ArtifactGenerator
source.extensions.fluxcd.io / v1beta1
apiVersion: source.extensions.fluxcd.io/v1beta1
kind: ArtifactGenerator
metadata:
name: example
apiVersion
string
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind
string
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata
object
spec object
ArtifactGeneratorSpec defines the desired state of ArtifactGenerator.
artifacts []object required
OutputArtifacts is a list of output artifacts to be generated.
minItems:
1maxItems:
1000copy []object required
Copy defines a list of copy operations to perform from the sources to the generated artifact.
The copy operations are performed in the order they are listed with existing files
being overwritten by later copy operations.
minItems:
1
exclude
[]string
Exclude specifies a list of glob patterns to exclude
files and dirs matched by the 'From' field. Patterns are matched
against paths relative to the source alias root or to the non-glob
prefix of 'From'. Patterns without a separator (e.g. "*.md") match
the file name at any depth.
maxItems:
100
from
string required
From specifies the source (by alias) and the glob pattern to match files.
The format is "@<alias>/<glob-pattern>". When pathPattern is set,
the path may use capture placeholders such as "{app}".
pattern:
^@([a-z0-9]([a-z0-9_-]*[a-z0-9])?)/(.*)$minLength:
1maxLength:
1024
optional
boolean
Optional, when set to true, allows the copy operation to silently
skip when the source path or glob pattern matches no files.
When false (default), the reconciliation fails with an error if
no files are matched.
strategy
string
Strategy specifies the copy strategy to use.
'Overwrite' will overwrite existing files in the destination.
'Merge' is for merging YAML files using Helm values merge strategy.
'Extract' is for extracting the contents of tarball archives (.tar.gz, .tgz)
When using glob patterns, non-tarball files are silently skipped. For single file sources,
the file must be a tarball or an error is returned. Directories are not supported.
If not specified, defaults to 'Overwrite'.
enum:
Overwrite, Merge, Extract
to
string required
To specifies the destination path within the artifact.
The format is "@artifact/path", the alias "artifact"
refers to the root path of the generated artifact. When pathPattern
is set, the path may use capture placeholders such as "{app}".
pattern:
^@artifact/([^/]{0,1}|[^./][^/]|[.][^./]|[^/]{3,})(/([^/]{0,1}|[^./][^/]|[.][^./]|[^/]{3,}))*$minLength:
1maxLength:
1024
inputsFrom
string
InputsFrom specifies a source path to a YAML file whose contents are
exported in the ExternalArtifact .status.exportedInputs field.
The format is "@<alias>/<path>", where <alias> references a source or
"artifact" for the generated artifact itself. When pathPattern is set,
the path may use capture placeholders such as "{module}".
pattern:
^@([a-z0-9]([a-z0-9_-]*[a-z0-9])?)/(.*)$minLength:
1maxLength:
1024
name
string required
Name is the name of the generated artifact.
When pathPattern is set, this field may use capture placeholders such as "{app}".
The maximum length accommodates capture placeholders; the effective
limits are enforced by the CEL validation when pathPattern is not set.
maxLength:
1024
namespace
string
Namespace is the namespace of the generated artifact.
If not provided, defaults to the same namespace as the ArtifactGenerator.
When pathPattern is set, this field may use capture placeholders such as "{app}".
The credentials used to reconcile the artifact are described in
.spec.serviceAccountName: an explicit ServiceAccount applies to every
generated artifact, while the --default-service-account flag only applies
to artifacts in a namespace other than the ArtifactGenerator namespace.
The maximum length accommodates capture placeholders; the effective
limits are enforced by the CEL validation when pathPattern is not set.
maxLength:
1024
originRevision
string
OriginRevision is used to set the 'org.opencontainers.image.revision'
annotation on the generated artifact metadata.
If specified, it must point to an existing source alias in the format "@<alias>".
If the referenced source has an origin revision (e.g. a Git commit SHA),
it will be used to set the annotation on the generated artifact.
