - --watch-all-namespaces=true + - --log-level=info + - --log-encoding=json + - --enable-leader-election + env: + - name: RUNTIME_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + containerName: manager + resource: limits.cpu + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + containerName: manager + resource: limits.memory + image: ghcr.io/fluxcd/helm-controller:v1.2.0 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 8080 + name: http-prom + protocol: TCP + - containerPort: 9440 + name: healthz + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + resources: + limits: + cpu: 1000m + memory: 1Gi + requests: + cpu: 100m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /tmp + name: temp + nodeSelector: + kubernetes.io/os: linux + priorityClassName: system-cluster-critical + securityContext: + fsGroup: 1337 + serviceAccountName: helm-controller + terminationGracePeriodSeconds: 600 + volumes: + - emptyDir: {} + name: temp +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + labels: + app.kubernetes.io/component: notification-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + name: alerts.notification.toolkit.fluxcd.io +spec: + group: notification.toolkit.fluxcd.io + names: + kind: Alert + listKind: AlertList + plural: alerts + singular: alert + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta1 Alert is deprecated, upgrade to v1beta3 + name: v1beta1 + schema: + openAPIV3Schema: + description: Alert is the Schema for the alerts API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: + AlertSpec defines an alerting rule for events involving a + list of objects + properties: + eventSeverity: + default: info + description: |- + Filter events based on severity, defaults to ('info'). + If set to 'info' no events will be filtered. + enum: + - info + - error + type: string + eventSources: + description: Filter events based on the involved objects. + items: + description: |- + CrossNamespaceObjectReference contains enough information to let you locate the + typed referenced object at cluster level + properties: + apiVersion: + description: API version of the referent + type: string + kind: + description: Kind of the referent + enum: + - Bucket + - GitRepository + - Kustomization + - HelmRelease + - HelmChart + - HelmRepository + - ImageRepository + - ImagePolicy + - ImageUpdateAutomation + - OCIRepository + type: string + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + name: + description: Name of the referent + maxLength: 53 + minLength: 1 + type: string + namespace: + description: Namespace of the referent + maxLength: 53 + minLength: 1 + type: string + required: + - kind + - name + type: object + type: array + exclusionList: + description: + A list of Golang regular expressions to be used for excluding + messages. + items: + type: string + type: array + providerRef: + description: Send events using this provider. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + summary: + description: Short description of the impact and affected cluster. + type: string + suspend: + description: |- + This flag tells the controller to suspend subsequent events dispatching. + Defaults to false. + type: boolean + required: + - eventSources + - providerRef + type: object + status: + default: + observedGeneration: -1 + description: AlertStatus defines the observed state of Alert + properties: + conditions: + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta2 Alert is deprecated, upgrade to v1beta3 + name: v1beta2 + schema: + openAPIV3Schema: + description: Alert is the Schema for the alerts API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: + AlertSpec defines an alerting rule for events involving a + list of objects. + properties: + eventMetadata: + additionalProperties: + type: string + description: |- + EventMetadata is an optional field for adding metadata to events dispatched by the + controller. This can be used for enhancing the context of the event. If a field + would override one already present on the original event as generated by the emitter, + then the override doesn't happen, i.e. the original value is preserved, and an info + log is printed. + type: object + eventSeverity: + default: info + description: |- + EventSeverity specifies how to filter events based on severity. + If set to 'info' no events will be filtered. + enum: + - info + - error + type: string + eventSources: + description: |- + EventSources specifies how to filter events based + on the involved object kind, name and namespace. + items: + description: |- + CrossNamespaceObjectReference contains enough information to let you locate the + typed referenced object at cluster level + properties: + apiVersion: + description: API version of the referent + type: string + kind: + description: Kind of the referent + enum: + - Bucket + - GitRepository + - Kustomization + - HelmRelease + - HelmChart + - HelmRepository + - ImageRepository + - ImagePolicy + - ImageUpdateAutomation + - OCIRepository + type: string + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + MatchLabels requires the name to be set to `*`. + type: object + name: + description: |- + Name of the referent + If multiple resources are targeted `*` may be set. + maxLength: 53 + minLength: 1 + type: string + namespace: + description: Namespace of the referent + maxLength: 53 + minLength: 1 + type: string + required: + - kind + - name + type: object + type: array + exclusionList: + description: |- + ExclusionList specifies a list of Golang regular expressions + to be used for excluding messages. + items: + type: string + type: array + inclusionList: + description: |- + InclusionList specifies a list of Golang regular expressions + to be used for including messages. + items: + type: string + type: array + providerRef: + description: + ProviderRef specifies which Provider this Alert should + use. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + summary: + description: + Summary holds a short description of the impact and affected + cluster. + maxLength: 255 + type: string + suspend: + description: |- + Suspend tells the controller to suspend subsequent + events handling for this Alert. + type: boolean + required: + - eventSources + - providerRef + type: object + status: + default: + observedGeneration: -1 + description: AlertStatus defines the observed state of the Alert. + properties: + conditions: + description: Conditions holds the conditions for the Alert. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta3 + schema: + openAPIV3Schema: + description: Alert is the Schema for the alerts API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: + AlertSpec defines an alerting rule for events involving a + list of objects. + properties: + eventMetadata: + additionalProperties: + type: string + description: |- + EventMetadata is an optional field for adding metadata to events dispatched by the + controller. This can be used for enhancing the context of the event. If a field + would override one already present on the original event as generated by the emitter, + then the override doesn't happen, i.e. the original value is preserved, and an info + log is printed. + type: object + eventSeverity: + default: info + description: |- + EventSeverity specifies how to filter events based on severity. + If set to 'info' no events will be filtered. + enum: + - info + - error + type: string + eventSources: + description: |- + EventSources specifies how to filter events based + on the involved object kind, name and namespace. + items: + description: |- + CrossNamespaceObjectReference contains enough information to let you locate the + typed referenced object at cluster level + properties: + apiVersion: + description: API version of the referent + type: string + kind: + description: Kind of the referent + enum: + - Bucket + - GitRepository + - Kustomization + - HelmRelease + - HelmChart + - HelmRepository + - ImageRepository + - ImagePolicy + - ImageUpdateAutomation + - OCIRepository + type: string + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + MatchLabels requires the name to be set to `*`. + type: object + name: + description: |- + Name of the referent + If multiple resources are targeted `*` may be set. + maxLength: 53 + minLength: 1 + type: string + namespace: + description: Namespace of the referent + maxLength: 53 + minLength: 1 + type: string + required: + - kind + - name + type: object + type: array + exclusionList: + description: |- + ExclusionList specifies a list of Golang regular expressions + to be used for excluding messages. + items: + type: string + type: array + inclusionList: + description: |- + InclusionList specifies a list of Golang regular expressions + to be used for including messages. + items: + type: string + type: array + providerRef: + description: + ProviderRef specifies which Provider this Alert should + use. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + summary: + description: |- + Summary holds a short description of the impact and affected cluster. + Deprecated: Use EventMetadata instead. + maxLength: 255 + type: string + suspend: + description: |- + Suspend tells the controller to suspend subsequent + events handling for this Alert. + type: boolean + required: + - eventSources + - providerRef + type: object + type: object + served: true + storage: true + subresources: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + labels: + app.kubernetes.io/component: notification-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + name: providers.notification.toolkit.fluxcd.io +spec: + group: notification.toolkit.fluxcd.io + names: + kind: Provider + listKind: ProviderList + plural: providers + singular: provider + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta1 Provider is deprecated, upgrade to v1beta3 + name: v1beta1 + schema: + openAPIV3Schema: + description: Provider is the Schema for the providers API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ProviderSpec defines the desired state of Provider + properties: + address: + description: HTTP/S webhook address of this provider + pattern: ^(http|https):// + type: string + certSecretRef: + description: |- + CertSecretRef can be given the name of a secret containing + a PEM-encoded CA certificate (`caFile`) + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + channel: + description: Alert channel for this provider + type: string + proxy: + description: HTTP/S address of the proxy + pattern: ^(http|https):// + type: string + secretRef: + description: |- + Secret reference containing the provider webhook URL + using "address" as data key + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + This flag tells the controller to suspend subsequent events handling. + Defaults to false. + type: boolean + timeout: + description: Timeout for sending alerts to the provider. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + type: + description: Type of provider + enum: + - slack + - discord + - msteams + - rocket + - generic + - generic-hmac + - github + - gitlab + - bitbucket + - azuredevops + - googlechat + - webex + - sentry + - azureeventhub + - telegram + - lark + - matrix + - opsgenie + - alertmanager + - grafana + - githubdispatch + type: string + username: + description: Bot username for this provider + type: string + required: + - type + type: object + status: + default: + observedGeneration: -1 + description: ProviderStatus defines the observed state of Provider + properties: + conditions: + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + observedGeneration: + description: ObservedGeneration is the last reconciled generation. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta2 Provider is deprecated, upgrade to v1beta3 + name: v1beta2 + schema: + openAPIV3Schema: + description: Provider is the Schema for the providers API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ProviderSpec defines the desired state of the Provider. + properties: + address: + description: |- + Address specifies the endpoint, in a generic sense, to where alerts are sent. + What kind of endpoint depends on the specific Provider type being used. + For the generic Provider, for example, this is an HTTP/S address. + For other Provider types this could be a project ID or a namespace. + maxLength: 2048 + type: string + certSecretRef: + description: |- + CertSecretRef specifies the Secret containing + a PEM-encoded CA certificate (in the `ca.crt` key). + + Note: Support for the `caFile` key has + been deprecated. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + channel: + description: + Channel specifies the destination channel where events + should be posted. + maxLength: 2048 + type: string + interval: + description: + Interval at which to reconcile the Provider with its + Secret references. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + proxy: + description: Proxy the HTTP/S address of the proxy server. + maxLength: 2048 + pattern: ^(http|https)://.*$ + type: string + secretRef: + description: |- + SecretRef specifies the Secret containing the authentication + credentials for this Provider. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend subsequent + events handling for this Provider. + type: boolean + timeout: + description: Timeout for sending alerts to the Provider. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + type: + description: Type specifies which Provider implementation to use. + enum: + - slack + - discord + - msteams + - rocket + - generic + - generic-hmac + - github + - gitlab + - gitea + - bitbucketserver + - bitbucket + - azuredevops + - googlechat + - googlepubsub + - webex + - sentry + - azureeventhub + - telegram + - lark + - matrix + - opsgenie + - alertmanager + - grafana + - githubdispatch + - pagerduty + - datadog + type: string + username: + description: Username specifies the name under which events are posted. + maxLength: 2048 + type: string + required: + - type + type: object + status: + default: + observedGeneration: -1 + description: ProviderStatus defines the observed state of the Provider. + properties: + conditions: + description: Conditions holds the conditions for the Provider. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last reconciled generation. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta3 + schema: + openAPIV3Schema: + description: Provider is the Schema for the providers API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ProviderSpec defines the desired state of the Provider. + properties: + address: + description: |- + Address specifies the endpoint, in a generic sense, to where alerts are sent. + What kind of endpoint depends on the specific Provider type being used. + For the generic Provider, for example, this is an HTTP/S address. + For other Provider types this could be a project ID or a namespace. + maxLength: 2048 + type: string + certSecretRef: + description: |- + CertSecretRef specifies the Secret containing + a PEM-encoded CA certificate (in the `ca.crt` key). + + Note: Support for the `caFile` key has + been deprecated. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + channel: + description: + Channel specifies the destination channel where events + should be posted. + maxLength: 2048 + type: string + interval: + description: |- + Interval at which to reconcile the Provider with its Secret references. + Deprecated and not used in v1beta3. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + proxy: + description: Proxy the HTTP/S address of the proxy server. + maxLength: 2048 + pattern: ^(http|https)://.*$ + type: string + secretRef: + description: |- + SecretRef specifies the Secret containing the authentication + credentials for this Provider. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend subsequent + events handling for this Provider. + type: boolean + timeout: + description: Timeout for sending alerts to the Provider. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + type: + description: Type specifies which Provider implementation to use. + enum: + - slack + - discord + - msteams + - rocket + - generic + - generic-hmac + - github + - gitlab + - gitea + - bitbucketserver + - bitbucket + - azuredevops + - googlechat + - googlepubsub + - webex + - sentry + - azureeventhub + - telegram + - lark + - matrix + - opsgenie + - alertmanager + - grafana + - githubdispatch + - pagerduty + - datadog + - nats + type: string + username: + description: Username specifies the name under which events are posted. + maxLength: 2048 + type: string + required: + - type + type: object + type: object + served: true + storage: true + subresources: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.1 + labels: + app.kubernetes.io/component: notification-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + name: receivers.notification.toolkit.fluxcd.io +spec: + group: notification.toolkit.fluxcd.io + names: + kind: Receiver + listKind: ReceiverList + plural: receivers + singular: receiver + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1 + schema: + openAPIV3Schema: + description: Receiver is the Schema for the receivers API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ReceiverSpec defines the desired state of the Receiver. + properties: + events: + description: |- + Events specifies the list of event types to handle, + e.g. 'push' for GitHub or 'Push Hook' for GitLab. + items: + type: string + type: array + interval: + default: 10m + description: + Interval at which to reconcile the Receiver with its + Secret references. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + resourceFilter: + description: |- + ResourceFilter is a CEL expression expected to return a boolean that is + evaluated for each resource referenced in the Resources field when a + webhook is received. If the expression returns false then the controller + will not request a reconciliation for the resource. + When the expression is specified the controller will parse it and mark + the object as terminally failed if the expression is invalid or does not + return a boolean. + type: string + resources: + description: A list of resources to be notified about changes. + items: + description: |- + CrossNamespaceObjectReference contains enough information to let you locate the + typed referenced object at cluster level + properties: + apiVersion: + description: API version of the referent + type: string + kind: + description: Kind of the referent + enum: + - Bucket + - GitRepository + - Kustomization + - HelmRelease + - HelmChart + - HelmRepository + - ImageRepository + - ImagePolicy + - ImageUpdateAutomation + - OCIRepository + type: string + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + MatchLabels requires the name to be set to `*`. + type: object + name: + description: |- + Name of the referent + If multiple resources are targeted `*` may be set. + maxLength: 53 + minLength: 1 + type: string + namespace: + description: Namespace of the referent + maxLength: 53 + minLength: 1 + type: string + required: + - kind + - name + type: object + type: array + secretRef: + description: |- + SecretRef specifies the Secret containing the token used + to validate the payload authenticity. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend subsequent + events handling for this receiver. + type: boolean + type: + description: |- + Type of webhook sender, used to determine + the validation procedure and payload deserialization. + enum: + - generic + - generic-hmac + - github + - gitlab + - bitbucket + - harbor + - dockerhub + - quay + - gcr + - nexus + - acr + - cdevents + type: string + required: + - resources + - secretRef + - type + type: object + status: + default: + observedGeneration: -1 + description: ReceiverStatus defines the observed state of the Receiver. + properties: + conditions: + description: Conditions holds the conditions for the Receiver. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: + ObservedGeneration is the last observed generation of + the Receiver object. + format: int64 + type: integer + webhookPath: + description: |- + WebhookPath is the generated incoming webhook address in the format + of '/hook/sha256sum(token+name+namespace)'. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta1 Receiver is deprecated, upgrade to v1 + name: v1beta1 + schema: + openAPIV3Schema: + description: Receiver is the Schema for the receivers API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ReceiverSpec defines the desired state of Receiver + properties: + events: + description: |- + A list of events to handle, + e.g. 'push' for GitHub or 'Push Hook' for GitLab. + items: + type: string + type: array + resources: + description: A list of resources to be notified about changes. + items: + description: |- + CrossNamespaceObjectReference contains enough information to let you locate the + typed referenced object at cluster level + properties: + apiVersion: + description: API version of the referent + type: string + kind: + description: Kind of the referent + enum: + - Bucket + - GitRepository + - Kustomization + - HelmRelease + - HelmChart + - HelmRepository + - ImageRepository + - ImagePolicy + - ImageUpdateAutomation + - OCIRepository + type: string + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + name: + description: Name of the referent + maxLength: 53 + minLength: 1 + type: string + namespace: + description: Namespace of the referent + maxLength: 53 + minLength: 1 + type: string + required: + - kind + - name + type: object + type: array + secretRef: + description: |- + Secret reference containing the token used + to validate the payload authenticity + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + This flag tells the controller to suspend subsequent events handling. + Defaults to false. + type: boolean + type: + description: |- + Type of webhook sender, used to determine + the validation procedure and payload deserialization. + enum: + - generic + - generic-hmac + - github + - gitlab + - bitbucket + - harbor + - dockerhub + - quay + - gcr + - nexus + - acr + type: string + required: + - resources + - secretRef + - type + type: object + status: + default: + observedGeneration: -1 + description: ReceiverStatus defines the observed state of Receiver + properties: + conditions: + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + url: + description: |- + Generated webhook URL in the format + of '/hook/sha256sum(token+name+namespace)'. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta2 Receiver is deprecated, upgrade to v1 + name: v1beta2 + schema: + openAPIV3Schema: + description: Receiver is the Schema for the receivers API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ReceiverSpec defines the desired state of the Receiver. + properties: + events: + description: |- + Events specifies the list of event types to handle, + e.g. 'push' for GitHub or 'Push Hook' for GitLab. + items: + type: string + type: array + interval: + description: + Interval at which to reconcile the Receiver with its + Secret references. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + resources: + description: A list of resources to be notified about changes. + items: + description: |- + CrossNamespaceObjectReference contains enough information to let you locate the + typed referenced object at cluster level + properties: + apiVersion: + description: API version of the referent + type: string + kind: + description: Kind of the referent + enum: + - Bucket + - GitRepository + - Kustomization + - HelmRelease + - HelmChart + - HelmRepository + - ImageRepository + - ImagePolicy + - ImageUpdateAutomation + - OCIRepository + type: string + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + MatchLabels requires the name to be set to `*`. + type: object + name: + description: |- + Name of the referent + If multiple resources are targeted `*` may be set. + maxLength: 53 + minLength: 1 + type: string + namespace: + description: Namespace of the referent + maxLength: 53 + minLength: 1 + type: string + required: + - kind + - name + type: object + type: array + secretRef: + description: |- + SecretRef specifies the Secret containing the token used + to validate the payload authenticity. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend subsequent + events handling for this receiver. + type: boolean + type: + description: |- + Type of webhook sender, used to determine + the validation procedure and payload deserialization. + enum: + - generic + - generic-hmac + - github + - gitlab + - bitbucket + - harbor + - dockerhub + - quay + - gcr + - nexus + - acr + type: string + required: + - resources + - secretRef + - type + type: object + status: + default: + observedGeneration: -1 + description: ReceiverStatus defines the observed state of the Receiver. + properties: + conditions: + description: Conditions holds the conditions for the Receiver. + items: + description: + Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: + ObservedGeneration is the last observed generation of + the Receiver object. + format: int64 + type: integer + url: + description: |- + URL is the generated incoming webhook address in the format + of '/hook/sha256sum(token+name+namespace)'. + Deprecated: Replaced by WebhookPath. + type: string + webhookPath: + description: |- + WebhookPath is the generated incoming webhook address in the format + of '/hook/sha256sum(token+name+namespace)'. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: notification-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + name: notification-controller + namespace: flux-system +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: notification-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + control-plane: controller + name: notification-controller + namespace: flux-system +spec: + ports: + - name: http + port: 80 + protocol: TCP + targetPort: http + selector: + app: notification-controller + type: ClusterIP +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: notification-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + control-plane: controller + name: webhook-receiver + namespace: flux-system +spec: + ports: + - name: http + port: 80 + protocol: TCP + targetPort: http-webhook + selector: + app: notification-controller + type: ClusterIP +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: notification-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.5.1 + control-plane: controller + name: notification-controller + namespace: flux-system +spec: + replicas: 1 + selector: + matchLabels: + app: notification-controller + template: + metadata: + annotations: + prometheus.io/port: "8080" + prometheus.io/scrape: "true" + labels: + app: notification-controller + spec: + containers: + - args: + - --watch-all-namespaces=true + - --log-level=info + - --log-encoding=json + - --enable-leader-election + env: + - name: RUNTIME_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + containerName: manager + resource: limits.cpu + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + containerName: manager + resource: limits.memory + image: ghcr.io/fluxcd/notification-controller:v1.5.0 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 9090 + name: http + protocol: TCP + - containerPort: 9292 + name: http-webhook + protocol: TCP + - containerPort: 8080 + name: http-prom + protocol: TCP + - containerPort: 9440 + name: healthz + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + resources: + limits: + cpu: 1000m + memory: 1Gi + requests: + cpu: 100m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /tmp + name: temp + nodeSelector: + kubernetes.io/os: linux + securityContext: + fsGroup: 1337 + serviceAccountName: notification-controller + terminationGracePeriodSeconds: 10 + volumes: + - emptyDir: {} + name: temp diff --git a/manifests/helm/kustomization.yaml b/manifests/helm/kustomization.yaml new file mode 100644 index 0000000..ed49217 --- /dev/null +++ b/manifests/helm/kustomization.yaml @@ -0,0 +1,4 @@ +resources: + - flux.yaml + - external-secrets.yaml + - cloudnative-pg.yaml diff --git a/manifests/kustomization.yaml b/manifests/kustomization.yaml index ad3955c..1cd3da6 100644 --- a/manifests/kustomization.yaml +++ b/manifests/kustomization.yaml @@ -1,5 +1,6 @@ resources: - namespaces + - helm - bitwarden - secrets - databases diff --git a/manifests/namespaces/external-secrets.yaml b/manifests/namespaces/external-secrets.yaml deleted file mode 100644 index 4ef398e..0000000 --- a/manifests/namespaces/external-secrets.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: external-secrets diff --git a/manifests/namespaces/kustomization.yaml b/manifests/namespaces/kustomization.yaml index 5631712..cc1c3d6 100644 --- a/manifests/namespaces/kustomization.yaml +++ b/manifests/namespaces/kustomization.yaml @@ -1,5 +1,4 @@ resources: - - external-secrets.yaml - bitwarden.yaml - db.yaml - matrix.yaml diff --git a/manifests/postgres/kustomization.yaml b/manifests/postgres/kustomization.yaml deleted file mode 100644 index 85f7b0d..0000000 --- a/manifests/postgres/kustomization.yaml +++ /dev/null @@ -1,13 +0,0 @@ -namespace: db - -helmCharts: - # Install the operator first (with CRDs) - - name: cloudnative-pg - repo: "https://cloudnative-pg.github.io/charts/" - version: "0.23.2" - namespace: cnpg-system - releaseName: cnpg - includeCRDs: true - valuesInline: - crds: - create: true diff --git a/manifests/secrets/k3sbackup.yaml b/manifests/secrets/k3sbackup.yaml new file mode 100644 index 0000000..ec52d84 --- /dev/null +++ b/manifests/secrets/k3sbackup.yaml @@ -0,0 +1,33 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: k3sbackup + namespace: db +spec: + target: + name: k3sbackup + deletionPolicy: Delete + template: + type: Opaque + data: + username: |- + {{ .username }} + password: |- + {{ .password }} + data: + - secretKey: username + sourceRef: + storeRef: + name: bitwarden-login + kind: ClusterSecretStore + remoteRef: + key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b + property: username + - secretKey: password + sourceRef: + storeRef: + name: bitwarden-login + kind: ClusterSecretStore + remoteRef: + key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b + property: password diff --git a/manifests/secrets/kustomization.yaml b/manifests/secrets/kustomization.yaml index 3ea41b4..b250cbf 100644 --- a/manifests/secrets/kustomization.yaml +++ b/manifests/secrets/kustomization.yaml @@ -2,3 +2,4 @@ resources: - postgres-user-gitlab.yaml - postgres-user-pgadmin.yaml - postgres-user-matrix.yaml + - k3sbackup.yaml diff --git a/modules/nixos/kubernetes.nix b/modules/nixos/kubernetes.nix index 23e14ad..b142bd7 100644 --- a/modules/nixos/kubernetes.nix +++ b/modules/nixos/kubernetes.nix @@ -27,6 +27,7 @@ in }; environment.systemPackages = [ + pkgs.fluxcd pkgs.kubectl-cnpg pkgs.kubernetes-helm pkgs.kustomize @@ -59,6 +60,7 @@ in "--service-cidr=10.221.0.0/16" "--write-kubeconfig-mode 0640" "--write-kubeconfig-group kubeconfig" + "--resolv-conf=/etc/resolv.conf" "--tls-san ${config.networking.hostName}.home" "--tls-san ${config.networking.hostName}.thehellings.lan" "--tls-san ${config.networking.hostName}.shire-zebra.ts.net" From c1922282d5e84765c14aa913092d714af79a651a Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Tue, 27 May 2025 20:05:05 -0500 Subject: [PATCH 14/18] Add bookmarks --- home/modules/gui/bookmarks.nix | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/home/modules/gui/bookmarks.nix b/home/modules/gui/bookmarks.nix index 9497183..81e16fc 100644 --- a/home/modules/gui/bookmarks.nix +++ b/home/modules/gui/bookmarks.nix @@ -211,6 +211,10 @@ } ]; } + { + name = "PGAdmin4"; + url = "http://pgadmin.kubernetes/"; + } { name = "Password Hash"; url = "https://unix4lyfe.org/crypt/"; @@ -238,6 +242,15 @@ } ]; } + { + name = "Docs"; + bookmarks = [ + { + name = "CloudNative PG"; + url = "https://cloudnative-pg.io/documentation/1.26/"; + } + ]; + } ]; } ] From d7f53e53a34204aff113881b3bc27aa9d0afd610 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Wed, 28 May 2025 00:10:50 -0500 Subject: [PATCH 15/18] Expost postgres cluster Expose the postgres cluster outside of the Kubernetes cluster Give myself the option of connecting to postgres from my own machines, so that I can hopefully leverage the improved performance Update some file linting issues in Nix Add necessary gitlab keys so it can be updated properly the next time I deploy to it Add DNS entries for postgres Update the configuraiton of Traefik to expose the appropriate ports --- hosts/genesis/net/hosts | 2 +- hosts/proxmoxtemplate/default.nix | 20 +++++---- .../hardware-configuration.nix | 43 +++++++++++++------ hosts/vm-gitlab/default.nix | 19 +++++--- hosts/vm-gitlab/hardware-configuration.nix | 43 +++++++++++++------ hosts/vm-jellyfin/hardware-configuration.nix | 43 +++++++++++++------ manifests/databases/ingress.yaml | 39 +++++++++++++++++ manifests/databases/kustomization.yaml | 1 + manifests/helm/kustomization.yaml | 1 + manifests/helm/traefik.yaml | 22 ++++++++++ modules/nixos/kubernetes.nix | 3 ++ secrets/gitlab/deterministic-key.age | 39 +++++++++++++++++ secrets/gitlab/primary-key.age | 39 +++++++++++++++++ secrets/gitlab/salt.age | 39 +++++++++++++++++ secrets/secrets.nix | 3 ++ 15 files changed, 298 insertions(+), 58 deletions(-) create mode 100644 manifests/databases/ingress.yaml create mode 100644 manifests/helm/traefik.yaml create mode 100644 secrets/gitlab/deterministic-key.age create mode 100644 secrets/gitlab/primary-key.age create mode 100644 secrets/gitlab/salt.age diff --git a/hosts/genesis/net/hosts b/hosts/genesis/net/hosts index 9041681..cc877ec 100644 --- a/hosts/genesis/net/hosts +++ b/hosts/genesis/net/hosts @@ -32,7 +32,7 @@ 100.88.91.27 genesis.home smart.home zwave.home nixcache.home gitcache.home dashy.home uptime.home speed.home 100.91.131.66 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan git.thehellings.lan 100.68.203.1 hosea.home hosea.shire-zebra.ts.net -100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes +100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes postgres.kubernetes 100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes 100.90.74.19 jude.home 100.115.57.8 linode.home diff --git a/hosts/proxmoxtemplate/default.nix b/hosts/proxmoxtemplate/default.nix index 8a95924..58fd871 100644 --- a/hosts/proxmoxtemplate/default.nix +++ b/hosts/proxmoxtemplate/default.nix @@ -2,13 +2,13 @@ # your system. Help is available in the configuration.nix(5) man page # and in the NixOS manual (accessible by running ‘nixos-help’). -{ config, pkgs, ... }: +{ pkgs, ... }: { - imports = - [ # Include the results of the hardware scan. - ./hardware-configuration.nix - ]; + imports = [ + # Include the results of the hardware scan. + ./hardware-configuration.nix + ]; # Bootloader. boot.loader = { @@ -16,8 +16,10 @@ efi.canTouchEfiVariables = true; }; - environment.systemPackages = with pkgs; [ - ]; + environment.systemPackages = + with pkgs; + [ + ]; greg = { home = true; @@ -43,6 +45,8 @@ nameservers = [ "10.42.1.5" ]; }; + services.qemuGuest.enable = true; + system.stateVersion = "24.11"; # Did you read the comment? # Define a user account. Don't forget to set a password with ‘passwd’. @@ -50,6 +54,6 @@ isNormalUser = true; description = "Greg Hellings"; extraGroups = [ "wheel" ]; - packages = with pkgs; []; + packages = with pkgs; [ ]; }; } diff --git a/hosts/proxmoxtemplate/hardware-configuration.nix b/hosts/proxmoxtemplate/hardware-configuration.nix index 95d03e8..1ef3394 100644 --- a/hosts/proxmoxtemplate/hardware-configuration.nix +++ b/hosts/proxmoxtemplate/hardware-configuration.nix @@ -1,28 +1,43 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: +{ + lib, + modulesPath, + ... +}: { - imports = - [ (modulesPath + "/profiles/qemu-guest.nix") - ]; + imports = [ + (modulesPath + "/profiles/qemu-guest.nix") + ]; - boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; + boot.initrd.availableKernelModules = [ + "uhci_hcd" + "ehci_pci" + "ahci" + "virtio_pci" + "virtio_scsi" + "sd_mod" + "sr_mod" + ]; boot.initrd.kernelModules = [ ]; boot.kernelModules = [ ]; boot.extraModulePackages = [ ]; - fileSystems."/" = - { device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb"; - fsType = "ext4"; - }; + fileSystems."/" = { + device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb"; + fsType = "ext4"; + }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/7115-EFA6"; - fsType = "vfat"; - options = [ "fmask=0077" "dmask=0077" ]; - }; + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/7115-EFA6"; + fsType = "vfat"; + options = [ + "fmask=0077" + "dmask=0077" + ]; + }; swapDevices = [ ]; diff --git a/hosts/vm-gitlab/default.nix b/hosts/vm-gitlab/default.nix index a52d043..0c4a31d 100644 --- a/hosts/vm-gitlab/default.nix +++ b/hosts/vm-gitlab/default.nix @@ -15,10 +15,10 @@ let containerIp = "192.168.200.2"; in { - imports = - [ # Include the results of the hardware scan. - ./hardware-configuration.nix - ]; + imports = [ + # Include the results of the hardware scan. + ./hardware-configuration.nix + ]; age.secrets = let @@ -36,6 +36,9 @@ in gitlab-jws = cfg "jws"; gitlab-key = cfg "key"; gitlab-cert = cfg "cert"; + gitlab-salt = cfg "salt"; + gitlab-primary-key = cfg "primary-key"; + gitlab-deterministic-key = cfg "deterministic-key"; minio_access_key_id = { file = ../../secrets/minio_access_key_id.age; @@ -79,7 +82,6 @@ in tailscale.enable = true; }; - networking = { hostName = "vm-gitlab"; # Define your hostname. firewall.allowedTCPPorts = [ @@ -134,10 +136,13 @@ in externalPort = 443; }; secrets = { - secretFile = config.age.secrets.gitlab-secret.path; - otpFile = config.age.secrets.gitlab-otp.path; + activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path; + activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path; + activeRecordSaltFile = config.age.secrets.gitlab-salt.path; dbFile = config.age.secrets.gitlab-db.path; jwsFile = config.age.secrets.gitlab-jws.path; + otpFile = config.age.secrets.gitlab-otp.path; + secretFile = config.age.secrets.gitlab-secret.path; }; extraConfig = { diff --git a/hosts/vm-gitlab/hardware-configuration.nix b/hosts/vm-gitlab/hardware-configuration.nix index dd7e4cf..a945d9f 100644 --- a/hosts/vm-gitlab/hardware-configuration.nix +++ b/hosts/vm-gitlab/hardware-configuration.nix @@ -1,18 +1,30 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: +{ + lib, + modulesPath, + ... +}: { - imports = - [ (modulesPath + "/profiles/qemu-guest.nix") - ]; + imports = [ + (modulesPath + "/profiles/qemu-guest.nix") + ]; # Bootloader. boot = { extraModulePackages = [ ]; initrd = { - availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; + availableKernelModules = [ + "uhci_hcd" + "ehci_pci" + "ahci" + "virtio_pci" + "virtio_scsi" + "sd_mod" + "sr_mod" + ]; kernelModules = [ ]; }; loader = { @@ -21,16 +33,19 @@ }; }; - fileSystems."/" = - { device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb"; - fsType = "ext4"; - }; + fileSystems."/" = { + device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb"; + fsType = "ext4"; + }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/7115-EFA6"; - fsType = "vfat"; - options = [ "fmask=0077" "dmask=0077" ]; - }; + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/7115-EFA6"; + fsType = "vfat"; + options = [ + "fmask=0077" + "dmask=0077" + ]; + }; swapDevices = [ ]; diff --git a/hosts/vm-jellyfin/hardware-configuration.nix b/hosts/vm-jellyfin/hardware-configuration.nix index 95d03e8..1ef3394 100644 --- a/hosts/vm-jellyfin/hardware-configuration.nix +++ b/hosts/vm-jellyfin/hardware-configuration.nix @@ -1,28 +1,43 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: +{ + lib, + modulesPath, + ... +}: { - imports = - [ (modulesPath + "/profiles/qemu-guest.nix") - ]; + imports = [ + (modulesPath + "/profiles/qemu-guest.nix") + ]; - boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; + boot.initrd.availableKernelModules = [ + "uhci_hcd" + "ehci_pci" + "ahci" + "virtio_pci" + "virtio_scsi" + "sd_mod" + "sr_mod" + ]; boot.initrd.kernelModules = [ ]; boot.kernelModules = [ ]; boot.extraModulePackages = [ ]; - fileSystems."