admin/cozystack
1
0 Fork 0
mirror of https://github.com/cozystack/cozystack.git synced 2026-11-09 05:25:14 +09:00
Code Issues Packages Projects Releases Wiki Activity

feat(fluxcd): bump flux-operator/instance to v0.48.0, web UI opt-in

Browse Source 
Bump flux-operator and flux-instance vendored charts from v0.33.0 to
v0.48.0, moving the Flux distribution from 2.7.x to 2.8.x. This brings
helm-controller v1.5.x, which exposes spec.install.healthCheckExprs on
HelmRelease — a prerequisite for adding real readiness gating to
dependency-target packages (postgres, mongodb, kafka, etc.).

The new flux-operator chart defaults web.enabled=true; override it to
false in packages/system/fluxcd-operator/values.yaml so the Flux Status
Web UI stays opt-in. Operators wanting it can set web.enabled=true and
configure web.config / web.configSecretName / web.ingress per the
upstream chart values.

Patches reapplied:
- kubernetesEnvs.diff: matched cleanly (offset shift only)
- networkPolicy.diff: extended to also restrict port 9080 (web UI port);
  hunk count updated 20 -> 22

Pre-flight: no references to the v0.39-removed --disable-wait-interruption
flag anywhere in packages/ or internal/.

Verified locally:
- helm template renders both packages without errors
- web.enabled=false (default): no web Deployment/Service/NetworkPolicy
- web.enabled=true: renders web NetworkPolicy on port 9080
- CiliumClusterwideNetworkPolicy lists 8080/8081/9080
- FluxInstance distribution.version: "2.8.x", all 7 components present
- Cozystack kustomize patches (concurrent, requeue, storage-adv-addr,
  events-addr) intact

Notable upstream changes between v0.33 and v0.48:
- Flux 2.8.x with HelmRelease inventory format change (auto-migrated)
- Reliability fixes for stuck FluxInstance/ResourceSet on health-check
  cancellation (v0.39, v0.46)
- New CLI: flux-operator migrate, diff, patch instance, distro mirror
- ResourceSetInputProvider: GitLab Environments, GitHub App, Gitea/Forgejo
- CVE-2026-23990 (Web UI OIDC impersonation bypass) — N/A while web is off

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
This commit is contained in:
Myasnikov Daniil committed 2026-05-28 12:43:49 +05:00
1 parent 8afb99b282
commit 9aa8710ef2
28 files changed
+717 -52
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

packages/system/fluxcd-operator/charts/flux-operator/Chart.yaml
+4 -4
View File
@@ -2,15 +2,15 @@ annotations:
artifacthub.io/license: AGPL-3.0
artifacthub.io/links: |
- name: Documentation
url: https://fluxcd.control-plane.io/operator
url: https://fluxoperator.dev/docs
- name: Chart Source
url: https://github.com/controlplaneio-fluxcd/charts
- name: Upstream Project
url: https://github.com/controlplaneio-fluxcd/flux-operator
apiVersion: v2
appVersion: v0.33.0
appVersion: v0.48.0
description: 'A Helm chart for deploying the Flux Operator. '
home: https://github.com/controlplaneio-fluxcd
home: https://fluxoperator.dev
icon: https://raw.githubusercontent.com/cncf/artwork/main/projects/flux/icon/color/flux-icon-color.png
keywords:
- flux
@@ -25,4 +25,4 @@ sources:
- https://github.com/controlplaneio-fluxcd/flux-operator
- https://github.com/controlplaneio-fluxcd/charts
type: application
version: 0.33.0
version: 0.48.0
packages/system/fluxcd-operator/charts/flux-operator/README.md
+32 -6
View File
@@ -1,6 +1,6 @@
# flux-operator
![Version: 0.33.0](https://img.shields.io/badge/Version-0.33.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.33.0](https://img.shields.io/badge/AppVersion-v0.33.0-informational?style=flat-square)
![Version: 0.48.0](https://img.shields.io/badge/Version-0.48.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.48.0](https://img.shields.io/badge/AppVersion-v0.48.0-informational?style=flat-square)
The [Flux Operator](https://github.com/controlplaneio-fluxcd/flux-operator) provides a
declarative API for the installation and upgrade of CNCF [Flux](https://fluxcd.io) and the
@@ -9,12 +9,15 @@ ControlPlane [enterprise distribution](https://control-plane.io/enterprise-for-f
The operator automates the patching for hotfixes and CVEs affecting the Flux controllers container images
and enables the configuration of multi-tenancy lockdown on Kubernetes and OpenShift clusters.
The operator comes with the Flux Status Page web UI exposed on port `9080` that allows users to visualize the
status of the Flux installation and monitor the GitOps delivery pipeline in real-time.
## Prerequisites
- Kubernetes 1.22+
- Kubernetes 1.30+
- Helm 3.8+
## Installing the Chart
## Installing Flux Operator
To install the operator in the `flux-system` namespace:
@@ -25,8 +28,22 @@ helm install flux-operator oci://ghcr.io/controlplaneio-fluxcd/charts/flux-opera
--wait
```
## Installing the Flux Web UI as a Standalone Deployment
You can install the Flux Status Web UI as a dedicated deployment in your Kubernetes cluster,
separate from the Flux Operator with:
```console
helm install flux-web oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator \
--namespace flux-system \
--set fullnameOverride=flux-web \
--set web.serverOnly=true \
--set installCRDs=false \
--wait
```
To deploy the Flux controllers and to configure automated updates,
see the Flux Operator [documentation](https://fluxcd.control-plane.io/operator/).
see the Flux Operator [documentation](https://fluxoperator.dev/docs/).
