Merge pull request #5216 from fluxcd/backport-5214-to-release/v2.5.x

[release/v2.5.x] Update kustomize-controller to v1.5.1

.github/labels.yaml

@@ -44,12 +44,15 @@
   description: Feature request proposals in the RFC format
   color: '#D621C3'
   aliases: ['area/RFC']
+- name: backport:release/v2.0.x
+  description: To be backported to release/v2.0.x
+  color: '#ffd700'
+- name: backport:release/v2.1.x
+  description: To be backported to release/v2.1.x
+  color: '#ffd700'
+- name: backport:release/v2.2.x
+  description: To be backported to release/v2.2.x
+  color: '#ffd700'
 - name: backport:release/v2.3.x
   description: To be backported to release/v2.3.x
   color: '#ffd700'
-- name: backport:release/v2.4.x
-  description: To be backported to release/v2.4.x
-  color: '#ffd700'
-- name: backport:release/v2.5.x
-  description: To be backported to release/v2.5.x
-  color: '#ffd700'

.github/workflows/conformance.yaml

@@ -19,7 +19,7 @@ jobs:
       matrix:
         # Keep this list up-to-date with https://endoflife.date/kubernetes
         # Build images with https://github.com/fluxcd/flux-benchmark/actions/workflows/build-kind.yaml
-        KUBERNETES_VERSION: [1.30.9, 1.31.5, 1.32.1, 1.33.0]
+        KUBERNETES_VERSION: [1.30.9, 1.31.5, 1.32.1 ]
       fail-fast: false
     steps:
       - name: Checkout
@@ -42,7 +42,7 @@ jobs:
       - name: Setup Kubernetes
         uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
         with:
-          version: v0.27.0
+          version: v0.22.0
           cluster_name: ${{ steps.prep.outputs.CLUSTER }}
           node_image: ghcr.io/fluxcd/kindest/node:v${{ matrix.KUBERNETES_VERSION }}-arm64
       - name: Run e2e tests

.github/workflows/release.yaml

@@ -2,7 +2,7 @@ name: release
 
 on:
   push:
-    tags: ["v*"]
+    tags: [ 'v*' ]
 
 permissions:
   contents: read
@@ -32,7 +32,7 @@ jobs:
         uses: docker/setup-qemu-action@4574d27a4764455b42196d70a065bc6853246a25 # v3.4.0
       - name: Setup Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
+        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca  # v3.9.0
       - name: Setup Syft
         uses: anchore/sbom-action/download-syft@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
       - name: Setup Cosign
@@ -44,9 +44,9 @@ jobs:
         with:
           registry: ghcr.io
           username: fluxcdbot
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.GHCR_TOKEN }}
       - name: Login to Docker Hub
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567  # v3.3.0
         with:
           username: fluxcdbot
           password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
@@ -66,12 +66,23 @@ jobs:
       - name: Archive the OpenAPI JSON schemas
         run: |
           tar -czvf ./output/crd-schemas.tar.gz -C schemas .
+      - name: Download release notes utility
+        env:
+          GH_REL_URL: https://github.com/buchanae/github-release-notes/releases/download/0.2.0/github-release-notes-linux-amd64-0.2.0.tar.gz
+        run: cd /tmp && curl -sSL ${GH_REL_URL} | tar xz && sudo mv github-release-notes /usr/local/bin/
+      - name: Generate release notes
+        run: |
+          NOTES="./output/notes.md"
+          echo '## CLI Changelog' > ${NOTES}
+          github-release-notes -org fluxcd -repo flux2 -since-latest-release -include-author >> ${NOTES}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Run GoReleaser
         id: run-goreleaser
         uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
         with:
           version: latest
-          args: release --skip=validate
+          args: release --release-notes=output/notes.md --skip=validate
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
@@ -114,7 +125,7 @@ jobs:
         with:
           registry: ghcr.io
           username: fluxcdbot
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ secrets.GHCR_TOKEN }}
       - name: Login to DockerHub
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
@@ -197,4 +208,4 @@ jobs:
       digest: ${{ needs.release-flux-cli.outputs.image_digest }}
       registry-username: fluxcdbot
     secrets:
-      registry-password: ${{ secrets.GITHUB_TOKEN }}
+      registry-password: ${{ secrets.GHCR_TOKEN }}

