Skip to content

feat(flux): complete cluster OCI migration #2161

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jfroy wants to merge 1 commit into from
Open

feat(flux): complete cluster OCI migration #2161

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion AGENTS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co

## Cluster

This is **kantai**, a Kubernetes cluster running Talos Linux, with a mix of bare-metal and virtual nodes, managed entirely through GitOps via FluxCD and Flux Operator. All services live under `kantai.xyz`. Current repo configuration targets Talos `v1.13.2` and Kubernetes `v1.36.1`. Flux syncs `refs/heads/main` from `https://github.com/jfroy/flatops` at `kubernetes/cluster`.
This is **kantai**, a Kubernetes cluster running Talos Linux, with a mix of bare-metal and virtual nodes, managed entirely through GitOps via FluxCD and Flux Operator. All services live under `kantai.xyz`. Current repo configuration targets Talos `v1.13.2` and Kubernetes `v1.36.1`. Flux syncs `kubernetes/cluster` from the `latest` artifact at `oci://ghcr.io/jfroy/flatops/cluster`. GitHub Actions publishes and keylessly signs the artifact from `refs/heads/main`; Flux verifies its Cosign identity before reconciliation.

@claude claude Bot Aug 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Cluster section is updated, but two things this PR changes are left undocumented, and both are exactly the kind of invariant an agent can't recover from the tree:

The flux-system OCIRepository is no longer a checked-in manifest. This PR deletes kubernetes/cluster/ocirepository.yaml, so grep -rn 'kind: OCIRepository' kubernetes/cluster/ now comes back empty while 176 sourceRef entries point at it. It is generated by FluxInstance.spec.sync and its Cosign verify block exists only as a Kustomize patch in kubernetes/apps/flux-system/instance/ks/helm-values.yaml. Worth a sentence saying so, since the natural place to look for it no longer has it.

"Maintenance Commands" (line 33) is now wrong. It still says:

Flux reconciliation, when appropriate and after Git state is ready:

Committed Git state is no longer the precondition — Cluster Release has to publish and promote latest first. Until it does, flux reconcile kustomization cluster-apps --with-source re-pulls the previous artifact and reads as a successful no-op, which is a genuinely misleading failure mode for anyone debugging "my commit didn't apply". Suggest rewording to "after the Cluster Release workflow has promoted the artifact" and adding flux reconcile source oci flux-system, since that is the source under cluster-apps now.


## Flux MCP Server

Expand Down Expand Up @@ -139,6 +139,7 @@ Renovate automatically opens PRs for container image and Helm chart updates. Min
GitHub Actions workflows in `.github/workflows/`:

- `claude-review.yaml` — runs `anthropics/claude-code-action` on every non-Renovate, non-fork PR to review the diff against these conventions and post inline review comments. Needs the `ANTHROPIC_API_KEY` repository secret
- `cluster-release.yaml` — builds the `kubernetes/` tree into an OCI artifact on main, publishes it to GHCR, signs its digest with GitHub OIDC/Cosign, verifies the signature, promotes it to `latest`, then calls the OIDC-authenticated Flux Receiver for immediate reconciliation
- `label-sync.yaml` — syncs `.github/labels.yaml` to the repository's labels