If the referenced source does not have an origin revision, the field is ignored.
pattern:
^@([a-z0-9]([a-z0-9_-]*[a-z0-9])?)$maxLength:
64
revision
string
Revision is the revision of the generated artifact.
If specified, it must point to an existing source alias in the format "@<alias>".
If not specified, the revision is automatically set to the digest of the artifact content.
pattern:
^@([a-z0-9]([a-z0-9_-]*[a-z0-9])?)$maxLength:
64commonMetadata object
CommonMetadata specifies the common labels and annotations that are
applied to all resources. Any existing label or annotation will be
overridden if its key matches a common one.
annotations
object
Annotations to be added to the object's metadata.
labels
object
Labels to be added to the object's metadata.
managedNamespaces object
ManagedNamespaces defines how the controller manages the namespaces
targeted by the generated artifacts. When omitted, the target namespaces
are unmanaged: they must already exist and are left untouched.
allowedNames
[]string required
AllowedNames is a list of CEL expressions that define the set of
namespaces the ArtifactGenerator agrees to manage. Each expression
receives the namespace name through the 'ns' string variable and must
return a boolean. A namespace is managed only when at least one
expression returns true. The 'default', 'kube-system', 'kube-public'
and 'flux-system' namespaces are always rejected, regardless of the
expressions.
minItems:
1metadata object
Metadata defines how the metadata of the desired namespaces is built,
on top of .spec.commonMetadata.
from []object
From is a list of metadata operations applied in order to the desired
namespaces, on top of .spec.commonMetadata and .fromSource.
annotations
object
Annotations to be applied to the namespace.
labels
object
Labels to be applied to the namespace.
namespace
string required
Namespace is the name of the desired namespace the metadata applies to,
or '*' to apply the metadata to all desired namespaces.
pattern:
^(\*|[a-z0-9]([-a-z0-9]*[a-z0-9])?)$maxLength:
63
strategy
string required
Strategy specifies how the labels and annotations are applied.
'Reset' clears all the existing labels and annotations before applying
the ones defined in the operation (fields that are not set clear the
corresponding metadata), 'Override' merges the ones defined in the
operation into the existing values, overriding existing keys, while
'Merge' merges only the absent keys, preserving existing values.
enum:
Reset, Override, MergefromSource object
FromSource sources namespace metadata from a NamespaceMetadata file
inside a source artifact.
allowedAnnotations
object
AllowedAnnotations is a schema for the annotations that the
NamespaceMetadata file is allowed to set. Each key is an annotation key
and each value is a CEL expression that receives the annotation value
through the 'value' string variable and must return a boolean.
Annotations whose key is not present in this map are ignored, while
annotations whose value does not satisfy the respective expression are
rejected.
The expressions are compiled, so a malformed expression or one that
does not return a boolean fails validation at the start of the
reconciliation.
allowedLabels
object
AllowedLabels is a schema for the labels that the NamespaceMetadata
file is allowed to set. Each key is a label key and each value is a
CEL expression that receives the label value through the 'value' string
variable and must return a boolean. Labels whose key is not present in
this map are ignored, while labels whose value does not satisfy the
respective expression are rejected.
The expressions are compiled, so a malformed expression or one that
does not return a boolean fails validation at the start of the
reconciliation.
path
string required
Path is the path to the NamespaceMetadata file inside a source artifact,
in the format "@<alias>/<path>". When pathPattern is set, the path may
use capture placeholders such as "{namespace}". Only namespace-level
captures are allowed, so that every artifact targeting a namespace
resolves to the same file.
pattern:
^@([a-z0-9]([a-z0-9_-]*[a-z0-9])?)/(.*)$minLength:
1maxLength:
1024
prune
boolean required
Prune specifies whether the controller deletes managed namespaces that
are no longer targeted by any generated artifact, or when the
ArtifactGenerator is deleted.
pathPattern
string
PathPattern specifies a directory traversal pattern to match within the sources.
