Merge pull request #439 from fluxcd/update-components

Update notification-controller to v0.2.1

cmd/flux/check.go

@@ -180,6 +180,10 @@ func componentsCheck() bool {
 		} else {
 			logger.Successf("%s is healthy", deployment)
 		}
+		kubectlArgs = []string{"-n", namespace, "get", "deployment", deployment, "-o", "jsonpath=\"{..image}\""}
+		if output, err := utils.ExecKubectlCommand(ctx, utils.ModeCapture, kubectlArgs...); err == nil {
+			logger.Actionf(strings.TrimPrefix(strings.TrimSuffix(output, "\""), "\""))
+		}
 	}
 	return ok
 }

cmd/flux/create_kustomization.go

@@ -83,6 +83,7 @@ var (
 	ksSANamespace        string
 	ksDecryptionProvider flags.DecryptionProvider
 	ksDecryptionSecret   string
+	ksTargetNamespace    string
 )
 
 func init() {
@@ -97,6 +98,7 @@ func init() {
 	createKsCmd.Flags().StringVar(&ksSANamespace, "sa-namespace", "", "service account namespace")
 	createKsCmd.Flags().Var(&ksDecryptionProvider, "decryption-provider", ksDecryptionProvider.Description())
 	createKsCmd.Flags().StringVar(&ksDecryptionSecret, "decryption-secret", "", "set the Kubernetes secret name that contains the OpenPGP private keys used for sops decryption")
+	createKsCmd.Flags().StringVar(&ksTargetNamespace, "target-namespace", "", "overrides the namespace of all Kustomization objects reconciled by this Kustomization")
 	createCmd.AddCommand(createKsCmd)
 }
 
@@ -139,8 +141,9 @@ func createKsCmdRun(cmd *cobra.Command, args []string) error {
 				Kind: ksSource.Kind,
 				Name: ksSource.Name,
 			},
-			Suspend:    false,
+			Suspend:         false,
-			Validation: ksValidation,
+			Validation:      ksValidation,
+			TargetNamespace: ksTargetNamespace,
 		},
 	}
 

docs/cmd/flux_create_kustomization.md

@@ -55,6 +55,7 @@ flux create kustomization [name] [flags]
       --sa-name string                           service account name
       --sa-namespace string                      service account namespace
       --source kustomizationSource               source that contains the Kubernetes manifests in the format '[<kind>/]<name>',where kind can be one of: (GitRepository, Bucket), if kind is not specified it defaults to GitRepository
+      --target-namespace string                  overrides the namespace of all Kustomization objects reconciled by this Kustomization
       --validation string                        validate the manifests before applying them on the cluster, can be 'client' or 'server'
 ```
 

docs/guides/flux-v1-migration.md

@@ -112,7 +112,7 @@ $ flux install \
   --arch=amd64 \
   --network-policy=true \
   --watch-all-namespaces=true \
-  --namespace=flux-systen
+  --namespace=flux-system
 ✚ generating manifests
 ✔ manifests build completed
 ► installing components in flux-system namespace

docs/guides/installation.md

@@ -44,12 +44,12 @@ Kubernetes cluster and configure it to manage itself from a Git
 repository.
 
 The bootstrap creates a Git repository if one doesn't exist and
-commits the Flux components manifests to the main branch.  Then it
+commits the Flux components manifests to the main branch. Then it
 configures the target cluster to synchronize with that repository by
 setting up SSH deploy keys.
 
 If the Flux components are present on the cluster, the bootstrap
-command will perform an upgrade if needed.  The bootstrap is
+command will perform an upgrade if needed. The bootstrap is
 idempotent, it's safe to run the command as many times as you want.
 
 You can choose what components to install and for which cluster with:
@@ -57,7 +57,7 @@ You can choose what components to install and for which cluster with:
 ```sh
 flux bootstrap <GIT-PROVIDER> \
   --components=source-controller,kustomize-controller,helm-controller,notification-controller \
-  --path=my-cluster \
+  --path=clusters/my-cluster \
   --version=latest
 ```
 
@@ -71,15 +71,16 @@ If you wish to install a specific version, use the Flux
 
 With `--path` you can configure the directory which will be used to reconcile the target cluster.
 To control multiple clusters from the same Git repository, you have to set a unique path per
-cluster e.g. `staging-cluster` and `production-cluster`:
+cluster e.g. `clusters/staging` and `clusters/production`:
 