## Values
@@ -47,7 +64,7 @@ see the Flux Operator [documentation](https://fluxcd.control-plane.io/operator/)
| livenessProbe | object | `{"httpGet":{"path":"/healthz","port":8081},"initialDelaySeconds":15,"periodSeconds":20}` | Container liveness probe settings. |
| logLevel | string | `"info"` | Container logging level flag. |
| marketplace | object | `{"account":"","license":"","type":""}` | Marketplace settings. |
| multitenancy | object | `{"defaultServiceAccount":"flux-operator","defaultWorkloadIdentityServiceAccount":"flux-operator","enabled":false,"enabledForWorkloadIdentity":false}` | Enable [multitenancy lockdown](https://fluxcd.control-plane.io/operator/resourceset/#role-based-access-control) for the ResourceSet APIs. |
| multitenancy | object | `{"defaultServiceAccount":"flux-operator","defaultWorkloadIdentityServiceAccount":"flux-operator","enabled":false,"enabledForWorkloadIdentity":false}` | Enable [multitenancy lockdown](https://fluxoperator.dev/docs/crd/resourceset/#role-based-access-control) for the ResourceSet APIs. |
| nameOverride | string | `""` | |
| nodeSelector | object | `{}` | Pod Node Selector settings. |
| podSecurityContext | object | `{}` | Pod security context settings. |
@@ -55,12 +72,21 @@ see the Flux Operator [documentation](https://fluxcd.control-plane.io/operator/)
| rbac.create | bool | `true` | Grant the cluster-admin role to the flux-operator service account (required for the Flux Instance deployment). |
| rbac.createAggregation | bool | `true` | Grant the Kubernetes view, edit and admin roles access to ResourceSet APIs. |
| readinessProbe | object | `{"httpGet":{"path":"/readyz","port":8081},"initialDelaySeconds":5,"periodSeconds":10}` | Container readiness probe settings. |
| reporting | object | `{"interval":"5m"}` | Flux [reporting](https://fluxcd.control-plane.io/operator/fluxreport/) settings. |
| reporting | object | `{"interval":"5m"}` | Flux [reporting](https://fluxoperator.dev/docs/crd/fluxreport/) settings. |
| resources | object | `{"limits":{"cpu":"2000m","memory":"1Gi"},"requests":{"cpu":"100m","memory":"64Mi"}}` | Container resources requests and limits settings. |
| securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Container security context settings. The default is compliant with the pod security restricted profile. |
| serviceAccount | object | `{"automount":true,"create":true,"name":""}` | Pod service account settings. The name of the service account defaults to the release name. |
| serviceMonitor | object | `{"create":false,"interval":"60s","labels":{},"scrapeTimeout":"30s"}` | Prometheus Operator scraping settings. |
| tolerations | list | `[]` | Pod tolerations settings. |
| web.config | object | `{}` | The spec of the [Web Config API](https://fluxoperator.dev/docs/web-ui/web-config-api/) |
| web.configSecretName | string | `""` | Reference to an existing Secret in the same namespace as the deployment containing the Web Config API. Should have the key `config.yaml`. |
| web.enabled | bool | `true` | Enable the [Flux Status web server](https://fluxoperator.dev/web-ui/) on port 9080. |
| web.httpRoute | object | `{"annotations":{},"enabled":false,"hostnames":[],"parentRefs":[]}` | Gateway API HTTPRoute settings for the Flux Status web interface. |
| web.ingress | object | `{"annotations":{},"className":"","enabled":false,"hosts":[],"tls":[]}` | Ingress settings for the Flux Status web interface. |
| web.networkPolicy | object | `{"create":true}` | Create a NetworkPolicy to allow access to the Flux Status web interface. |
| web.rbac | object | `{"createAggregation":false,"createRoles":true}` | Create standard roles for [user access management](https://fluxoperator.dev/docs/web-ui/user-management/). |
| web.serverOnly | bool | `false` | Run the Flux Status web server as a standalone deployment (requires a dedicated Helm release). |
| web.serverReplicas | int | `1` | Number of replicas for the Flux Status web server standalone deployment (only applicable if `web.serverOnly` is `true`). |
## Source Code
packages/system/fluxcd-operator/charts/flux-operator/templates/NOTES.txt
+1 -1
View File
@@ -1 +1 @@
Documentation at https://fluxcd.control-plane.io/operator/
Documentation at https://fluxoperator.dev/docs/
packages/system/fluxcd-operator/charts/flux-operator/templates/_helpers.tpl
+60
View File
@@ -56,3 +56,63 @@ Create the name of the service account to use
{{- define "flux-operator.serviceAccountName" -}}
{{- default (include "flux-operator.fullname" .) .Values.serviceAccount.name }}
{{- end }}
{{/*
Check if web config secret should be created.
Returns "true" when web is enabled, config is provided inline, and no external secret is referenced.
*/}}
{{- define "flux-operator.createWebConfigSecret" -}}
{{- if and .Values.web.enabled .Values.web.config (not .Values.web.configSecretName) -}}
true
{{- end -}}
{{- end }}
{{/*
Check if an external web config secret is referenced.
Returns "true" when web is enabled, an external secret name is provided, and no inline config is set.
*/}}
{{- define "flux-operator.useWebConfigSecret" -}}
{{- if and .Values.web.enabled .Values.web.configSecretName (not .Values.web.config) -}}
true
{{- end -}}
{{- end }}
{{/*
Check if running in web server only mode.
Returns "true" when web is enabled and serverOnly mode is set.
*/}}
{{- define "flux-operator.webServerOnly" -}}
{{- if and .Values.web.enabled .Values.web.serverOnly -}}
true
{{- end -}}
{{- end }}
{{/*
Check if web server replicas should be set.
Returns "true" when web is enabled, serverOnly mode is set, and serverReplicas is greater than 1.
*/}}
{{- define "flux-operator.setWebServerReplicas" -}}
{{- if and .Values.web.enabled .Values.web.serverOnly (gt (int .Values.web.serverReplicas) 1) -}}
true
{{- end -}}
{{- end }}
{{/*
Check if web roles should be created.
Returns "true" when web is enabled and createRoles is enabled.
*/}}
{{- define "flux-operator.createWebRoles" -}}
{{- if and .Values.web.enabled .Values.web.rbac.createRoles -}}
true
{{- end -}}
{{- end }}
{{/*
Check if web roles aggregation should be created.
Returns "true" when web is enabled and createAggregation is enabled.
