FluxInstance
fluxcd.controlplane.io / v1
apiVersion: fluxcd.controlplane.io/v1
kind: FluxInstance
metadata:
name: example
apiVersion
string
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind
string
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata
object
spec object
FluxInstanceSpec defines the desired state of FluxInstance
cluster object
Cluster holds the specification of the Kubernetes cluster.
domain
string
Domain is the cluster domain used for generating the FQDN of services.
Defaults to 'cluster.local'.
multitenant
boolean
Multitenant enables the multitenancy lockdown. Defaults to false.
multitenantObjectIdentity
boolean
MultitenantObjectIdentity enables the multitenancy lockdown for
object identity. Defaults to false.
multitenantWorkloadIdentity
boolean
MultitenantWorkloadIdentity is now legacy.
Legacy: Use MultitenantObjectIdentity instead.
networkPolicy
boolean
NetworkPolicy restricts network access to the current namespace.
Defaults to true.
objectIdentityRBAC
boolean
ObjectIdentityRBAC configures the RBAC required for object identity
using Kubernetes service account tokens. Object identity is the new
name of the upstream Flux object-level workload identity feature.
In Flux v2.6.0 to v2.9.x this enables the
ObjectLevelWorkloadIdentity feature gate and leaves the RBAC for
creating service account tokens in place. When disabled, the
operator removes that RBAC from the Flux controllers' ClusterRole.
Starting with Flux v2.10.0, the ObjectLevelWorkloadIdentity feature
gate is retired and no longer changes behavior, so the operator no
longer passes it to the controllers.
Starting with Flux v2.10.0, the RBAC for creating service account
tokens is removed from the Flux distribution, and this field
controls whether the operator adds it.
This feature is only available in Flux v2.6.0 and later.
objectLevelWorkloadIdentity
boolean
ObjectLevelWorkloadIdentity is now legacy.
Legacy: Use ObjectIdentityRBAC instead.
size
string
Size defines the vertical scaling profile of the Flux controllers.
The size is used to determine the concurrency and CPU/Memory limits for the Flux controllers.
Accepted values are: 'small', 'medium' and 'large'.
enum:
small, medium, large
tenantDefaultDecryptionServiceAccount
string
TenantDefaultDecryptionServiceAccount is the name of the service account
to use as default for kustomize-controller SOPS decryption when the
multitenant lockdown for object identity is enabled. Defaults to the
'default' service account from the tenant namespace.
tenantDefaultKubeConfigServiceAccount
string
TenantDefaultKubeConfigServiceAccount is the name of the service account
to use as default for kustomize-controller and helm-controller remote
cluster access via spec.kubeConfig.configMapRef when the multitenant
lockdown for object identity is enabled. Defaults to the 'default'
service account from the tenant namespace.
tenantDefaultServiceAccount
string
TenantDefaultServiceAccount is the name of the service account
to use as default when the multitenant lockdown is enabled, for
kustomize-controller and helm-controller.
This field will also be used for multitenant object identity
lockdown for source-controller, notification-controller,
image-reflector-controller and image-automation-controller.
Defaults to the 'default' service account from the tenant namespace.
type
string
Type specifies the distro of the Kubernetes cluster.
Defaults to 'kubernetes'.
enum:
kubernetes, openshift, aws, azure, gcpcommonMetadata object
CommonMetadata specifies the common labels and annotations that are
applied to all resources. Any existing label or annotation will be
overridden if its key matches a common one.
annotations
object
Annotations to be added to the object's metadata.
labels
object
Labels to be added to the object's metadata.
components
[]string
Components is the list of controllers to install.