 ```sh
-├── staging-cluster # <- path=staging-cluster
+./clusters/
+├── staging # <- path=clusters/staging
 │   └── flux-system # <- namespace dir generated by bootstrap
 │       ├── gotk-components.yaml
 │       ├── gotk-sync.yaml
 │       └── kustomization.yaml
-└── production-cluster # <- path=production-cluster
+└── production-cluster # <- path=clusters/production
     └── flux-system
 ```
 
@@ -87,6 +88,9 @@ cluster e.g. `staging-cluster` and `production-cluster`:
     If you wish to change the branch to something else than main, create the repository manually,
     push a branch to origin and then use `flux bootstrap <GIT-PROVIDER> --branch=your-branch`.
 
+For examples on how you can structure your Git repository see:
+* [flux2-kustomize-helm-example](https://github.com/fluxcd/flux2-kustomize-helm-example)
+
 ### GitHub and GitHub Enterprise
 
 Generate a [personal access token](https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line)
@@ -104,7 +108,7 @@ Run the bootstrap for a repository on your personal GitHub account:
 flux bootstrap github \
   --owner=my-github-username \
   --repository=my-repository \
-  --path=my-cluster \
+  --path=clusters/my-cluster \
   --personal
 ```
 
@@ -116,7 +120,7 @@ flux bootstrap github \
   --repository=my-repository \
   --team=team1-slug \
   --team=team2-slug \
-  --path=my-cluster
+  --path=clusters/my-cluster
 ```
 
 When you specify a list of teams, those teams will be granted maintainer access to the repository.
@@ -129,7 +133,7 @@ flux bootstrap github \
   --owner=my-github-organization \
   --repository=my-repository \
   --branch=main \
-  --path=my-cluster
+  --path=clusters/my-cluster
 ```
 
 ### GitLab and GitLab Enterprise
@@ -150,7 +154,7 @@ flux bootstrap gitlab \
   --owner=my-gitlab-username \
   --repository=my-repository \
   --branch=master \
-  --path=my-cluster \
+  --path=clusters/my-cluster \
   --personal
 ```
 
@@ -162,7 +166,7 @@ flux bootstrap gitlab \
   --owner=my-gitlab-username \
   --repository=my-repository \
   --branch=master \
-  --path=my-cluster
+  --path=clusters/my-cluster
 ```
 
 !!! hint "Authentication"
@@ -177,7 +181,7 @@ flux bootstrap gitlab \
   --owner=my-gitlab-group \
   --repository=my-repository \
   --branch=master \
-  --path=my-cluster
+  --path=clusters/my-cluster
 ```
 
 To run the bootstrap for a repository hosted on GitLab on-prem or enterprise, you have to specify your GitLab hostname:
@@ -188,7 +192,7 @@ flux bootstrap gitlab \
   --owner=my-gitlab-group \
   --repository=my-repository \
   --branch=master \
-  --path=my-cluster
+  --path=clusters/my-cluster
 ```
 
 ### Generic Git Server
@@ -205,15 +209,16 @@ cd my-repository
 Create a directory inside the repository:
 
 ```sh
-mkdir -p ./my-cluster/flux-system
+mkdir -p ./clusters/my-cluster/flux-system
 ```
 
 Generate the Flux manifests with:
 
 ```sh
+# on ARM64/AARCH64 clusters use --arch=arm64
 flux install --version=latest \
-  --arch=amd64 \ # on ARM64/AARCH64 clusters use --arch=arm64
+  --arch=amd64 \
-  --export > ./my-cluster/flux-system/gotk-components.yaml
+  --export > ./clusters/my-cluster/flux-system/gotk-components.yaml
 ```
 