*/}}
{{- define "flux-operator.createWebRolesAggregation" -}}
{{- if and .Values.web.enabled .Values.web.rbac.createAggregation -}}
true
{{- end -}}
{{- end }}
packages/system/fluxcd-operator/charts/flux-operator/templates/admin-clusterrole.yaml
+1 -1
View File
@@ -1,4 +1,4 @@
{{- if .Values.rbac.create }}
{{- if and .Values.rbac.create (not (include "flux-operator.webServerOnly" .)) }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
packages/system/fluxcd-operator/charts/flux-operator/templates/aggregate-clusterrole.yaml
+1 -1
View File
@@ -1,4 +1,4 @@
{{- if .Values.rbac.createAggregation }}
{{- if and .Values.rbac.createAggregation (not (include "flux-operator.webServerOnly" .)) }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
packages/system/fluxcd-operator/charts/flux-operator/templates/crds.yaml
+70 -10
View File
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.19.0
controller-gen.kubebuilder.io/version: v0.20.0
helm.sh/resource-policy: keep
labels:
app.kubernetes.io/instance: '{{ .Release.Name }}'
@@ -164,7 +164,11 @@ spec:
components:
description: |-
Components is the list of controllers to install.
Defaults to a commonly used subset.
Defaults to the core Flux controllers:
- source-controller
- kustomize-controller
- helm-controller
- notification-controller
items:
description: Component is the name of a controller to install.
enum:
@@ -211,6 +215,7 @@ spec:
- upstream-alpine
- enterprise-alpine
- enterprise-distroless
- enterprise-distroless-fips
type: string
version:
description: Version semver expression e.g. '2.x', '2.3.x'.
@@ -618,7 +623,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.19.0
controller-gen.kubebuilder.io/version: v0.20.0
helm.sh/resource-policy: keep
labels:
app.kubernetes.io/instance: '{{ .Release.Name }}'
@@ -785,7 +790,7 @@ spec:
failing:
description: |-
Failing is the number of reconciled
resources in the Failing state.
resources in the Failing state and not Suspended.
type: integer
running:
description: |-
@@ -921,7 +926,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.19.0
controller-gen.kubebuilder.io/version: v0.20.0
helm.sh/resource-policy: keep
labels:
app.kubernetes.io/instance: '{{ .Release.Name }}'
@@ -985,9 +990,9 @@ spec:
- a PEM-encoded CA certificate (`ca.crt`)
- a PEM-encoded client certificate (`tls.crt`) and private key (`tls.key`)
When connecting to a Git or OCI provider that uses self-signed certificates, the CA certificate
must be set in the Secret under the 'ca.crt' key to establish the trust relationship.
When connecting to an OCI provider that supports client certificates (mTLS), the client certificate
When connecting to a Git, OCI, or ExternalService provider that uses self-signed certificates,
the CA certificate must be set in the Secret under the 'ca.crt' key to establish the trust relationship.
When connecting to a provider that supports client certificates (mTLS), the client certificate
and private key must be set in the Secret under the 'tls.crt' and 'tls.key' keys, respectively.
properties:
name:
@@ -1013,6 +1018,11 @@ spec:
ExcludeBranch specifies the regular expression to filter the branches
that the input provider should exclude.
type: string
excludeEnvironment:
description: |-
ExcludeEnvironment specifies the regular expression to filter the environments
that the input provider should exclude.
type: string
excludeTag:
description: |-
ExcludeTag specifies the regular expression to filter the tags
@@ -1023,6 +1033,11 @@ spec:
IncludeBranch specifies the regular expression to filter the branches
that the input provider should include.
type: string
includeEnvironment:
description: |-
IncludeEnvironment specifies the regular expression to filter the environments
that the input provider should include.
type: string
includeTag:
description: |-
IncludeTag specifies the regular expression to filter the tags
@@ -1048,6 +1063,11 @@ spec:
Supported only for tags at the moment.
type: string
type: object
insecure:
description: |-
Insecure allows connecting to an ExternalService or OCIArtifactTag provider
over plain HTTP without TLS. When not set, the URL must use HTTPS.
type: boolean
schedule:
description: Schedule defines the schedules for the input provider
to run.
@@ -1075,13 +1095,16 @@ spec:
type: array
secretRef:
description: |-
SecretRef specifies the Kubernetes Secret containing the basic-auth credentials
SecretRef specifies the Kubernetes Secret containing the credentials
to access the input provider.
When connecting to a Git provider, the secret must contain the keys
'username' and 'password', and the password should be a personal access token
that grants read-only access to the repository.
When connecting to an OCI provider, the secret must contain a Kubernetes
Image Pull Secret, as if created by `kubectl create secret docker-registry`.
When connecting to an ExternalService provider, the secret must contain either
a 'token' key for bearer token authentication, or 'username' and 'password'
keys for basic authentication.
properties:
name:
description: Name of the referent.
@@ -1119,13 +1142,18 @@ spec:
- GitLabBranch
- GitLabTag
- GitLabMergeRequest
- GitLabEnvironment
- AzureDevOpsBranch
- AzureDevOpsTag
- AzureDevOpsPullRequest
- GiteaBranch
- GiteaTag
- GiteaPullRequest
- OCIArtifactTag
- ACRArtifactTag
- ECRArtifactTag
- GARArtifactTag
- ExternalService
type: string
url:
description: |-
@@ -1151,6 +1179,16 @@ spec:
- message: spec.url must start with 'oci://' when spec.type is an OCI
provider
rule: '!self.type.endsWith(''ArtifactTag'') || self.url.startsWith(''oci'')'
- message: spec.url must start with 'http://' or 'https://' when spec.type
is 'ExternalService'
rule: self.type != 'ExternalService' || self.url.startsWith('http')
- message: spec.insecure can only be set when spec.type is 'ExternalService'
or 'OCIArtifactTag'
rule: '!has(self.insecure) || !self.insecure || self.type == ''ExternalService''
|| self.type == ''OCIArtifactTag'''
- message: spec.url must use 'https://' unless spec.insecure is true
rule: self.type != 'ExternalService' || !self.url.startsWith('http://')
|| (has(self.insecure) && self.insecure)
- message: cannot specify spec.serviceAccountName when spec.type is not
one of AzureDevOps* or *ArtifactTag
rule: '!has(self.serviceAccountName) || self.type.startsWith(''AzureDevOps'')
@@ -1289,7 +1327,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.19.0
controller-gen.kubebuilder.io/version: v0.20.0
helm.sh/resource-policy: keep
labels:
app.kubernetes.io/instance: '{{ .Release.Name }}'
@@ -1403,6 +1441,15 @@ spec:
input provider objects are used. Defaults to flattening all inputs
from all providers into a single list of input sets.