Defaults to the core Flux controllers:
- source-controller
- kustomize-controller
- helm-controller
- notification-controller
distribution object required
Distribution specifies the version and container registry to pull images from.
artifact
string
Artifact is the URL to the OCI artifact containing
the latest Kubernetes manifests for the distribution,
e.g. 'oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests:latest'.
pattern:
^oci://.*$
artifactPullSecret
string
ArtifactPullSecret is the name of the Kubernetes secret
to use for pulling the Kubernetes manifests for the distribution specified in the Artifact field.
imagePullSecret
string
ImagePullSecret is the name of the Kubernetes secret
to use for pulling images.
registry
string required
Registry address to pull the distribution images from
e.g. 'ghcr.io/fluxcd'.
variant
string
Variant specifies the Flux distribution flavor stored
in the registry.
enum:
upstream-alpine, enterprise-alpine, enterprise-distroless, enterprise-distroless-fips
version
string required
Version semver expression e.g. '2.x', '2.3.x'.
kustomize object
Kustomize holds a set of patches that can be applied to the
Flux installation, to customize the way Flux operates.
patches []object
Strategic merge and JSON patches, defined as inline YAML objects,
capable of targeting objects based on kind, label and annotation selectors.
patch
string required
Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with
an array of operation objects.
target object
Target points to the resources that the patch document should be applied to.
annotationSelector
string
AnnotationSelector is a string that follows the label selection expression
https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
It matches with the resource annotations.
group
string
Group is the API group to select resources from.
Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
kind
string
Kind of the API Group to select resources from.
Together with Group and Version it is capable of unambiguously
identifying and/or selecting resources.
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
labelSelector
string
LabelSelector is a string that follows the label selection expression
https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
It matches with the resource labels.
name
string
Name to match resources with.
namespace
string
Namespace to select resources from.
version
string
Version of the API Group to select resources from.
Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.
https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
migrateResources
boolean
MigrateResources instructs the controller to migrate the Flux custom resources
from the previous version to the latest API version specified in the CRD.
Defaults to true.
sharding object
Sharding holds the specification of the sharding configuration.
key
string
Key is the label key used to shard the resources.
shards
[]string required
Shards is the list of shard names.
minItems:
1
storage
string
Storage defines if the source-controller shards
should use an emptyDir or a persistent volume claim for storage.
Accepted values are 'ephemeral' or 'persistent', defaults to 'ephemeral'.
When set to 'persistent', the '.spec.storage' field must be set.
enum:
ephemeral, persistentspiffe object
SPIFFE holds the configuration for the SPIFFE integration.
When set, the operator configures the Flux controllers to use
the SPIFFE Workload API and optionally enables object identity
and mTLS between the controllers.
The flux-operator pod must also be configured with the same Workload API
and, when used, Broker API settings, but does not need the inter-controller
flags.
brokerAPI object
BrokerAPI holds the configuration for the SPIFFE Broker API.
When set, enables the object-level SPIFFE features.
endpoint
string required
Endpoint is the address of the SPIFFE Broker API endpoint,
e.g. 'dns:///spiffe-broker.example.com:443'.
The flux-operator pod accepts the same --spiffe-broker-endpoint flag
as the Flux controllers. For OLM installations, the endpoint can be
set with the SPIFFE_BROKER_ENDPOINT environment variable.
pattern:
^[!-~]+$minLength:
1maxLength:
1024
ids
[]string required
IDs is the list of SPIFFE IDs or SPIFFE ID prefixes authorized
for the SPIFFE Broker API endpoint. SPIFFE IDs ending with a slash
are treated as prefixes.
The flux-operator pod accepts the same repeatable --spiffe-broker-id
flag as the Flux controllers. For OLM installations, the IDs can be
set with the SPIFFE_BROKER_IDS environment variable as a comma-separated
list.
minItems:
1maxItems:
64mtls object
MTLS holds the configuration for mTLS between the Flux controllers.
The flux-operator reads the controller SPIFFE IDs from .status.spiffe.
componentIDTemplate
string required
ComponentIDTemplate is the SPIFFE ID template for the Flux controllers.
The '{component}' placeholder is replaced with the name of each
installed component. A trailing slash indicates a SPIFFE ID prefix.
The flux-operator ID is derived from this template with 'flux-operator'
as the component name, and is only authorized when the operator has a
SPIFFE Workload API source. The template must resolve to the operator
pod's actual SPIFFE ID.
When the operator has a SPIFFE Workload API source, its ID is added to
notification-controller as an authorized notifier. When the operator's
embedded Web UI is enabled, it is also added to source-controller and
source-watcher as an authorized artifact client for the Web UI artifact
downloads. Enabling or disabling the embedded Web UI changes these
controller arguments and rolls out the affected controllers.