PR manifest diffs are not a workflow: `konflate` runs in-cluster (`kubernetes/apps/flux-system/konflate/`), renders HelmReleases and Kustomizations for changed manifests, and reports back as PR comments and status checks. Its UI is at `konflate.kantai.xyz`.
4 changes: 2 additions & 2 deletions kubernetes/apps/actions-runner-system/arc/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ spec:
path: ./kubernetes/apps/actions-runner-system/arc/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand All @@ -34,7 +34,7 @@ spec:
path: ./kubernetes/apps/actions-runner-system/arc/runners
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
4 changes: 2 additions & 2 deletions kubernetes/apps/cert-manager/cert-manager/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ spec:
path: ./kubernetes/apps/cert-manager/cert-manager/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand All @@ -43,7 +43,7 @@ spec:
path: ./kubernetes/apps/cert-manager/cert-manager/issuers
prune: false # don't delete issued certificates
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
4 changes: 2 additions & 2 deletions kubernetes/apps/cert-manager/trust-manager/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ spec:
path: ./kubernetes/apps/cert-manager/trust-manager/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand All @@ -28,7 +28,7 @@ spec:
path: ./kubernetes/apps/cert-manager/trust-manager/cluster-ca-bundle
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/cnpg-system/barman-cloud/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ spec:
path: ./kubernetes/apps/cnpg-system/barman-cloud/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/cnpg-system/cloudnative-pg/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ spec:
path: ./kubernetes/apps/cnpg-system/cloudnative-pg/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/database/cnpg/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ spec:
path: ./kubernetes/apps/database/cnpg/pg18vc
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/database/influxdb/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ spec:
path: ./kubernetes/apps/database/influxdb/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
4 changes: 2 additions & 2 deletions kubernetes/apps/external-secrets/external-secrets/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ spec:
path: ./kubernetes/apps/external-secrets/external-secrets/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand All @@ -43,7 +43,7 @@ spec:
path: ./kubernetes/apps/external-secrets/external-secrets/stores
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/flux-system/instance/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ spec:
path: ./kubernetes/apps/flux-system/instance/ks
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
21 changes: 17 additions & 4 deletions kubernetes/apps/flux-system/instance/ks/helm-values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,13 +9,26 @@ instance:
- helm-controller
- notification-controller
sync:
kind: GitRepository
url: https://github.com/jfroy/flatops
ref: refs/heads/main
kind: OCIRepository
url: oci://ghcr.io/jfroy/flatops/cluster
ref: latest
path: kubernetes/cluster
interval: 1h
interval: 5m
Comment on lines 11 to +16

@claude claude Bot Aug 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No pull credentials are configured for the new source. spec.sync has no pullSecret, and the only patch on OCIRepository/flux-system adds spec.verify — nothing adds secretRef/serviceAccountName.

GHCR packages are private on first push, and ghcr.io/jfroy/flatops/cluster is new (the existing ghcr.io/jfroy/flatops/* packages don't cover it). If the package inherits private visibility, source-controller gets 401 Unauthorized on every poll and the entire cluster loses its source of truth — same failure mode as the ordering issue in kubernetes/cluster/ks.yaml, but permanent.

Either set the package to public (the artifact only contains manifests and ExternalSecret references, no plaintext secrets, so that's viable) or add a pullSecret with a GHCR read token. Worth stating which one was chosen, since it's cluster-fatal and not visible from the repo.

Also note the signature verification is doing double duty here: with a public package, spec.verify is what keeps an unrelated pusher from being trusted, so it's load-bearing rather than defence-in-depth. Please confirm kustomize.patches actually reach the generated sync source in your flux-operator version (i.e. the live OCIRepository shows spec.verify after rollout) — kustomize silently no-ops a patches entry whose target doesn't match, so a wrong target here fails open rather than loudly.

Comment on lines +12 to +16

@claude claude Bot Aug 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

spec.sync has no pullSecret, so ghcr.io/jfroy/flatops/cluster must be anonymously pullable. Konflate's check on this PR says it isn't (yet):

OCIRepository flux-system/flux-system resolve latest:
HEAD "https://ghcr.io/v2/jfroy/flatops/cluster/manifests/latest": ...
403: denied: requested access to the resource is denied

That's the same anonymous path source-controller will take. GHCR packages are private by default and cluster-release.yaml never sets visibility or links the package to the repo, so if this 403 is package visibility rather than "artifact not published from main yet", the root source goes NotReady the moment FluxInstance takes over and there is no in-band way to fix it (see the deadlock note on the deleted kubernetes/cluster/ocirepository.yaml).

Please confirm ghcr.io/jfroy/flatops/cluster is public — and that a Konflate re-run is green — before merging, or add pullSecret here.

Comment on lines 11 to +16

@claude claude Bot Aug 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After this lands there is no path into the cluster that doesn't go through ghcr.io/jfroy/flatops/cluster:latest with signature verification enforced. Anything that makes the artifact unpullable or unverifiable — Sigstore trust-root or bundle-format change, GHCR outage, an accidental flux tag artifact --tag latest onto a bad digest — freezes all 176 Kustomizations, and the fix cannot be delivered through Git, because the source definition now exists only in these values, which are themselves delivered by that source.