properties:
includeEmptyProviders:
description: |-
IncludeEmptyProviders controls how input providers that export no
inputs are treated. Only applies when Name is Permute. When true, if
any provider has zero inputs the resulting permutation set is empty
(mathematically correct Cartesian product behavior). When false or
unset (default), providers with zero inputs are silently skipped and
the remaining providers still permute among themselves.
type: boolean
name:
description: |-
Name defines how the inputs are combined when multiple
@@ -1425,6 +1472,9 @@ spec:
required:
- name
type: object
x-kubernetes-validations:
- message: includeEmptyProviders only applies when name is Permute
rule: '!has(self.includeEmptyProviders) || self.name == ''Permute'''
inputs:
description: Inputs contains the list of ResourceSet inputs.
items:
@@ -1603,6 +1653,16 @@ spec:
- type
type: object
type: array
externalChecksumRefs:
description: |-
ExternalChecksumRefs lists the ConfigMap and Secret references
discovered in checksumFrom annotations on the last reconciliation
that point to objects not rendered by this ResourceSet. Each entry
has the form "Kind/namespace/name". It is used to trigger a
reconciliation when one of the referenced objects changes.
items:
type: string
type: array
history:
description: |-
History contains the reconciliation history of the ResourceSet
packages/system/fluxcd-operator/charts/flux-operator/templates/deployment.yaml
+32
View File
@@ -13,6 +13,9 @@ metadata:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
{{- if include "flux-operator.setWebServerReplicas" . }}
replicas: {{ .Values.web.serverReplicas }}
{{- end }}
selector:
matchLabels:
{{- include "flux-operator.selectorLabels" . | nindent 6 }}
@@ -22,6 +25,9 @@ spec:
prometheus.io/scrape: "true"
prometheus.io/port: "8080"
prometheus.io/path: "/metrics"
{{- if include "flux-operator.createWebConfigSecret" . }}
checksum/web-config: {{ (include (print $.Template.BasePath "/web-secret.yaml") . | fromYaml).stringData | toYaml | sha256sum }}
{{- end }}
{{- with .Values.commonAnnotations }}
{{- toYaml . | nindent 8 }}
{{- end }}
@@ -56,6 +62,15 @@ spec:
{{- if .Values.multitenancy.enabledForWorkloadIdentity }}
- --default-workload-identity-service-account={{ .Values.multitenancy.defaultWorkloadIdentityServiceAccount }}
{{- end }}
{{- if include "flux-operator.webServerOnly" . }}
- --web-server-only=true
{{- end }}
{{- if include "flux-operator.createWebConfigSecret" . }}
- --web-config=/etc/flux-operator/web/config.yaml
{{- end }}
{{- if include "flux-operator.useWebConfigSecret" . }}
- --web-config-secret-name={{ .Values.web.configSecretName }}
{{- end }}
{{- range .Values.extraArgs }}
- {{ . }}
{{- end }}
@@ -66,6 +81,8 @@ spec:
fieldPath: metadata.namespace
- name: REPORTING_INTERVAL
value: {{ .Values.reporting.interval }}
- name: WEB_SERVER_PORT
value: "{{ ternary "9080" "0" .Values.web.enabled }}"
{{- with .Values.marketplace.type }}
- name: MARKETPLACE_TYPE
value: {{ . }}
@@ -93,6 +110,11 @@ spec:
- name: http
containerPort: 8081
protocol: TCP
{{- if .Values.web.enabled }}
- name: http-web
containerPort: 9080
protocol: TCP
{{- end }}
livenessProbe:
{{- toYaml .Values.livenessProbe | nindent 12 }}
readinessProbe:
@@ -102,12 +124,22 @@ spec:
volumeMounts:
- name: temp
mountPath: /tmp
{{- if include "flux-operator.createWebConfigSecret" . }}
- name: web-config
mountPath: /etc/flux-operator/web
readOnly: true
{{- end }}
{{- if .Values.extraVolumeMounts }}
{{- toYaml .Values.extraVolumeMounts | nindent 12 }}
{{- end }}
volumes:
- name: temp
emptyDir: {}
{{- if include "flux-operator.createWebConfigSecret" . }}
- name: web-config
secret:
secretName: {{ include "flux-operator.fullname" . }}-web-config
{{- end }}
{{- if .Values.extraVolumes }}
{{- toYaml .Values.extraVolumes | nindent 8 }}
{{- end }}
packages/system/fluxcd-operator/charts/flux-operator/templates/httproute.yaml
+26
View File
@@ -0,0 +1,26 @@
{{- if .Values.web.httpRoute.enabled -}}
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: {{ include "flux-operator.fullname" . }}
namespace: {{ .Release.Namespace }}
labels:
{{- include "flux-operator.labels" . | nindent 4 }}
{{- with .Values.web.httpRoute.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
{{- with .Values.web.httpRoute.parentRefs }}
parentRefs:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .Values.web.httpRoute.hostnames }}
hostnames:
{{- toYaml . | nindent 4 }}
{{- end }}
rules:
- backendRefs:
- name: {{ include "flux-operator.fullname" . }}
port: 9080
{{- end }}
packages/system/fluxcd-operator/charts/flux-operator/templates/ingress.yaml
+44
View File
@@ -0,0 +1,44 @@
{{- if .Values.web.ingress.enabled -}}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: {{ include "flux-operator.fullname" . }}
namespace: {{ .Release.Namespace }}
labels:
{{- include "flux-operator.labels" . | nindent 4 }}
{{- with .Values.web.ingress.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
{{- with .Values.web.ingress.className }}
ingressClassName: {{ . }}
{{- end }}
{{- if .Values.web.ingress.tls }}
tls:
{{- range .Values.web.ingress.tls }}
- hosts:
{{- range .hosts }}
- {{ . | quote }}
{{- end }}
secretName: {{ .secretName }}
{{- end }}
{{- end }}
rules:
{{- range .Values.web.ingress.hosts }}
- host: {{ .host | quote }}
http:
paths:
{{- range .paths }}
- path: {{ .path }}
{{- with .pathType }}
pathType: {{ . }}
{{- end }}
backend:
service:
name: {{ include "flux-operator.fullname" $ }}