 If your cluster must pull images from a private container registry, first you should pull
@@ -241,7 +246,7 @@ Set your registry domain, and the pull secret when generating the manifests:
 flux install --version=latest \
   --registry=registry.internal/fluxcd \
   --image-pull-secret=regcred \
-  --export > ./my-cluster/flux-system/gotk-components.yaml
+  --export > ./clusters/my-cluster/flux-system/gotk-components.yaml
 ```
 
 Commit and push the manifest to the master branch:
@@ -253,7 +258,7 @@ git add -A && git commit -m "add components" && git push
 Apply the manifests on your cluster:
 
 ```sh
-kubectl apply -f ./my-cluster/flux-system/gotk-components.yaml
+kubectl apply -f ./clusters/my-cluster/flux-system/gotk-components.yaml
 ```
 
 Verify that the controllers have started:
@@ -301,12 +306,12 @@ Export both objects, generate a `kustomization.yaml`, commit and push the manife
 
 ```sh
 flux export source git flux-system \
-  > ./my-cluster/flux-system/gotk-sync.yaml
+  > ./clusters/my-cluster/flux-system/gotk-sync.yaml
 
 flux export kustomization flux-system \
-  >> ./my-cluster/flux-system/gotk-sync.yaml
+  >> ./clusters/my-cluster/flux-system/gotk-sync.yaml
 
-cd ./my-cluster/flux-system && kustomize create --autodetect
+cd ./clusters/my-cluster/flux-system && kustomize create --autodetect
 
 git add -A && git commit -m "add sync manifests" && git push
 ```
@@ -315,7 +320,7 @@ To upgrade the Flux components to a newer version, run the install command and c
 
 ```sh
 flux install --version=latest \
-  --export > ./my-cluster/flux-system/gotk-components.yaml
+  --export > ./clusters/my-cluster/flux-system/gotk-components.yaml
 
 git add -A && git commit -m "update flux" && git push
 ```
@@ -323,15 +328,74 @@ git add -A && git commit -m "update flux" && git push
 The source-controller will pull the changes on the cluster, then the kustomize-controller
 will perform a rolling update of all Flux components including itself.
 
-## Dev install
+## Customize Flux manifests
 
-For testing purposes you can install Flux without storing its manifests in a Git repository.
+You can customize the Flux components in the Git repository where you've run bootstrap with Kustomize patches.
 
-Here is the equivalent to `fluxctl install`:
+First clone the repository locally and generate a `kustomization.yaml` file with:
 
 ```sh
-flux install \
+cd ./clusters/production && kustomize create --autodetect
-  --components=source-controller,kustomize-controller
+```
+
+Assuming you want to add custom annotations and labels to the Flux controllers in `clusters/production`.
+Create a Kustomize patch and set the metadata for source-controller and kustomize-controller pods:
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: source-controller
+  namespace: flux-system
+spec:
+  template:
+    metadata:
+      annotations:
+        custom: annotation
+      labels:
+        custom: label
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kustomize-controller
+  namespace: flux-system
+spec:
+  template:
+    metadata:
+      annotations:
+        custom: annotation
+      labels:
+        custom: label
+```
+
+Save the above file as `flux-system-patch.yaml` inside the `clusters/production` dir.
+
+Edit `clusters/production/kustomization.yaml` and add the patch:
+
+```yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - flux-system
+patchesStrategicMerge:
+  - flux-system-patch.yaml
+```
+
+Push the changes to main branch:
+
+```sh
+git add -A && git commit -m "add production metadata" && git push
+```
+
+Flux will detect the change and will update itself on the production cluster.
+
+## Dev install
+
+For testing purposes you can install Flux without storing its manifests in a Git repository:
+
+```sh
+flux install --arch=amd64
 ```
 
 Then you can register Git repositories and reconcile them on your cluster:
@@ -352,27 +416,20 @@ flux create kustomization podinfo-default \
   --health-check-timeout=2m
 ```
 