Recovery becomes a manual kubectl patch fluxinstance or a hand-applied replacement source, i.e. exactly the live mutation AGENTS.md tells agents not to perform without authorization. Since this PR already updates AGENTS.md for the new sync model, it'd be worth documenting the break-glass procedure there too — or keeping a suspended GitRepository + Kustomization in kubernetes/cluster/ as a dormant fallback.

kustomize:
patches:
# Only reconcile cluster state from artifacts signed by this workflow on main.
- patch: |-
- op: add
path: /spec/verify
value:
provider: cosign
matchOIDCIdentity:
- issuer: ^https://token[.]actions[.]githubusercontent[.]com$
subject: ^https://github[.]com/jfroy/flatops/[.]github/workflows/cluster-release[.]yaml@refs/heads/main$
target:
group: source.toolkit.fluxcd.io
kind: OCIRepository
name: flux-system
Comment on lines +19 to +31

@claude claude Bot Aug 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moving spec.verify from the deleted kubernetes/cluster/ocirepository.yaml into a JSON6902 patch on the flux-operator-generated sync source makes signature enforcement fail open: kustomize silently no-ops a patch whose target matches nothing, so if flux-operator ever changes the generated resource's name/group (or this stanza gets a typo), the cluster keeps reconciling unsigned artifacts with no error anywhere.

Worth confirming after rollout that the field actually landed:

kubectl -n flux-system get ocirepository flux-system -o jsonpath='{.spec.verify}'

(and ideally asserting it in the release workflow or a VAP, since this is the only thing standing between a GHCR push and cluster-wide apply).

Comment on lines +19 to +31

@claude claude Bot Aug 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This moves the cluster's only signature gate from a first-class manifest into a Kustomize patch, which fails open: Kustomize silently no-ops a patch whose target selects nothing. If flux-operator ever renames or re-kinds the generated sync source, spec.verify just disappears and the FluxInstance still reports Ready — nothing surfaces the loss.

Two things worth adding:

  • Confirm after rollout that the generated object really carries it: kubectl get ocirepository flux-system -n flux-system -o jsonpath='{.spec.verify}' (and that SourceVerified is on the status).
  • Consider a kubernetes/vap/ ValidatingAdmissionPolicy requiring spec.verify.provider == "cosign" on OCIRepository/flux-system in flux-system, so the gate can't be dropped silently. cluster-vap already runs before cluster-apps, so it's the right place for this invariant.

Comment on lines +19 to +31

@claude claude Bot Aug 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Worth confirming this patch actually reaches the sync-generated OCIRepository before kubernetes/cluster/ocirepository.yaml goes away, because a patches entry whose target selects nothing is a silent no-op in kustomize — no error, no warning.

The failure mode is unusually easy to miss here. The live OCIRepository/flux-system already carries spec.verify from the previous kustomize-controller apply, and SSA field ownership for it stays with kustomize-controller once this repo stops managing the object — flux-operator won't strip a field it doesn't own. So a no-op patch looks perfectly healthy on this cluster and only surfaces on a rebuild or if the object is ever recreated, at which point the cluster root reconciles latest with no signature verification at all.

Cheap check after the FluxInstance takes over: kubectl get ocirepository flux-system -n flux-system -o yaml and confirm spec.verify is claimed by a flux-operator entry in metadata.managedFields, not just inherited from kustomize-controller.

Comment on lines +19 to +31

@claude claude Bot Aug 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

With kubernetes/cluster/ocirepository.yaml deleted, this patch becomes the only declaration of Cosign verification for the cluster root source — and a Kustomize patches entry whose target matches nothing is a silent no-op, not an error.

So if the target ever stops matching (flux-operator changes the generated source's name, or someone later sets spec.sync.name), flux-operator re-applies OCIRepository/flux-system with force ownership and strips spec.verify from the live object. The cluster then reconciles whatever latest points to, with no signature check and no warning — a fail-open on the one source that controls everything.

Two ways to make it fail closed, either is cheap:

  1. Add a VAP under kubernetes/vap/ requiring spec.verify.provider == "cosign" on OCIRepository named flux-system in flux-system. That fits the existing cluster-vap → cluster-apps ordering and would reject the unverified apply outright.
  2. At minimum, after merge assert the operator-generated source actually carries the block and reports SourceVerified, not just Ready — Ready alone is satisfied by an unverified pull.

Comment on lines +20 to +31

@claude claude Bot Aug 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

With kubernetes/cluster/ocirepository.yaml deleted, this patch is the only thing that puts spec.verify on the source that every one of the 176 sourceRef entries now depends on — and a Kustomize patches entry whose target selects nothing is a silent no-op, not an error. Two coupled assumptions are load-bearing and neither is asserted anywhere:

  1. spec.sync has no name, so the generated source is named by flux-operator's default (flux-system) — which this target.name hardcodes, as do all the ks.yaml sourceRefs.
  2. flux-operator has to run spec.kustomize.patches over the sync-generated objects, not just the controller Deployments.