port:
name: http-web
{{- end }}
{{- end }}
{{- end }}
packages/system/fluxcd-operator/charts/flux-operator/templates/network-policy.yaml
+2
View File
@@ -14,6 +14,8 @@ spec:
protocol: TCP
- port: "8081"
protocol: TCP
- port: "9080"
protocol: TCP
ingress:
- fromEntities:
- cluster
packages/system/fluxcd-operator/charts/flux-operator/templates/networkpolicy.yaml
+32
View File
@@ -0,0 +1,32 @@
{{- if and .Values.web.enabled .Values.web.networkPolicy.create }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{ include "flux-operator.fullname" . }}-web
namespace: {{ .Release.Namespace }}
labels:
{{- include "flux-operator.labels" . | nindent 4 }}
{{- with .Values.commonLabels }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .Values.commonAnnotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
policyTypes:
- Ingress
podSelector:
matchLabels:
{{- include "flux-operator.selectorLabels" . | nindent 6 }}
ingress:
- from:
- namespaceSelector: {}
ports:
- protocol: TCP
port: 9080
{{- if .Values.serviceMonitor.create }}
- protocol: TCP
port: 8080
{{- end }}
{{- end }}
packages/system/fluxcd-operator/charts/flux-operator/templates/service.yaml
+6
View File
@@ -18,5 +18,11 @@ spec:
targetPort: http-metrics
protocol: TCP
name: http
{{- if .Values.web.enabled }}
- port: 9080
targetPort: http-web
protocol: TCP
name: http-web
{{- end }}
selector:
{{- include "flux-operator.selectorLabels" . | nindent 4 }}
packages/system/fluxcd-operator/charts/flux-operator/templates/web-clusterrole.yaml
+47
View File
@@ -0,0 +1,47 @@
{{- if include "flux-operator.webServerOnly" . }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ include "flux-operator.fullname" . }}-view
labels:
{{- include "flux-operator.labels" . | nindent 4 }}
{{- with .Values.commonLabels }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .Values.commonAnnotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
rules:
- apiGroups: ["*"]
resources: ["*"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create"]
- apiGroups: [""]
resources: ["users", "groups"]
verbs: ["impersonate"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: {{ include "flux-operator.fullname" . }}
labels:
{{- include "flux-operator.labels" . | nindent 4 }}
{{- with .Values.commonLabels }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .Values.commonAnnotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ include "flux-operator.fullname" . }}-view
subjects:
- kind: ServiceAccount
name: {{ include "flux-operator.serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
{{- end }}
packages/system/fluxcd-operator/charts/flux-operator/templates/web-secret.yaml
+26
View File
@@ -0,0 +1,26 @@
{{- if and .Values.web.config .Values.web.configSecretName -}}
{{- fail "Invalid values: 'web.config' and 'web.configSecretName' cannot both be set. Set at most one." -}}
{{- end -}}
{{- if include "flux-operator.createWebConfigSecret" . -}}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "flux-operator.fullname" . }}-web-config
namespace: {{ .Release.Namespace }}
labels:
{{- include "flux-operator.labels" . | nindent 4 }}
{{- with .Values.commonLabels }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .Values.commonAnnotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
type: Opaque
stringData:
config.yaml: |
apiVersion: web.fluxcd.controlplane.io/v1
kind: Config
spec:
{{- toYaml .Values.web.config | nindent 6 }}
{{- end }}
packages/system/fluxcd-operator/charts/flux-operator/templates/web-standard-roles.yaml
+131
View File
@@ -0,0 +1,131 @@
{{- if include "flux-operator.createWebRoles" . }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: flux-web-user
labels:
{{- include "flux-operator.labels" . | nindent 4 }}
{{- with .Values.commonLabels }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .Values.commonAnnotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
rules:
- apiGroups: ["*"]
resources: ["*"]
verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: flux-web-admin
labels:
{{- include "flux-operator.labels" . | nindent 4 }}
{{- with .Values.commonLabels }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .Values.commonAnnotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
rules:
- apiGroups: ["*"]
resources: ["*"]
verbs: ["get", "list", "watch"]
- apiGroups:
- fluxcd.controlplane.io
- source.toolkit.fluxcd.io
- source.extensions.fluxcd.io
- kustomize.toolkit.fluxcd.io
- helm.toolkit.fluxcd.io
- image.toolkit.fluxcd.io
- notification.toolkit.fluxcd.io
resources: ["*"]
verbs:
- patch
- reconcile
- suspend
- resume
- download
- apiGroups:
- apps
resources:
- deployments
- statefulsets
- daemonsets
verbs:
- patch
- restart
- apiGroups:
- batch
resources:
- cronjobs
- jobs
verbs:
- create
- restart
- apiGroups:
- ""
resources:
- pods
verbs:
- delete
{{- end }}
{{- if include "flux-operator.createWebRolesAggregation" . }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: flux-web-edit
labels:
{{- include "flux-operator.labels" . | nindent 4 }}
{{- with .Values.commonLabels }}
{{- toYaml . | nindent 4 }}
{{- end }}
rbac.authorization.k8s.io/aggregate-to-edit: "true"
{{- with .Values.commonAnnotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
rules:
- apiGroups:
- fluxcd.controlplane.io
- source.toolkit.fluxcd.io
- source.extensions.fluxcd.io
- kustomize.toolkit.fluxcd.io
- helm.toolkit.fluxcd.io
- image.toolkit.fluxcd.io
- notification.toolkit.fluxcd.io
resources:
- '*'
verbs:
- reconcile