For a standalone Web UI, use ExtraArtifactClients and ExtraNotifiers.
pattern:
^spiffe://[a-z0-9._-]{1,255}(?:/(?:[a-zA-Z0-9_-]|[.][a-zA-Z0-9_-]|[{]component[}])[a-zA-Z0-9._-]*(?:[{]component[}][a-zA-Z0-9._-]*)*)+(?:/)?$maxLength:
2048
enabled
boolean required
Enabled enables mTLS between the Flux controllers.
extraArtifactClients
[]string
ExtraArtifactClients is a list of additional SPIFFE IDs added to
source-controller and source-watcher as authorized artifact clients,
e.g. the standalone Web UI or the Flux MCP Server.
maxItems:
64
extraArtifactServers
[]string
ExtraArtifactServers is a list of additional SPIFFE IDs added to
kustomize-controller, helm-controller and source-watcher as authorized
artifact servers, e.g. an external source controller.
maxItems:
64
extraNotifiers
[]string
ExtraNotifiers is a list of additional SPIFFE IDs added to
notification-controller as authorized notifiers, e.g. the standalone
Web UI or the Flux MCP Server.
maxItems:
64
receivers
[]string
Receivers is the list of SPIFFE IDs of external Ingress or Gateway
controllers authorized to send webhook requests to notification-controller.
Setting at least one ID makes the receiver accept only SPIFFE mTLS clients.
maxItems:
64workloadAPI object required
WorkloadAPI holds the configuration for the SPIFFE Workload API.
It is required for enabling any of the SPIFFE features and is used
to render the go-spiffe environment variable and the SPIFFE CSI volume.
csiDriver
string
CSIDriver is the name of the SPIFFE CSI driver used to mount
the Workload API socket into the Flux controller pods.
When set, the operator mounts the CSI volume at /spiffe-workload-api
and the endpoint must be a unix socket under that path.
When omitted, no CSI volume is configured.
pattern:
^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?)*$minLength:
1maxLength:
63
endpoint
string required
Endpoint is the address of the SPIFFE Workload API endpoint,
in the form 'unix:///<absolute path>', 'unix:/<absolute path>'
or 'tcp://<ip>:<port>',
e.g. 'unix:///spiffe-workload-api/agent.sock'.
The flux-operator pod must be configured with the same endpoint
through the SPIFFE_ENDPOINT_SOCKET environment variable.
pattern:
^(?:unix:(?:///[!$&->@-~]+|/[!$&-.0->@-~][!$&->@-~]*)|tcp://(?:[0-9]{1,3}(?:\.[0-9]{1,3}){3}|\[[0-9a-fA-F:.]+\]):[0-9]{1,5})$minLength:
1maxLength:
1024storage object
Storage holds the specification of the source-controller
persistent volume claim.
class
string required
Class is the storage class to use for the PVC.
size
string required
Size is the size of the PVC.
sync object
Sync specifies the source for the cluster sync operation.
When set, a Flux source (GitRepository, OCIRepository or Bucket)
and Flux Kustomization are created to sync the cluster state
with the source repository.
interval
string
Interval is the time between syncs.
pattern:
^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
kind
string required
Kind is the kind of the source.
enum:
OCIRepository, GitRepository, Bucket
name
string
Name is the name of the Flux source and kustomization resources.
When not specified, the name is set to the namespace name of the FluxInstance.
maxLength:
63
path
string required
Path is the path to the source directory containing
the kustomize overlay or plain Kubernetes manifests.
provider
string
Provider specifies OIDC provider for source authentication.
For OCIRepository and Bucket the provider can be set to 'aws', 'azure' or 'gcp'.
For GitRepository the provider can be set to 'aws' (requires Flux 2.9 or later),
'azure' or 'github'.
To disable OIDC authentication the provider can be set to 'generic' or left empty.
enum:
generic, aws, azure, gcp, github
pullSecret
string
PullSecret specifies the Kubernetes Secret containing the
authentication credentials for the source.
For Git over HTTP/S sources, the secret must contain username and password fields.
