Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package flux2-cli for openSUSE:Factory checked in at 2026-10-28 17:48:15 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/flux2-cli (Old) and /work/SRC/openSUSE:Factory/.flux2-cli.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "flux2-cli" Wed Oct 28 17:48:15 2026 rev:41 rq:1393243 version:2.10.0 Changes: -------- --- /work/SRC/openSUSE:Factory/flux2-cli/flux2-cli.changes 2026-10-08 11:59:06.573285606 +0200 +++ /work/SRC/openSUSE:Factory/.flux2-cli.new.2252680/flux2-cli.changes 2026-10-28 17:48:24.306726816 +0100 @@ -1,0 +2,23 @@ +Tue Oct 27 15:06:34 UTC 2026 - Robert Munteanu <[email protected]> + +- Update to version 2.10.0: + Flux v2.10.0 is a feature release. Highlights include GA for object + identity, SPIFFE mTLS between controllers, and promotion of the + notification APIs to v1. The minimum supported Kubernetes version + is now 1.35. Users are encouraged to upgrade for the best experience; + review the upstream upgrade notes for RBAC and API changes. + * Components changelog + - source-controller v1.10.1 + - kustomize-controller v1.10.1 + - notification-controller v1.10.0 + - helm-controller v1.7.1 + - image-reflector-controller v1.3.0 + - image-automation-controller v1.3.0 + - source-watcher v2.3.1 + * CLI changelog + - Add suspend, resume and reconcile commands for ArtifactGenerator + - Accept TYPE/NAME arguments in resource commands + - Support OCIRepository chart sources for HelmRelease + - Add --policy-change-delay to create image update + +------------------------------------------------------------------- Old: ---- flux2-cli-2.9.6.obscpio New: ---- flux2-cli-2.10.0.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ flux2-cli.spec ++++++ --- /var/tmp/diff_new_pack.x4fZu7/_old 2026-10-28 17:48:25.671783922 +0100 +++ /var/tmp/diff_new_pack.x4fZu7/_new 2026-10-28 17:48:25.673784006 +0100 @@ -20,16 +20,16 @@ # check these versions on updates # see flux2/manifests/bases/*/kustomization.yaml -%define helm_controller_version v1.6.5 -%define image_automation_controller_version v1.2.5 -%define image_reflector_controller_version v1.2.5 -%define kustomize_controller_version v1.9.6 -%define notification_controller_version v1.9.4 -%define source_controller_version v1.9.6 -%define source_watcher_version v2.2.4 +%define helm_controller_version v1.7.1 +%define image_automation_controller_version v1.3.0 +%define image_reflector_controller_version v1.3.0 +%define kustomize_controller_version v1.10.1 +%define notification_controller_version v1.10.0 +%define source_controller_version v1.10.1 +%define source_watcher_version v2.3.1 Name: flux2-cli -Version: 2.9.6 +Version: 2.10.0 Release: 0 Summary: CLI for Flux2CD License: Apache-2.0 @@ -59,7 +59,7 @@ BuildRequires: kustomize BuildRequires: zsh # 16.0 currently contains 1.26rc3 which causes the build to fail... -BuildRequires: go1.26 >= 1.26.0 +BuildRequires: go1.27 >= 1.27.0 %description Flux is a tool for keeping Kubernetes clusters in sync with sources of ++++++ _service ++++++ --- /var/tmp/diff_new_pack.x4fZu7/_old 2026-10-28 17:48:25.761787687 +0100 +++ /var/tmp/diff_new_pack.x4fZu7/_new 2026-10-28 17:48:25.765787854 +0100 @@ -3,7 +3,7 @@ <param name="url">https://github.com/fluxcd/flux2.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v2.9.6</param> + <param name="revision">refs/tags/v2.10.0</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.x4fZu7/_old 2026-10-28 17:48:25.800789319 +0100 +++ /var/tmp/diff_new_pack.x4fZu7/_new 2026-10-28 17:48:25.803789444 +0100 @@ -3,6 +3,6 @@ <param name="url">https://github.com/fluxcd/flux2</param> <param name="changesrevision">1fd61a06264d71cf445ed55c4f14d401d26a1c64</param></service><service name="tar_scm"> <param name="url">https://github.com/fluxcd/flux2.git</param> - <param name="changesrevision">b9c17924adb533d3617ec7de97a7b0f4acc07b39</param></service></servicedata> + <param name="changesrevision">3fa784edd773d56630bb9f62645e08f70c2cff0a</param></service></servicedata> (No newline at EOF) ++++++ flux2-cli-2.9.6.obscpio -> flux2-cli-2.10.0.obscpio ++++++ ++++ 14664 lines of diff (skipped) ++++++ flux2-cli.obsinfo ++++++ --- /var/tmp/diff_new_pack.x4fZu7/_old 2026-10-28 17:48:26.276809232 +0100 +++ /var/tmp/diff_new_pack.x4fZu7/_new 2026-10-28 17:48:26.281809441 +0100 @@ -1,5 +1,5 @@ name: flux2-cli -version: 2.9.6 -mtime: 1790846860 -commit: b9c17924adb533d3617ec7de97a7b0f4acc07b39 +version: 2.10.0 +mtime: 1793024436 +commit: 3fa784edd773d56630bb9f62645e08f70c2cff0a ++++++ helm-controller.crds.yaml ++++++ --- /var/tmp/diff_new_pack.x4fZu7/_old 2026-10-28 17:48:26.332811575 +0100 +++ /var/tmp/diff_new_pack.x4fZu7/_new 2026-10-28 17:48:26.340811910 +0100 @@ -57,9 +57,26 @@ properties: chart: description: |- - Chart defines the template of the v1.HelmChart that should be created - for this HelmRelease. + Chart defines the template of the source object that should be + created for this HelmRelease. The Kind field determines whether a + sourcev1.HelmChart or sourcev1.OCIRepository is created. properties: + kind: + description: |- + Kind is the kind of the source object generated from this template. Valid values: + - HelmChart (default): generates a source.toolkit.fluxcd.io/v1 HelmChart from + the HelmChartSpec-compatible fields under .spec.chart.spec. In particular, + .spec.chart.spec.chart and .spec.chart.spec.sourceRef are required. + - OCIRepository: generates a source.toolkit.fluxcd.io/v1 OCIRepository from + the OCIRepositorySpec fields under .spec.chart.spec. In particular, + .spec.chart.spec.url is required, and .spec.chart.spec.interval defaults + to .spec.interval (interval is required in a plain OCIRepository). + Use OCIRepository for charts hosted in OCI registries; use HelmChart for + HelmRepository, GitRepository or Bucket sources. + enum: + - HelmChart + - OCIRepository + type: string metadata: description: ObjectMeta holds the template for metadata like labels and annotations. @@ -83,27 +100,101 @@ type: object type: object spec: - description: Spec holds the template for the v1.HelmChartSpec - for this HelmRelease. + description: Spec holds the spec of the object generated for this + HelmRelease. properties: + certSecretRef: + description: |- + CertSecretRef can be given the name of a Secret containing + either or both of + + - a PEM-encoded client certificate (`tls.crt`) and private + key (`tls.key`); + - a PEM-encoded CA certificate (`ca.crt`) + + and whichever are supplied, will be used for connecting to the + registry. The client cert and key are useful if you are + authenticating with a certificate; the CA cert is useful if + you are using a self-signed server certificate. The Secret must + be of type `Opaque` or `kubernetes.io/tls`. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object chart: description: The name or path the Helm chart is available at in the SourceRef. maxLength: 2048 minLength: 1 type: string + ignore: + description: |- + Ignore overrides the set of excluded patterns in the .sourceignore format + (which is the same as .gitignore). If not provided, a default will be used, + consult the documentation for your version to find out what those are. + type: string ignoreMissingValuesFiles: description: IgnoreMissingValuesFiles controls whether to silently ignore missing values files rather than failing. type: boolean + insecure: + description: Insecure allows connecting to a non-TLS HTTP + container registry. + type: boolean interval: description: |- - Interval at which to check the v1.Source for updates. Defaults to - 'HelmReleaseSpec.Interval'. + Interval at which the OCIRepository URL is checked for updates. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ type: string + layerSelector: + description: |- + LayerSelector specifies which layer should be extracted from the OCI artifact. + When not specified, the first layer found in the artifact is selected. + properties: + mediaType: + description: |- + MediaType specifies the OCI media type of the layer + which should be extracted from the OCI Artifact. The + first layer matching this type is selected. + type: string + operation: + description: |- + Operation specifies how the selected layer should be processed. + By default, the layer compressed content is extracted to storage. + When the operation is set to 'copy', the layer compressed content + is persisted to storage as it is. + enum: + - extract + - copy + type: string + type: object + provider: + description: |- + The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'. + When not specified, defaults to 'generic'. + enum: + - generic + - aws + - azure + - gcp + type: string + proxySecretRef: + description: |- + ProxySecretRef specifies the Secret containing the proxy configuration + to use while communicating with the container registry. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object reconcileStrategy: - default: ChartVersion description: |- Determines what enables the creation of a new artifact. Valid values are ('ChartVersion', 'Revision'). @@ -113,6 +204,52 @@ - ChartVersion - Revision type: string + ref: + description: |- + The OCI reference to pull and monitor for changes, + defaults to the latest tag. + properties: + digest: + description: |- + Digest is the image digest to pull, takes precedence over SemVer. + The value should be in the format 'sha256:<HASH>'. + type: string + semver: + description: |- + SemVer is the range of tags to pull selecting the latest within + the range, takes precedence over Tag. + type: string + semverFilter: + description: SemverFilter is a regex pattern to filter + the tags within the SemVer range. + type: string + tag: + description: Tag is the image tag to pull, defaults to + latest. + type: string + type: object + secretRef: + description: |- + SecretRef contains the secret name containing the registry login + credentials to resolve image metadata. + The secret must be of type kubernetes.io/dockerconfigjson. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + serviceAccountName: + description: |- + ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate + the image pull, either with the pull secrets attached to the service account or with + an object identity. + For more information about object identity: + https://fluxcd.io/flux/integrations/object-identity/ + For more information about image pull secrets: + https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account + type: string sourceRef: description: The name and namespace of the v1.Source the chart is available at. @@ -141,6 +278,21 @@ - kind - name type: object + suspend: + description: This flag tells the controller to suspend the + reconciliation of this source. + type: boolean + timeout: + description: The timeout for remote OCI Repository operations + like pulling, defaults to 60s. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + url: + description: |- + URL is a reference to an OCI artifact repository hosted + on a remote container registry. + pattern: ^oci://.