- suspend
- resume
- download
- apiGroups:
- apps
resources:
- deployments
- statefulsets
- daemonsets
verbs:
- patch
- restart
- apiGroups:
- batch
resources:
- cronjobs
- jobs
verbs:
- create
- restart
- apiGroups:
- ""
resources:
- pods
verbs:
- delete
{{- end }}
packages/system/fluxcd-operator/charts/flux-operator/values.schema.json
+109
View File
@@ -425,6 +425,115 @@
"items": {
"type": "object"
}
},
"web": {
"type": "object",
"properties": {
"config": {
"type": "object"
},
"configSecretName": {
"default": "",
"type": "string"
},
"enabled": {
"type": "boolean"
},
"httpRoute": {
"default": {
"annotations": {},
"enabled": false,
"hostnames": [],
"parentRefs": []
},
"type": "object",
"properties": {
"annotations": {
"type": "object"
},
"enabled": {
"default": false,
"type": "boolean"
},
"hostnames": {
"type": "array",
"uniqueItems": true,
"items": {
"type": "string"
}
},
"parentRefs": {
"type": "array",
"uniqueItems": true,
"items": {
"type": "object"
}
}
}
},
"ingress": {
"default": {
"annotations": {},
"className": "",
"enabled": false
},
"type": "object",
"properties": {
"annotations": {
"type": "object"
},
"className": {
"type": "string"
},
"enabled": {
"default": false,
"type": "boolean"
},
"hosts": {
"type": "array",
"uniqueItems": true,
"items": {
"type": "object"
}
},
"tls": {
"type": "array",
"uniqueItems": true,
"items": {
"type": "object"
}
}
}
},
"networkPolicy": {
"type": "object",
"properties": {
"create": {
"type": "boolean"
}
}
},
"rbac": {
"type": "object",
"properties": {
"createAggregation": {
"default": false,
"type": "boolean"
},
"createRoles": {
"default": true,
"type": "boolean"
}
}
},
"serverOnly": {
"type": "boolean"
},
"serverReplicas": {
"default": 1,
"type": "integer"
}
}
}
}
}
packages/system/fluxcd-operator/charts/flux-operator/values.yaml
+45 -2
View File
@@ -3,17 +3,60 @@
nameOverride: ""
fullnameOverride: ""
# -- Enable [multitenancy lockdown](https://fluxcd.control-plane.io/operator/resourceset/#role-based-access-control) for the ResourceSet APIs.
# -- Enable [multitenancy lockdown](https://fluxoperator.dev/docs/crd/resourceset/#role-based-access-control) for the ResourceSet APIs.
multitenancy:
enabled: false
enabledForWorkloadIdentity: false
defaultServiceAccount: "flux-operator" # @schema required: true
defaultWorkloadIdentityServiceAccount: "flux-operator" # @schema required: true
# -- Flux [reporting](https://fluxcd.control-plane.io/operator/fluxreport/) settings.
# -- Flux [reporting](https://fluxoperator.dev/docs/crd/fluxreport/) settings.
reporting:
interval: 5m # @schema required: true
web:
# -- Enable the [Flux Status web server](https://fluxoperator.dev/web-ui/) on port 9080.
enabled: true
# -- The spec of the [Web Config API](https://fluxoperator.dev/docs/web-ui/web-config-api/)
config: { } # @schema type: object
# -- Reference to an existing Secret in the same namespace as the deployment containing the Web Config API. Should have the key `config.yaml`.
configSecretName: "" # @schema default: ""
# -- Create a NetworkPolicy to allow access to the Flux Status web interface.
networkPolicy:
create: true
# -- Create standard roles for [user access management](https://fluxoperator.dev/docs/web-ui/user-management/).
rbac:
createRoles: true # @schema default: true
createAggregation: false # @schema default: false
# -- Run the Flux Status web server as a standalone deployment (requires a dedicated Helm release).
serverOnly: false
# -- Number of replicas for the Flux Status web server standalone deployment (only applicable if `web.serverOnly` is `true`).
serverReplicas: 1 # @schema default: 1
# -- Ingress settings for the Flux Status web interface.
ingress: # @schema default: {"enabled":false,"className":"","annotations":{}}
enabled: false # @schema default: false
className: ""
annotations: { } # @schema type: object
hosts: [ ] # @schema item: object ; uniqueItems: true
# - host: flux-operator.example.com
# paths:
# - path: /
# pathType: ImplementationSpecific
tls: [ ] # @schema item: object ; uniqueItems: true
# - secretName: flux-operator-tls
# hosts:
# - flux-operator.example.com
# -- Gateway API HTTPRoute settings for the Flux Status web interface.
httpRoute: # @schema default: {"enabled":false,"annotations":{},"parentRefs":[],"hostnames":[]}
enabled: false # @schema default: false
annotations: { } # @schema type: object
parentRefs: [ ] # @schema item: object ; uniqueItems: true
# - name: my-gateway
# namespace: gateway-system
# sectionName: https
hostnames: [ ] # @schema item: string ; uniqueItems: true
# - flux.example.com
# -- Install and upgrade the custom resource definitions.
installCRDs: true # @schema default: true
packages/system/fluxcd-operator/patches/networkPolicy.diff
+3 -1
View File
@@ -2,7 +2,7 @@ diff --git a/charts/flux-operator/templates/network-policy.yaml b/packages/syste
new file mode 100644
--- /dev/null (revision 52a23eacfc32430d8b008b765c64a81526521bae)
+++ b/charts/flux-operator/templates/network-policy.yaml (revision 52a23eacfc32430d8b008b765c64a81526521bae)
@@ -0,0 +1,20 @@
@@ -0,0 +1,22 @@
+{{- if .Capabilities.APIVersions.Has "cilium.io/v2/CiliumClusterwideNetworkPolicy" }}
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
@@ -19,6 +19,8 @@ new file mode 100644
+ protocol: TCP
+ - port: "8081"
+ protocol: TCP
+ - port: "9080"
+ protocol: TCP
+ ingress:
+ - fromEntities:
+ - cluster
packages/system/fluxcd-operator/values.yaml
+4
View File
@@ -12,3 +12,7 @@ flux-operator:
requests:
cpu: 100m
memory: 350Mi
# Flux Status Web UI is opt-in. Override `web.enabled: true` (and configure
# `web.config` / `web.configSecretName` / `web.ingress` as needed) to enable.
web:
enabled: false
packages/system/fluxcd/charts/flux-instance/Chart.yaml
+4 -4
View File
@@ -2,15 +2,15 @@ annotations:
artifacthub.io/license: AGPL-3.0
artifacthub.io/links: |
- name: Documentation
url: https://fluxcd.control-plane.io/operator
url: https://fluxoperator.dev/docs
- name: Chart Source
url: https://github.com/controlplaneio-fluxcd/charts
- name: Upstream Project
url: https://github.com/controlplaneio-fluxcd/flux-operator
apiVersion: v2
appVersion: v0.33.0
appVersion: v0.48.0
description: 'A Helm chart for deploying a Flux instance managed by Flux Operator. '
home: https://github.com/controlplaneio-fluxcd
home: https://fluxoperator.dev
icon: https://raw.githubusercontent.com/cncf/artwork/main/projects/flux/icon/color/flux-icon-color.png
keywords:
- flux
@@ -25,4 +25,4 @@ sources:
- https://github.com/controlplaneio-fluxcd/flux-operator
- https://github.com/controlplaneio-fluxcd/charts
type: application
version: 0.33.0
version: 0.48.0
packages/system/fluxcd/charts/flux-instance/README.md
+11 -11
View File
@@ -1,6 +1,6 @@
# flux-instance
![Version: 0.33.0](https://img.shields.io/badge/Version-0.33.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.33.0](https://img.shields.io/badge/AppVersion-v0.33.0-informational?style=flat-square)
![Version: 0.48.0](https://img.shields.io/badge/Version-0.48.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.48.0](https://img.shields.io/badge/AppVersion-v0.48.0-informational?style=flat-square)
This chart is a thin wrapper around the `FluxInstance` custom resource, which is
used by the [Flux Operator](https://github.com/controlplaneio-fluxcd/flux-operator)
@@ -8,7 +8,7 @@ to install, configure and automatically upgrade Flux.
## Prerequisites
- Kubernetes 1.22+
- Kubernetes 1.30+
- Helm 3.8+
## Installing the Chart
@@ -20,7 +20,7 @@ helm -n flux-system install flux oci://ghcr.io/controlplaneio-fluxcd/charts/flux
```
For more information on the available configuration options,
see the [Flux Instance documentation](https://fluxcd.control-plane.io/operator/fluxinstance/).
see the [Flux Instance documentation](https://fluxoperator.dev/docs/crd/fluxinstance/).
## Uninstalling the Chart
@@ -39,14 +39,14 @@ helm -n flux-system uninstall flux
| fullnameOverride | string | `"flux"` | |
| healthcheck.enabled | bool | `false` | Enable post-install and post-upgrade health checks. |
| healthcheck.timeout | string | `"5m"` | Health check timeout in Go duration format. |
| instance.cluster | object | `{"domain":"cluster.local","multitenant":false,"networkPolicy":true,"size":"","tenantDefaultServiceAccount":"default","type":"kubernetes"}` | Cluster https://fluxcd.control-plane.io/operator/fluxinstance/#cluster-configuration |
| instance.commonMetadata | object | `{"annotations":{},"labels":{}}` | Common metadata https://fluxcd.control-plane.io/operator/fluxinstance/#common-metadata |
| instance.components | list | `["source-controller","kustomize-controller","helm-controller","notification-controller"]` | Components https://fluxcd.control-plane.io/operator/fluxinstance/#components-configuration |
| instance.distribution | object | `{"artifact":"oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests:latest","artifactPullSecret":"","imagePullSecret":"","registry":"ghcr.io/fluxcd","version":"2.x"}` | Distribution https://fluxcd.control-plane.io/operator/fluxinstance/#distribution-configuration |
| instance.kustomize.patches | list | `[]` | Kustomize patches https://fluxcd.control-plane.io/operator/fluxinstance/#kustomize-patches |
| instance.sharding | object | `{"key":"sharding.fluxcd.io/key","shards":[]}` | Sharding https://fluxcd.control-plane.io/operator/fluxinstance/#sharding-configuration |
| instance.storage | object | `{"class":"","size":""}` | Storage https://fluxcd.control-plane.io/operator/fluxinstance/#storage-configuration |
| instance.sync | object | `{"interval":"1m","kind":"GitRepository","name":"","path":"","provider":"","pullSecret":"","ref":"","url":""}` | Sync https://fluxcd.control-plane.io/operator/fluxinstance/#sync-configuration |
| instance.cluster | object | `{"domain":"cluster.local","multitenant":false,"networkPolicy":true,"size":"","tenantDefaultServiceAccount":"default","type":"kubernetes"}` | Cluster https://fluxoperator.dev/docs/crd/fluxinstance/#cluster-configuration |
| instance.commonMetadata | object | `{"annotations":{},"labels":{}}` | Common metadata https://fluxoperator.dev/docs/crd/fluxinstance/#common-metadata |
| instance.components | list | `["source-controller","kustomize-controller","helm-controller","notification-controller"]` | Components https://fluxoperator.dev/docs/crd/fluxinstance/#components-configuration |
| instance.distribution | object | `{"artifact":"oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests:latest","artifactPullSecret":"","imagePullSecret":"","registry":"ghcr.io/fluxcd","variant":"","version":"2.x"}` | Distribution https://fluxoperator.dev/docs/crd/fluxinstance/#distribution-configuration |
| instance.kustomize.patches | list | `[]` | Kustomize patches https://fluxoperator.dev/docs/crd/fluxinstance/#kustomize-patches |
| instance.sharding | object | `{"key":"sharding.fluxcd.io/key","shards":[]}` | Sharding https://fluxoperator.dev/docs/crd/fluxinstance/#sharding-configuration |