The format is "@<alias>/<pattern>". Named captures in the pattern (e.g. "{app}")
can be used as placeholders in OutputArtifacts fields.
pattern:
^@([a-z0-9]([a-z0-9_-]*[a-z0-9])?)/(.*)$maxLength:
1024
serviceAccountName
string
ServiceAccountName is the name of the ServiceAccount used to authorize
the reconciliation of the generated ExternalArtifacts and the managed
Namespaces. The name is resolved in the ArtifactGenerator namespace. When
specified, the controller checks this ServiceAccount with
SubjectAccessReview for every namespace targeted by the generated
ExternalArtifacts, including the ArtifactGenerator namespace, and its
RBAC bindings determine the namespaces in which they can be created,
updated and deleted.
When not specified, the controller uses its own credentials for
ExternalArtifacts in the ArtifactGenerator namespace, and the
ServiceAccount configured with the --default-service-account flag
(when set) for artifacts targeting another namespace.
Namespace management (.spec.managedNamespaces) always requires a
ServiceAccount for authorization, so either this field or the
--default-service-account flag must be set; otherwise the reconciliation
fails with a terminal error. The controller performs the namespace
operations with its own credentials.
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?$minLength:
1maxLength:
63sources []object required
Sources is a list of references to the Flux source-controller
resources that will be used to generate the artifact.
minItems:
1maxItems:
1000
alias
string required
Alias of the source within the ArtifactGenerator context.
The alias must be unique per ArtifactGenerator, and must consist
of lower case alphanumeric characters, underscores, and hyphens.
It must start and end with an alphanumeric character.
pattern:
^[a-z0-9]([a-z0-9_-]*[a-z0-9])?$maxLength:
63
kind
string required
Kind of the source.
enum:
Bucket, GitRepository, OCIRepository, HelmChart, ExternalArtifact
name
string required
Name of the source.
pattern:
^[a-z0-9]([a-z0-9-]*[a-z0-9])?$maxLength:
253
namespace
string
Namespace of the source.
If not provided, defaults to the same namespace as the ArtifactGenerator.
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?$minLength:
1maxLength:
63status object
ArtifactGeneratorStatus defines the observed state of ArtifactGenerator.
conditions []object
Conditions holds the conditions for the ArtifactGenerator.
lastTransitionTime
string required
lastTransitionTime is the last time the condition transitioned from one status to another.
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
format:
date-time
message
string required
message is a human readable message indicating details about the transition.
This may be an empty string.
maxLength:
32768
observedGeneration
integer
observedGeneration represents the .metadata.generation that the condition was set based upon.
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
with respect to the current state of the instance.
format:
int64minimum:
0
reason
string required
reason contains a programmatic identifier indicating the reason for the condition's last transition.
Producers of specific condition types may define expected values and meanings for this field,
and whether the values are considered a guaranteed API.
The value should be a CamelCase string.
This field may not be empty.
pattern:
^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$minLength:
1maxLength:
1024
status
string required
status of the condition, one of True, False, Unknown.
enum:
True, False, Unknown
type
string required
type of condition in CamelCase or in foo.example.com/CamelCase.
pattern:
^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$maxLength:
316inventory []object
Inventory contains the list of objects managed by the ArtifactGenerator,
such as the generated ExternalArtifacts and the managed Namespaces.
digest
string required
Digest of the referent object. For generated artifacts this is the
artifact content digest; for managed namespaces this is a digest of the
metadata applied by the controller.
filename
string
Filename is the name of the artifact file.
kind
string
Kind is the kind of the referent object.
enum:
ExternalArtifact, Namespace
name
string required
Name of the referent object.
namespace
string
Namespace of the referent object. Empty for cluster-scoped objects.
lastHandledReconcileAt
string
LastHandledReconcileAt holds the value of the most recent
reconcile request value, so a change of the annotation value
can be detected.
observedSourcesDigest
string
ObservedSourcesDigest is a hash representing the current state of
all the sources referenced by the ArtifactGenerator.
No matches. Try .spec.artifacts for an exact path