*$ + type: string valuesFiles: description: |- Alternative list of values files to use as the chart values (values.yaml @@ -155,14 +307,39 @@ Verify contains the secret name containing the trusted public keys used to verify the signature and specifies which provider to use to check whether OCI image is authentic. - This field is only supported for OCI sources. - Chart dependencies, which are not bundled in the umbrella chart artifact, - are not verified. properties: + matchOIDCIdentity: + description: |- + MatchOIDCIdentity specifies the identity matching criteria to use + while verifying an OCI artifact which was signed using Cosign keyless + signing. The artifact's identity is deemed to be verified if any of the + specified matchers match against the identity. + items: + description: |- + OIDCIdentityMatch specifies options for verifying the certificate identity, + i.e. the issuer and the subject of the certificate. + properties: + issuer: + description: |- + Issuer specifies the regex pattern to match against to verify + the OIDC issuer in the Fulcio certificate. The pattern must be a + valid Go regular expression. + type: string + subject: + description: |- + Subject specifies the regex pattern to match against to verify + the identity subject in the Fulcio certificate. The pattern must + be a valid Go regular expression. + type: string + required: + - issuer + - subject + type: object + type: array provider: default: cosign description: Provider specifies the technology used to - sign the OCI Helm chart. + sign the OCI Artifact. enum: - cosign - notation @@ -178,22 +355,59 @@ required: - name type: object + trustedRootSecretRef: + description: |- + TrustedRootSecretRef specifies the Kubernetes Secret containing a + Sigstore trusted_root.json file. This enables verification against + self-hosted Sigstore infrastructure (custom Fulcio CA, self-hosted + Rekor instance). The Secret must contain a key named "trusted_root.json". + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object required: - provider type: object version: - default: '*' description: |- Version semver expression, ignored for charts from v1.GitRepository and - v1beta2.Bucket sources. Defaults to latest when omitted. + v1beta2.Bucket sources. Defaults to latest when omitted i.e. to '*'. type: string - required: - - chart - - sourceRef type: object required: - spec type: object + x-kubernetes-validations: + - message: chart.spec.url must be set when chart.kind is 'OCIRepository' + rule: '!has(self.kind) || self.kind != ''OCIRepository'' || (has(self.spec.url) + && size(self.spec.url) > 0)' + - message: 'chart.spec.url requires chart.kind: ''OCIRepository''; + for a HelmChart template set spec.chart and spec.sourceRef instead' + rule: '!has(self.spec.url) || (has(self.kind) && self.kind == ''OCIRepository'')' + - message: chart.spec.chart and chart.spec.sourceRef must be set when + chart.kind is not 'OCIRepository' + rule: (has(self.kind) && self.kind == 'OCIRepository') || (has(self.spec.chart) + && has(self.spec.sourceRef)) + - message: chart.spec.chart cannot be set when chart.kind is 'OCIRepository' + rule: '!has(self.kind) || self.kind != ''OCIRepository'' || !has(self.spec.chart)' + - message: chart.spec.version cannot be set when chart.kind is 'OCIRepository' + rule: '!has(self.kind) || self.kind != ''OCIRepository'' || !has(self.spec.version) + || self.spec.version == ''*''' + - message: chart.spec.sourceRef cannot be set when chart.kind is 'OCIRepository' + rule: '!has(self.kind) || self.kind != ''OCIRepository'' || !has(self.spec.sourceRef)' + - message: chart.spec.reconcileStrategy cannot be set when chart.kind + is 'OCIRepository' + rule: '!has(self.kind) || self.kind != ''OCIRepository'' || !has(self.spec.reconcileStrategy) + || self.spec.reconcileStrategy == ''ChartVersion''' + - message: chart.spec.valuesFiles cannot be set when chart.kind is + 'OCIRepository' + rule: '!has(self.kind) || self.kind != ''OCIRepository'' || !has(self.spec.valuesFiles)' + - message: chart.spec.ignoreMissingValuesFiles cannot be set when + chart.kind is 'OCIRepository' + rule: '!has(self.kind) || self.kind != ''OCIRepository'' || !has(self.spec.ignoreMissingValuesFiles)' chartRef: description: |- ChartRef holds a reference to a source controller resource containing the @@ -537,8 +751,7 @@ forces the controller to act on behalf of that Service Account at the target cluster. If the --default-service-account flag is set, its value will be used as - a controller level fallback for when HelmReleaseSpec.ServiceAccountName - is empty. + the default for HelmReleaseSpec.ServiceAccountName when it is empty. properties: configMapRef: description: |- @@ -560,15 +773,15 @@ - `ca.crt`: the optional PEM-encoded CA certificate for the Kubernetes API server. If not set, the controller will use the CA certificate from the cluster resource. - - `audiences`: the optional audiences as a list of - line-break-separated strings for the Kubernetes ServiceAccount - token. Defaults to the `address` for the `generic` provider, or - to specific values for the other providers depending on the - provider. - `serviceAccountName`: the optional name of the Kubernetes ServiceAccount in the same namespace that should be used for authentication. If not specified, the controller ServiceAccount will be used. + - `audiences`: the optional audiences as a list of string separated by + commas and/or whitespaces/newlines for the Kubernetes ServiceAccount + token. Defaults to the `address` for the `generic` provider, or + to specific values for the other providers depending on the + provider. Mutually exclusive with SecretRef. properties: @@ -603,10 +816,7 @@ x-kubernetes-validations: - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef must be specified - rule: has(self.configMapRef) || has(self.secretRef) - - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef - must be specified - rule: '!has(self.configMapRef) || !has(self.secretRef)' + rule: has(self.configMapRef) != has(self.secretRef) maxHistory: description: |- MaxHistory is the number of revisions saved by Helm for this HelmRelease. @@ -1239,7 +1449,9 @@ helmChart: description: |- HelmChart is the namespaced name of the HelmChart resource created by - the controller for the HelmRelease. + the controller for the HelmRelease, in the format '<namespace>/<name>', + or the typed and namespaced name of the OCIRepository resource, in the + format '<kind>/<namespace>/<name>'. type: string history: description: |- ++++++ helm-controller.deployment.yaml ++++++ --- /var/tmp/diff_new_pack.x4fZu7/_old 2026-10-28 17:48:26.371813207 +0100 +++ /var/tmp/diff_new_pack.x4fZu7/_new 2026-10-28 17:48:26.379813541 +0100 @@ -28,7 +28,7 @@ valueFrom: fieldRef: fieldPath: metadata.namespace - image: fluxcd/helm-controller:v1.6.5 + image: fluxcd/helm-controller:v1.7.1 imagePullPolicy: IfNotPresent livenessProbe: httpGet: ++++++ image-automation-controller.crds.yaml ++++++ --- /var/tmp/diff_new_pack.x4fZu7/_old 2026-10-28 17:48:26.429815633 +0100 +++ /var/tmp/diff_new_pack.x4fZu7/_new 2026-10-28 17:48:26.437815968 +0100 @@ -224,6 +224,14 @@ run should be attempted. pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ type: string + policyChangeDelay: + description: |- + PolicyChangeDelay delays the run triggered by ImagePolicy changes, so + that image updates arriving within the delay are committed together. + If PolicySelector is also set, only changes to the selected policies + trigger a run. By default, the automation runs as soon as a policy changes. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string policySelector: description: |- PolicySelector allows to filter applied policies based on labels. ++++++ image-automation-controller.deployment.yaml ++++++ --- /var/tmp/diff_new_pack.x4fZu7/_old 2026-10-28 17:48:26.468817265 +0100 +++ /var/tmp/diff_new_pack.x4fZu7/_new 2026-10-28 17:48:26.471817390 +0100 @@ -28,7 +28,7 @@ valueFrom: fieldRef: fieldPath: metadata.namespace - image: fluxcd/image-automation-controller:v1.2.5 + image: fluxcd/image-automation-controller:v1.3.0 imagePullPolicy: IfNotPresent livenessProbe: httpGet: ++++++ image-reflector-controller.crds.yaml ++++++ --- /var/tmp/diff_new_pack.x4fZu7/_old 2026-10-28 17:48:26.507818896 +0100 +++ /var/tmp/diff_new_pack.x4fZu7/_new 2026-10-28 17:48:26.512819105 +0100 @@ -487,7 +487,10 @@ serviceAccountName: description: |- ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate - the image pull if the service account has attached pull secrets. + the image pull, either with the pull secrets attached to the service account or with + an object identity. + For more information about object identity: + https://fluxcd.io/flux/integrations/object-identity/ maxLength: 253 type: string suspend: ++++++ image-reflector-controller.deployment.yaml ++++++ --- /var/tmp/diff_new_pack.x4fZu7/_old 2026-10-28 17:48:26.540820277 +0100 +++ /var/tmp/diff_new_pack.x4fZu7/_new 2026-10-28 17:48:26.545820486 +0100 @@ -28,7 +28,7 @@ valueFrom: fieldRef: fieldPath: metadata.namespace - image: fluxcd/image-reflector-controller:v1.2.5 + image: fluxcd/image-reflector-controller:v1.3.0 imagePullPolicy: IfNotPresent livenessProbe: httpGet: ++++++ kustomize-controller.crds.yaml ++++++ --- /var/tmp/diff_new_pack.x4fZu7/_old 2026-10-28 17:48:26.588822285 +0100 +++ /var/tmp/diff_new_pack.x4fZu7/_new 2026-10-28 17:48:26.592822452 +0100 @@ -351,8 +351,7 @@ forces the controller to act on behalf of that Service Account at the target cluster. If the --default-service-account flag is set, its value will be used as - a controller level fallback for when KustomizationSpec.ServiceAccountName - is empty. + the default for KustomizationSpec.ServiceAccountName when it is empty. properties: configMapRef: description: |- @@ -374,15 +373,15 @@ - `ca.crt`: the optional PEM-encoded CA certificate for the Kubernetes API server. If not set, the controller will use the CA certificate from the cluster resource. - - `audiences`: the optional audiences as a list of - line-break-separated strings for the Kubernetes ServiceAccount - token. Defaults to the `address` for the `generic` provider, or - to specific values for the other providers depending on the - provider. - `serviceAccountName`: the optional name of the Kubernetes ServiceAccount in the same namespace that should be used for authentication. If not specified, the controller ServiceAccount will be used. + - `audiences`: the optional audiences as a list of string separated by + commas and/or whitespaces/newlines for the Kubernetes ServiceAccount + token. Defaults to the `address` for the `generic` provider, or + to specific values for the other providers depending on the + provider. Mutually exclusive with SecretRef. properties: @@ -417,10 +416,7 @@ x-kubernetes-validations: - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef must be specified - rule: has(self.configMapRef) || has(self.secretRef) - - message: exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef - must be specified - rule: '!has(self.configMapRef) || !has(self.secretRef)' + rule: has(self.configMapRef) != has(self.secretRef) namePrefix: description: NamePrefix will prefix the names of all managed resources. maxLength: 200 ++++++ kustomize-controller.deployment.yaml ++++++ --- /var/tmp/diff_new_pack.x4fZu7/_old 2026-10-28 17:48:26.629824000 +0100 +++ /var/tmp/diff_new_pack.x4fZu7/_new 2026-10-28 17:48:26.633824168 +0100 @@ -28,7 +28,7 @@ valueFrom: fieldRef: fieldPath: metadata.namespace - image: fluxcd/kustomize-controller:v1.9.6 + image: fluxcd/kustomize-controller:v1.10.1 imagePullPolicy: IfNotPresent livenessProbe: httpGet: ++++++ notification-controller.crds.yaml ++++++ --- /var/tmp/diff_new_pack.x4fZu7/_old 2026-10-28 17:48:26.672825799 +0100 +++ /var/tmp/diff_new_pack.x4fZu7/_new 2026-10-28 17:48:26.675825925 +0100 @@ -22,6 +22,148 @@ - jsonPath: .metadata.creationTimestamp name: Age type: date + name: v1 + schema: + openAPIV3Schema: + description: Alert is the Schema for the alerts API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: AlertSpec defines an alerting rule for events involving a + list of objects. + properties: + eventMetadata: + additionalProperties: + type: string + description: |- + EventMetadata adds metadata to events. Sources, from lowest to highest precedence: + `event.toolkit.fluxcd.io/` annotations on the involved object, Alert `.spec.eventMetadata`, + and controller-defined `<controller group>.toolkit.fluxcd.io/` event metadata. + Higher precedence wins; conflicts produce an info log and a Warning Event. + See the Alert