If either changes, the OCIRepository is still created and still Ready — just unverified, pulling whatever latest points at. Worse, the live object already carries spec.verify from the bootstrap manifest under kustomize-controller's SSA field ownership, so a non-matching patch would look fine indefinitely on the existing cluster and only surface on a rebuild.

Worth pinning down before merge:

# after the FluxInstance flips, confirm the patch actually landed and is owned by flux-operator
kubectl get ocirepository flux-system -n flux-system \
  -o jsonpath='{.spec.verify}{"\n"}{range .metadata.managedFields[*]}{.manager}{" "}{end}{"\n"}'

A VAP under kubernetes/vap/ requiring spec.verify.provider == "cosign" on OCIRepository/flux-system would make it fail closed permanently.

# Increase the number of reconciliations that can be performed in parallel
# https://fluxcd.io/flux/installation/configuration/vertical-scaling/#increase-the-number-of-workers-and-limits
- patch: |
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/flux-system/konflate/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ spec:
path: ./kubernetes/apps/flux-system/konflate/ks
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/flux-system/ocharted/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ spec:
path: ./kubernetes/apps/flux-system/ocharted/ks
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/flux-system/operator/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ spec:
path: ./kubernetes/apps/flux-system/operator/ks
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/gpu-operator/gpu-operator/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ spec:
path: ./kubernetes/apps/gpu-operator/gpu-operator/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
4 changes: 2 additions & 2 deletions kubernetes/apps/kopiur-system/kopiur/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ spec:
path: ./kubernetes/apps/kopiur-system/kopiur/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand All @@ -36,7 +36,7 @@ spec:
path: ./kubernetes/apps/kopiur-system/kopiur/repository
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
4 changes: 2 additions & 2 deletions kubernetes/apps/kube-system/cilium/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ spec:
path: ./kubernetes/apps/kube-system/cilium/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand All @@ -31,7 +31,7 @@ spec:
path: ./kubernetes/apps/kube-system/cilium/config
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/kube-system/coredns/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ spec:
path: ./kubernetes/apps/kube-system/coredns/app
prune: false # don't GC coredns to avoid unwanted DR
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/kube-system/cpufreq/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ spec:
path: ./kubernetes/apps/kube-system/cpufreq/kantai1
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/kube-system/csi-driver-smb/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ spec:
path: ./kubernetes/apps/kube-system/csi-driver-smb/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/kube-system/descheduler/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ spec:
path: ./kubernetes/apps/kube-system/descheduler/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/kube-system/gateway-crd/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ spec:
path: ./kubernetes/apps/kube-system/gateway-crd/experimental
prune: false # don't GC CRDs
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/kube-system/generic-device-plugin/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ spec:
path: ./kubernetes/apps/kube-system/generic-device-plugin/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/kube-system/k8s-digester/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ spec:
path: ./kubernetes/apps/kube-system/k8s-digester/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/kube-system/kubelet-csr-approver/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ spec:
path: ./kubernetes/apps/kube-system/kubelet-csr-approver/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/kube-system/metrics-server/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ spec:
path: ./kubernetes/apps/kube-system/metrics-server/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
4 changes: 2 additions & 2 deletions kubernetes/apps/kube-system/multus/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ spec:
path: ./kubernetes/apps/kube-system/multus/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand All @@ -34,7 +34,7 @@ spec:
path: ./kubernetes/apps/kube-system/multus/networks
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
4 changes: 2 additions & 2 deletions kubernetes/apps/kube-system/node-feature-discovery/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ spec:
path: ./kubernetes/apps/kube-system/node-feature-discovery/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand All @@ -26,7 +26,7 @@ spec:
path: ./kubernetes/apps/kube-system/node-feature-discovery/custom
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/kube-system/reloader/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ spec:
path: ./kubernetes/apps/kube-system/reloader/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/kube-system/runtimes/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ spec:
path: ./kubernetes/apps/kube-system/runtimes/ks
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/kube-system/snapshot-controller/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ spec:
path: ./kubernetes/apps/kube-system/snapshot-controller/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/kube-system/spegel/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ spec:
path: ./kubernetes/apps/kube-system/spegel/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
2 changes: 1 addition & 1 deletion kubernetes/apps/kube-system/zfs-static-csi/ks.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ spec:
path: ./kubernetes/apps/kube-system/zfs-static-csi/app
prune: true
sourceRef:
kind: GitRepository
kind: OCIRepository
name: flux-system
namespace: flux-system
interval: 1h
Expand Down
Loading
Loading