-Here is the equivalent to `helm install helm-operator`:
+You can register Helm repositories and create Helm releases:
 
 ```sh
-flux install \
+flux create source helm bitnami \
-  --components=source-controller,kustomize-controller,helm-controller
-```
-
-Then you can register Helm repositories and create Helm releases:
-
-```sh
-flux create source helm stable \
   --interval=1h \
-  --url=https://charts.helm.sh/stable
+  --url=https://charts.bitnami.com/bitnami
 
-flux create helmrelease sealed-secrets \
+flux create helmrelease nginx \
   --interval=1h \
-  --release-name=sealed-secrets \
+  --release-name=nginx-ingress-controller \
-  --target-namespace=flux-system \
+  --target-namespace=kube-system \
-  --source=HelmRepository/stable \
+  --source=HelmRepository/bitnami \
-  --chart=sealed-secrets \
+  --chart=nginx-ingress-controller \
-  --chart-version="1.10.x"
+  --chart-version="5.x.x"
 ```
 
 ## Monitoring with Prometheus and Grafana

docs/guides/mozilla-sops.md

@@ -1,12 +1,12 @@
 # Manage Kubernetes secrets with Mozilla SOPS
 
 In order to store secrets safely in a public or private Git repository, you can use
-Mozilla's [SOPS](https://github.com/mozilla/sops) CLI to encrypt 
+Mozilla's [SOPS](https://github.com/mozilla/sops) CLI to encrypt
 Kubernetes secrets with OpenPGP, AWS KMS, GCP KMS and Azure Key Vault.
 
 ## Prerequisites
 
-To follow this guide you'll need a Kubernetes cluster with the GitOps 
+To follow this guide you'll need a Kubernetes cluster with the GitOps
 toolkit controllers installed on it.
 Please see the [get started guide](../get-started/index.md)
 or the [installation guide](installation.md).
@@ -26,7 +26,7 @@ $ gpg --full-generate-key
 
 Real name: stefanprodan
 Email address: stefanprodan@users.noreply.github.com
-Comment: 
+Comment:
 You selected this USER-ID:
     "stefanprodan <stefanprodan@users.noreply.github.com>"
 ```
@@ -48,7 +48,7 @@ gpg --export-secret-keys \
 --armor 1F3D1CED2F865F5E59CA564553241F147E7C5FA4 |
 kubectl create secret generic sops-gpg \
 --namespace=flux-system \
---from-file=sops.asc=/dev/stdin 
+--from-file=sops.asc=/dev/stdin
 ```
 
 ## Encrypt secrets
@@ -102,10 +102,12 @@ Note that the `sops-gpg` can contain more than one key, sops will try to decrypt
 secrets by iterating over all the private keys until it finds one that works.
 
 !!! hint KMS
-    When using AWS/GCP KMS or Azure Key Vault, you'll have to bind an IAM Role
+    When using AWS/GCP KMS, you'll have to bind an IAM Role
     with read access to the KMS keys to the `default` service account of the
     `flux-system` namespace for kustomize-controller to be able to fetch
-    keys from KMS.
+    keys from KMS. When using Azure Key Vault you need to authenticate the kustomize controller either by passing
+    [Service Principal credentials as environment variables](https://github.com/mozilla/sops#encrypting-using-azure-key-vault)
+    or with [add-pod-identity](https://github.com/Azure/aad-pod-identity).
 
 ## GitOps workflow
 
@@ -161,6 +163,6 @@ to a database using a username and password, they'll be doing the following:
 Once the manifests have been pushed to the Git repository, the following happens:
 
 * source-controller pulls the changes from Git
-* kustomize-controller loads the GPG keys from the `sops-pgp` secret 
+* kustomize-controller loads the GPG keys from the `sops-pgp` secret
 * kustomize-controller decrypts the Kubernetes secrets with sops and applies them on the cluster
 * kubelet creates the pods and mounts the secret as a volume or env variable inside the app container

docs/roadmap/index.md

@@ -92,4 +92,5 @@ Tasks
 - [x]  <span style="color:grey">Implement support for Helm charts from Git</span>
 - [x]  <span style="color:grey">Implement support for referring to an alternative chart values file</span>
 - [x]  <span style="color:grey">Stabilize API</span>
-- [ ]  Create a migration guide for Helm Operator users
+- [x]  <span style="color:grey">[Create a migration guide for Helm Operator users](../guides/helm-operator-migration.md)</span>
+- [ ] [Gather feedback on the migration guide](https://github.com/fluxcd/flux2/discussions/413)