.goreleaser.yml

@@ -1,6 +1,4 @@
 project_name: flux
-changelog:
-  use: github-native
 builds:
   - <<: &build_defaults
       binary: flux

.scorecard.yml

@@ -1,5 +0,0 @@
-annotations:
-  - checks:
-      - dangerous-workflow
-    reasons:
-      - reason: not-applicable # This workflow does not run untrusted code, the bot will only backport a code if the a PR was approved and merged into main.

cmd/flux/create_source_git.go

@@ -138,7 +138,7 @@ func init() {
 	createSourceGitCmd.Flags().StringVar(&sourceGitArgs.branch, "branch", "", "git branch")
 	createSourceGitCmd.Flags().StringVar(&sourceGitArgs.tag, "tag", "", "git tag")
 	createSourceGitCmd.Flags().StringVar(&sourceGitArgs.semver, "tag-semver", "", "git tag semver range")
-	createSourceGitCmd.Flags().StringVar(&sourceGitArgs.refName, "ref-name", "", "git reference name")
+	createSourceGitCmd.Flags().StringVar(&sourceGitArgs.refName, "ref-name", "", " git reference name")
 	createSourceGitCmd.Flags().StringVar(&sourceGitArgs.commit, "commit", "", "git commit")
 	createSourceGitCmd.Flags().StringVarP(&sourceGitArgs.username, "username", "u", "", "basic authentication username")
 	createSourceGitCmd.Flags().StringVarP(&sourceGitArgs.password, "password", "p", "", "basic authentication password")

cmd/flux/debug_helmrelease.go

@@ -21,6 +21,7 @@ import (
 	"fmt"
 
 	helmv2 "github.com/fluxcd/helm-controller/api/v2"
+	"github.com/fluxcd/pkg/apis/meta"
 	"github.com/fluxcd/pkg/chartutil"
 	"github.com/go-logr/logr"
 	"github.com/spf13/cobra"
@@ -92,12 +93,23 @@ func debugHelmReleaseCmdRun(cmd *cobra.Command, args []string) error {
 	}
 
 	if debugHelmReleaseArgs.showValues {
+		// TODO(stefan): remove the mapping when helm-controller/api v1.2.0 has been released
+		var valuesRefs []meta.ValuesReference
+		for _, source := range hr.Spec.ValuesFrom {
+			valuesRefs = append(valuesRefs, meta.ValuesReference{
+				Kind:      source.Kind,
+				Name:      source.Name,
+				ValuesKey: source.ValuesKey,
+				Optional:  source.Optional,
+			})
+		}
+
 		finalValues, err := chartutil.ChartValuesFromReferences(ctx,
 			logr.Discard(),
 			kubeClient,
 			hr.GetNamespace(),
 			hr.GetValues(),
-			hr.Spec.ValuesFrom...)
+			valuesRefs...)
 		if err != nil {
 			return err
 		}

cmd/flux/testdata/debug_helmrelease/objects.yaml

@@ -38,10 +38,6 @@ spec:
     - kind: Secret
       name: test
       valuesKey: secrets.yaml
-    - kind: Secret
-      name: test
-      valuesKey: flatValue
-      targetPath: aFlatValue
     - kind: ConfigMap
       name: none
       optional: true
@@ -65,4 +61,3 @@ stringData:
   secrets.yaml: |
     secret: "test"
     override: "secret"
-  flatValue: some-flat-value

cmd/flux/testdata/debug_helmrelease/values-from.golden.yaml

@@ -1,4 +1,3 @@
-aFlatValue: some-flat-value
 cm: test
 image:
   repository: stefanprodan/podinfo

rfcs/0000-external-artifact/README.md

@@ -1,166 +0,0 @@
-# RFC External Artifacts
-
-**Status:** provisional
-
-**Creation date:** 2025-04-08
-
-**Last update:** 2025-04-08
-
-## Summary
-
-This RFC proposes the introduction of a new API called `ExternalArtifact` that would allow
-3rd party controllers to act as a source of truth for the cluster desired state. In effect,
-the `ExternalArtifact` API acts as an extension of the existing `source.toolkit.fluxcd.io` APIs
-that enables Flux `kustomize-controller` and `helm-controller` to consume artifacts from external
-source types that are not natively supported by `source-controller`.
-
-## Motivation
-
-Over the years, we've received requests from users to support other source types besides the
-ones natively supported by `source-controller`. For example, users have asked for support of
-downloading Kubernetes manifests from GitHub/GitLab releases, Omaha protocol, SFTP protocol,
-and other remote storage systems.
-
-Another common request is to run transformations on the artifacts fetched by source-controller.
-For example, users want to be able to generate YAML manifests from jsonnet, cue, and other
-templating engines before they are consumed by Flux `kustomize-controller`.
-
-In order to support these use cases, we need to define a standard API that allows 3rd party
-controllers to expose artifacts in-cluster (in the same way `source-controller` does)
-that can be consumed by Flux  `kustomize-controller` and `helm-controller`.
-
-### Goals
-
-Define a standard API for 3rd party controllers to expose artifacts that can be consumed by
-Flux controllers in the same way as the existing `source.toolkit.fluxcd.io` APIs.
-
-Allow Flux users to transition from using `source-controller` to using 3rd party source controllers
-with minimal changes to their existing `Kustomizations` and `HelmReleases`.
-
-### Non-Goals
-
-Allow arbitrary custom resources to be referenced in Flux `Kustomization` and `HelmRelease` as `sourceRef`.
-
-Extend the Flux controllers permissions to access custom resources that are not part of the
-`source.toolkit.fluxcd.io` APIs.
-
-## Proposal
-
-Assuming we have a custom controller called `release-controller` that is responsible for
-reconciling `GitHubRelease` custom resources. This controller downloads the Kubernetes
-deployment YAML manifests from the GitHub API and stores them in a local file system
-as a `tar.gz` file. The `release-controller` then creates an `ExternalArtifact`
-custom resource that tells the Flux controllers from where to fetch the artifact.
-
-Every time the `release-controller` reconciles a `GitHubRelease` custom resource,
-it updates the `ExternalArtifact` status with the latest artifact information if the
-upstream release has changed.
-
-The `release-controller` is responsible for exposing a HTTP endpoint that serves
-the artifacts from its own storage. The URL of the `tar.gz` artifact is stored in
-the `ExternalArtifact` status and should be accessible from the Flux controllers
-running in the cluster.
-
-Example of a generated `ExternalArtifact` custom resource:
-
-```yaml
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: ExternalArtifact
-metadata:
-  name: podinfo
-  namespace: apps
-spec:
-  # SourceRef points to the Kubernetes custom resource for
-  # which the artifact is generated.
-  # +required
-  sourceRef:
-    apiVersion: source.example.com/v1alpha1
-    kind: GitHubRelease
-    name: podinfo
-    namespace: apps
-status:
-  artifact:
-    # Digest is the digest of the tar.gz file in the form of '<algorithm>:<checksum>'.
-    # The digest is used by the Flux controllers to verify the integrity of the artifact.
-    # +required
-    digest: sha256:35d47c9db0eee6ffe08a404dfb416bee31b2b79eabc3f2eb26749163ce487f52
-    # LastUpdateTime is the timestamp corresponding to the last update of the
-    # Artifact in storage.
-    # +required
-    lastUpdateTime: "2025-03-21T13:37:31Z"
-    # Path is the relative file path of the Artifact. It can be used to locate
-    # the file in the root of the Artifact storage on the local file system of
-    # the controller managing the Source.
-    # +required
-    path: release/apps/podinfo/6.8.0-b3396ad.tar.gz
-    # Revision is a human-readable identifier traceable in the origin source system
-    # in the form of '<human-readable-identifier>@<algorithm>:<checksum>'.
-    # The revision is used by the Flux controllers to determine if the artifact has changed.
-    # +required
-    revision: 6.8.0@sha256:35d47c9db0eee6ffe08a404dfb416bee31b2b79eabc3f2eb26749163ce487f52
-    # Size is the number of bytes of the tar.gz file.
-    # +required
-    size: 20914
-    # URL is the in-cluster HTTP address of the Artifact as exposed by the controller
-    # managing the Source. It can be used to retrieve the Artifact for
-    # consumption, e.g. by kustomize-controller applying the Artifact contents.
-    # +required
-    url: http://release-controller.flux-system.svc.cluster.local./release/apps/podinfo/6.8.0-b3396ad.tar.gz
-  conditions:
-  - lastTransitionTime: "2025-04-08T09:09:49Z"
-    message: stored artifact for release 6.8.0
-    observedGeneration: 1
-    reason: Succeeded
-    status: "True"
-    type: Ready
-```
-
-Note that the `.status.artifact` is identical to how `source-controller` exposes the
-artifact information for `Bucket`, `GitRepository`, and `OCIRepository` custom resources.
-This allows the Flux controllers to consume external artifacts with minimal changes.
-
-The `ExternalArtifact` custom resource is referenced by a Flux `Kustomization` as follows:
-
-```yaml
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: podinfo
-  namespace: apps
-spec:
-  interval: 10m
-  sourceRef:
-    kind: ExternalArtifact
-    name: podinfo
-  path: "./"
-  prune: true
-```
-
-Flux `kustomize-controller` will then fetch the artifact from the URL specified in the
-`ExternalArtifact` status, verifies the integrity of the artifact using the digest
-and applies the contents of the artifact to the cluster.
-
-Like with the existing `source.toolkit.fluxcd.io` APIs, `kustomize-controller` will
-watch the `ExternalArtifact` custom resource for changes and will re-apply the
-contents of the artifact when the `.status.artifact.revision` changes.
-
-### User Stories
-
-TODO
-
-### Alternatives
-
-TODO
-
-## Design Details
-
-TODO
-
-## Implementation History
-
-<!--
-Major milestones in the lifecycle of the RFC such as:
-- The first Flux release where an initial version of the RFC was available.
-- The version of Flux where the RFC graduated to general availability.
-- The version of Flux where the RFC was retired or superseded.
--->