API docs (Event metadata section). + type: object + eventSeverity: + default: info + description: |- + EventSeverity specifies how to filter events based on severity. + If set to 'info' no events will be filtered. + enum: + - info + - error + type: string + eventSources: + description: |- + EventSources specifies how to filter events based + on the involved object kind, name and namespace. + items: + description: |- + CrossNamespaceObjectReference contains enough information to let you locate the + typed referenced object at cluster level + properties: + apiVersion: + description: API version of the referent + type: string + kind: + description: Kind of the referent + enum: + - Bucket + - GitRepository + - Kustomization + - HelmRelease + - HelmChart + - HelmRepository + - ImageRepository + - ImagePolicy + - ImageUpdateAutomation + - OCIRepository + - ArtifactGenerator + - ExternalArtifact + type: string + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + MatchLabels requires the name to be set to `*`. + type: object + name: + description: |- + Name of the referent + If multiple resources are targeted `*` may be set. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: Namespace of the referent + maxLength: 253 + minLength: 1 + type: string + required: + - kind + - name + type: object + type: array + exclusionList: + description: |- + ExclusionList specifies a list of Golang regular expressions + to be used for excluding messages. + items: + type: string + type: array + inclusionList: + description: |- + InclusionList specifies a list of Golang regular expressions + to be used for including messages. + items: + type: string + type: array + providerRef: + description: ProviderRef specifies which Provider this Alert should + use. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend subsequent + events handling for this Alert. + type: boolean + required: + - eventSources + - providerRef + type: object + type: object + served: true + storage: true + subresources: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + deprecated: true + deprecationWarning: v1beta3 Alert is deprecated, upgrade to v1 name: v1beta3 schema: openAPIV3Schema: @@ -162,7 +304,7 @@ type: object type: object served: true - storage: true + storage: false subresources: {} --- apiVersion: apiextensions.k8s.io/v1 @@ -189,6 +331,182 @@ - jsonPath: .metadata.creationTimestamp name: Age type: date + name: v1 + schema: + openAPIV3Schema: + description: Provider is the Schema for the providers API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ProviderSpec defines the desired state of the Provider. + properties: + address: + description: |- + Address specifies the endpoint, in a generic sense, to where alerts are sent. + What kind of endpoint depends on the specific Provider type being used. + For the generic Provider, for example, this is an HTTP/S address. + For other Provider types this could be a project ID or a namespace. + maxLength: 2048 + type: string + certSecretRef: + description: |- + CertSecretRef specifies the Secret containing TLS certificates + for secure communication. + + Supported configurations: + - CA-only: Server authentication (provide ca.crt only) + - mTLS: Mutual authentication (provide ca.crt + tls.crt + tls.key) + - Client-only: Client authentication with system CA (provide tls.crt + tls.key only) + + Legacy keys "caFile", "certFile", "keyFile" are supported but deprecated. Use "ca.crt", "tls.crt", "tls.key" instead. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + channel: + description: Channel specifies the destination channel where events + should be posted. + maxLength: 2048 + type: string + commitStatusExpr: + description: |- + CommitStatusExpr is a CEL expression that evaluates to a string value + that can be used to generate a custom commit status message for use + with eligible Provider types (github, gitlab, gitea, bitbucketserver, + bitbucket, azuredevops). Supported variables are: event, provider, + and alert. + type: string + proxySecretRef: + description: |- + ProxySecretRef specifies the Secret containing the proxy configuration + for this Provider. The Secret should contain an 'address' key with the + HTTP/S address of the proxy server. Optional 'username' and 'password' + keys can be provided for proxy authentication. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + secretRef: + description: |- + SecretRef specifies the Secret containing the authentication + credentials for this Provider. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + serviceAccountName: + description: |- + ServiceAccountName is the name of the Kubernetes ServiceAccount used to + authenticate with cloud provider services through object identity. + This enables multi-tenant authentication without storing static credentials. + + Supported provider types: azureeventhub, azuredevops, googlepubsub + + When specified, the controller will: + 1. Create an OIDC token for the specified ServiceAccount + 2. Exchange it for cloud provider credentials via STS + 3. Use the obtained credentials for API authentication + + When unspecified, the controller's workload identity is used (single-tenant). + + An error is thrown if static credentials are also defined in SecretRef. + type: string + suspend: + description: |- + Suspend tells the controller to suspend subsequent + events handling for this Provider. + type: boolean + timeout: + description: Timeout for sending alerts to the Provider. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + type: + description: Type specifies which Provider implementation to use. + enum: + - slack + - discord + - msteams + - rocket + - generic + - generic-hmac + - github + - gitlab + - gitea + - giteapullrequestcomment + - bitbucketserver + - bitbucket + - azuredevops + - googlechat + - googlepubsub + - webex + - sentry + - azureeventhub + - telegram + - lark + - matrix + - opsgenie + - alertmanager + - grafana + - githubdispatch + - githubpullrequestcomment + - gitlabmergerequestcomment + - pagerduty + - datadog + - nats + - zulip + - otel + - zoom + - incident.io + - mastodon + type: string + username: + description: Username specifies the name under which events are posted. + maxLength: 2048 + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: spec.commitStatusExpr is only supported for the 'github', 'gitlab', + 'gitea', 'bitbucketserver', 'bitbucket', 'azuredevops' provider types + rule: self.type == 'github' || self.type == 'gitlab' || self.type == + 'gitea' || self.type == 'bitbucketserver' || self.type == 'bitbucket' + || self.type == 'azuredevops' || !has(self.commitStatusExpr) + type: object + served: true + storage: true + subresources: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + deprecated: true + deprecationWarning: v1beta3 Provider is deprecated, upgrade to v1 name: v1beta3 schema: openAPIV3Schema: @@ -306,7 +624,6 @@ When unspecified, controller-level authentication is used (single-tenant). An error is thrown if static credentials are also defined in SecretRef. - This field requires the ObjectLevelWorkloadIdentity feature gate to be enabled. type: string suspend: description: |- @@ -352,6 +669,8 @@ - nats - zulip - otel + - zoom + - incident.io type: string username: description: Username specifies the name under which events are posted. @@ -368,7 +687,7 @@ || self.type == 'azuredevops' || !has(self.commitStatusExpr) type: object served: true - storage: true + storage: false subresources: {} --- apiVersion: apiextensions.k8s.io/v1 ++++++ notification-controller.deployment.yaml ++++++ --- /var/tmp/diff_new_pack.x4fZu7/_old 2026-10-28 17:48:26.713827514 +0100 +++ /var/tmp/diff_new_pack.x4fZu7/_new 2026-10-28 17:48:26.716827640 +0100 @@ -60,7 +60,7 @@ valueFrom: fieldRef: fieldPath: metadata.namespace - image: fluxcd/notification-controller:v1.9.4 + image: fluxcd/notification-controller:v1.10.0 imagePullPolicy: IfNotPresent livenessProbe: httpGet: ++++++ source-controller.crds.yaml ++++++ --- /var/tmp/diff_new_pack.x4fZu7/_old 2026-10-28 17:48:26.753829188 +0100 +++ /var/tmp/diff_new_pack.x4fZu7/_new 2026-10-28 17:48:26.759829439 +0100 @@ -150,8 +150,8 @@ description: |- ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate the bucket. This field is only supported for the 'gcp' and 'aws' providers. - For more information about workload identity: - https://fluxcd.io/flux/components/source/buckets/#workload-identity + For more information about object identity: + https://fluxcd.io/flux/integrations/object-identity/ type: string sts: description: |- @@ -576,6 +576,14 @@ - type type: object type: array + exportedInputs: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + description: |- + ExportedInputs holds a map of structured data optionally extracted from the source resource. + It may be used, for example, by downstream consumers such as templating engines like + ResourceSet to consume these inputs for implementing templating logic. + type: object type: object type: object served: true @@ -1061,6 +1069,13 @@ items: type: string type: array + sourceVerificationFingerprint: + description: |- + SourceVerificationFingerprint is the fingerprint of the public keys used + to verify the signature of the Git object(s) for the current Artifact. + It is used to detect changes to the verification policy, such as a key + rotation, that require the current revision to be verified again. + type: string sourceVerificationMode: description: |- SourceVerificationMode is the last used verification mode indicating @@ -1879,7 +1894,6 @@ type: string type: object provider: - default: generic description: |- The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'. When not specified, defaults to 'generic'. @@ -1938,7 +1952,11 @@ serviceAccountName: description: |- ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate - the image pull if the service account has attached pull secrets. For more information: + the image pull, either with the pull secrets attached to the service account or with + an object identity. + For more information about object identity: + https://fluxcd.io/flux/integrations/object-identity/ + For more information about image pull secrets: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account type: string suspend: @@ -1946,7 +1964,6 @@ of this source. type: boolean timeout: - default: 60s description: The timeout for remote OCI Repository operations like pulling, defaults to 60s. pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ @@ -2026,9 +2043,6 @@ required: - provider type: object - required: - - interval - - url type: object status: default: @@ -2176,12 +2190,24 @@ - copy type: string type: object + sourceVerificationFingerprint: + description: |- + SourceVerificationFingerprint is the fingerprint of the verification + material used to verify the signature of the current Artifact. It is + used to detect changes to the verification policy, such as a key + rotation, that require the current revision to be verified again. + type: string url: description: URL is the download link for the artifact output of the last OCI Repository sync. type: string type: object type: object + x-kubernetes-validations: + - message: spec.url is required + rule: has(self.spec) && has(self.spec.url) + - message: spec.interval is required + rule: has(self.spec) && has(self.spec.interval) served: true storage: true subresources: ++++++ source-controller.deployment.yaml ++++++ --- /var/tmp/diff_new_pack.x4fZu7/_old 2026-10-28 17:48:26.783830443 +0100 +++ /var/tmp/diff_new_pack.x4fZu7/_new 2026-10-28 17:48:26.787830610 +0100 @@ -50,7 +50,7 @@ fieldPath: metadata.namespace - name: TUF_ROOT value: /tmp/.sigstore - image: fluxcd/source-controller:v1.9.6 + image: fluxcd/source-controller:v1.10.1 imagePullPolicy: IfNotPresent livenessProbe: httpGet: @@ -69,8 +69,8 @@ protocol: TCP readinessProbe: httpGet: - path: / - port: http + path: /readyz + port: healthz resources: limits: cpu: 1000m ++++++ source-watcher.crds.yaml ++++++ --- /var/tmp/diff_new_pack.x4fZu7/_old 2026-10-28 17:48:26.823832116 +0100 +++ /var/tmp/diff_new_pack.x4fZu7/_new 2026-10-28 17:48:26.828832326 +0100 @@ -90,6 +90,13 @@ minLength: 1 pattern: ^@([a-z0-9]([a-z0-9_-]*[a-z0-9])?)