| instance.storage | object | `{"class":"","size":""}` | Storage https://fluxoperator.dev/docs/crd/fluxinstance/#storage-configuration |
| instance.sync | object | `{"interval":"1m","kind":"GitRepository","name":"","path":"","provider":"","pullSecret":"","ref":"","url":""}` | Sync https://fluxoperator.dev/docs/crd/fluxinstance/#sync-configuration |
| nameOverride | string | `""` | |
## Source Code
packages/system/fluxcd/charts/flux-instance/templates/NOTES.txt
+1 -1
View File
@@ -1 +1 @@
Documentation at https://fluxcd.control-plane.io/operator/
Documentation at https://fluxoperator.dev/docs/
packages/system/fluxcd/charts/flux-instance/templates/healthcheck.yaml
+1
View File
@@ -3,6 +3,7 @@ apiVersion: batch/v1
kind: Job
metadata:
name: "{{ .Release.Name }}-healthcheck"
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/managed-by: {{ .Release.Service | quote }}
app.kubernetes.io/instance: {{ .Release.Name | quote }}
packages/system/fluxcd/charts/flux-instance/templates/instance.yaml
+4 -1
View File
@@ -14,7 +14,7 @@ metadata:
{{- end }}
spec:
distribution:
version: {{ .Values.instance.distribution.version }}
version: {{ .Values.instance.distribution.version | quote }}
registry: {{ .Values.instance.distribution.registry }}
artifact: {{ .Values.instance.distribution.artifact }}
{{- if .Values.instance.distribution.artifactPullSecret }}
@@ -23,6 +23,9 @@ spec:
{{- if .Values.instance.distribution.imagePullSecret }}
imagePullSecret: {{ .Values.instance.distribution.imagePullSecret }}
{{- end }}
{{- if .Values.instance.distribution.variant }}
variant: {{ .Values.instance.distribution.variant }}
{{- end }}
components: {{ .Values.instance.components | toYaml | nindent 4 }}
cluster:
{{- range $key, $value := .Values.instance.cluster }}
packages/system/fluxcd/charts/flux-instance/values.schema.json
+10
View File
@@ -350,6 +350,16 @@
"registry": {
"type": "string"
},
"variant": {
"type": "string",
"enum": [
"",
"upstream-alpine",
"enterprise-alpine",
"enterprise-distroless",
"enterprise-distroless-fips"
]
},
"version": {
"type": "string"
}
packages/system/fluxcd/charts/flux-instance/values.yaml
+9 -8
View File
@@ -4,20 +4,21 @@ nameOverride: ""
fullnameOverride: "flux"
instance:
# -- Distribution https://fluxcd.control-plane.io/operator/fluxinstance/#distribution-configuration
# -- Distribution https://fluxoperator.dev/docs/crd/fluxinstance/#distribution-configuration
distribution: # @schema required: true
version: "2.x" # @schema required: true
registry: "ghcr.io/fluxcd" # @schema required: true
artifact: "oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests:latest"
artifactPullSecret: ""
imagePullSecret: ""
# -- Components https://fluxcd.control-plane.io/operator/fluxinstance/#components-configuration
variant: "" # @schema enum:['',upstream-alpine,enterprise-alpine,enterprise-distroless,enterprise-distroless-fips]
# -- Components https://fluxoperator.dev/docs/crd/fluxinstance/#components-configuration
components: # @schema item: string; uniqueItems: true; itemEnum: [source-controller,kustomize-controller,helm-controller,notification-controller,image-reflector-controller,image-automation-controller,source-watcher]
- source-controller
- kustomize-controller
- helm-controller
- notification-controller
# -- Cluster https://fluxcd.control-plane.io/operator/fluxinstance/#cluster-configuration
# -- Cluster https://fluxoperator.dev/docs/crd/fluxinstance/#cluster-configuration
cluster: # @schema required: true
type: kubernetes # @schema enum:[kubernetes,openshift,aws,azure,gcp]
size: "" # @schema enum:['',small,medium,large]
@@ -25,19 +26,19 @@ instance:
networkPolicy: true
multitenant: false
tenantDefaultServiceAccount: "default"
# -- Common metadata https://fluxcd.control-plane.io/operator/fluxinstance/#common-metadata
# -- Common metadata https://fluxoperator.dev/docs/crd/fluxinstance/#common-metadata
commonMetadata: # @schema required: false
labels: { }
annotations: { }
# -- Storage https://fluxcd.control-plane.io/operator/fluxinstance/#storage-configuration
# -- Storage https://fluxoperator.dev/docs/crd/fluxinstance/#storage-configuration
storage: # @schema required: false
class: ""
size: ""
# -- Sharding https://fluxcd.control-plane.io/operator/fluxinstance/#sharding-configuration
# -- Sharding https://fluxoperator.dev/docs/crd/fluxinstance/#sharding-configuration
sharding: # @schema required: false
key: "sharding.fluxcd.io/key"
shards: [ ] # @schema item: string
# -- Sync https://fluxcd.control-plane.io/operator/fluxinstance/#sync-configuration
# -- Sync https://fluxoperator.dev/docs/crd/fluxinstance/#sync-configuration
sync: # @schema required: false
interval: 1m
kind: "GitRepository" # @schema enum:[GitRepository,OCIRepository,Bucket]
@@ -48,7 +49,7 @@ instance:
name: ""
provider: ""
kustomize: # @schema required: false
# -- Kustomize patches https://fluxcd.control-plane.io/operator/fluxinstance/#kustomize-patches
# -- Kustomize patches https://fluxoperator.dev/docs/crd/fluxinstance/#kustomize-patches
patches: [ ] # @schema item: object
# -- Common annotations to add to all deployed objects including pods.
packages/system/fluxcd/values.yaml
+1 -1
View File
@@ -5,7 +5,7 @@ flux-instance:
domain: cozy.local # -- default value is overriden in patches
distribution:
artifact: ""
version: 2.7.x
version: 2.8.x
registry: ghcr.io/fluxcd
components:
- source-controller