rfcs/0007-git-repo-passwordless-auth/README.md

@@ -262,7 +262,7 @@ spec:
 ---
 kind: Secret
 metadata:
-  name: github-app
+  name: github-sa
 stringData:
   githubAppID: <app-id>
   githubInstallationID: <installation-id>

rfcs/0008-custom-event-metadata-from-annotations/README.md

@@ -1,6 +1,6 @@
 # RFC-0008 Custom Event Metadata from Annotations
 
-**Status:** implemented
+**Status:** implementable
 
 <!--
 Status represents the current state of the RFC.
@@ -9,7 +9,7 @@ Must be one of `provisional`, `implementable`, `implemented`, `deferred`, `rejec
 
 **Creation date:** 2024-05-23
 
-**Last update:** 2025-02-22
+**Last update:** 2024-12-17
 
 ## Summary
 
@@ -241,8 +241,6 @@ To disable the feature, do not use `event.toolkit.fluxcd.io/` as a prefix in Flu
 
 ## Implementation History
 
-* RFC implemented and generally available in Flux v2.5.
-
 <!--
 Major milestones in the lifecycle of the RFC such as:
 - The first Flux release where an initial version of the RFC was available.

rfcs/0009-custom-health-checks/README.md

@@ -1,10 +1,10 @@
 # RFC-0009 Custom Health Checks for Kustomization using Common Expression Language (CEL)
 
-**Status:** implemented
+**Status:** implementable
 
 **Creation date:** 2024-01-05
 
-**Last update:** 2025-02-22
+**Last update:** 2025-01-23
 
 ## Summary
 
@@ -329,4 +329,3 @@ We will implement a `CEL` environment that will use the Kubernetes CEL library t
 
 ## Implementation History
 
-* RFC implemented and generally available in Flux v2.5.