For Git over SSH sources, the secret must contain known_hosts and identity fields.
For OCI sources, the secret must be of type kubernetes.io/dockerconfigjson.
For Bucket sources, the secret must contain accesskey and secretkey fields.
ref
string required
Ref is the source reference, can be a Git ref name e.g. 'refs/heads/main',
an OCI tag e.g. 'latest' or a bucket name e.g. 'flux'.
url
string required
URL is the source URL, can be a Git repository HTTP/S or SSH address,
an OCI repository address or a Bucket endpoint.
wait
boolean
Wait instructs the controller to check the health of all the reconciled
resources. Defaults to true.
status object
FluxInstanceStatus defines the observed state of FluxInstance
components []object
Components contains the container images used by the components.
digest
string
Digest of the container image.
name
string required
Name of the component.
repository
string required
Repository address of the container image.
tag
string required
Tag of the container image.
conditions []object
Conditions contains the readiness conditions of the object.
lastTransitionTime
string required
lastTransitionTime is the last time the condition transitioned from one status to another.
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
format:
date-time
message
string required
message is a human readable message indicating details about the transition.
This may be an empty string.
maxLength:
32768
observedGeneration
integer
observedGeneration represents the .metadata.generation that the condition was set based upon.
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
with respect to the current state of the instance.
format:
int64minimum:
0
reason
string required
reason contains a programmatic identifier indicating the reason for the condition's last transition.
Producers of specific condition types may define expected values and meanings for this field,
and whether the values are considered a guaranteed API.
The value should be a CamelCase string.
This field may not be empty.
pattern:
^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$minLength:
1maxLength:
1024
status
string required
status of the condition, one of True, False, Unknown.
enum:
True, False, Unknown
type
string required
type of condition in CamelCase or in foo.example.com/CamelCase.
pattern:
^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$maxLength:
316history []object
History contains the reconciliation history of the FluxInstance
as a list of snapshots ordered by the last reconciled time.
digest
string required
Digest is the checksum in the format `<algo>:<hex>` of the resources in this snapshot.
firstReconciled
string required
FirstReconciled is the time when this revision was first reconciled to the cluster.
format:
date-time
lastReconciled
string required
LastReconciled is the time when this revision was last reconciled to the cluster.
format:
date-time
lastReconciledDuration
string required
LastReconciledDuration is time it took to reconcile the resources in this revision.
lastReconciledStatus
string required
LastReconciledStatus is the status of the last reconciliation.
metadata
object
Metadata contains additional information about the snapshot.
totalReconciliations
integer required
TotalReconciliations is the total number of reconciliations that have occurred for this snapshot.
format:
int64inventory object
Inventory contains a list of Kubernetes resource object references
last applied on the cluster.
entries []object required
Entries of Kubernetes resource object references.
id
string required
ID is the string representation of the Kubernetes resource object's metadata,
in the format '<namespace>_<name>_<group>_<kind>'.
v
string required
Version is the API version of the Kubernetes resource object's kind.
lastAppliedRevision
string
LastAppliedRevision is the version and digest of the
distribution config that was last reconcile.
lastArtifactRevision
string
LastArtifactRevision is the digest of the last pulled
distribution artifact.
lastAttemptedRevision
string
LastAttemptedRevision is the version and digest of the
distribution config that was last attempted to reconcile.
lastHandledForceAt
string
LastHandledForceAt holds the value of the most recent
force request value, so a change of the annotation value
can be detected.
lastHandledReconcileAt
string
LastHandledReconcileAt holds the value of the most recent
reconcile request value, so a change of the annotation value
can be detected.
spiffe object
SPIFFE holds the SPIFFE settings of the last applied distribution.
mtls object
MTLS holds the applied mTLS settings.
componentIDTemplate
string
ComponentIDTemplate is the SPIFFE ID template of the Flux controllers.
enabled
boolean required
Enabled is true when the Flux controllers were deployed with mTLS.
extraArtifactServers
[]string
ExtraArtifactServers is the list of additional SPIFFE IDs
authorized as artifact servers.
No matches. Try .spec.cluster for an exact path