/" = - { device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb"; - fsType = "ext4"; - }; + fileSystems."/" = { + device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb"; + fsType = "ext4"; + }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/7115-EFA6"; - fsType = "vfat"; - options = [ "fmask=0077" "dmask=0077" ]; - }; + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/7115-EFA6"; + fsType = "vfat"; + options = [ + "fmask=0077" + "dmask=0077" + ]; + }; swapDevices = [ ]; diff --git a/manifests/databases/ingress.yaml b/manifests/databases/ingress.yaml new file mode 100644 index 0000000..f75c920 --- /dev/null +++ b/manifests/databases/ingress.yaml @@ -0,0 +1,39 @@ +apiVersion: traefik.io/v1alpha1 +kind: MiddlewareTCP +metadata: + name: local-hosts-only + namespace: db +spec: + ipAllowList: + sourceRange: + - 127.0.0.1/32 # Localhost, obviously + - 10.42.0.0/16 # My internal net + - 10.211.0.0/16 # Kubernetes IPs + # Tailscale hosts + - 100.119.228.115 # chronicles + - 100.88.91.27 # dns? + - 100.80.99.48 # exodus + - 100.88.91.27 # genesis + - 100.91.131.66 # gitlab + - 100.68.203.1 # hosea + - 100.84.183.79 # isaiah + - 100.102.186.39 # jeremiah + - 100.90.74.19 # jude + - 100.115.57.8 # linode + - 100.65.5.38 # matrix + - 100.127.55.22 # jellyfin +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRouteTCP +metadata: + name: ingress-route-postgres + namespace: db +spec: + entryPoints: + - postgres + routes: + - match: HostSNI(`*`) + priority: 10 + services: + - name: postgres-rw + port: 5432 diff --git a/manifests/databases/kustomization.yaml b/manifests/databases/kustomization.yaml index f6f06b6..d8e8a11 100644 --- a/manifests/databases/kustomization.yaml +++ b/manifests/databases/kustomization.yaml @@ -5,3 +5,4 @@ resources: - postgres-gitlab.yaml - postgres-pgadmin.yaml - postgres-matrix.yaml + - ingress.yaml diff --git a/manifests/helm/kustomization.yaml b/manifests/helm/kustomization.yaml index ed49217..c6ae679 100644 --- a/manifests/helm/kustomization.yaml +++ b/manifests/helm/kustomization.yaml @@ -1,4 +1,5 @@ resources: - flux.yaml + - traefik.yaml - external-secrets.yaml - cloudnative-pg.yaml diff --git a/manifests/helm/traefik.yaml b/manifests/helm/traefik.yaml new file mode 100644 index 0000000..ee24569 --- /dev/null +++ b/manifests/helm/traefik.yaml @@ -0,0 +1,22 @@ +apiVersion: "helm.cattle.io/v1" +kind: "HelmChartConfig" +metadata: + name: "traefik" + namespace: "kube-system" +spec: + valuesContent: |- + additionalArguments: + - "--entryPoints.postgres.address=:5432/tcp" + - "--api.dashboard=true" + - "--api.insecure=true" + - "--log.level=DEBUG" + ports: + postgres: + expose: + default: true + port: 5432 + exposedPort: 5432 + protocol: TCP + traefik: + expose: + default: true diff --git a/modules/nixos/kubernetes.nix b/modules/nixos/kubernetes.nix index b142bd7..a30cf49 100644 --- a/modules/nixos/kubernetes.nix +++ b/modules/nixos/kubernetes.nix @@ -37,6 +37,9 @@ in networking.firewall = { allowedTCPPorts = [ + 80 + 443 + 5432 6443 ] ++ ( diff --git a/secrets/gitlab/deterministic-key.age b/secrets/gitlab/deterministic-key.age new file mode 100644 index 0000000..443bda7 --- /dev/null +++ b/secrets/gitlab/deterministic-key.age @@ -0,0 +1,39 @@ +age-encryption.org/v1 +-> ssh-ed25519 64uajw pGArtr7GB1lyaooKK46PBygPCtdQmFfEpk1rA0molCA +8ssJyIFriGAp9BQCYMyTf+S2HmMeOC1UH2QXqbqBFLQ +-> ssh-ed25519 oyEmTw AZbFjT/AjhDQOVHQYiZAKwZyUZar5uMiM2r2B3IpN3A +FQ3cu6l6KZbHB6vSatiLWV/ntDoc1zVT4/QUinPVZCc +-> ssh-ed25519 mOmPfg Ru0AM8rjvVpn3PjWp7KPf/wtdBAphHfpNJ9bbZZVdmM +sphzkfNpy3GiLSXo5U9ct8t55tLGE+Lt2MVglsMCu/E +-> ssh-ed25519 YJiRbw UuAcR0LT/TWfWI1Ba8cm6iv/aYY+eADglTwPBAyjP1Q +NxxO5o0G+PQZBRTC1pdAFNr28+ijKUEXAZJDsbF2sLg +-> ssh-ed25519 aY2AXA 4Y8xviHTR9/fjycJHzcHLzN1txHl1+bGHG099CNnDm4 +Y9IQVYf5KQ1qDdFwPKpWxsCwdy46OYRlYCncvEMHXO0 +-> ssh-ed25519 xNtnoA CWVPYtuxcHQLtSd9cWLs7yuPgAuaY1hRGMesA+HhGCE +5LFGLF5uRxHkbSp0WenWH5pBpEDNr269GmTOrSA5F90 +-> ssh-ed25519 AQhf1g bjCjRVRxIWGPIbXg6QvNwXjiXajyuwMXbLu/3EDxp3Y +zHlX3WzfAccjVyksrzsdWfVsx2ia2oXBdTWLGroP1BA +-> ssh-ed25519 B8wa7Q zr+NOkU1OAJPvpN/MXECQAowUKWIbnNLJJsGeGUydww ++we1cguTwDROfIAJJYrExz9Towmr18JXVY3oRkpv14w +-> ssh-ed25519 8UnW5Q QjneH4f6Oly7tnAMLiLMwUIjAsaSi5ZFoC8TQG6GkmY +kspnipzqALYSiT1jJRhF1yZecxbkXv70vlBKMUxBPZw +-> ssh-ed25519 0/WsKg Ep9gDq0DtcGbdQh/PrYe+iBv6OSeLPWxICjXbKjFJnE +2g526leouu0mRQBJSebsQ2h/3UF2fqQe6P8PnSLEhWA +-> ssh-ed25519 Nl/5yA ki1Df4IbjbBJsBuu0i7mlCDkIcp/238uCzTq2xxo3SU +0KPSkglgV55rtv0cJ0ZHxXXrrd/kFWPieM1RSSz+KKU +-> ssh-ed25519 GdLgCQ L+YIJXArLcYoRNBOEgSrpM0fNQHWTZn3AKmuue9s1Hs +Y7dOqUW2+/6DTVHfitXWPRQTn8dAXFaO848XhiarYYI +-> ssh-ed25519 tOH/HQ rohrw+mCT7L76YNfHG2kZ//3+0BvLE5adIv4iDCYPXo +7VsJeUR655/7Rl5+aT3OUK1iUHL2xaz88VblWxyzDbk +-> ssh-ed25519 FpzvfQ v8DOcm6/7afe7hqJLs4yS9QsoaKrtmft1nUbVMIQbiY +zPtH/T7vUG0TYAImLK4a4i8ta/n4Iu5qUIHNzj4AExk +-> ssh-ed25519 kdPvzQ TVIyKHig7iMyCx25roaLgF+wbm8r/FdDmYzsn47mQFY +7FGAj3og7JONhSZFjywwoc41lGSaUvJb2BaFjc7Ymlw +-> ssh-ed25519 onmXpg yr5rUSP7BVin9iRa8dbhsqkhzMNBgk03kSj0ne+9cxw +5fYMGMVh4lxXuZzNIOUhXj9B43RIEzI2mCy9urSSEng +-> ssh-ed25519 CnhD0g 7hvSFju7gEZ3z/wh7vYErWG545rqx2Vw+uoOk/QplEs +UOPP23HMYyJ5w/3qbtEmHZU36F8kwiCVBsaZHTeOJgk +-> ssh-ed25519 4ep2UA SSi6Na4Zkz15jv9AIQV9UW0xr2YFmoT5s96Fz0X0nmk +BoSwO6G8pMUt/N8RRLdVxzmQsn6RK655j27shIV5xq8 +--- FsKrB9/IGIe8BxDxJDSnAnm84SoJAPZFawQjoAUTbUE +\86IrwN[]$`u8BބHփ.a#|biҮ*>Kpq \ No newline at end of file diff --git a/secrets/gitlab/primary-key.age b/secrets/gitlab/primary-key.age new file mode 100644 index 0000000..f05290b --- /dev/null +++ b/secrets/gitlab/primary-key.age @@ -0,0 +1,39 @@ +age-encryption.org/v1 +-> ssh-ed25519 64uajw 65up4NePHDRo97ryHxOcL/ZulVqH6bE8o0HRwKaS/zI +c4XtvR4EeZ8G4iT7sEj9prfvAoDDMnp8dUF2JSc/qPU +-> ssh-ed25519 oyEmTw QiQFAuLBYBQmiJ8TAGagLqfDFktf4mwsOhmJ7ZBIM0s +fdpvwfAKAWJUrFcGNA5NmH14Weixfp8NUqoPA/mw+4I +-> ssh-ed25519 mOmPfg dPYBhH6jodNFeTNTMwPuEq46i7DzKq67tMlYWkw3+T8 +Z4Uh0YhUL8KWqUCmr/AFILazC7v9L2poNC7IUbE6Uu8 +-> ssh-ed25519 YJiRbw RvWUVFSFOvz7q5mNBg1FoYLi1jbpMPvImUlJSy5zBTQ +nNuNQnN/RhtFUOsbezo8LP8ceY/yqFSYDCo7igujiqM +-> ssh-ed25519 aY2AXA LbCZXvEeHWVtlvecusaJVdRSUjsCONHhD2ADA73FGy8 +4zNv08Z7vvS1c2/BOdL0JxAX/Y+kU4q/WWlfxmA6fVk +-> ssh-ed25519 xNtnoA fZVGgBdLb47UmapPENDK6nxICXx+KeIEhBQ3UKIi7HM +dTJO+0qXtgpzjCe6K4+FQa0nynH5qEXebyERRQEBDzE +-> ssh-ed25519 AQhf1g 8Srs6GErqaEibInARo/dzXwXdNqNTFBk/kgPyXGlEAM +K0Ol9j/Uxw1up7xEapKwtoTAc2ZgoHuqKiHFcdrM4IY +-> ssh-ed25519 B8wa7Q PZekZdp5Dj84fnRopshQYTZu7ue8A92PMfMqGMyPIUk +Y6WvNhXo2nQI/nmI2gGdO9XCjjafpAai+fEGeYSGCHA +-> ssh-ed25519 8UnW5Q AsNtL1dQUNeKHaatp/85nVUe1jLL5WsviNpKXQEBqkY +z/9Q/DJQqVGNYHHJ3fU/EFPfTREZSJMxxlm6fhVGpME +-> ssh-ed25519 0/WsKg 4TV+ryC7wbPQGTnU7TzuwCJz+iZEluBFAlnk23deA0U +h9JoILNlSPX+dePFjSYM8vvetXINWAJ+DIXcStM+D6M +-> ssh-ed25519 Nl/5yA uw7SLz+XPRnHb5ux2mp1VEL/cwnMFMhc86UnglcwARI +k7lt+0yFMqAcepklurzW0MoB+yr3HL9DLTa+1+PPETg +-> ssh-ed25519 GdLgCQ t5aY2s4XfLnlmAjB5k8UpEy2iMm2K8NFeowDyP9nliY ++x0yKD0pDecGPnU/ijJ7WRUm/UNoQu4EX4/azB9Og6Y +-> ssh-ed25519 tOH/HQ Cc06HO0i/Yy65bNTREl2r0qd8sM+vhLyVxB7Pm8pemY +qy1juC+a7BjtMZ2XoFvfCkIEI8ihTCs9ThAkTSvEsVg +-> ssh-ed25519 FpzvfQ MdxHv8FxO4tRbiup4k6N4JUFtnofB6WJ8xn8KTUSjyM +Mx+0cPM5bq/qJxKXSmzneL/Pg5CBiO7bjHjyFT05exw +-> ssh-ed25519 kdPvzQ Tww+Oh8cQV9/qUw+2FWpRJTljjsbFB7T93xrRJcFGwo +lGyd6FuQ3Y68pVn/aZCCtxVEoc9gn5Nc42peuFy68dk +-> ssh-ed25519 onmXpg asPPNt+wiRFWgaBaie0voK4Yw5R8t8r5I3t6qujAsx0 +oa8Em8djkwbKYUQkPvZ3YMvvM2x9NEtm/f6Y7PoWmmo +-> ssh-ed25519 CnhD0g lfXt1ZIhVWv84cvAykGjO44OvVny+U1Rju+17gx6qR0 +7StUFJgr+8zVr9OAmtgQk+UoBaQ8LqIUmttqlXdpX+s +-> ssh-ed25519 4ep2UA ued9/iPni10UpRf/RM0wesnRfp+lpoO99831MoShxnk +k5t8fmGnoCkHskZdvw1fYyCdns7BZsPUaLlJ6WzQgHc +--- HaCc7eAoVLgJf982a8aRJPadwoZ9WAQ2jH1+j5Z2w8Y +W!MCuX?l=?˳[(MNqh^"`#A4&qhE \ No newline at end of file diff --git a/secrets/gitlab/salt.age b/secrets/gitlab/salt.age new file mode 100644 index 0000000..19af78c --- /dev/null +++ b/secrets/gitlab/salt.age @@ -0,0 +1,39 @@ +age-encryption.org/v1 +-> ssh-ed25519 64uajw RdFMAWftlhzUEqoxui6a0IBxI7KxrU6C5uQeJwhUAzg +UO611nUdfsLfG+LRhPVkX+BaVM2NoTB571nDdy7nn6E +-> ssh-ed25519 oyEmTw 3zfLtPD8rpTSaVSMQCOSp38S9fywd6e+V0e9v9JGgwU +qjaK+z7HDjmLdViDNjCj6rm3bNjc0xrrUVlwupkXd5w +-> ssh-ed25519 mOmPfg weCYfjyuqqPcEVNM7+rqE/x5ZL8Mifp+obzMULqZgWU +0HTPHd8Hq8qJOfVzP/kczVQYaXKJykT9KCK9Rn6r/nI +-> ssh-ed25519 YJiRbw 0ARXvdUzE670xRni7RRnyVhzFURTyoQ1GTNtfY+MWU8 +jlt7BMNJ/AwOOIkIDAyiFyy8FV5PYlcqwB6MOLSZce4 +-> ssh-ed25519 aY2AXA CyalC9EQJFdNCl+BNLKrt8KKZBPnaPzH3t25F9otkEM +m3mig+c7SvWuxUIorZcVfzIqualwTC+xJBDKvB+zCcU +-> ssh-ed25519 xNtnoA 3n7J6GMt64Z9+0M89QTmZaeJ2/A7JdMl7TfC2nUt+xQ +wk6G2SZL9VTzFlyIzc/EulzzG5P9EG9M1652aapvT+Q +-> ssh-ed25519 AQhf1g ksxGPi6mYEhc1X2waHMXkTFgnB6lpKWKUeyMxFOnMkM +Jj6fEbw52O3I9wUyk9of+NSJmNZC1U4+7UF98ChEbQI +-> ssh-ed25519 B8wa7Q yMYUdu6A9dEmiAgYveyxSKoUL5XkmMdnyOIwherXzyc +4n87yY0czhQib32cxQ8XH6tepRIzjmE7ewWCRaY0Dpg +-> ssh-ed25519 8UnW5Q PLN3cqCd4t1m4bNbRjFNAs5k2hwTUxRV02DPgpZ75Uk +tRwglJ5sPoJzp9Je5xEXlYM2kbUUd+xwawZIBYKZKZk +-> ssh-ed25519 0/WsKg V0GKvQ3KdATmhVHlXyL95Lb1bZ7uTBMHH+1DloQwaWA +UDb0UWGNzjY7K7qNqhU88+ViGoP7msG73sxmiTwaKgQ +-> ssh-ed25519 Nl/5yA eyZT6r909dv5ClBxUhCflv1676VV1uQALhsrHJycRQY +0AkXJLRwKURIXPhnM8VnUVkBl9Oq4LUHTs4n7Ai0X0w +-> ssh-ed25519 GdLgCQ bIMe/3XDR7HCZOzxG+n8ud5bzMMDrZSPCDoPnbX7clg +XGRkbM1xkZzhaCa2frDhWAZkJ0RAlbBx7IcJrCzhXWc +-> ssh-ed25519 tOH/HQ 42VvN/DyV1VjbK0sI3/AWGCByXw+W/atfLUjlEIkyCs +f2DijeqBQss3f44fFIDC5M3SXRRpm3Cl0iaLLOyAD68 +-> ssh-ed25519 FpzvfQ iRQ1JgNvo6mpRIn4HiF3dOul/ZhzQbjP8MCID8sFY2k +SL9kRpWY1SigL2MVhy99hB3ACCHIPTK/IMIH98epch0 +-> ssh-ed25519 kdPvzQ gleTd+wfxQgl4IcQDqw5SmdRQvOV5MRHtSh1XeXz3wY +5fGWJak3xivrRJS+dfiUWc15KaVTIXe8xlLhr+lgIR4 +-> ssh-ed25519 onmXpg SU/B3Y0ddUAUNDPwSeAqaG1ICihEQRglorF1143KC1s +Qm6GGzluTIvEVnXTbl3z0LcrzxXpdN5hOksc03giazY +-> ssh-ed25519 CnhD0g GVlnY0nuxGqWn3y7CPIk3p5P/bJ2ovt/DCpsemTwnRw +vleILr9u6erKyzgofdIZuVShrilviX0New95Xw3+0pM +-> ssh-ed25519 4ep2UA xSlFMYDkUBAzs+xaJJr29rbaC4L88ARUG6zq8v82cng +C/i6coQ1Eg1Kka6sDXFnV7bMTekcKJOf6Q0gc6scFJA +--- sx1TUDKIOIimdMTVBePkZzcfpJnvHddO1itsV7adTSo +8Z4bɑLe @B'ƠjOiZەpI[!o8ɛc<Г眗P޽ \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 2d8392a..4e09c95 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -92,6 +92,9 @@ in # Then pipe the resulting files to agenix -e "gitlab/key.age".publicKeys = everyone; "gitlab/cert.age".publicKeys = everyone; + "gitlab/salt.age".publicKeys = everyone; + "gitlab/primary-key.age".publicKeys = everyone; + "gitlab/deterministic-key.age".publicKeys = everyone; "gitlab/nixos-qemu-shell.age".publicKeys = everyone; "gitlab/nixos-vbox-shell.age".publicKeys = everyone; "gitlab/kubernetes-k3s-local.age".publicKeys = everyone; From 4e137b97ec80c8c202dd957a669974aafc83be66 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Fri, 30 May 2025 00:24:25 -0500 Subject: [PATCH 16/18] Add greg to podman group --- hosts/exodus/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hosts/exodus/default.nix b/hosts/exodus/default.nix index 7de274a..b1730ad 100644 --- a/hosts/exodus/default.nix +++ b/hosts/exodus/default.nix @@ -55,4 +55,6 @@ virtualisation = { oci-containers.backend = "podman"; }; + + users.users.greg.extraGroups = [ "podman" ]; } From c71436d926326a5f0df93e838dedea501b09e70a Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Fri, 30 May 2025 00:25:34 -0500 Subject: [PATCH 17/18] Try to fix podman exec --- .gitlab-ci.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 3d9e09b..56aa807 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -29,8 +29,8 @@ default: - IMG: - img-bitwarden script: - - podman login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY" + - nix run "nixpkgs#podman" login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY" - nix build ".#${IMG}" - - podman load -i result - - podman tag "localhost/${IMG}:latest" "$CI_REGISTRY/greg/ci-images/${IMG}:latest" - - podman push "$CI_REGISTRY/greg/ci-images/${IMG}:latest" + - nix run "nixpkgs#podman" load -i result + - nix run "nixpkgs#podman" tag "localhost/${IMG}:latest" "$CI_REGISTRY/greg/ci-images/${IMG}:latest" + - nix run "nixpkgs#podman" push "$CI_REGISTRY/greg/ci-images/${IMG}:latest" From ec06d665cd9b171cb5b20d39303cccec807d6201 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Fri, 30 May 2025 00:26:07 -0500 Subject: [PATCH 18/18] Update zed --- flake.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/flake.lock b/flake.lock index 3ebcb74..9efd40d 100644 --- a/flake.lock +++ b/flake.lock @@ -962,11 +962,11 @@ "patched-nixpkgs": "patched-nixpkgs" }, "locked": { - "lastModified": 1747467107, - "narHash": "sha256-IIewGkpjoV6zSJNgxsL7p+wij/Q7RpDAlf0OVggK/ME=", + "lastModified": 1747989907, + "narHash": "sha256-91ddFyGUJNgyiJw1GYD04sbENGp9IuqtuUWHwbL/RVU=", "owner": "HPsaucii", "repo": "zed-editor-flake", - "rev": "50b08c64d1abed4318b8289ec3f62b64b4f34231", + "rev": "aa6440225e5aa225f242bb38235fba185665a616", "type": "github" }, "original": {