/(.*)$ type: string + optional: + description: |- + Optional, when set to true, allows the copy operation to silently + skip when the source path or glob pattern matches no files. + When false (default), the reconciliation fails with an error if + no files are matched. + type: boolean strategy: description: |- Strategy specifies the copy strategy to use. @@ -120,12 +127,37 @@ type: object minItems: 1 type: array + inputsFrom: + description: |- + InputsFrom specifies a source path to a YAML file whose contents are + exported in the ExternalArtifact .status.exportedInputs field. + The format is "@<alias>/<path>", where <alias> references a source or + "artifact" for the generated artifact itself. When pathPattern is set, + the path may use capture placeholders such as "{module}". + maxLength: 1024 + minLength: 1 + pattern: ^@([a-z0-9]([a-z0-9_-]*[a-z0-9])?)/(.*)$ + type: string name: description: |- Name is the name of the generated artifact. When pathPattern is set, this field may use capture placeholders such as "{app}". - maxLength: 253 - minLength: 1 + The maximum length accommodates capture placeholders; the effective + limits are enforced by the CEL validation when pathPattern is not set. + maxLength: 1024 + type: string + namespace: + description: |- + Namespace is the namespace of the generated artifact. + If not provided, defaults to the same namespace as the ArtifactGenerator. + When pathPattern is set, this field may use capture placeholders such as "{app}". + The credentials used to reconcile the artifact are described in + .spec.serviceAccountName: an explicit ServiceAccount applies to every + generated artifact, while the --default-service-account flag only applies + to artifacts in a namespace other than the ArtifactGenerator namespace. + The maximum length accommodates capture placeholders; the effective + limits are enforced by the CEL validation when pathPattern is not set. + maxLength: 1024 type: string originRevision: description: |- @@ -170,6 +202,143 @@ description: Labels to be added to the object's metadata. type: object type: object + managedNamespaces: + description: |- + ManagedNamespaces defines how the controller manages the namespaces + targeted by the generated artifacts. When omitted, the target namespaces + are unmanaged: they must already exist and are left untouched. + properties: + allowedNames: + description: |- + AllowedNames is a list of CEL expressions that define the set of + namespaces the ArtifactGenerator agrees to manage. Each expression + receives the namespace name through the 'ns' string variable and must + return a boolean. A namespace is managed only when at least one + expression returns true. The 'default', 'kube-system', 'kube-public' + and 'flux-system' namespaces are always rejected, regardless of the + expressions. + items: + type: string + minItems: 1 + type: array + metadata: + description: |- + Metadata defines how the metadata of the desired namespaces is built, + on top of .spec.commonMetadata. + properties: + from: + description: |- + From is a list of metadata operations applied in order to the desired + namespaces, on top of .spec.commonMetadata and .fromSource. + items: + description: |- + NamespaceMetadataFrom defines a metadata operation applied to a desired + namespace. + properties: + annotations: + additionalProperties: + type: string + description: Annotations to be applied to the namespace. + type: object + labels: + additionalProperties: + type: string + description: Labels to be applied to the namespace. + type: object + namespace: + description: |- + Namespace is the name of the desired namespace the metadata applies to, + or '*' to apply the metadata to all desired namespaces. + maxLength: 63 + pattern: ^(\*|[a-z0-9]([-a-z0-9]*[a-z0-9])?)$ + type: string + strategy: + description: |- + Strategy specifies how the labels and annotations are applied. + 'Reset' clears all the existing labels and annotations before applying + the ones defined in the operation (fields that are not set clear the + corresponding metadata), 'Override' merges the ones defined in the + operation into the existing values, overriding existing keys, while + 'Merge' merges only the absent keys, preserving existing values. + enum: + - Reset + - Override + - Merge + type: string + required: + - namespace + - strategy + type: object + type: array + fromSource: + description: |- + FromSource sources namespace metadata from a NamespaceMetadata file + inside a source artifact. + properties: + allowedAnnotations: + additionalProperties: + type: string + description: |- + AllowedAnnotations is a schema for the annotations that the + NamespaceMetadata file is allowed to set. Each key is an annotation key + and each value is a CEL expression that receives the annotation value + through the 'value' string variable and must return a boolean. + Annotations whose key is not present in this map are ignored, while + annotations whose value does not satisfy the respective expression are + rejected. + The expressions are compiled, so a malformed expression or one that + does not return a boolean fails validation at the start of the + reconciliation. + type: object + allowedLabels: + additionalProperties: + type: string + description: |- + AllowedLabels is a schema for the labels that the NamespaceMetadata + file is allowed to set. Each key is a label key and each value is a + CEL expression that receives the label value through the 'value' string + variable and must return a boolean. Labels whose key is not present in + this map are ignored, while labels whose value does not satisfy the + respective expression are rejected. + The expressions are compiled, so a malformed expression or one that + does not return a boolean fails validation at the start of the + reconciliation. + type: object + path: + description: |- + Path is the path to the NamespaceMetadata file inside a source artifact, + in the format "@<alias>/<path>". When pathPattern is set, the path may + use capture placeholders such as "{namespace}". Only namespace-level + captures are allowed, so that every artifact targeting a namespace + resolves to the same file. + maxLength: 1024 + minLength: 1 + pattern: ^@([a-z0-9]([a-z0-9_-]*[a-z0-9])?)/(.*)$ + type: string + required: + - path + type: object + x-kubernetes-validations: + - message: at least one annotation or label must be set + rule: (has(self.allowedAnnotations) && size(self.allowedAnnotations) + > 0) || (has(self.allowedLabels) && size(self.allowedLabels) + > 0) + type: object + x-kubernetes-validations: + - message: either fromSource or at least one from operation must + be set + rule: has(self.fromSource) || (has(self.from) && size(self.from) + > 0) + prune: + description: |- + Prune specifies whether the controller deletes managed namespaces that + are no longer targeted by any generated artifact, or when the + ArtifactGenerator is deleted. + type: boolean + required: + - allowedNames + - prune + type: object pathPattern: description: |- PathPattern specifies a directory traversal pattern to match within the sources. @@ -178,6 +347,29 @@ maxLength: 1024 pattern: ^@([a-z0-9]([a-z0-9_-]*[a-z0-9])?)/(.*)$ type: string + serviceAccountName: + description: |- + ServiceAccountName is the name of the ServiceAccount used to authorize + the reconciliation of the generated ExternalArtifacts and the managed + Namespaces. The name is resolved in the ArtifactGenerator namespace. When + specified, the controller checks this ServiceAccount with + SubjectAccessReview for every namespace targeted by the generated + ExternalArtifacts, including the ArtifactGenerator namespace, and its + RBAC bindings determine the namespaces in which they can be created, + updated and deleted. + When not specified, the controller uses its own credentials for + ExternalArtifacts in the ArtifactGenerator namespace, and the + ServiceAccount configured with the --default-service-account flag + (when set) for artifacts targeting another namespace. + Namespace management (.spec.managedNamespaces) always requires a + ServiceAccount for authorization, so either this field or the + --default-service-account flag must be set; otherwise the reconciliation + fails with a terminal error. The controller performs the namespace + operations with its own credentials. + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string sources: description: |- Sources is a list of references to the Flux source-controller @@ -233,7 +425,13 @@ - message: artifact names must be valid Kubernetes object names when pathPattern is not set rule: has(self.pathPattern) && size(self.pathPattern) > 0 || self.artifacts.all(a, - a.name.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$')) + a.name.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$') + && a.name.size() <= 253) + - message: artifact namespaces must be valid Kubernetes namespaces when + pathPattern is not set + rule: has(self.pathPattern) && size(self.pathPattern) > 0 || self.artifacts.all(a, + !has(a.__namespace__) || (a.__namespace__.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?$') + && a.__namespace__.size() <= 63)) status: description: ArtifactGeneratorStatus defines the observed state of ArtifactGenerator. properties: @@ -295,30 +493,40 @@ type: object type: array inventory: - description: Inventory contains the list of generated ExternalArtifact - references. + description: |- + Inventory contains the list of objects managed by the ArtifactGenerator, + such as the generated ExternalArtifacts and the managed Namespaces. items: description: |- - ExternalArtifactReference contains the reference to a - generated ExternalArtifact along with its digest. + InventoryEntry contains a reference to an object managed by the + ArtifactGenerator, such as a generated ExternalArtifact or a managed + Namespace. properties: digest: - description: Digest of the referent artifact. + description: |- + Digest of the referent object. For generated artifacts this is the + artifact content digest; for managed namespaces this is a digest of the + metadata applied by the controller. type: string filename: description: Filename is the name of the artifact file. type: string + kind: + description: Kind is the kind of the referent object. + enum: + - ExternalArtifact + - Namespace + type: string name: - description: Name of the referent artifact. + description: Name of the referent object. type: string namespace: - description: Namespace of the referent artifact. + description: Namespace of the referent object. Empty for cluster-scoped + objects. type: string required: - digest - - filename - name - - namespace type: object type: array lastHandledReconcileAt: ++++++ source-watcher.deployment.yaml ++++++ --- /var/tmp/diff_new_pack.x4fZu7/_old 2026-10-28 17:48:26.857833539 +0100 +++ /var/tmp/diff_new_pack.x4fZu7/_new 2026-10-28 17:48:26.859833622 +0100 @@ -48,7 +48,7 @@ valueFrom: fieldRef: fieldPath: metadata.namespace - image: fluxcd/source-watcher:v2.2.4 + image: fluxcd/source-watcher:v2.3.1 imagePullPolicy: IfNotPresent livenessProbe: httpGet: @@ -67,8 +67,8 @@ protocol: TCP readinessProbe: httpGet: - path: / - port: http + path: /readyz + port: healthz resources: limits: cpu: 1000m ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/flux2-cli/vendor.tar.gz /work/SRC/openSUSE:Factory/.flux2-cli.new.2252680/vendor.tar.gz differ: char 13, line 1
