Add `--cert-ref` to `flux create source oci`

Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>

cmd/flux/create_source_oci.go

@@ -56,6 +56,7 @@ type sourceOCIRepositoryFlags struct {
 	digest         string
 	secretRef      string
 	serviceAccount string
+	certSecretRef  string
 	ignorePaths    []string
 }
 
@@ -68,6 +69,7 @@ func init() {
 	createSourceOCIRepositoryCmd.Flags().StringVar(&sourceOCIRepositoryArgs.digest, "digest", "", "the OCI artifact digest")
 	createSourceOCIRepositoryCmd.Flags().StringVar(&sourceOCIRepositoryArgs.secretRef, "secret-ref", "", "the name of the Kubernetes image pull secret (type 'kubernetes.io/dockerconfigjson')")
 	createSourceOCIRepositoryCmd.Flags().StringVar(&sourceOCIRepositoryArgs.serviceAccount, "service-account", "", "the name of the Kubernetes service account that refers to an image pull secret")
+	createSourceOCIRepositoryCmd.Flags().StringVar(&sourceOCIRepositoryArgs.certSecretRef, "cert-ref", "", "the name of a secret to use for TLS certificates")
 	createSourceOCIRepositoryCmd.Flags().StringSliceVar(&sourceOCIRepositoryArgs.ignorePaths, "ignore-paths", nil, "set paths to ignore resources (can specify multiple paths with commas: path1,path2)")
 
 	createSourceCmd.AddCommand(createSourceOCIRepositoryCmd)
@@ -135,6 +137,12 @@ func createSourceOCIRepositoryCmdRun(cmd *cobra.Command, args []string) error {
 		}
 	}
 
+	if secretName := sourceOCIRepositoryArgs.certSecretRef; secretName != "" {
+		repository.Spec.CertSecretRef = &meta.LocalObjectReference{
+			Name: secretName,
+		}
+	}
+
 	if createArgs.export {
 		return printExport(exportOCIRepository(repository))
 	}

cmd/flux/testdata/oci/get_oci.golden

@@ -1,2 +1,2 @@
 NAME 	REVISION                                                        	SUSPENDED	READY	MESSAGE                                                                                         
-thrfg	3b6cdcc7adcc9a84d3214ee1c029543789d90b5ae69debe9efa3f66e982875de	False    	True 	stored artifact for revision '3b6cdcc7adcc9a84d3214ee1c029543789d90b5ae69debe9efa3f66e982875de'	
+thrfg	3b6cdcc7adcc9a84d3214ee1c029543789d90b5ae69debe9efa3f66e982875de	False    	True 	stored artifact for digest '3b6cdcc7adcc9a84d3214ee1c029543789d90b5ae69debe9efa3f66e982875de'

manifests/bases/source-controller/kustomization.yaml

@@ -15,4 +15,4 @@ patchesJson6902:
 # TODO: remove the hardcoded image when OCIRepository is released
 images:
   - name: fluxcd/source-controller
-    newTag: oci-ba5f5353
+    newTag: oci-09a9ef44