go.mod

@@ -6,7 +6,7 @@ require (
 	github.com/blang/semver/v4 v4.0.0
 	github.com/fluxcd/helm-controller/api v0.2.0
 	github.com/fluxcd/kustomize-controller/api v0.2.1
-	github.com/fluxcd/notification-controller/api v0.2.0
+	github.com/fluxcd/notification-controller/api v0.2.1
 	github.com/fluxcd/pkg/apis/meta v0.2.0
 	github.com/fluxcd/pkg/git v0.0.7
 	github.com/fluxcd/pkg/runtime v0.2.0

go.sum

@@ -142,8 +142,8 @@ github.com/fluxcd/helm-controller/api v0.2.0 h1:HWfqy4rUlo4ck+YnTIMcwWBrfeK2sW7l
 github.com/fluxcd/helm-controller/api v0.2.0/go.mod h1:02vw8JOlzdOysJ8p5AMp7XhPqtH9DS12VIeN46yzHY0=
 github.com/fluxcd/kustomize-controller/api v0.2.1 h1:9qtOFdUXIF1j0PW+3c9c/VU+fA4EibnL4Ogz1qgazPw=
 github.com/fluxcd/kustomize-controller/api v0.2.1/go.mod h1:rNS7iETBnm3BvZmPtaLM1otIIyiu4SPeJEL2H2X0uAc=
-github.com/fluxcd/notification-controller/api v0.2.0 h1:8bToM5qayZHWdayxC+/xKgIWTqW1scc6hk86sCvspa0=
+github.com/fluxcd/notification-controller/api v0.2.1 h1:G08+7BjsBLV62nvmGQ/uduozR3y3ldaet9y7dX1rN2E=
-github.com/fluxcd/notification-controller/api v0.2.0/go.mod h1:ygBRvQxylsFhYxcot2sbX29B3H2g9WYlWRX0DKtI/lQ=
+github.com/fluxcd/notification-controller/api v0.2.1/go.mod h1:p0dP0a5iosNSdxQXIddx4E0TGOIxu5/Dp8UWAs535no=
 github.com/fluxcd/pkg/apis/meta v0.0.2 h1:kyA4Y0IzNjf1joBOnFqpWG7aNDHvtLExZcaHQM7qhRI=
 github.com/fluxcd/pkg/apis/meta v0.0.2/go.mod h1:nCNps5JJOcEQr3MNDmZqI4o0chjePSUYL6Q2ktDtotU=
 github.com/fluxcd/pkg/apis/meta v0.1.0 h1:CfOYHYaHslhcb3QlzgKCOXl4ziCbA5zG/fUa1qFlHis=

manifests/bases/notification-controller/kustomization.yaml

@@ -1,5 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- https://github.com/fluxcd/notification-controller/archive/v0.2.0.zip//notification-controller-0.2.0/config/crd
+- https://github.com/fluxcd/notification-controller/archive/v0.2.1.zip//notification-controller-0.2.1/config/crd
-- https://github.com/fluxcd/notification-controller/archive/v0.2.0.zip//notification-controller-0.2.0/config/manager
+- https://github.com/fluxcd/notification-controller/archive/v0.2.1.zip//notification-controller-0.2.1/config/manager

mkdocs.yml

@@ -52,9 +52,9 @@ nav:
       - Monitoring with Prometheus: guides/monitoring.md
       - Sealed Secrets: guides/sealed-secrets.md
       - Mozilla SOPS: guides/mozilla-sops.md
-      - Migrate:
+      - Migration:
-        - From Flux v1: guides/flux-v1-migration.md
+        - Migrate from Flux v1: guides/flux-v1-migration.md
-        - From the Helm Operator: guides/helm-operator-migration.md
+        - Migrate from the Helm Operator: guides/helm-operator-migration.md
   - Toolkit Components:
     - Overview: components/index.md
     - Source Controller: