fix: improve wording

Signed-off-by: Max Jonas Werner <mail@makk.es>
feat: prompt for access tokens in 'bootstrap' command
2026-03-01 11:16:56 +00:00 · 2021-11-02 14:46:29 +01:00 · 2021-11-02 09:54:52 +01:00
179 changed files with 1497 additions and 4961 deletions
--- a/.github/aur/flux-go/PKGBUILD.template
+++ b/.github/aur/flux-go/PKGBUILD.template
@@ -12,7 +12,7 @@ provides=("flux-bin")
 conflicts=("flux-bin")
 replaces=("flux-cli")
 depends=("glibc")
-makedepends=('go>=1.17', 'kustomize>=3.0')
+makedepends=('go>=1.16', 'kustomize>=3.0')
 optdepends=('bash-completion: auto-completion for flux in Bash',
 'zsh-completions: auto-completion for flux in ZSH')
 source=(
@@ -30,20 +30,12 @@ build() {
  export CGO_CXXFLAGS="$CXXFLAGS"
  export CGO_CPPFLAGS="$CPPFLAGS"
  export GOFLAGS="-buildmode=pie -trimpath -mod=readonly -modcacherw"
-  make cmd/flux/.manifests.done
+  ./manifests/scripts/bundle.sh "${PWD}/manifests" "${PWD}/cmd/flux/manifests"
  go build -ldflags "-linkmode=external -X main.VERSION=${pkgver}" -o ${_srcname} ./cmd/flux
 }

 check() {
  cd "flux2-${pkgver}"
-  case $CARCH in
-    aarch64)
-      export ENVTEST_ARCH=arm64
-      ;;
-    armv6h|armv7h)
-      export ENVTEST_ARCH=arm
-      ;;
-  esac
  make test
 }

--- a/.github/aur/flux-scm/PKGBUILD.template
+++ b/.github/aur/flux-scm/PKGBUILD.template
@@ -11,7 +11,7 @@ license=("APACHE")
 provides=("flux-bin")
 conflicts=("flux-bin")
 depends=("glibc")
-makedepends=('go>=1.17', 'kustomize>=3.0', 'git')
+makedepends=('go>=1.16', 'kustomize>=3.0')
 optdepends=('bash-completion: auto-completion for flux in Bash',
 'zsh-completions: auto-completion for flux in ZSH')
 source=(
@@ -32,20 +32,12 @@ build() {
  export CGO_CXXFLAGS="$CXXFLAGS"
  export CGO_CPPFLAGS="$CPPFLAGS"
  export GOFLAGS="-buildmode=pie -trimpath -mod=readonly -modcacherw"
-  make cmd/flux/.manifests.done
+  make cmd/flux/manifests
  go build -ldflags "-linkmode=external -X main.VERSION=${pkgver}" -o ${_srcname} ./cmd/flux
 }

 check() {
  cd "flux2"
-  case $CARCH in
-    aarch64)
-      export ENVTEST_ARCH=arm64
-      ;;
-    armv6h|armv7h)
-      export ENVTEST_ARCH=arm
-      ;;
-  esac
  make test
 }

--- a/.github/runners/README.md
+++ b/.github/runners/README.md
@@ -1,72 +1,42 @@
-# Flux ARM64 GitHub runners
+# Flux GitHub runners

-The Flux ARM64 end-to-end tests run on Equinix instances provisioned with Docker and GitHub self-hosted runners.
+How to provision GitHub Actions self-hosted runners for Flux conformance testing.

-## Current instances
-
-| Runner        | Instance            | Region |
-|---------------|---------------------|--------|
-| equinix-arm-1 | flux-equinix-arm-01 | AMS1   |
-| equinix-arm-2 | flux-equinix-arm-01 | AMS1   |
-| equinix-arm-3 | flux-equinix-arm-01 | AMS1   |
-| equinix-arm-4 | flux-equinix-arm-02 | DFW2   |
-| equinix-arm-5 | flux-equinix-arm-02 | DFW2   |
-| equinix-arm-6 | flux-equinix-arm-02 | DFW2   |
-
-## Instance setup
+## ARM64 Instance specs

 In order to add a new runner to the GitHub Actions pool,
-first create a server on Equinix with the following configuration:
- Type: c2.large.arm
- OS: Ubuntu 20.04
+first create an instance on Oracle Cloud with the following configuration:
+- OS: Canonical Ubuntu 20.04
+- Shape: VM.Standard.A1.Flex
+- OCPU Count: 2 
+- Memory (GB): 12
+- Network Bandwidth (Gbps): 2
+- Local Disk: Block Storage Only  

-### Install prerequisites
+Note that the instance image source must be **Canonical Ubuntu** instead of the default Oracle Linux.
+
+## ARM64 Instance setup

 - SSH into a newly created instance
 ```shell
-ssh root@<instance-public-IP>
+ssh ubuntu@<instance-public-IP>
 ``` 
-
- Create the ubuntu user
+- Create the action runner dir
 ```shell
-adduser ubuntu
-usermod -aG sudo ubuntu
-su - ubuntu
+mkdir -p actions-runner && cd actions-runner
 ```
-
- Create the prerequisites dir
+- Download the provisioning script
 ```shell
-mkdir -p prereq && cd prereq
+curl -sL https://raw.githubusercontent.com/fluxcd/flux2/main/.github/runners/arm64.sh > arm64.sh \
+  && chmod +x ./arm64.sh
 ```
-
- Download the prerequisites script
-```shell
-curl -sL https://raw.githubusercontent.com/fluxcd/flux2/main/.github/runners/prereq.sh > prereq.sh \
-  && chmod +x ./prereq.sh
-```
-
- Install the prerequisites
-```shell
-sudo ./prereq.sh
-```
-
-### Install runners
-
 - Retrieve the GitHub runner token from the repository [settings page](https://github.com/fluxcd/flux2/settings/actions/runners/new?arch=arm64&os=linux)
-
- Create 3 directories `runner1`, `runner2`, `runner3`
-
- In each dir run:
+- Run the provisioning script passing the token as the first argument
 ```shell
-curl -sL https://raw.githubusercontent.com/fluxcd/flux2/main/.github/runners/runner-setup.sh > runner-setup.sh \
-  && chmod +x ./runner-setup.sh
-
-./runner-setup.sh equinix-arm-<NUMBER> <TOKEN>
+sudo ./arm64.sh <TOKEN>
 ```
-
 - Reboot the instance
 ```shell
 sudo reboot
-```
-
+```  
 - Navigate to the GitHub repository [runners page](https://github.com/fluxcd/flux2/settings/actions/runners) and check the runner status
--- a/.github/runners/prereq.sh
+++ b/.github/runners/prereq.sh
@@ -14,16 +14,20 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-# This script installs the prerequisites for running Flux end-to-end tests with Docker and GitHub self-hosted runners.
+# This script is meant to be run locally and in CI to validate the Kubernetes
+# manifests (including Flux custom resources) before changes are merged into
+# the branch synced by Flux in-cluster.

 set -eu

+REPOSITORY_TOKEN=$1
+REPOSITORY_URL=${2:-https://github.com/fluxcd/flux2}
+
 KIND_VERSION=0.11.1
 KUBECTL_VERSION=1.21.2
 KUSTOMIZE_VERSION=4.1.3
-HELM_VERSION=3.7.2
-GITHUB_RUNNER_VERSION=2.285.1
-PACKAGES="apt-transport-https ca-certificates software-properties-common build-essential libssl-dev gnupg lsb-release jq pkg-config"
+GITHUB_RUNNER_VERSION=2.278.0
+PACKAGES="apt-transport-https ca-certificates software-properties-common build-essential libssl-dev gnupg lsb-release jq"

 # install prerequisites
 apt-get update \
@@ -53,12 +57,6 @@ curl -Lo ./kustomize.tar.gz https://github.com/kubernetes-sigs/kustomize/release
  && rm kustomize.tar.gz
 install -o root -g root -m 0755 kustomize /usr/local/bin/kustomize

-# install helm
-curl -Lo ./helm.tar.gz https://get.helm.sh/helm-v${HELM_VERSION}-linux-arm64.tar.gz \
-  && tar -zxvf helm.tar.gz \
-  && rm helm.tar.gz
-install -o root -g root -m 0755 linux-arm64/helm /usr/local/bin/helm
-
 # download runner
 curl -o actions-runner-linux-arm64.tar.gz -L https://github.com/actions/runner/releases/download/v${GITHUB_RUNNER_VERSION}/actions-runner-linux-arm64-${GITHUB_RUNNER_VERSION}.tar.gz \
  && tar xzf actions-runner-linux-arm64.tar.gz \
@@ -66,3 +64,10 @@ curl -o actions-runner-linux-arm64.tar.gz -L https://github.com/actions/runner/r

 # install runner dependencies
 ./bin/installdependencies.sh
+
+# register runner with GitHub
+sudo -u ubuntu ./config.sh --unattended --url ${REPOSITORY_URL} --token ${REPOSITORY_TOKEN}
+
+# start runner
+./svc.sh install
+./svc.sh start
--- a/.github/runners/runner-setup.sh
+++ b/.github/runners/runner-setup.sh
@@ -1,37 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright 2021 The Flux authors. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# This script installs a GitHub self-hosted ARM64 runner for running Flux end-to-end tests.
-
-set -eu
-
-RUNNER_NAME=$1
-REPOSITORY_TOKEN=$2
-REPOSITORY_URL=${3:-https://github.com/fluxcd/flux2}
-
-GITHUB_RUNNER_VERSION=2.285.1
-
-# download runner
-curl -o actions-runner-linux-arm64.tar.gz -L https://github.com/actions/runner/releases/download/v${GITHUB_RUNNER_VERSION}/actions-runner-linux-arm64-${GITHUB_RUNNER_VERSION}.tar.gz \
-  && tar xzf actions-runner-linux-arm64.tar.gz \
-  && rm actions-runner-linux-arm64.tar.gz
-
-# register runner with GitHub
-./config.sh --unattended --url ${REPOSITORY_URL} --token ${REPOSITORY_TOKEN} --name ${RUNNER_NAME}
-
-# start runner
-sudo ./svc.sh install
-sudo ./svc.sh start
--- a/.github/workflows/bootstrap.yaml
+++ b/.github/workflows/bootstrap.yaml
@@ -17,13 +17,13 @@ jobs:
        uses: actions/cache@v1
        with:
          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go1.17-${{ hashFiles('**/go.sum') }}
+          key: ${{ runner.os }}-go1.16-${{ hashFiles('**/go.sum') }}
          restore-keys: |
-            ${{ runner.os }}-go1.17-
+            ${{ runner.os }}-go1.16-
      - name: Setup Go
        uses: actions/setup-go@v2
        with:
-          go-version: 1.17.x
+          go-version: 1.16.x
      - name: Setup Kubernetes
        uses: engineerd/setup-kind@v0.5.0
        with:
@@ -91,38 +91,17 @@ jobs:
        run: |
          /tmp/flux uninstall -s --keep-namespace
          kubectl delete ns flux-system --timeout=10m --wait=true
-      - name: test image automation
+      - name: bootstrap reinstall
        run: |
-          make setup-image-automation
          /tmp/flux bootstrap github --manifests ./manifests/install/ \
          --owner=fluxcd-testing \
          --repository=${{ steps.vars.outputs.test_repo_name }} \
          --branch=main \
          --path=test-cluster \
-          --read-write-key
-          /tmp/flux reconcile image repository podinfo
-          /tmp/flux reconcile image update flux-system
-          /tmp/flux get images all
-          
-          retries=10
-          count=0
-          ok=false
-          until ${ok}; do
-              /tmp/flux get image update flux-system | grep 'commit' && ok=true || ok=false
-              count=$(($count + 1))
-              if [[ ${count} -eq ${retries} ]]; then
-                  echo "No more retries left"
-                  exit 1
-              fi
-              sleep 6
-              /tmp/flux reconcile image update flux-system
-          done
+          --team=team-z
        env:
          GITHUB_TOKEN: ${{ secrets.GITPROVIDER_BOT_TOKEN }}
-          GITHUB_REPO_NAME: ${{ steps.vars.outputs.test_repo_name }}
-          GITHUB_ORG_NAME: fluxcd-testing
      - name: delete repository
-        if: ${{ always() }}
        run: |
          curl \
            -X DELETE \
--- a/.github/workflows/e2e-arm64.yaml
+++ b/.github/workflows/e2e-arm64.yaml
@@ -3,20 +3,21 @@ name: e2e-arm64
 on:
  workflow_dispatch:
  push:
-    branches: [ main, update-components, equinix-runners ]
+    branches: [ main, update-components, arm64-e2e ]

 jobs:
-  test:
-    # Hosted on Equinix
+  ampere:
+    # Runner info
+    # Owner: Stefan Prodan
    # Docs: https://github.com/fluxcd/flux2/tree/main/.github/runners
-    runs-on: [self-hosted, Linux, ARM64, equinix]
+    runs-on: [self-hosted, Linux, ARM64]
    steps:
      - name: Checkout
        uses: actions/checkout@v2
      - name: Setup Go
        uses: actions/setup-go@v2
        with:
-          go-version: 1.17.x
+          go-version: 1.16.x
      - name: Prepare
        id: prep
        run: |
--- a/.github/workflows/e2e-azure.yaml
+++ b/.github/workflows/e2e-azure.yaml
@@ -17,13 +17,13 @@ jobs:
        uses: actions/cache@v1
        with:
          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go1.17-${{ hashFiles('**/go.sum') }}
+          key: ${{ runner.os }}-go1.16-${{ hashFiles('**/go.sum') }}
          restore-keys: |
-            ${{ runner.os }}-go1.17-
+            ${{ runner.os }}-go1.16-
      - name: Setup Go
        uses: actions/setup-go@v2
        with:
-          go-version: 1.17.x
+          go-version: 1.16.x
      - name: Install libgit2
        run: |
          sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 648ACFD622F3D138
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -2,7 +2,7 @@ name: e2e

 on:
  push:
-    branches: [ main, e2e* ]
+    branches: [ main ]
  pull_request:
    branches: [ main ]

@@ -16,22 +16,26 @@ jobs:
        uses: actions/cache@v1
        with:
          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go1.17-${{ hashFiles('**/go.sum') }}
+          key: ${{ runner.os }}-go1.16-${{ hashFiles('**/go.sum') }}
          restore-keys: |
-            ${{ runner.os }}-go1.17-
+            ${{ runner.os }}-go1.16-
      - name: Setup Go
        uses: actions/setup-go@v2
        with:
-          go-version: 1.17.x
+          go-version: 1.16.x
      - name: Setup Kubernetes
        uses: engineerd/setup-kind@v0.5.0
        with:
          version: v0.11.1
-          image: kindest/node:v1.20.7
+          image: kindest/node:v1.19.11@sha256:07db187ae84b4b7de440a73886f008cf903fcf5764ba8106a9fd5243d6f32729
          config: .github/kind/config.yaml # disable KIND-net
+      - name: Setup envtest
+        uses: fluxcd/pkg/actions/envtest@main
+        with:
+          version: "1.21.x"
      - name: Setup Calico for network policy
        run: |
-          kubectl apply -f https://docs.projectcalico.org/v3.20/manifests/calico.yaml
+          kubectl apply -f https://docs.projectcalico.org/v3.16/manifests/calico.yaml
          kubectl -n kube-system set env daemonset/calico-node FELIX_IGNORELOOSERPF=true
      - name: Setup Kustomize
        uses: fluxcd/pkg//actions/kustomize@main
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -4,11 +4,6 @@ on:
  push:
    tags: [ 'v*' ]

-permissions:
-  contents: write # needed to write releases
-  id-token: write # needed for keyless signing
-  packages: write # needed for ghcr access
-
 jobs:
  goreleaser:
    runs-on: ubuntu-latest
@@ -20,18 +15,16 @@ jobs:
      - name: Setup Go
        uses: actions/setup-go@v2
        with:
-          go-version: 1.17.x
+          go-version: 1.16.x
      - name: Setup QEMU
        uses: docker/setup-qemu-action@v1
+        with:
+          platforms: all
      - name: Setup Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v1
-      - name: Setup Syft
-        uses: anchore/sbom-action/download-syft@v0
-      - name: Setup Cosign
-        uses: sigstore/cosign-installer@main
-      - name: Setup Kustomize
-        uses: fluxcd/pkg//actions/kustomize@main
+        with:
+          buildkitd-flags: "--debug"
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v1
        with:
@@ -43,6 +36,18 @@ jobs:
        with:
          username: fluxcdbot
          password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
+      - name: Download release notes utility
+        env:
+          GH_REL_URL: https://github.com/buchanae/github-release-notes/releases/download/0.2.0/github-release-notes-linux-amd64-0.2.0.tar.gz
+        run: cd /tmp && curl -sSL ${GH_REL_URL} | tar xz && sudo mv github-release-notes /usr/local/bin/
+      - name: Generate release notes
+        run: |
+          echo 'CHANGELOG' > /tmp/release.txt
+          github-release-notes -org fluxcd -repo toolkit -since-latest-release -include-author >> /tmp/release.txt
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Setup Kustomize
+        uses: fluxcd/pkg//actions/kustomize@main
      - name: Generate manifests
        run: |
          make cmd/flux/.manifests.done
@@ -51,32 +56,19 @@ jobs:
      - name: Build CRDs
        run: |
          kustomize build manifests/crds > all-crds.yaml
-      # Pinned to commit before https://github.com/fluxcd/pkg/pull/189 due to
-      # introduction faulty behavior.
      - name: Generate OpenAPI JSON schemas from CRDs
-        uses: fluxcd/pkg//actions/crdjsonschema@49e26aa2ee9e734c3233c560253fd9542afe18ae
+        uses: fluxcd/pkg//actions/crdjsonschema@main
        with:
          crd: all-crds.yaml
          output: schemas
      - name: Archive the OpenAPI JSON schemas
        run: |
          tar -czvf ./output/crd-schemas.tar.gz -C schemas .
-      - name: Download release notes utility
-        env:
-          GH_REL_URL: https://github.com/buchanae/github-release-notes/releases/download/0.2.0/github-release-notes-linux-amd64-0.2.0.tar.gz
-        run: cd /tmp && curl -sSL ${GH_REL_URL} | tar xz && sudo mv github-release-notes /usr/local/bin/
-      - name: Generate release notes
-        run: |
-          NOTES="./output/notes.md"
-          echo '## CLI Changelog' > ${NOTES}
-          github-release-notes -org fluxcd -repo flux2 -since-latest-release -include-author >> ${NOTES}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v1
        with:
          version: latest
-          args: release --release-notes=output/notes.md --skip-validate
+          args: release --release-notes=/tmp/release.txt --skip-validate
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
--- a/.github/workflows/update.yaml
+++ b/.github/workflows/update.yaml
@@ -16,7 +16,7 @@ jobs:
      - name: Setup Go
        uses: actions/setup-go@v2
        with:
-          go-version: 1.17.x
+          go-version: 1.16.x
      - name: Update component versions
        id: update
        run: |
--- a/.gitignore
+++ b/.gitignore
@@ -20,7 +20,6 @@ bin/
 output/
 cmd/flux/manifests/
 cmd/flux/.manifests.done
-testbin/

 # Docs
 site/
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -40,36 +40,6 @@ archives:
    format: zip
    files:
      - none*
-source:
-  enabled: true
-  name_template: '{{ .ProjectName }}_{{ .Version }}_source_code'
-sboms:
-  - id: source
-    artifacts: source
-    documents:
-      - "{{ .ProjectName }}_{{ .Version }}_sbom.spdx.json"
-release:
-  extra_files:
-    - glob: output/crd-schemas.tar.gz
-    - glob: output/manifests.tar.gz
-    - glob: output/install.yaml
-checksum:
-  extra_files:
-    - glob: output/crd-schemas.tar.gz
-    - glob: output/manifests.tar.gz
-    - glob: output/install.yaml
-signs:
-  - cmd: cosign
-    env:
-      - COSIGN_EXPERIMENTAL=1
-    certificate: '${artifact}.pem'
-    args:
-      - sign-blob
-      - '--output-certificate=${certificate}'
-      - '--output-signature=${signature}'
-      - '${artifact}'
-    artifacts: checksum
-    output: true
 brews:
  - name: flux
    tap:
@@ -108,12 +78,17 @@ publishers:
      - AUR_BOT_SSH_PRIVATE_KEY={{ .Env.AUR_BOT_SSH_PRIVATE_KEY }}
    cmd: |
      .github/aur/flux-go/publish.sh {{ .Version }}
+release:
+  extra_files:
+    - glob: ./output/crd-schemas.tar.gz
+    - glob: ./output/manifests.tar.gz
+    - glob: ./output/install.yaml
 dockers:
 - image_templates:
    - 'fluxcd/flux-cli:{{ .Tag }}-amd64'
    - 'ghcr.io/fluxcd/flux-cli:{{ .Tag }}-amd64'
  dockerfile: Dockerfile
-  use: buildx
+  use_buildx: true
  goos: linux
  goarch: amd64
  build_flag_templates:
@@ -129,7 +104,7 @@ dockers:
    - 'fluxcd/flux-cli:{{ .Tag }}-arm64'
    - 'ghcr.io/fluxcd/flux-cli:{{ .Tag }}-arm64'
  dockerfile: Dockerfile
-  use: buildx
+  use_buildx: true
  goos: linux
  goarch: arm64
  build_flag_templates:
@@ -145,7 +120,7 @@ dockers:
    - 'fluxcd/flux-cli:{{ .Tag }}-arm'
    - 'ghcr.io/fluxcd/flux-cli:{{ .Tag }}-arm'
  dockerfile: Dockerfile
-  use: buildx
+  use_buildx: true
  goos: linux
  goarch: arm
  goarm: 7
@@ -169,12 +144,3 @@ docker_manifests:
    - 'ghcr.io/fluxcd/flux-cli:{{ .Tag }}-amd64'
    - 'ghcr.io/fluxcd/flux-cli:{{ .Tag }}-arm64'
    - 'ghcr.io/fluxcd/flux-cli:{{ .Tag }}-arm'
-docker_signs:
-  - cmd: cosign
-    env:
-      - COSIGN_EXPERIMENTAL=1
-    args:
-      - sign
-      - '${artifact}'
-    artifacts: all
-    output: true
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -67,9 +67,9 @@ for source changes.

 Prerequisites:

-* go >= 1.17
-* kubectl >= 1.20
-* kustomize >= 4.4
+* go >= 1.16
+* kubectl >= 1.19
+* kustomize >= 4.0

 Install the [controller-runtime/envtest](https://github.com/kubernetes-sigs/controller-runtime/tree/master/tools/setup-envtest) binaries with:

--- a/7
+++ b/7
@@ -1,15 +1,15 @@
-FROM alpine:3.15 as builder
+FROM alpine:3.13 as builder

 RUN apk add --no-cache ca-certificates curl

 ARG ARCH=linux/amd64
-ARG KUBECTL_VER=1.23.1
+ARG KUBECTL_VER=1.22.2

 RUN curl -sL https://storage.googleapis.com/kubernetes-release/release/v${KUBECTL_VER}/bin/${ARCH}/kubectl \
    -o /usr/local/bin/kubectl && chmod +x /usr/local/bin/kubectl && \
    kubectl version --client=true

-FROM alpine:3.15 as flux-cli
+FROM alpine:3.13 as flux-cli

 # Create minimal nsswitch.conf file to prioritize the usage of /etc/hosts over DNS queries.
 # https://github.com/gliderlabs/docker-alpine/issues/367#issuecomment-354316460
@@ -20,5 +20,4 @@ RUN apk add --no-cache ca-certificates
 COPY --from=builder /usr/local/bin/kubectl /usr/local/bin/
 COPY --chmod=755 flux /usr/local/bin/

-USER 65534:65534
 ENTRYPOINT [ "flux" ]
--- a/4
+++ b/4
@@ -12,9 +12,9 @@ should.

 In alphabetical order:

-Aurel Canciu, NexHealth <aurel.canciu@nexhealth.com> (github: @relu, slack: relu)
+Aurel Canciu, Sortlist <aurel@sortlist.com> (github: @relu, slack: relu)
 Hidde Beydals, Weaveworks <hidde@weave.works> (github: @hiddeco, slack: hidde)
-Max Jonas Werner, D2iQ <max@e13.dev> (github: @makkes, slack: max)
+Max Jonas Werner, D2iQ <mwerner@d2iq.com> (github: @makkes, slack: max)
 Philip Laine, Xenit <philip.laine@xenit.se> (github: @phillebaba, slack: phillebaba)
 Stefan Prodan, Weaveworks <stefan@weave.works> (github: @stefanprodan, slack: stefanprodan)
 Sunny, Weaveworks <sunny@weave.works> (github: @darkowlzz, slack: darkowlzz)
--- a/51
+++ b/51
@@ -1,8 +1,8 @@
 VERSION?=$(shell grep 'VERSION' cmd/flux/main.go | awk '{ print $$4 }' | head -n 1 | tr -d '"')
 EMBEDDED_MANIFESTS_TARGET=cmd/flux/.manifests.done
 TEST_KUBECONFIG?=/tmp/flux-e2e-test-kubeconfig
-# Architecture to use envtest with
-ENVTEST_ARCH ?= amd64
+ENVTEST_BIN_VERSION?=latest
+KUBEBUILDER_ASSETS?=$(shell $(SETUP_ENVTEST) use -i $(ENVTEST_BIN_VERSION) -p path)

 # Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
 ifeq (,$(shell go env GOBIN))
@@ -17,7 +17,6 @@ all: test build

 tidy:
 	go mod tidy
-	cd tests/azure && go mod tidy

 fmt:
 	go fmt ./...
@@ -34,7 +33,6 @@ cleanup-kind:
 	kind delete cluster --name=flux-e2e-test
 	rm $(TEST_KUBECONFIG)

-KUBEBUILDER_ASSETS?="$(shell $(ENVTEST) --arch=$(ENVTEST_ARCH) use -i $(ENVTEST_KUBERNETES_VERSION) --bin-dir=$(ENVTEST_ASSETS_DIR) -p path)"
 test: $(EMBEDDED_MANIFESTS_TARGET) tidy fmt vet install-envtest
 	KUBEBUILDER_ASSETS="$(KUBEBUILDER_ASSETS)" go test ./... -coverprofile cover.out --tags=unit

@@ -60,33 +58,24 @@ install:
 install-dev:
 	CGO_ENABLED=0 go build -o /usr/local/bin ./cmd/flux

+install-envtest:  setup-envtest
+	 $(SETUP_ENVTEST) use $(ENVTEST_BIN_VERSION)
+
 setup-bootstrap-patch:
 	go run ./tests/bootstrap/main.go

-setup-image-automation:
-	cd tests/image-automation && go run main.go
-
-ENVTEST_ASSETS_DIR=$(shell pwd)/testbin
-ENVTEST_KUBERNETES_VERSION?=latest
-install-envtest: setup-envtest
-	mkdir -p ${ENVTEST_ASSETS_DIR}
-	$(ENVTEST) use $(ENVTEST_KUBERNETES_VERSION) --arch=$(ENVTEST_ARCH) --bin-dir=$(ENVTEST_ASSETS_DIR)
-
-ENVTEST = $(shell pwd)/bin/setup-envtest
-.PHONY: envtest
-setup-envtest: ## Download envtest-setup locally if necessary.
-	$(call go-install-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest@latest)
-
-# go-install-tool will 'go install' any package $2 and install it to $1.
-PROJECT_DIR := $(shell dirname $(abspath $(lastword $(MAKEFILE_LIST))))
-define go-install-tool
-@[ -f $(1) ] || { \
-set -e ;\
-TMP_DIR=$$(mktemp -d) ;\
-cd $$TMP_DIR ;\
-go mod init tmp ;\
-echo "Downloading $(2)" ;\
-GOBIN=$(PROJECT_DIR)/bin go install $(2) ;\
-rm -rf $$TMP_DIR ;\
-}
-endef
+# Find or download setup-envtest
+setup-envtest:
+ifeq (, $(shell which setup-envtest))
+	@{ \
+	set -e ;\
+	SETUP_ENVTEST_TMP_DIR=$$(mktemp -d) ;\
+	cd $$SETUP_ENVTEST_TMP_DIR ;\
+	go mod init tmp ;\
+	go get sigs.k8s.io/controller-runtime/tools/setup-envtest@latest ;\
+	rm -rf $$SETUP_ENVTEST_TMP_DIR ;\
+	}
+SETUP_ENVTEST=$(GOBIN)/setup-envtest
+else
+SETUP_ENVTEST=$(shell which setup-envtest)
+endif
--- a/action/action.yml
+++ b/action/action.yml
@@ -12,9 +12,6 @@ inputs:
    description: "arch can be amd64, arm64 or arm"
    required: true
    default: "amd64"
-  bindir:
-    description: "Optional location of the Flux binary. Will not use sudo if set. Updates System Path."
-    required: false
 runs:
  using: composite
  steps:
@@ -32,16 +29,10 @@ runs:
        curl -sL ${BIN_URL} -o /tmp/flux.tar.gz
        mkdir -p /tmp/flux
        tar -C /tmp/flux/ -zxvf /tmp/flux.tar.gz
-    - name: "Copy Flux binary to execute location"
+    - name: "Add flux binary to /usr/local/bin"
      shell: bash
      run: |
-        BINDIR=${{ inputs.bindir }}
-        if [ -z $BINDIR ]; then
-          sudo cp /tmp/flux/flux /usr/local/bin
-        else
-          cp /tmp/flux/flux "${BINDIR}"
-          echo "${BINDIR}" >> $GITHUB_PATH
-        fi
+        sudo cp /tmp/flux/flux /usr/local/bin
    - name: "Cleanup tmp"
      shell: bash
      run: |
--- a/cmd/flux/bootstrap.go
+++ b/cmd/flux/bootstrap.go
@@ -140,7 +140,7 @@ func NewBootstrapFlags() bootstrapFlags {
 	return bootstrapFlags{
 		logLevel:           flags.LogLevel(rootArgs.defaults.LogLevel),
 		requiredComponents: []string{"source-controller", "kustomize-controller"},
-		keyAlgorithm:       flags.PublicKeyAlgorithm(sourcesecret.ECDSAPrivateKeyAlgorithm),
+		keyAlgorithm:       flags.PublicKeyAlgorithm(sourcesecret.RSAPrivateKeyAlgorithm),
 		keyRSABits:         2048,
 		keyECDSACurve:      flags.ECDSACurve{Curve: elliptic.P384()},
 	}
--- a/cmd/flux/bootstrap_bitbucket_server.go
+++ b/cmd/flux/bootstrap_bitbucket_server.go
@@ -1,280 +0,0 @@
-/*
-Copyright 2021 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"time"
-
-	"github.com/go-git/go-git/v5/plumbing/transport/http"
-	"github.com/spf13/cobra"
-
-	"github.com/fluxcd/flux2/internal/bootstrap"
-	"github.com/fluxcd/flux2/internal/bootstrap/git/gogit"
-	"github.com/fluxcd/flux2/internal/bootstrap/provider"
-	"github.com/fluxcd/flux2/internal/flags"
-	"github.com/fluxcd/flux2/internal/utils"
-	"github.com/fluxcd/flux2/pkg/manifestgen/install"
-	"github.com/fluxcd/flux2/pkg/manifestgen/sourcesecret"
-	"github.com/fluxcd/flux2/pkg/manifestgen/sync"
-)
-
-var bootstrapBServerCmd = &cobra.Command{
-	Use:   "bitbucket-server",
-	Short: "Bootstrap toolkit components in a Bitbucket Server repository",
-	Long: `The bootstrap bitbucket-server command creates the Bitbucket Server repository if it doesn't exists and
-commits the toolkit components manifests to the master branch.
-Then it configures the target cluster to synchronize with the repository.
-If the toolkit components are present on the cluster,
-the bootstrap command will perform an upgrade if needed.`,
-	Example: `  # Create a Bitbucket Server API token and export it as an env var
-  export BITBUCKET_TOKEN=<my-token>
-
-  # Run bootstrap for a private repository using HTTPS token authentication
-  flux bootstrap bitbucket-server --owner=<project> --username=<user> --repository=<repository name> --hostname=<domain> --token-auth
-
-  # Run bootstrap for a private repository using SSH authentication
-  flux bootstrap bitbucket-server --owner=<project> --username=<user> --repository=<repository name> --hostname=<domain>
-
-  # Run bootstrap for a repository path
-  flux bootstrap bitbucket-server --owner=<project> --username=<user> --repository=<repository name> --path=dev-cluster --hostname=<domain>
-
-  # Run bootstrap for a public repository on a personal account
-  flux bootstrap bitbucket-server --owner=<user> --repository=<repository name> --private=false --personal --hostname=<domain> --token-auth
-
-  # Run bootstrap for a an existing repository with a branch named main
-  flux bootstrap bitbucket-server --owner=<project> --username=<user> --repository=<repository name> --branch=main --hostname=<domain> --token-auth`,
-	RunE: bootstrapBServerCmdRun,
-}
-
-const (
-	bServerDefaultPermission = "push"
-	bServerTokenEnvVar       = "BITBUCKET_TOKEN"
-)
-
-type bServerFlags struct {
-	owner        string
-	repository   string
-	interval     time.Duration
-	personal     bool
-	username     string
-	private      bool
-	hostname     string
-	path         flags.SafeRelativePath
-	teams        []string
-	readWriteKey bool
-	reconcile    bool
-}
-
-var bServerArgs bServerFlags
-
-func init() {
-	bootstrapBServerCmd.Flags().StringVar(&bServerArgs.owner, "owner", "", "Bitbucket Server user or project name")
-	bootstrapBServerCmd.Flags().StringVar(&bServerArgs.repository, "repository", "", "Bitbucket Server repository name")
-	bootstrapBServerCmd.Flags().StringSliceVar(&bServerArgs.teams, "group", []string{}, "Bitbucket Server groups to be given write access (also accepts comma-separated values)")
-	bootstrapBServerCmd.Flags().BoolVar(&bServerArgs.personal, "personal", false, "if true, the owner is assumed to be a Bitbucket Server user; otherwise a group")
-	bootstrapBServerCmd.Flags().StringVarP(&bServerArgs.username, "username", "u", "git", "authentication username")
-	bootstrapBServerCmd.Flags().BoolVar(&bServerArgs.private, "private", true, "if true, the repository is setup or configured as private")
-	bootstrapBServerCmd.Flags().DurationVar(&bServerArgs.interval, "interval", time.Minute, "sync interval")
-	bootstrapBServerCmd.Flags().StringVar(&bServerArgs.hostname, "hostname", "", "Bitbucket Server hostname")
-	bootstrapBServerCmd.Flags().Var(&bServerArgs.path, "path", "path relative to the repository root, when specified the cluster sync will be scoped to this path")
-	bootstrapBServerCmd.Flags().BoolVar(&bServerArgs.readWriteKey, "read-write-key", false, "if true, the deploy key is configured with read/write permissions")
-	bootstrapBServerCmd.Flags().BoolVar(&bServerArgs.reconcile, "reconcile", false, "if true, the configured options are also reconciled if the repository already exists")
-
-	bootstrapCmd.AddCommand(bootstrapBServerCmd)
-}
-
-func bootstrapBServerCmdRun(cmd *cobra.Command, args []string) error {
-	bitbucketToken := os.Getenv(bServerTokenEnvVar)
-	if bitbucketToken == "" {
-		var err error
-		bitbucketToken, err = readPasswordFromStdin("Please enter your Bitbucket personal access token (PAT): ")
-		if err != nil {
-			return fmt.Errorf("could not read token: %w", err)
-		}
-	}
-
-	if bServerArgs.hostname == "" {
-		return fmt.Errorf("invalid hostname %q", bServerArgs.hostname)
-	}
-
-	if err := bootstrapValidate(); err != nil {
-		return err
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
-	defer cancel()
-
-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
-	if err != nil {
-		return err
-	}
-
-	// Manifest base
-	if ver, err := getVersion(bootstrapArgs.version); err == nil {
-		bootstrapArgs.version = ver
-	}
-	manifestsBase, err := buildEmbeddedManifestBase()
-	if err != nil {
-		return err
-	}
-	defer os.RemoveAll(manifestsBase)
-
-	user := bServerArgs.username
-	if bServerArgs.personal {
-		user = bServerArgs.owner
-	}
-
-	var caBundle []byte
-	if bootstrapArgs.caFile != "" {
-		var err error
-		caBundle, err = os.ReadFile(bootstrapArgs.caFile)
-		if err != nil {
-			return fmt.Errorf("unable to read TLS CA file: %w", err)
-		}
-	}
-
-	// Build Bitbucket Server provider
-	providerCfg := provider.Config{
-		Provider: provider.GitProviderStash,
-		Hostname: bServerArgs.hostname,
-		Username: user,
-		Token:    bitbucketToken,
-		CaBundle: caBundle,
-	}
-
-	providerClient, err := provider.BuildGitProvider(providerCfg)
-	if err != nil {
-		return err
-	}
-
-	// Lazy go-git repository
-	tmpDir, err := os.MkdirTemp("", "flux-bootstrap-")
-	if err != nil {
-		return fmt.Errorf("failed to create temporary working dir: %w", err)
-	}
-	defer os.RemoveAll(tmpDir)
-	gitClient := gogit.New(tmpDir, &http.BasicAuth{
-		Username: user,
-		Password: bitbucketToken,
-	})
-
-	// Install manifest config
-	installOptions := install.Options{
-		BaseURL:                rootArgs.defaults.BaseURL,
-		Version:                bootstrapArgs.version,
-		Namespace:              *kubeconfigArgs.Namespace,
-		Components:             bootstrapComponents(),
-		Registry:               bootstrapArgs.registry,
-		ImagePullSecret:        bootstrapArgs.imagePullSecret,
-		WatchAllNamespaces:     bootstrapArgs.watchAllNamespaces,
-		NetworkPolicy:          bootstrapArgs.networkPolicy,
-		LogLevel:               bootstrapArgs.logLevel.String(),
-		NotificationController: rootArgs.defaults.NotificationController,
-		ManifestFile:           rootArgs.defaults.ManifestFile,
-		Timeout:                rootArgs.timeout,
-		TargetPath:             bServerArgs.path.ToSlash(),
-		ClusterDomain:          bootstrapArgs.clusterDomain,
-		TolerationKeys:         bootstrapArgs.tolerationKeys,
-	}
-	if customBaseURL := bootstrapArgs.manifestsPath; customBaseURL != "" {
-		installOptions.BaseURL = customBaseURL
-	}
-
-	// Source generation and secret config
-	secretOpts := sourcesecret.Options{
-		Name:         bootstrapArgs.secretName,
-		Namespace:    *kubeconfigArgs.Namespace,
-		TargetPath:   bServerArgs.path.String(),
-		ManifestFile: sourcesecret.MakeDefaultOptions().ManifestFile,
-	}
-	if bootstrapArgs.tokenAuth {
-		if bServerArgs.personal {
-			secretOpts.Username = bServerArgs.owner
-		} else {
-			secretOpts.Username = bServerArgs.username
-		}
-		secretOpts.Password = bitbucketToken
-
-		if bootstrapArgs.caFile != "" {
-			secretOpts.CAFilePath = bootstrapArgs.caFile
-		}
-	} else {
-		secretOpts.PrivateKeyAlgorithm = sourcesecret.PrivateKeyAlgorithm(bootstrapArgs.keyAlgorithm)
-		secretOpts.RSAKeyBits = int(bootstrapArgs.keyRSABits)
-		secretOpts.ECDSACurve = bootstrapArgs.keyECDSACurve.Curve
-		secretOpts.SSHHostname = bServerArgs.hostname
-
-		if bootstrapArgs.privateKeyFile != "" {
-			secretOpts.PrivateKeyPath = bootstrapArgs.privateKeyFile
-		}
-		if bootstrapArgs.sshHostname != "" {
-			secretOpts.SSHHostname = bootstrapArgs.sshHostname
-		}
-	}
-
-	// Sync manifest config
-	syncOpts := sync.Options{
-		Interval:          bServerArgs.interval,
-		Name:              *kubeconfigArgs.Namespace,
-		Namespace:         *kubeconfigArgs.Namespace,
-		Branch:            bootstrapArgs.branch,
-		Secret:            bootstrapArgs.secretName,
-		TargetPath:        bServerArgs.path.ToSlash(),
-		ManifestFile:      sync.MakeDefaultOptions().ManifestFile,
-		GitImplementation: sourceGitArgs.gitImplementation.String(),
-		RecurseSubmodules: bootstrapArgs.recurseSubmodules,
-	}
-
-	// Bootstrap config
-	bootstrapOpts := []bootstrap.GitProviderOption{
-		bootstrap.WithProviderRepository(bServerArgs.owner, bServerArgs.repository, bServerArgs.personal),
-		bootstrap.WithBranch(bootstrapArgs.branch),
-		bootstrap.WithBootstrapTransportType("https"),
-		bootstrap.WithAuthor(bootstrapArgs.authorName, bootstrapArgs.authorEmail),
-		bootstrap.WithCommitMessageAppendix(bootstrapArgs.commitMessageAppendix),
-		bootstrap.WithProviderTeamPermissions(mapTeamSlice(bServerArgs.teams, bServerDefaultPermission)),
-		bootstrap.WithReadWriteKeyPermissions(bServerArgs.readWriteKey),
-		bootstrap.WithKubeconfig(kubeconfigArgs),
-		bootstrap.WithLogger(logger),
-		bootstrap.WithCABundle(caBundle),
-		bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyRingPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
-	}
-	if bootstrapArgs.sshHostname != "" {
-		bootstrapOpts = append(bootstrapOpts, bootstrap.WithSSHHostname(bootstrapArgs.sshHostname))
-	}
-	if bootstrapArgs.tokenAuth {
-		bootstrapOpts = append(bootstrapOpts, bootstrap.WithSyncTransportType("https"))
-	}
-	if !bServerArgs.private {
-		bootstrapOpts = append(bootstrapOpts, bootstrap.WithProviderRepositoryConfig("", "", "public"))
-	}
-	if bServerArgs.reconcile {
-		bootstrapOpts = append(bootstrapOpts, bootstrap.WithReconcile())
-	}
-
-	// Setup bootstrapper with constructed configs
-	b, err := bootstrap.NewGitProviderBootstrapper(gitClient, providerClient, kubeClient, bootstrapOpts...)
-	if err != nil {
-		return err
-	}
-
-	// Run
-	return bootstrap.Run(ctx, b, manifestsBase, installOptions, secretOpts, syncOpts, rootArgs.pollInterval, rootArgs.timeout)
-}
--- a/cmd/flux/bootstrap_git.go
+++ b/cmd/flux/bootstrap_git.go
@@ -101,7 +101,7 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
@@ -128,7 +128,7 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
 	installOptions := install.Options{
 		BaseURL:                rootArgs.defaults.BaseURL,
 		Version:                bootstrapArgs.version,
-		Namespace:              *kubeconfigArgs.Namespace,
+		Namespace:              rootArgs.namespace,
 		Components:             bootstrapComponents(),
 		Registry:               bootstrapArgs.registry,
 		ImagePullSecret:        bootstrapArgs.imagePullSecret,
@@ -149,7 +149,7 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
 	// Source generation and secret config
 	secretOpts := sourcesecret.Options{
 		Name:         bootstrapArgs.secretName,
-		Namespace:    *kubeconfigArgs.Namespace,
+		Namespace:    rootArgs.namespace,
 		TargetPath:   gitArgs.path.String(),
 		ManifestFile: sourcesecret.MakeDefaultOptions().ManifestFile,
 	}
@@ -161,15 +161,10 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
 			secretOpts.CAFilePath = bootstrapArgs.caFile
 		}

-		// Remove port of the given host when not syncing over HTTP/S to not assume port for protocol
-		// This _might_ be overwritten later on by e.g. --ssh-hostname
-		if repositoryURL.Scheme != "https" && repositoryURL.Scheme != "http" {
-			repositoryURL.Host = repositoryURL.Hostname()
-		}
-
 		// Configure repository URL to match auth config for sync.
 		repositoryURL.User = nil
 		repositoryURL.Scheme = "https"
+		repositoryURL.Host = repositoryURL.Hostname()
 	} else {
 		secretOpts.PrivateKeyAlgorithm = sourcesecret.PrivateKeyAlgorithm(bootstrapArgs.keyAlgorithm)
 		secretOpts.Password = gitArgs.password
@@ -199,8 +194,8 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
 	// Sync manifest config
 	syncOpts := sync.Options{
 		Interval:          gitArgs.interval,
-		Name:              *kubeconfigArgs.Namespace,
-		Namespace:         *kubeconfigArgs.Namespace,
+		Name:              rootArgs.namespace,
+		Namespace:         rootArgs.namespace,
 		URL:               repositoryURL.String(),
 		Branch:            bootstrapArgs.branch,
 		Secret:            bootstrapArgs.secretName,
@@ -225,7 +220,7 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
 		bootstrap.WithBranch(bootstrapArgs.branch),
 		bootstrap.WithAuthor(bootstrapArgs.authorName, bootstrapArgs.authorEmail),
 		bootstrap.WithCommitMessageAppendix(bootstrapArgs.commitMessageAppendix),
-		bootstrap.WithKubeconfig(kubeconfigArgs),
+		bootstrap.WithKubeconfig(rootArgs.kubeconfig, rootArgs.kubecontext),
 		bootstrap.WithPostGenerateSecretFunc(promptPublicKey),
 		bootstrap.WithLogger(logger),
 		bootstrap.WithCABundle(caBundle),
--- a/cmd/flux/bootstrap_github.go
+++ b/cmd/flux/bootstrap_github.go
@@ -125,7 +125,7 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
@@ -140,20 +140,11 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
 	}
 	defer os.RemoveAll(manifestsBase)

-	var caBundle []byte
-	if bootstrapArgs.caFile != "" {
-		var err error
-		caBundle, err = os.ReadFile(bootstrapArgs.caFile)
-		if err != nil {
-			return fmt.Errorf("unable to read TLS CA file: %w", err)
-		}
-	}
 	// Build GitHub provider
 	providerCfg := provider.Config{
 		Provider: provider.GitProviderGitHub,
 		Hostname: githubArgs.hostname,
 		Token:    ghToken,
-		CaBundle: caBundle,
 	}
 	providerClient, err := provider.BuildGitProvider(providerCfg)
 	if err != nil {
@@ -175,7 +166,7 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
 	installOptions := install.Options{
 		BaseURL:                rootArgs.defaults.BaseURL,
 		Version:                bootstrapArgs.version,
-		Namespace:              *kubeconfigArgs.Namespace,
+		Namespace:              rootArgs.namespace,
 		Components:             bootstrapComponents(),
 		Registry:               bootstrapArgs.registry,
 		ImagePullSecret:        bootstrapArgs.imagePullSecret,
@@ -196,7 +187,7 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
 	// Source generation and secret config
 	secretOpts := sourcesecret.Options{
 		Name:         bootstrapArgs.secretName,
-		Namespace:    *kubeconfigArgs.Namespace,
+		Namespace:    rootArgs.namespace,
 		TargetPath:   githubArgs.path.ToSlash(),
 		ManifestFile: sourcesecret.MakeDefaultOptions().ManifestFile,
 	}
@@ -221,8 +212,8 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
 	// Sync manifest config
 	syncOpts := sync.Options{
 		Interval:          githubArgs.interval,
-		Name:              *kubeconfigArgs.Namespace,
-		Namespace:         *kubeconfigArgs.Namespace,
+		Name:              rootArgs.namespace,
+		Namespace:         rootArgs.namespace,
 		Branch:            bootstrapArgs.branch,
 		Secret:            bootstrapArgs.secretName,
 		TargetPath:        githubArgs.path.ToSlash(),
@@ -240,10 +231,8 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
 		bootstrap.WithCommitMessageAppendix(bootstrapArgs.commitMessageAppendix),
 		bootstrap.WithProviderTeamPermissions(mapTeamSlice(githubArgs.teams, ghDefaultPermission)),
 		bootstrap.WithReadWriteKeyPermissions(githubArgs.readWriteKey),
-		bootstrap.WithKubeconfig(kubeconfigArgs),
+		bootstrap.WithKubeconfig(rootArgs.kubeconfig, rootArgs.kubecontext),
 		bootstrap.WithLogger(logger),
-		bootstrap.WithCABundle(caBundle),
-		bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyRingPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
 	}
 	if bootstrapArgs.sshHostname != "" {
 		bootstrapOpts = append(bootstrapOpts, bootstrap.WithSSHHostname(bootstrapArgs.sshHostname))
--- a/cmd/flux/bootstrap_gitlab.go
+++ b/cmd/flux/bootstrap_gitlab.go
@@ -129,7 +129,7 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
@@ -144,21 +144,11 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
 	}
 	defer os.RemoveAll(manifestsBase)

-	var caBundle []byte
-	if bootstrapArgs.caFile != "" {
-		var err error
-		caBundle, err = os.ReadFile(bootstrapArgs.caFile)
-		if err != nil {
-			return fmt.Errorf("unable to read TLS CA file: %w", err)
-		}
-	}
-
 	// Build GitLab provider
 	providerCfg := provider.Config{
 		Provider: provider.GitProviderGitLab,
 		Hostname: gitlabArgs.hostname,
 		Token:    glToken,
-		CaBundle: caBundle,
 	}
 	// Workaround for: https://github.com/fluxcd/go-git-providers/issues/55
 	if hostname := providerCfg.Hostname; hostname != glDefaultDomain &&
@@ -186,7 +176,7 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
 	installOptions := install.Options{
 		BaseURL:                rootArgs.defaults.BaseURL,
 		Version:                bootstrapArgs.version,
-		Namespace:              *kubeconfigArgs.Namespace,
+		Namespace:              rootArgs.namespace,
 		Components:             bootstrapComponents(),
 		Registry:               bootstrapArgs.registry,
 		ImagePullSecret:        bootstrapArgs.imagePullSecret,
@@ -207,7 +197,7 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
 	// Source generation and secret config
 	secretOpts := sourcesecret.Options{
 		Name:         bootstrapArgs.secretName,
-		Namespace:    *kubeconfigArgs.Namespace,
+		Namespace:    rootArgs.namespace,
 		TargetPath:   gitlabArgs.path.String(),
 		ManifestFile: sourcesecret.MakeDefaultOptions().ManifestFile,
 	}
@@ -235,8 +225,8 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
 	// Sync manifest config
 	syncOpts := sync.Options{
 		Interval:          gitlabArgs.interval,
-		Name:              *kubeconfigArgs.Namespace,
-		Namespace:         *kubeconfigArgs.Namespace,
+		Name:              rootArgs.namespace,
+		Namespace:         rootArgs.namespace,
 		Branch:            bootstrapArgs.branch,
 		Secret:            bootstrapArgs.secretName,
 		TargetPath:        gitlabArgs.path.ToSlash(),
@@ -254,10 +244,8 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
 		bootstrap.WithCommitMessageAppendix(bootstrapArgs.commitMessageAppendix),
 		bootstrap.WithProviderTeamPermissions(mapTeamSlice(gitlabArgs.teams, glDefaultPermission)),
 		bootstrap.WithReadWriteKeyPermissions(gitlabArgs.readWriteKey),
-		bootstrap.WithKubeconfig(kubeconfigArgs),
+		bootstrap.WithKubeconfig(rootArgs.kubeconfig, rootArgs.kubecontext),
 		bootstrap.WithLogger(logger),
-		bootstrap.WithCABundle(caBundle),
-		bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyRingPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
 	}
 	if bootstrapArgs.sshHostname != "" {
 		bootstrapOpts = append(bootstrapOpts, bootstrap.WithSSHHostname(bootstrapArgs.sshHostname))
--- a/cmd/flux/build.go
+++ b/cmd/flux/build.go
@@ -1,31 +0,0 @@
-/*
-Copyright 2021 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"github.com/spf13/cobra"
-)
-
-var buildCmd = &cobra.Command{
-	Use:   "build",
-	Short: "Build a flux resource",
-	Long:  "The build command is used to build flux resources.",
-}
-
-func init() {
-	rootCmd.AddCommand(buildCmd)
-}
--- a/cmd/flux/build_kustomization.go
+++ b/cmd/flux/build_kustomization.go
@@ -1,100 +0,0 @@
-/*
-Copyright 2021 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"fmt"
-	"os"
-	"os/signal"
-
-	"github.com/spf13/cobra"
-
-	"github.com/fluxcd/flux2/internal/build"
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
-)
-
-var buildKsCmd = &cobra.Command{
-	Use:     "kustomization",
-	Aliases: []string{"ks"},
-	Short:   "Build Kustomization",
-	Long: `The build command queries the Kubernetes API and fetches the specified Flux Kustomization. 
-It then uses the fetched in cluster flux kustomization to perform needed transformation on the local kustomization.yaml
-pointed at by --path. The local kustomization.yaml is generated if it does not exist. Finally it builds the overlays using the local kustomization.yaml, and write the resulting multi-doc YAML to stdout.`,
-	Example: `# Build the local manifests as they were built on the cluster
-flux build kustomization my-app --path ./path/to/local/manifests`,
-	ValidArgsFunction: resourceNamesCompletionFunc(kustomizev1.GroupVersion.WithKind(kustomizev1.KustomizationKind)),
-	RunE:              buildKsCmdRun,
-}
-
-type buildKsFlags struct {
-	path string
-}
-
-var buildKsArgs buildKsFlags
-
-func init() {
-	buildKsCmd.Flags().StringVar(&buildKsArgs.path, "path", "", "Path to the manifests location.)")
-	buildCmd.AddCommand(buildKsCmd)
-}
-
-func buildKsCmdRun(cmd *cobra.Command, args []string) error {
-	if len(args) < 1 {
-		return fmt.Errorf("%s name is required", kustomizationType.humanKind)
-	}
-	name := args[0]
-
-	if buildKsArgs.path == "" {
-		return fmt.Errorf("invalid resource path %q", buildKsArgs.path)
-	}
-
-	if fs, err := os.Stat(buildKsArgs.path); err != nil || !fs.IsDir() {
-		return fmt.Errorf("invalid resource path %q", buildKsArgs.path)
-	}
-
-	builder, err := build.NewBuilder(kubeconfigArgs, name, buildKsArgs.path, build.WithTimeout(rootArgs.timeout))
-	if err != nil {
-		return err
-	}
-
-	// create a signal channel
-	sigc := make(chan os.Signal, 1)
-	signal.Notify(sigc, os.Interrupt)
-
-	errChan := make(chan error)
-	go func() {
-		manifests, err := builder.Build()
-		if err != nil {
-			errChan <- err
-		}
-
-		cmd.Print(string(manifests))
-		errChan <- nil
-	}()
-
-	select {
-	case <-sigc:
-		fmt.Println("Build cancelled... exiting.")
-		return builder.Cancel()
-	case err := <-errChan:
-		if err != nil {
-			return err
-		}
-	}
-
-	return nil
-
-}
--- a/cmd/flux/build_kustomization_test.go
+++ b/cmd/flux/build_kustomization_test.go
@@ -1,83 +0,0 @@
-//go:build unit
-// +build unit
-
-/*
-Copyright 2021 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"testing"
-)
-
-func setup(t *testing.T, tmpl map[string]string) {
-	t.Helper()
-	testEnv.CreateObjectFile("./testdata/build-kustomization/podinfo-source.yaml", tmpl, t)
-	testEnv.CreateObjectFile("./testdata/build-kustomization/podinfo-kustomization.yaml", tmpl, t)
-}
-
-func TestBuildKustomization(t *testing.T) {
-	tests := []struct {
-		name       string
-		args       string
-		resultFile string
-		assertFunc string
-	}{
-		{
-			name:       "no args",
-			args:       "build kustomization podinfo",
-			resultFile: "invalid resource path \"\"",
-			assertFunc: "assertError",
-		},
-		{
-			name:       "build podinfo",
-			args:       "build kustomization podinfo --path ./testdata/build-kustomization/podinfo",
-			resultFile: "./testdata/build-kustomization/podinfo-result.yaml",
-			assertFunc: "assertGoldenTemplateFile",
-		},
-		{
-			name:       "build podinfo without service",
-			args:       "build kustomization podinfo --path ./testdata/build-kustomization/delete-service",
-			resultFile: "./testdata/build-kustomization/podinfo-without-service-result.yaml",
-			assertFunc: "assertGoldenTemplateFile",
-		},
-	}
-
-	tmpl := map[string]string{
-		"fluxns": allocateNamespace("flux-system"),
-	}
-	setup(t, tmpl)
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			var assert assertFunc
-
-			switch tt.assertFunc {
-			case "assertGoldenTemplateFile":
-				assert = assertGoldenTemplateFile(tt.resultFile, tmpl)
-			case "assertError":
-				assert = assertError(tt.resultFile)
-			}
-
-			cmd := cmdTestCase{
-				args:   tt.args + " -n " + tmpl["fluxns"],
-				assert: assert,
-			}
-
-			cmd.runTestCmd(t)
-		})
-	}
-}
--- a/cmd/flux/check.go
+++ b/cmd/flux/check.go
@@ -56,7 +56,10 @@ type checkFlags struct {
 }

 var kubernetesConstraints = []string{
-	">=1.20.6-0",
+	">=1.19.0-0",
+	">=1.16.11-0 <=1.16.15-0",
+	">=1.17.7-0 <=1.17.17-0",
+	">=1.18.4-0 <=1.18.20-0",
 }

 var checkArgs checkFlags
@@ -125,7 +128,7 @@ func fluxCheck() {
 }

 func kubernetesCheck(constraints []string) bool {
-	cfg, err := utils.KubeConfig(kubeconfigArgs)
+	cfg, err := utils.KubeConfig(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		logger.Failuref("Kubernetes client initialization failed: %s", err.Error())
 		return false
@@ -173,7 +176,7 @@ func componentsCheck() bool {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeConfig, err := utils.KubeConfig(kubeconfigArgs)
+	kubeConfig, err := utils.KubeConfig(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return false
 	}
@@ -183,7 +186,7 @@ func componentsCheck() bool {
 		return false
 	}

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return false
 	}
@@ -191,7 +194,7 @@ func componentsCheck() bool {
 	ok := true
 	selector := client.MatchingLabels{manifestgen.PartOfLabelKey: manifestgen.PartOfLabelValue}
 	var list v1.DeploymentList
-	if err := kubeClient.List(ctx, &list, client.InNamespace(*kubeconfigArgs.Namespace), selector); err == nil {
+	if err := kubeClient.List(ctx, &list, client.InNamespace(rootArgs.namespace), selector); err == nil {
 		for _, d := range list.Items {
 			if ref, err := buildComponentObjectRefs(d.Name); err == nil {
 				if err := statusChecker.Assess(ref...); err != nil {
--- a/cmd/flux/check_test.go
+++ b/cmd/flux/check_test.go
@@ -1,4 +1,3 @@
-//go:build e2e
 // +build e2e

 /*
@@ -30,7 +29,7 @@ import (
 )

 func TestCheckPre(t *testing.T) {
-	jsonOutput, err := utils.ExecKubectlCommand(context.TODO(), utils.ModeCapture, *kubeconfigArgs.KubeConfig, *kubeconfigArgs.Context, "version", "--output", "json")
+	jsonOutput, err := utils.ExecKubectlCommand(context.TODO(), utils.ModeCapture, rootArgs.kubeconfig, rootArgs.kubecontext, "version", "--output", "json")
 	if err != nil {
 		t.Fatalf("Error running utils.ExecKubectlCommand: %v", err.Error())
 	}
--- a/cmd/flux/completion.go
+++ b/cmd/flux/completion.go
@@ -25,7 +25,10 @@ import (
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/discovery"
+	memory "k8s.io/client-go/discovery/cached"
 	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/restmapper"
 )

 var completionCmd = &cobra.Command{
@@ -39,7 +42,7 @@ func init() {
 }

 func contextsCompletionFunc(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-	rawConfig, err := kubeconfigArgs.ToRawKubeConfigLoader().RawConfig()
+	rawConfig, err := utils.ClientConfig(rootArgs.kubeconfig, rootArgs.kubecontext).RawConfig()
 	if err != nil {
 		return completionError(err)
 	}
@@ -60,15 +63,16 @@ func resourceNamesCompletionFunc(gvk schema.GroupVersionKind) func(cmd *cobra.Co
 		ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 		defer cancel()

-		cfg, err := utils.KubeConfig(kubeconfigArgs)
+		cfg, err := utils.KubeConfig(rootArgs.kubeconfig, rootArgs.kubecontext)
 		if err != nil {
 			return completionError(err)
 		}

-		mapper, err := kubeconfigArgs.ToRESTMapper()
+		dc, err := discovery.NewDiscoveryClientForConfig(cfg)
 		if err != nil {
 			return completionError(err)
 		}
+		mapper := restmapper.NewDeferredDiscoveryRESTMapper(memory.NewMemCacheClient(dc))

 		mapping, err := mapper.RESTMapping(gvk.GroupKind(), gvk.Version)
 		if err != nil {
@@ -82,7 +86,7 @@ func resourceNamesCompletionFunc(gvk schema.GroupVersionKind) func(cmd *cobra.Co

 		var dr dynamic.ResourceInterface
 		if mapping.Scope.Name() == meta.RESTScopeNameNamespace {
-			dr = client.Resource(mapping.Resource).Namespace(*kubeconfigArgs.Namespace)
+			dr = client.Resource(mapping.Resource).Namespace(rootArgs.namespace)
 		} else {
 			dr = client.Resource(mapping.Resource)
 		}
--- a/cmd/flux/create.go
+++ b/cmd/flux/create.go
@@ -104,7 +104,7 @@ func (names apiType) upsertAndWait(object upsertWaitable, mutate func() error) e
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs) // NB globals
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext) // NB globals
 	if err != nil {
 		return err
 	}
--- a/cmd/flux/create_alert.go
+++ b/cmd/flux/create_alert.go
@@ -102,7 +102,7 @@ func createAlertCmdRun(cmd *cobra.Command, args []string) error {
 	alert := notificationv1.Alert{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    sourceLabels,
 		},
 		Spec: notificationv1.AlertSpec{
@@ -122,7 +122,7 @@ func createAlertCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
--- a/cmd/flux/create_alertprovider.go
+++ b/cmd/flux/create_alertprovider.go
@@ -94,7 +94,7 @@ func createAlertProviderCmdRun(cmd *cobra.Command, args []string) error {
 	provider := notificationv1.Provider{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    sourceLabels,
 		},
 		Spec: notificationv1.ProviderSpec{
@@ -118,7 +118,7 @@ func createAlertProviderCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
--- a/cmd/flux/create_helmrelease.go
+++ b/cmd/flux/create_helmrelease.go
@@ -160,7 +160,7 @@ func createHelmReleaseCmdRun(cmd *cobra.Command, args []string) error {
 	helmRelease := helmv2.HelmRelease{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    sourceLabels,
 		},
 		Spec: helmv2.HelmReleaseSpec{
@@ -250,7 +250,7 @@ func createHelmReleaseCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
--- a/cmd/flux/create_image_policy.go
+++ b/cmd/flux/create_image_policy.go
@@ -101,7 +101,7 @@ func createImagePolicyRun(cmd *cobra.Command, args []string) error {
 	var policy = imagev1.ImagePolicy{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      objectName,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    labels,
 		},
 		Spec: imagev1.ImagePolicySpec{
--- a/cmd/flux/create_image_repository.go
+++ b/cmd/flux/create_image_repository.go
@@ -104,7 +104,7 @@ func createImageRepositoryRun(cmd *cobra.Command, args []string) error {
 	var repo = imagev1.ImageRepository{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      objectName,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    labels,
 		},
 		Spec: imagev1.ImageRepositorySpec{
--- a/cmd/flux/create_image_update.go
+++ b/cmd/flux/create_image_update.go
@@ -108,11 +108,11 @@ func createImageUpdateRun(cmd *cobra.Command, args []string) error {
 	var update = autov1.ImageUpdateAutomation{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      objectName,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    labels,
 		},
 		Spec: autov1.ImageUpdateAutomationSpec{
-			SourceRef: autov1.CrossNamespaceSourceReference{
+			SourceRef: autov1.SourceReference{
 				Kind: sourcev1.GitRepositoryKind,
 				Name: imageUpdateArgs.gitRepoRef,
 			},
--- a/cmd/flux/create_kustomization.go
+++ b/cmd/flux/create_kustomization.go
@@ -143,7 +143,7 @@ func createKsCmdRun(cmd *cobra.Command, args []string) error {
 	kustomization := kustomizev1.Kustomization{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    kslabels,
 		},
 		Spec: kustomizev1.KustomizationSpec{
@@ -232,7 +232,7 @@ func createKsCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
--- a/cmd/flux/create_receiver.go
+++ b/cmd/flux/create_receiver.go
@@ -109,7 +109,7 @@ func createReceiverCmdRun(cmd *cobra.Command, args []string) error {
 	receiver := notificationv1.Receiver{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    sourceLabels,
 		},
 		Spec: notificationv1.ReceiverSpec{
@@ -130,7 +130,7 @@ func createReceiverCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
--- a/cmd/flux/create_secret_git.go
+++ b/cmd/flux/create_secret_git.go
@@ -105,7 +105,7 @@ func init() {

 func NewSecretGitFlags() secretGitFlags {
 	return secretGitFlags{
-		keyAlgorithm: flags.PublicKeyAlgorithm(sourcesecret.ECDSAPrivateKeyAlgorithm),
+		keyAlgorithm: flags.PublicKeyAlgorithm(sourcesecret.RSAPrivateKeyAlgorithm),
 		rsaBits:      2048,
 		ecdsaCurve:   flags.ECDSACurve{Curve: elliptic.P384()},
 	}
@@ -132,7 +132,7 @@ func createSecretGitCmdRun(cmd *cobra.Command, args []string) error {

 	opts := sourcesecret.Options{
 		Name:         name,
-		Namespace:    *kubeconfigArgs.Namespace,
+		Namespace:    rootArgs.namespace,
 		Labels:       labels,
 		ManifestFile: sourcesecret.MakeDefaultOptions().ManifestFile,
 	}
@@ -176,14 +176,14 @@ func createSecretGitCmdRun(cmd *cobra.Command, args []string) error {

 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
 	if err := upsertSecret(ctx, kubeClient, s); err != nil {
 		return err
 	}
-	logger.Actionf("git secret '%s' created in '%s' namespace", name, *kubeconfigArgs.Namespace)
+	logger.Actionf("git secret '%s' created in '%s' namespace", name, rootArgs.namespace)

 	return nil
 }
--- a/cmd/flux/create_secret_git_test.go
+++ b/cmd/flux/create_secret_git_test.go
@@ -22,12 +22,12 @@ func TestCreateGitSecret(t *testing.T) {
 		},
 		{
 			name:   "ssh key",
-			args:   "create secret git podinfo-auth --url=ssh://git@github.com/stefanprodan/podinfo --private-key-file=./testdata/create_secret/git/ecdsa.private --namespace=my-namespace --export",
+			args:   "create secret git podinfo-auth --url=ssh://git@github.com/stefanprodan/podinfo --private-key-file=./testdata/create_secret/git/rsa.private --namespace=my-namespace --export",
 			assert: assertGoldenFile("testdata/create_secret/git/git-ssh-secret.yaml"),
 		},
 		{
 			name:   "ssh key with password",
-			args:   "create secret git podinfo-auth --url=ssh://git@github.com/stefanprodan/podinfo --private-key-file=./testdata/create_secret/git/ecdsa-password.private --password=password --namespace=my-namespace --export",
+			args:   "create secret git podinfo-auth --url=ssh://git@github.com/stefanprodan/podinfo --private-key-file=./testdata/create_secret/git/rsa-password.private --password=password --namespace=my-namespace --export",
 			assert: assertGoldenFile("testdata/create_secret/git/git-ssh-secret-password.yaml"),
 		},
 	}
--- a/cmd/flux/create_secret_helm.go
+++ b/cmd/flux/create_secret_helm.go
@@ -80,7 +80,7 @@ func createSecretHelmCmdRun(cmd *cobra.Command, args []string) error {

 	opts := sourcesecret.Options{
 		Name:         name,
-		Namespace:    *kubeconfigArgs.Namespace,
+		Namespace:    rootArgs.namespace,
 		Labels:       labels,
 		Username:     secretHelmArgs.username,
 		Password:     secretHelmArgs.password,
@@ -100,7 +100,7 @@ func createSecretHelmCmdRun(cmd *cobra.Command, args []string) error {

 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
@@ -112,6 +112,6 @@ func createSecretHelmCmdRun(cmd *cobra.Command, args []string) error {
 		return err
 	}

-	logger.Actionf("helm secret '%s' created in '%s' namespace", name, *kubeconfigArgs.Namespace)
+	logger.Actionf("helm secret '%s' created in '%s' namespace", name, rootArgs.namespace)
 	return nil
 }
--- a/cmd/flux/create_secret_tls.go
+++ b/cmd/flux/create_secret_tls.go
@@ -79,7 +79,7 @@ func createSecretTLSCmdRun(cmd *cobra.Command, args []string) error {

 	opts := sourcesecret.Options{
 		Name:         name,
-		Namespace:    *kubeconfigArgs.Namespace,
+		Namespace:    rootArgs.namespace,
 		Labels:       labels,
 		CAFilePath:   secretTLSArgs.caFile,
 		CertFilePath: secretTLSArgs.certFile,
@@ -97,7 +97,7 @@ func createSecretTLSCmdRun(cmd *cobra.Command, args []string) error {

 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
@@ -109,6 +109,6 @@ func createSecretTLSCmdRun(cmd *cobra.Command, args []string) error {
 		return err
 	}

-	logger.Actionf("tls secret '%s' created in '%s' namespace", name, *kubeconfigArgs.Namespace)
+	logger.Actionf("tls secret '%s' created in '%s' namespace", name, rootArgs.namespace)
 	return nil
 }
--- a/cmd/flux/create_source_bucket.go
+++ b/cmd/flux/create_source_bucket.go
@@ -120,7 +120,7 @@ func createSourceBucketCmdRun(cmd *cobra.Command, args []string) error {
 	bucket := &sourcev1.Bucket{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    sourceLabels,
 		},
 		Spec: sourcev1.BucketSpec{
@@ -152,7 +152,7 @@ func createSourceBucketCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
@@ -165,7 +165,7 @@ func createSourceBucketCmdRun(cmd *cobra.Command, args []string) error {
 		secret := corev1.Secret{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      secretName,
-				Namespace: *kubeconfigArgs.Namespace,
+				Namespace: rootArgs.namespace,
 				Labels:    sourceLabels,
 			},
 			StringData: map[string]string{},
--- a/cmd/flux/create_source_git.go
+++ b/cmd/flux/create_source_git.go
@@ -143,7 +143,7 @@ func init() {

 func newSourceGitFlags() sourceGitFlags {
 	return sourceGitFlags{
-		keyAlgorithm:  flags.PublicKeyAlgorithm(sourcesecret.ECDSAPrivateKeyAlgorithm),
+		keyAlgorithm:  flags.PublicKeyAlgorithm(sourcesecret.RSAPrivateKeyAlgorithm),
 		keyRSABits:    2048,
 		keyECDSACurve: flags.ECDSACurve{Curve: elliptic.P384()},
 	}
@@ -193,7 +193,7 @@ func createSourceGitCmdRun(cmd *cobra.Command, args []string) error {
 	gitRepository := sourcev1.GitRepository{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    sourceLabels,
 		},
 		Spec: sourcev1.GitRepositorySpec{
@@ -235,7 +235,7 @@ func createSourceGitCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
@@ -244,7 +244,7 @@ func createSourceGitCmdRun(cmd *cobra.Command, args []string) error {
 	if sourceGitArgs.secretRef == "" {
 		secretOpts := sourcesecret.Options{
 			Name:         name,
-			Namespace:    *kubeconfigArgs.Namespace,
+			Namespace:    rootArgs.namespace,
 			ManifestFile: sourcesecret.MakeDefaultOptions().ManifestFile,
 		}
 		switch u.Scheme {
--- a/cmd/flux/create_source_git_test.go
+++ b/cmd/flux/create_source_git_test.go
@@ -1,4 +1,3 @@
-//go:build unit
 // +build unit

 /*
--- a/cmd/flux/create_source_helm.go
+++ b/cmd/flux/create_source_helm.go
@@ -118,7 +118,7 @@ func createSourceHelmCmdRun(cmd *cobra.Command, args []string) error {
 	helmRepository := &sourcev1.HelmRepository{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    sourceLabels,
 		},
 		Spec: sourcev1.HelmRepositorySpec{
@@ -147,7 +147,7 @@ func createSourceHelmCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
@@ -157,7 +157,7 @@ func createSourceHelmCmdRun(cmd *cobra.Command, args []string) error {
 		secretName := fmt.Sprintf("helm-%s", name)
 		secretOpts := sourcesecret.Options{
 			Name:         secretName,
-			Namespace:    *kubeconfigArgs.Namespace,
+			Namespace:    rootArgs.namespace,
 			Username:     sourceHelmArgs.username,
 			Password:     sourceHelmArgs.password,
 			CertFilePath: sourceHelmArgs.certFile,
--- a/cmd/flux/create_tenant.go
+++ b/cmd/flux/create_tenant.go
@@ -159,7 +159,7 @@ func createTenantCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
--- a/cmd/flux/delete.go
+++ b/cmd/flux/delete.go
@@ -60,13 +60,13 @@ func (del deleteCommand) run(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}

 	namespacedName := types.NamespacedName{
-		Namespace: *kubeconfigArgs.Namespace,
+		Namespace: rootArgs.namespace,
 		Name:      name,
 	}

@@ -85,7 +85,7 @@ func (del deleteCommand) run(cmd *cobra.Command, args []string) error {
 		}
 	}

-	logger.Actionf("deleting %s %s in %s namespace", del.humanKind, name, *kubeconfigArgs.Namespace)
+	logger.Actionf("deleting %s %s in %s namespace", del.humanKind, name, rootArgs.namespace)
 	err = kubeClient.Delete(ctx, del.object.asClientObject())
 	if err != nil {
 		return err
--- a/cmd/flux/diff.go
+++ b/cmd/flux/diff.go
@@ -1,31 +0,0 @@
-/*
-Copyright 2021 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"github.com/spf13/cobra"
-)
-
-var diffCmd = &cobra.Command{
-	Use:   "diff",
-	Short: "Diff a flux resource",
-	Long:  "The diff command is used to do a server-side dry-run on flux resources, then prints the diff.",
-}
-
-func init() {
-	rootCmd.AddCommand(diffCmd)
-}
--- a/cmd/flux/diff_kustomization.go
+++ b/cmd/flux/diff_kustomization.go
@@ -1,104 +0,0 @@
-/*
-Copyright 2021 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"fmt"
-	"os"
-	"os/signal"
-
-	"github.com/spf13/cobra"
-
-	"github.com/fluxcd/flux2/internal/build"
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
-)
-
-var diffKsCmd = &cobra.Command{
-	Use:     "kustomization",
-	Aliases: []string{"ks"},
-	Short:   "Diff Kustomization",
-	Long: `The diff command does a build, then it performs a server-side dry-run and prints the diff.
-Exit status: 0 No differences were found. 1 Differences were found. >1 diff failed with an error.`,
-	Example: `# Preview local changes as they were applied on the cluster
-flux diff kustomization my-app --path ./path/to/local/manifests`,
-	ValidArgsFunction: resourceNamesCompletionFunc(kustomizev1.GroupVersion.WithKind(kustomizev1.KustomizationKind)),
-	RunE:              diffKsCmdRun,
-}
-
-type diffKsFlags struct {
-	path string
-}
-
-var diffKsArgs diffKsFlags
-
-func init() {
-	diffKsCmd.Flags().StringVar(&diffKsArgs.path, "path", "", "Path to a local directory that matches the specified Kustomization.spec.path.)")
-	diffCmd.AddCommand(diffKsCmd)
-}
-
-func diffKsCmdRun(cmd *cobra.Command, args []string) error {
-	if len(args) < 1 {
-		return fmt.Errorf("%s name is required", kustomizationType.humanKind)
-	}
-	name := args[0]
-
-	if diffKsArgs.path == "" {
-		return &RequestError{StatusCode: 2, Err: fmt.Errorf("invalid resource path %q", diffKsArgs.path)}
-	}
-
-	if fs, err := os.Stat(diffKsArgs.path); err != nil || !fs.IsDir() {
-		return &RequestError{StatusCode: 2, Err: fmt.Errorf("invalid resource path %q", diffKsArgs.path)}
-	}
-
-	builder, err := build.NewBuilder(kubeconfigArgs, name, diffKsArgs.path, build.WithTimeout(rootArgs.timeout))
-	if err != nil {
-		return &RequestError{StatusCode: 2, Err: err}
-	}
-
-	// create a signal channel
-	sigc := make(chan os.Signal, 1)
-	signal.Notify(sigc, os.Interrupt)
-
-	errChan := make(chan error)
-	go func() {
-		output, hasChanged, err := builder.Diff()
-		if err != nil {
-			errChan <- &RequestError{StatusCode: 2, Err: err}
-		}
-
-		cmd.Print(output)
-
-		if hasChanged {
-			errChan <- &RequestError{StatusCode: 1, Err: fmt.Errorf("identified at least one change, exiting with non-zero exit code")}
-		} else {
-			errChan <- nil
-		}
-	}()
-
-	select {
-	case <-sigc:
-		fmt.Println("Build cancelled... exiting.")
-		return builder.Cancel()
-	case err := <-errChan:
-		if err != nil {
-			return err
-		}
-	}
-
-	return nil
-
-}
--- a/cmd/flux/diff_kustomization_test.go
+++ b/cmd/flux/diff_kustomization_test.go
@@ -1,141 +0,0 @@
-//go:build unit
-// +build unit
-
-/*
-Copyright 2021 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"context"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/fluxcd/flux2/internal/build"
-	"github.com/fluxcd/pkg/ssa"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-)
-
-func TestDiffKustomization(t *testing.T) {
-	tests := []struct {
-		name       string
-		args       string
-		objectFile string
-		assert     assertFunc
-	}{
-		{
-			name:       "no args",
-			args:       "diff kustomization podinfo",
-			objectFile: "",
-			assert:     assertError("invalid resource path \"\""),
-		},
-		{
-			name:       "diff nothing deployed",
-			args:       "diff kustomization podinfo --path ./testdata/build-kustomization/podinfo",
-			objectFile: "",
-			assert:     assertGoldenFile("./testdata/diff-kustomization/nothing-is-deployed.golden"),
-		},
-		{
-			name:       "diff with a deployment object",
-			args:       "diff kustomization podinfo --path ./testdata/build-kustomization/podinfo",
-			objectFile: "./testdata/diff-kustomization/deployment.yaml",
-			assert:     assertGoldenFile("./testdata/diff-kustomization/diff-with-deployment.golden"),
-		},
-		{
-			name:       "diff with a drifted service object",
-			args:       "diff kustomization podinfo --path ./testdata/build-kustomization/podinfo",
-			objectFile: "./testdata/diff-kustomization/service.yaml",
-			assert:     assertGoldenFile("./testdata/diff-kustomization/diff-with-drifted-service.golden"),
-		},
-		{
-			name:       "diff with a drifted secret object",
-			args:       "diff kustomization podinfo --path ./testdata/build-kustomization/podinfo",
-			objectFile: "./testdata/diff-kustomization/secret.yaml",
-			assert:     assertGoldenFile("./testdata/diff-kustomization/diff-with-drifted-secret.golden"),
-		},
-		{
-			name:       "diff with a drifted key in sops secret object",
-			args:       "diff kustomization podinfo --path ./testdata/build-kustomization/podinfo",
-			objectFile: "./testdata/diff-kustomization/key-sops-secret.yaml",
-			assert:     assertGoldenFile("./testdata/diff-kustomization/diff-with-drifted-key-sops-secret.golden"),
-		},
-		{
-			name:       "diff with a drifted value in sops secret object",
-			args:       "diff kustomization podinfo --path ./testdata/build-kustomization/podinfo",
-			objectFile: "./testdata/diff-kustomization/value-sops-secret.yaml",
-			assert:     assertGoldenFile("./testdata/diff-kustomization/diff-with-drifted-value-sops-secret.golden"),
-		},
-		{
-			name:       "diff with a sops dockerconfigjson secret object",
-			args:       "diff kustomization podinfo --path ./testdata/build-kustomization/podinfo",
-			objectFile: "./testdata/diff-kustomization/dockerconfigjson-sops-secret.yaml",
-			assert:     assertGoldenFile("./testdata/diff-kustomization/diff-with-dockerconfigjson-sops-secret.golden"),
-		},
-		{
-			name:       "diff with a sops stringdata secret object",
-			args:       "diff kustomization podinfo --path ./testdata/build-kustomization/podinfo",
-			objectFile: "./testdata/diff-kustomization/stringdata-sops-secret.yaml",
-			assert:     assertGoldenFile("./testdata/diff-kustomization/diff-with-stringdata-sops-secret.golden"),
-		},
-	}
-
-	tmpl := map[string]string{
-		"fluxns": allocateNamespace("flux-system"),
-	}
-
-	b, _ := build.NewBuilder(kubeconfigArgs, "podinfo", "")
-
-	resourceManager, err := b.Manager()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	setup(t, tmpl)
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if tt.objectFile != "" {
-				resourceManager.ApplyAll(context.Background(), createObjectFromFile(tt.objectFile, tmpl, t), ssa.DefaultApplyOptions())
-			}
-			cmd := cmdTestCase{
-				args:   tt.args + " -n " + tmpl["fluxns"],
-				assert: tt.assert,
-			}
-			cmd.runTestCmd(t)
-			if tt.objectFile != "" {
-				testEnv.DeleteObjectFile(tt.objectFile, tmpl, t)
-			}
-		})
-	}
-}
-
-func createObjectFromFile(objectFile string, templateValues map[string]string, t *testing.T) []*unstructured.Unstructured {
-	buf, err := os.ReadFile(objectFile)
-	if err != nil {
-		t.Fatalf("Error reading file '%s': %v", objectFile, err)
-	}
-	content, err := executeTemplate(string(buf), templateValues)
-	if err != nil {
-		t.Fatalf("Error evaluating template file '%s': '%v'", objectFile, err)
-	}
-	clientObjects, err := readYamlObjects(strings.NewReader(content))
-	if err != nil {
-		t.Fatalf("Error decoding yaml file '%s': %v", objectFile, err)
-	}
-
-	return clientObjects
-}
--- a/cmd/flux/export.go
+++ b/cmd/flux/export.go
@@ -20,7 +20,6 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-
 	"github.com/spf13/cobra"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -74,19 +73,19 @@ func (export exportCommand) run(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}

 	if exportArgs.all {
-		err = kubeClient.List(ctx, export.list.asClientList(), client.InNamespace(*kubeconfigArgs.Namespace))
+		err = kubeClient.List(ctx, export.list.asClientList(), client.InNamespace(rootArgs.namespace))
 		if err != nil {
 			return err
 		}

 		if export.list.len() == 0 {
-			return fmt.Errorf("no objects found in %s namespace", *kubeconfigArgs.Namespace)
+			return fmt.Errorf("no objects found in %s namespace", rootArgs.namespace)
 		}

 		for i := 0; i < export.list.len(); i++ {
@@ -97,7 +96,7 @@ func (export exportCommand) run(cmd *cobra.Command, args []string) error {
 	} else {
 		name := args[0]
 		namespacedName := types.NamespacedName{
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Name:      name,
 		}
 		err = kubeClient.Get(ctx, namespacedName, export.object.asClientObject())
--- a/cmd/flux/export_secret.go
+++ b/cmd/flux/export_secret.go
@@ -19,7 +19,6 @@ package main
 import (
 	"context"
 	"fmt"
-
 	"github.com/spf13/cobra"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -59,19 +58,19 @@ func (export exportWithSecretCommand) run(cmd *cobra.Command, args []string) err
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}

 	if exportArgs.all {
-		err = kubeClient.List(ctx, export.list.asClientList(), client.InNamespace(*kubeconfigArgs.Namespace))
+		err = kubeClient.List(ctx, export.list.asClientList(), client.InNamespace(rootArgs.namespace))
 		if err != nil {
 			return err
 		}

 		if export.list.len() == 0 {
-			return fmt.Errorf("no objects found in %s namespace", *kubeconfigArgs.Namespace)
+			return fmt.Errorf("no objects found in %s namespace", rootArgs.namespace)
 		}

 		for i := 0; i < export.list.len(); i++ {
@@ -89,7 +88,7 @@ func (export exportWithSecretCommand) run(cmd *cobra.Command, args []string) err
 	} else {
 		name := args[0]
 		namespacedName := types.NamespacedName{
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Name:      name,
 		}
 		err = kubeClient.Get(ctx, namespacedName, export.object.asClientObject())
--- a/cmd/flux/export_test.go
+++ b/cmd/flux/export_test.go
@@ -1,4 +1,3 @@
-//go:build unit
 // +build unit

 package main
--- a/cmd/flux/get.go
+++ b/cmd/flux/get.go
@@ -135,14 +135,14 @@ func (get getCommand) run(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}

 	var listOpts []client.ListOption
 	if !getArgs.allNamespaces {
-		listOpts = append(listOpts, client.InNamespace(*kubeconfigArgs.Namespace))
+		listOpts = append(listOpts, client.InNamespace(rootArgs.namespace))
 	}

 	if len(args) > 0 {
@@ -162,7 +162,7 @@ func (get getCommand) run(cmd *cobra.Command, args []string) error {

 	if get.list.len() == 0 {
 		if !getAll {
-			logger.Failuref("no %s objects found in %s namespace", get.kind, *kubeconfigArgs.Namespace)
+			logger.Failuref("no %s objects found in %s namespace", get.kind, rootArgs.namespace)
 		}
 		return nil
 	}
--- a/cmd/flux/get_image.go
+++ b/cmd/flux/get_image.go
@@ -25,6 +25,9 @@ var getImageCmd = &cobra.Command{
 	Aliases: []string{"image"},
 	Short:   "Get image automation object status",
 	Long:    "The get image sub-commands print the status of image automation objects.",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return validateWatchOption(cmd, "images")
+	},
 }

 func init() {
--- a/cmd/flux/get_kustomization.go
+++ b/cmd/flux/get_kustomization.go
@@ -18,12 +18,10 @@ package main

 import (
 	"fmt"
-	"regexp"
 	"strconv"
 	"strings"

 	"github.com/spf13/cobra"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"

 	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
@@ -80,10 +78,6 @@ func (a kustomizationListAdapter) summariseItem(i int, includeNamespace bool, in
 	item := a.Items[i]
 	revision := item.Status.LastAppliedRevision
 	status, msg := statusAndMessage(item.Status.Conditions)
-	if status == string(metav1.ConditionTrue) {
-		revision = shortenCommitSha(revision)
-		msg = shortenCommitSha(msg)
-	}
 	return append(nameColumns(&item, includeNamespace, includeKind),
 		status, msg, revision, strings.Title(strconv.FormatBool(item.Spec.Suspend)))
 }
@@ -100,13 +94,3 @@ func (a kustomizationListAdapter) statusSelectorMatches(i int, conditionType, co
 	item := a.Items[i]
 	return statusMatches(conditionType, conditionStatus, item.Status.Conditions)
 }
-
-func shortenCommitSha(msg string) string {
-	r := regexp.MustCompile("/([a-f0-9]{40})$")
-	sha := r.FindString(msg)
-	if sha != "" {
-		msg = strings.Replace(msg, sha, string([]rune(sha)[:8]), -1)
-	}
-
-	return msg
-}
--- a/cmd/flux/get_source.go
+++ b/cmd/flux/get_source.go
@@ -25,6 +25,10 @@ var getSourceCmd = &cobra.Command{
 	Aliases: []string{"source"},
 	Short:   "Get source statuses",
 	Long:    "The get source sub-commands print the statuses of the sources.",
+	RunE: func(cmd *cobra.Command, args []string) error {
+
+		return validateWatchOption(cmd, "sources")
+	},
 }

 func init() {
--- a/cmd/flux/get_source_git.go
+++ b/cmd/flux/get_source_git.go
@@ -22,7 +22,6 @@ import (
 	"strings"

 	"github.com/spf13/cobra"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"

 	sourcev1 "github.com/fluxcd/source-controller/api/v1beta1"
@@ -81,10 +80,6 @@ func (a *gitRepositoryListAdapter) summariseItem(i int, includeNamespace bool, i
 		revision = item.GetArtifact().Revision
 	}
 	status, msg := statusAndMessage(item.Status.Conditions)
-	if status == string(metav1.ConditionTrue) {
-		revision = shortenCommitSha(revision)
-		msg = shortenCommitSha(msg)
-	}
 	return append(nameColumns(&item, includeNamespace, includeKind),
 		status, msg, revision, strings.Title(strconv.FormatBool(item.Spec.Suspend)))
 }
--- a/cmd/flux/helmrelease_test.go
+++ b/cmd/flux/helmrelease_test.go
@@ -1,4 +1,3 @@
-//go:build e2e
 // +build e2e

 /*
--- a/cmd/flux/image_test.go
+++ b/cmd/flux/image_test.go
@@ -1,4 +1,3 @@
-//go:build e2e
 // +build e2e

 package main
--- a/cmd/flux/install.go
+++ b/cmd/flux/install.go
@@ -21,6 +21,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 	"time"

 	"github.com/spf13/cobra"
@@ -131,7 +132,7 @@ func installCmdRun(cmd *cobra.Command, args []string) error {
 		logger.Generatef("generating manifests")
 	}

-	tmpDir, err := os.MkdirTemp("", *kubeconfigArgs.Namespace)
+	tmpDir, err := os.MkdirTemp("", rootArgs.namespace)
 	if err != nil {
 		return err
 	}
@@ -148,7 +149,7 @@ func installCmdRun(cmd *cobra.Command, args []string) error {
 	opts := install.Options{
 		BaseURL:                installArgs.manifestsPath,
 		Version:                installArgs.version,
-		Namespace:              *kubeconfigArgs.Namespace,
+		Namespace:              rootArgs.namespace,
 		Components:             components,
 		Registry:               installArgs.registry,
 		ImagePullSecret:        installArgs.imagePullSecret,
@@ -156,7 +157,7 @@ func installCmdRun(cmd *cobra.Command, args []string) error {
 		NetworkPolicy:          installArgs.networkPolicy,
 		LogLevel:               installArgs.logLevel.String(),
 		NotificationController: rootArgs.defaults.NotificationController,
-		ManifestFile:           fmt.Sprintf("%s.yaml", *kubeconfigArgs.Namespace),
+		ManifestFile:           fmt.Sprintf("%s.yaml", rootArgs.namespace),
 		Timeout:                rootArgs.timeout,
 		ClusterDomain:          installArgs.clusterDomain,
 		TolerationKeys:         installArgs.tolerationKeys,
@@ -176,28 +177,32 @@ func installCmdRun(cmd *cobra.Command, args []string) error {
 	}

 	if installArgs.export {
+		fmt.Println("---")
+		fmt.Println("# Flux version:", installArgs.version)
+		fmt.Println("# Components:", strings.Join(components, ","))
 		fmt.Print(manifest.Content)
+		fmt.Println("---")
 		return nil
 	} else if rootArgs.verbose {
 		fmt.Print(manifest.Content)
 	}

 	logger.Successf("manifests build completed")
-	logger.Actionf("installing components in %s namespace", *kubeconfigArgs.Namespace)
+	logger.Actionf("installing components in %s namespace", rootArgs.namespace)

 	if installArgs.dryRun {
 		logger.Successf("install dry-run finished")
 		return nil
 	}

-	applyOutput, err := utils.Apply(ctx, kubeconfigArgs, filepath.Join(tmpDir, manifest.Path))
+	applyOutput, err := utils.Apply(ctx, rootArgs.kubeconfig, rootArgs.kubecontext, filepath.Join(tmpDir, manifest.Path))
 	if err != nil {
 		return fmt.Errorf("install failed: %w", err)
 	}

 	fmt.Fprintln(os.Stderr, applyOutput)

-	kubeConfig, err := utils.KubeConfig(kubeconfigArgs)
+	kubeConfig, err := utils.KubeConfig(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return fmt.Errorf("install failed: %w", err)
 	}
--- a/cmd/flux/kustomization_test.go
+++ b/cmd/flux/kustomization_test.go
@@ -1,4 +1,3 @@
-//go:build e2e
 // +build e2e

 /*
--- a/cmd/flux/logs.go
+++ b/cmd/flux/logs.go
@@ -99,7 +99,7 @@ func logsCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	cfg, err := utils.KubeConfig(kubeconfigArgs)
+	cfg, err := utils.KubeConfig(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
@@ -278,7 +278,7 @@ func filterPrintLog(t *template.Template, l *ControllerLogEntry) {
 	if logsArgs.logLevel != "" && logsArgs.logLevel != l.Level ||
 		logsArgs.kind != "" && strings.ToLower(logsArgs.kind) != strings.ToLower(l.Kind) ||
 		logsArgs.name != "" && strings.ToLower(logsArgs.name) != strings.ToLower(l.Name) ||
-		!logsArgs.allNamespaces && strings.ToLower(*kubeconfigArgs.Namespace) != strings.ToLower(l.Namespace) {
+		!logsArgs.allNamespaces && strings.ToLower(rootArgs.namespace) != strings.ToLower(l.Namespace) {
 		return
 	}

--- a/cmd/flux/logs_test.go
+++ b/cmd/flux/logs_test.go
@@ -1,4 +1,3 @@
-//go:build unit
 // +build unit

 /*
--- a/cmd/flux/main.go
+++ b/cmd/flux/main.go
@@ -21,13 +21,12 @@ import (
 	"fmt"
 	"log"
 	"os"
-	"strings"
+	"path/filepath"
 	"time"

 	"github.com/spf13/cobra"
 	"golang.org/x/term"
 	corev1 "k8s.io/api/core/v1"
-	"k8s.io/cli-runtime/pkg/genericclioptions"
 	_ "k8s.io/client-go/plugin/pkg/client/auth"

 	"github.com/fluxcd/flux2/pkg/manifestgen/install"
@@ -99,43 +98,29 @@ Command line utility for assembling Kubernetes CD pipelines the GitOps way.`,
 var logger = stderrLogger{stderr: os.Stderr}

 type rootFlags struct {
+	kubeconfig   string
+	kubecontext  string
+	namespace    string
 	timeout      time.Duration
 	verbose      bool
 	pollInterval time.Duration
 	defaults     install.Options
 }

-// RequestError is a custom error type that wraps an error returned by the flux api.
-type RequestError struct {
-	StatusCode int
-	Err        error
-}
-
-func (r *RequestError) Error() string {
-	return r.Err.Error()
-}
-
 var rootArgs = NewRootFlags()
-var kubeconfigArgs = genericclioptions.NewConfigFlags(false)

 func init() {
+	rootCmd.PersistentFlags().StringVarP(&rootArgs.namespace, "namespace", "n", rootArgs.defaults.Namespace,
+		"the namespace scope for this operation, can be set with FLUX_SYSTEM_NAMESPACE env var")
+	rootCmd.RegisterFlagCompletionFunc("namespace", resourceNamesCompletionFunc(corev1.SchemeGroupVersion.WithKind("Namespace")))
+
 	rootCmd.PersistentFlags().DurationVar(&rootArgs.timeout, "timeout", 5*time.Minute, "timeout for this operation")
 	rootCmd.PersistentFlags().BoolVar(&rootArgs.verbose, "verbose", false, "print generated objects")
+	rootCmd.PersistentFlags().StringVarP(&rootArgs.kubeconfig, "kubeconfig", "", "",
+		"absolute path to the kubeconfig file")

-	configureDefaultNamespace()
-	kubeconfigArgs.APIServer = nil // prevent AddFlags from configuring --server flag
-	kubeconfigArgs.Timeout = nil   // prevent AddFlags from configuring --request-timeout flag, we have --timeout instead
-	kubeconfigArgs.AddFlags(rootCmd.PersistentFlags())
-
-	// Since some subcommands use the `-s` flag as a short version for `--silent`, we manually configure the server flag
-	// without the `-s` short version. While we're no longer on par with kubectl's flags, we maintain backwards compatibility
-	// on the CLI interface.
-	apiServer := ""
-	kubeconfigArgs.APIServer = &apiServer
-	rootCmd.PersistentFlags().StringVar(kubeconfigArgs.APIServer, "server", *kubeconfigArgs.APIServer, "The address and port of the Kubernetes API server")
-
+	rootCmd.PersistentFlags().StringVarP(&rootArgs.kubecontext, "context", "", "", "kubernetes context to use")
 	rootCmd.RegisterFlagCompletionFunc("context", contextsCompletionFunc)
-	rootCmd.RegisterFlagCompletionFunc("namespace", resourceNamesCompletionFunc(corev1.SchemeGroupVersion.WithKind("Namespace")))

 	rootCmd.DisableAutoGenTag = true
 	rootCmd.SetOut(os.Stdout)
@@ -152,28 +137,30 @@ func NewRootFlags() rootFlags {

 func main() {
 	log.SetFlags(0)
+	configureKubeconfig()
+	configureDefaultNamespace()
 	if err := rootCmd.Execute(); err != nil {
-
-		if err, ok := err.(*RequestError); ok {
-			if err.StatusCode == 1 {
-				logger.Warningf("%v", err)
-			} else {
-				logger.Failuref("%v", err)
-			}
-
-			os.Exit(err.StatusCode)
-		}
-
 		logger.Failuref("%v", err)
 		os.Exit(1)
 	}
 }

+func configureKubeconfig() {
+	switch {
+	case len(rootArgs.kubeconfig) > 0:
+	case len(os.Getenv("KUBECONFIG")) > 0:
+		rootArgs.kubeconfig = os.Getenv("KUBECONFIG")
+	default:
+		if home := homeDir(); len(home) > 0 {
+			rootArgs.kubeconfig = filepath.Join(home, ".kube", "config")
+		}
+	}
+}
+
 func configureDefaultNamespace() {
-	*kubeconfigArgs.Namespace = rootArgs.defaults.Namespace
 	fromEnv := os.Getenv("FLUX_SYSTEM_NAMESPACE")
-	if fromEnv != "" {
-		kubeconfigArgs.Namespace = &fromEnv
+	if fromEnv != "" && rootArgs.namespace == rootArgs.defaults.Namespace {
+		rootArgs.namespace = fromEnv
 	}
 }

@@ -184,9 +171,6 @@ func homeDir() string {
 	return os.Getenv("USERPROFILE") // windows
 }

-// readPasswordFromStdin reads a password from stdin and returns the input
-// with trailing newline and/or carriage return removed. It also makes sure that terminal
-// echoing is turned off if stdin is a terminal.
 func readPasswordFromStdin(prompt string) (string, error) {
 	var out string
 	var err error
@@ -203,5 +187,5 @@ func readPasswordFromStdin(prompt string) (string, error) {
 		return "", fmt.Errorf("could not read from stdin: %w", err)
 	}
 	fmt.Println()
-	return strings.TrimRight(out, "\r\n"), nil
+	return out, nil
 }
--- a/cmd/flux/main_e2e_test.go
+++ b/cmd/flux/main_e2e_test.go
@@ -1,4 +1,3 @@
-//go:build e2e
 // +build e2e

 /*
@@ -36,7 +35,7 @@ func TestMain(m *testing.M) {
 	if err != nil {
 		panic(fmt.Errorf("error creating kube manager: '%w'", err))
 	}
-	kubeconfigArgs.KubeConfig = &testEnv.kubeConfigPath
+	rootArgs.kubeconfig = testEnv.kubeConfigPath

 	// Install Flux.
 	output, err := executeCommand("install --components-extra=image-reflector-controller,image-automation-controller")
@@ -55,7 +54,7 @@ func TestMain(m *testing.M) {

 	// Delete namespace and wait for finalisation
 	kubectlArgs := []string{"delete", "namespace", "flux-system"}
-	_, err = utils.ExecKubectlCommand(context.TODO(), utils.ModeStderrOS, *kubeconfigArgs.KubeConfig, *kubeconfigArgs.Context, kubectlArgs...)
+	_, err = utils.ExecKubectlCommand(context.TODO(), utils.ModeStderrOS, rootArgs.kubeconfig, rootArgs.kubecontext, kubectlArgs...)
 	if err != nil {
 		panic(fmt.Errorf("delete namespace error:'%w'", err))
 	}
@@ -67,13 +66,13 @@ func TestMain(m *testing.M) {

 func setupTestNamespace(namespace string) (func(), error) {
 	kubectlArgs := []string{"create", "namespace", namespace}
-	_, err := utils.ExecKubectlCommand(context.TODO(), utils.ModeStderrOS, *kubeconfigArgs.KubeConfig, *kubeconfigArgs.Context, kubectlArgs...)
+	_, err := utils.ExecKubectlCommand(context.TODO(), utils.ModeStderrOS, rootArgs.kubeconfig, rootArgs.kubecontext, kubectlArgs...)
 	if err != nil {
 		return nil, err
 	}

 	return func() {
 		kubectlArgs := []string{"delete", "namespace", namespace}
-		utils.ExecKubectlCommand(context.TODO(), utils.ModeCapture, *kubeconfigArgs.KubeConfig, *kubeconfigArgs.Context, kubectlArgs...)
+		utils.ExecKubectlCommand(context.TODO(), utils.ModeCapture, rootArgs.kubeconfig, rootArgs.kubecontext, kubectlArgs...)
 	}, nil
 }
--- a/cmd/flux/main_test.go
+++ b/cmd/flux/main_test.go
@@ -49,8 +49,8 @@ func allocateNamespace(prefix string) string {
 	return fmt.Sprintf("%s-%d", prefix, id)
 }

-func readYamlObjects(rdr io.Reader) ([]*unstructured.Unstructured, error) {
-	objects := []*unstructured.Unstructured{}
+func readYamlObjects(rdr io.Reader) ([]unstructured.Unstructured, error) {
+	objects := []unstructured.Unstructured{}
 	reader := k8syaml.NewYAMLReader(bufio.NewReader(rdr))
 	for {
 		doc, err := reader.Read()
@@ -65,7 +65,7 @@ func readYamlObjects(rdr io.Reader) ([]*unstructured.Unstructured, error) {
 		if err != nil {
 			return nil, err
 		}
-		objects = append(objects, unstructuredObj)
+		objects = append(objects, *unstructuredObj)
 	}
 	return objects, nil
 }
@@ -96,7 +96,7 @@ func (m *testEnvKubeManager) CreateObjectFile(objectFile string, templateValues
 	}
 }

-func (m *testEnvKubeManager) CreateObjects(clientObjects []*unstructured.Unstructured, t *testing.T) error {
+func (m *testEnvKubeManager) CreateObjects(clientObjects []unstructured.Unstructured, t *testing.T) error {
 	for _, obj := range clientObjects {
 		// First create the object then set its status if present in the
 		// yaml file. Make a copy first since creating an object may overwrite
@@ -107,7 +107,7 @@ func (m *testEnvKubeManager) CreateObjects(clientObjects []*unstructured.Unstruc
 			return err
 		}
 		obj.SetResourceVersion(createObj.GetResourceVersion())
-		err = m.client.Status().Update(context.Background(), obj)
+		err = m.client.Status().Update(context.Background(), &obj)
 		if err != nil {
 			return err
 		}
@@ -115,36 +115,6 @@ func (m *testEnvKubeManager) CreateObjects(clientObjects []*unstructured.Unstruc
 	return nil
 }

-func (m *testEnvKubeManager) DeleteObjectFile(objectFile string, templateValues map[string]string, t *testing.T) {
-	buf, err := os.ReadFile(objectFile)
-	if err != nil {
-		t.Fatalf("Error reading file '%s': %v", objectFile, err)
-	}
-	content, err := executeTemplate(string(buf), templateValues)
-	if err != nil {
-		t.Fatalf("Error evaluating template file '%s': '%v'", objectFile, err)
-	}
-	clientObjects, err := readYamlObjects(strings.NewReader(content))
-	if err != nil {
-		t.Fatalf("Error decoding yaml file '%s': %v", objectFile, err)
-	}
-	err = m.DeleteObjects(clientObjects, t)
-	if err != nil {
-		t.Logf("Error deleting test objects: '%v'", err)
-	}
-}
-
-func (m *testEnvKubeManager) DeleteObjects(clientObjects []*unstructured.Unstructured, t *testing.T) error {
-	for _, obj := range clientObjects {
-		err := m.client.Delete(context.Background(), obj)
-		if err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
 func (m *testEnvKubeManager) Stop() error {
 	if m.testEnv == nil {
 		return fmt.Errorf("do nothing because testEnv is nil")
@@ -325,12 +295,6 @@ type cmdTestCase struct {

 func (cmd *cmdTestCase) runTestCmd(t *testing.T) {
 	actual, testErr := executeCommand(cmd.args)
-
-	// If the cmd error is a change, discard it
-	if isChangeError(testErr) {
-		testErr = nil
-	}
-
 	if assertErr := cmd.assert(actual, testErr); assertErr != nil {
 		t.Error(assertErr)
 	}
@@ -372,12 +336,3 @@ func resetCmdArgs() {
 	getArgs = GetFlags{}
 	secretGitArgs = NewSecretGitFlags()
 }
-
-func isChangeError(err error) bool {
-	if reqErr, ok := err.(*RequestError); ok {
-		if strings.Contains(err.Error(), "identified at least one change, exiting with non-zero exit code") && reqErr.StatusCode == 1 {
-			return true
-		}
-	}
-	return false
-}
--- a/cmd/flux/main_unit_test.go
+++ b/cmd/flux/main_unit_test.go
@@ -1,4 +1,3 @@
-//go:build unit
 // +build unit

 /*
@@ -43,8 +42,7 @@ func TestMain(m *testing.M) {
 		panic(fmt.Errorf("error creating kube manager: '%w'", err))
 	}
 	testEnv = km
-	// rootArgs.kubeconfig = testEnv.kubeConfigPath
-	kubeconfigArgs.KubeConfig = &testEnv.kubeConfigPath
+	rootArgs.kubeconfig = testEnv.kubeConfigPath

 	// Run tests
 	code := m.Run()
--- a/cmd/flux/reconcile.go
+++ b/cmd/flux/reconcile.go
@@ -75,13 +75,13 @@ func (reconcile reconcileCommand) run(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}

 	namespacedName := types.NamespacedName{
-		Namespace: *kubeconfigArgs.Namespace,
+		Namespace: rootArgs.namespace,
 		Name:      name,
 	}

@@ -94,7 +94,7 @@ func (reconcile reconcileCommand) run(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("resource is suspended")
 	}

-	logger.Actionf("annotating %s %s in %s namespace", reconcile.kind, name, *kubeconfigArgs.Namespace)
+	logger.Actionf("annotating %s %s in %s namespace", reconcile.kind, name, rootArgs.namespace)
 	if err := requestReconciliation(ctx, kubeClient, namespacedName, reconcile.object); err != nil {
 		return err
 	}
--- a/cmd/flux/reconcile_alertprovider.go
+++ b/cmd/flux/reconcile_alertprovider.go
@@ -54,17 +54,17 @@ func reconcileAlertProviderCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}

 	namespacedName := types.NamespacedName{
-		Namespace: *kubeconfigArgs.Namespace,
+		Namespace: rootArgs.namespace,
 		Name:      name,
 	}

-	logger.Actionf("annotating Provider %s in %s namespace", name, *kubeconfigArgs.Namespace)
+	logger.Actionf("annotating Provider %s in %s namespace", name, rootArgs.namespace)
 	var alertProvider notificationv1.Provider
 	err = kubeClient.Get(ctx, namespacedName, &alertProvider)
 	if err != nil {
--- a/cmd/flux/reconcile_receiver.go
+++ b/cmd/flux/reconcile_receiver.go
@@ -54,13 +54,13 @@ func reconcileReceiverCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}

 	namespacedName := types.NamespacedName{
-		Namespace: *kubeconfigArgs.Namespace,
+		Namespace: rootArgs.namespace,
 		Name:      name,
 	}

@@ -74,7 +74,7 @@ func reconcileReceiverCmdRun(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("resource is suspended")
 	}

-	logger.Actionf("annotating Receiver %s in %s namespace", name, *kubeconfigArgs.Namespace)
+	logger.Actionf("annotating Receiver %s in %s namespace", name, rootArgs.namespace)
 	if receiver.Annotations == nil {
 		receiver.Annotations = map[string]string{
 			meta.ReconcileRequestAnnotation: time.Now().Format(time.RFC3339Nano),
--- a/cmd/flux/reconcile_with_source.go
+++ b/cmd/flux/reconcile_with_source.go
@@ -36,13 +36,13 @@ func (reconcile reconcileWithSourceCommand) run(cmd *cobra.Command, args []strin
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}

 	namespacedName := types.NamespacedName{
-		Namespace: *kubeconfigArgs.Namespace,
+		Namespace: rootArgs.namespace,
 		Name:      name,
 	}

@@ -57,20 +57,20 @@ func (reconcile reconcileWithSourceCommand) run(cmd *cobra.Command, args []strin

 	if reconcile.object.reconcileSource() {
 		reconcileCmd, nsName := reconcile.object.getSource()
-		nsCopy := *kubeconfigArgs.Namespace
+		nsCopy := rootArgs.namespace
 		if nsName.Namespace != "" {
-			*kubeconfigArgs.Namespace = nsName.Namespace
+			rootArgs.namespace = nsName.Namespace
 		}

 		err := reconcileCmd.run(nil, []string{nsName.Name})
 		if err != nil {
 			return err
 		}
-		*kubeconfigArgs.Namespace = nsCopy
+		rootArgs.namespace = nsCopy
 	}

 	lastHandledReconcileAt := reconcile.object.lastHandledReconcileRequest()
-	logger.Actionf("annotating %s %s in %s namespace", reconcile.kind, name, *kubeconfigArgs.Namespace)
+	logger.Actionf("annotating %s %s in %s namespace", reconcile.kind, name, rootArgs.namespace)
 	if err := requestReconciliation(ctx, kubeClient, namespacedName, reconcile.object); err != nil {
 		return err
 	}
--- a/cmd/flux/resume.go
+++ b/cmd/flux/resume.go
@@ -48,7 +48,6 @@ func init() {

 type resumable interface {
 	adapter
-	copyable
 	statusable
 	setUnsuspended()
 	successMessage() string
@@ -73,13 +72,13 @@ func (resume resumeCommand) run(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}

 	var listOpts []client.ListOption
-	listOpts = append(listOpts, client.InNamespace(*kubeconfigArgs.Namespace))
+	listOpts = append(listOpts, client.InNamespace(rootArgs.namespace))
 	if len(args) > 0 {
 		listOpts = append(listOpts, client.MatchingFields{
 			"metadata.name": args[0],
@@ -92,24 +91,21 @@ func (resume resumeCommand) run(cmd *cobra.Command, args []string) error {
 	}

 	if resume.list.len() == 0 {
-		logger.Failuref("no %s objects found in %s namespace", resume.kind, *kubeconfigArgs.Namespace)
+		logger.Failuref("no %s objects found in %s namespace", resume.kind, rootArgs.namespace)
 		return nil
 	}

 	for i := 0; i < resume.list.len(); i++ {
-		logger.Actionf("resuming %s %s in %s namespace", resume.humanKind, resume.list.resumeItem(i).asClientObject().GetName(), *kubeconfigArgs.Namespace)
-		obj := resume.list.resumeItem(i)
-		patch := client.MergeFrom(obj.deepCopyClientObject())
-		obj.setUnsuspended()
-		if err := kubeClient.Patch(ctx, obj.asClientObject(), patch); err != nil {
+		logger.Actionf("resuming %s %s in %s namespace", resume.humanKind, resume.list.resumeItem(i).asClientObject().GetName(), rootArgs.namespace)
+		resume.list.resumeItem(i).setUnsuspended()
+		if err := kubeClient.Update(ctx, resume.list.resumeItem(i).asClientObject()); err != nil {
 			return err
 		}
-
 		logger.Successf("%s resumed", resume.humanKind)

 		namespacedName := types.NamespacedName{
 			Name:      resume.list.resumeItem(i).asClientObject().GetName(),
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 		}

 		logger.Waitingf("waiting for %s reconciliation", resume.kind)
--- a/cmd/flux/status.go
+++ b/cmd/flux/status.go
@@ -69,11 +69,11 @@ func isReady(ctx context.Context, kubeClient client.Client,
 func buildComponentObjectRefs(components ...string) ([]object.ObjMetadata, error) {
 	var objRefs []object.ObjMetadata
 	for _, deployment := range components {
-		objRefs = append(objRefs, object.ObjMetadata{
-			Namespace: *kubeconfigArgs.Namespace,
-			Name:      deployment,
-			GroupKind: schema.GroupKind{Group: "apps", Kind: "Deployment"},
-		})
+		objMeta, err := object.CreateObjMetadata(rootArgs.namespace, deployment, schema.GroupKind{Group: "apps", Kind: "Deployment"})
+		if err != nil {
+			return nil, err
+		}
+		objRefs = append(objRefs, objMeta)
 	}
 	return objRefs, nil
 }
--- a/cmd/flux/suspend.go
+++ b/cmd/flux/suspend.go
@@ -46,7 +46,6 @@ func init() {

 type suspendable interface {
 	adapter
-	copyable
 	isSuspended() bool
 	setSuspended()
 }
@@ -70,13 +69,13 @@ func (suspend suspendCommand) run(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()

-	kubeClient, err := utils.KubeClient(kubeconfigArgs)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}

 	var listOpts []client.ListOption
-	listOpts = append(listOpts, client.InNamespace(*kubeconfigArgs.Namespace))
+	listOpts = append(listOpts, client.InNamespace(rootArgs.namespace))
 	if len(args) > 0 {
 		listOpts = append(listOpts, client.MatchingFields{
 			"metadata.name": args[0],
@@ -89,17 +88,14 @@ func (suspend suspendCommand) run(cmd *cobra.Command, args []string) error {
 	}

 	if suspend.list.len() == 0 {
-		logger.Failuref("no %s objects found in %s namespace", suspend.kind, *kubeconfigArgs.Namespace)
+		logger.Failuref("no %s objects found in %s namespace", suspend.kind, rootArgs.namespace)
 		return nil
 	}

 	for i := 0; i < suspend.list.len(); i++ {
-		logger.Actionf("suspending %s %s in %s namespace", suspend.humanKind, suspend.list.item(i).asClientObject().GetName(), *kubeconfigArgs.Namespace)
-
-		obj := suspend.list.item(i)
-		patch := client.MergeFrom(obj.deepCopyClientObject())
-		obj.setSuspended()
-		if err := kubeClient.Patch(ctx, obj.asClientObject(), patch); err != nil {
+		logger.Actionf("suspending %s %s in %s namespace", suspend.humanKind, suspend.list.item(i).asClientObject().GetName(), rootArgs.namespace)
+		suspend.list.item(i).setSuspended()
+		if err := kubeClient.Update(ctx, suspend.list.item(i).asClientObject()); err != nil {
 			return err
 		}
 		logger.Successf("%s suspended", suspend.humanKind)
--- a/cmd/flux/testdata/build-kustomization/delete-service/deployment.yaml
+++ b/cmd/flux/testdata/build-kustomization/delete-service/deployment.yaml
@@ -1,74 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: podinfo
-spec:
-  minReadySeconds: 3
-  revisionHistoryLimit: 5
-  progressDeadlineSeconds: 60
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 0
-    type: RollingUpdate
-  selector:
-    matchLabels:
-      app: podinfo
-  template:
-    metadata:
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "9797"
-      labels:
-        app: podinfo
-    spec:
-      containers:
-      - name: podinfod
-        image: ghcr.io/stefanprodan/podinfo:6.0.3
-        imagePullPolicy: IfNotPresent
-        ports:
-        - name: http
-          containerPort: 9898
-          protocol: TCP
-        - name: http-metrics
-          containerPort: 9797
-          protocol: TCP
-        - name: grpc
-          containerPort: 9999
-          protocol: TCP
-        command:
-        - ./podinfo
-        - --port=9898
-        - --port-metrics=9797
-        - --grpc-port=9999
-        - --grpc-service-name=podinfo
-        - --level=info
-        - --random-delay=false
-        - --random-error=false
-        env:
-        - name: PODINFO_UI_COLOR
-          value: "#34577c"
-        livenessProbe:
-          exec:
-            command:
-            - podcli
-            - check
-            - http
-            - localhost:9898/healthz
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
-        readinessProbe:
-          exec:
-            command:
-            - podcli
-            - check
-            - http
-            - localhost:9898/readyz
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
-        resources:
-          limits:
-            cpu: 2000m
-            memory: 512Mi
-          requests:
-            cpu: 100m
-            memory: 64Mi
--- a/cmd/flux/testdata/build-kustomization/delete-service/hpa.yaml
+++ b/cmd/flux/testdata/build-kustomization/delete-service/hpa.yaml
@@ -1,20 +0,0 @@
-apiVersion: autoscaling/v2beta2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: podinfo
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: podinfo
-  minReplicas: 2
-  maxReplicas: 4
-  metrics:
-  - type: Resource
-    resource:
-      name: cpu
-      target:
-        type: Utilization
-        # scale up if usage is above
-        # 99% of the requested CPU (100m)
-        averageUtilization: 99
--- a/cmd/flux/testdata/build-kustomization/delete-service/kustomization.yaml
+++ b/cmd/flux/testdata/build-kustomization/delete-service/kustomization.yaml
@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- ./deployment.yaml
- ./hpa.yaml
--- a/cmd/flux/testdata/build-kustomization/podinfo-kustomization.yaml
+++ b/cmd/flux/testdata/build-kustomization/podinfo-kustomization.yaml
@@ -1,15 +0,0 @@
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-kind: Kustomization
-metadata:
-  name: podinfo
-  namespace: {{ .fluxns }}
-spec:
-  interval: 5m0s
-  path: ./kustomize
-  force: true
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: podinfo
-  targetNamespace: default
--- a/cmd/flux/testdata/build-kustomization/podinfo-result.yaml
+++ b/cmd/flux/testdata/build-kustomization/podinfo-result.yaml
@@ -1,173 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: podinfo
-    kustomize.toolkit.fluxcd.io/namespace: {{ .fluxns }}
-  name: podinfo
-  namespace: default
-spec:
-  minReadySeconds: 3
-  progressDeadlineSeconds: 60
-  revisionHistoryLimit: 5
-  selector:
-    matchLabels:
-      app: podinfo
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 0
-    type: RollingUpdate
-  template:
-    metadata:
-      annotations:
-        prometheus.io/port: "9797"
-        prometheus.io/scrape: "true"
-      labels:
-        app: podinfo
-    spec:
-      containers:
-      - command:
-        - ./podinfo
-        - --port=9898
-        - --port-metrics=9797
-        - --grpc-port=9999
-        - --grpc-service-name=podinfo
-        - --level=info
-        - --random-delay=false
-        - --random-error=false
-        env:
-        - name: PODINFO_UI_COLOR
-          value: '#34577c'
-        image: ghcr.io/stefanprodan/podinfo:6.0.10
-        imagePullPolicy: IfNotPresent
-        livenessProbe:
-          exec:
-            command:
-            - podcli
-            - check
-            - http
-            - localhost:9898/healthz
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
-        name: podinfod
-        ports:
-        - containerPort: 9898
-          name: http
-          protocol: TCP
-        - containerPort: 9797
-          name: http-metrics
-          protocol: TCP
-        - containerPort: 9999
-          name: grpc
-          protocol: TCP
-        readinessProbe:
-          exec:
-            command:
-            - podcli
-            - check
-            - http
-            - localhost:9898/readyz
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
-        resources:
-          limits:
-            cpu: 2000m
-            memory: 512Mi
-          requests:
-            cpu: 100m
-            memory: 64Mi
---
-apiVersion: autoscaling/v2beta2
-kind: HorizontalPodAutoscaler
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: podinfo
-    kustomize.toolkit.fluxcd.io/namespace: {{ .fluxns }}
-  name: podinfo
-  namespace: default
-spec:
-  maxReplicas: 4
-  metrics:
-  - resource:
-      name: cpu
-      target:
-        averageUtilization: 99
-        type: Utilization
-    type: Resource
-  minReplicas: 2
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: podinfo
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: podinfo
-    kustomize.toolkit.fluxcd.io/namespace: {{ .fluxns }}
-  name: podinfo
-  namespace: default
-spec:
-  ports:
-  - name: http
-    port: 9898
-    protocol: TCP
-    targetPort: http
-  - name: grpc
-    port: 9999
-    protocol: TCP
-    targetPort: grpc
-  selector:
-    app: podinfo
-  type: ClusterIP
---
-apiVersion: v1
-data:
-  .dockerconfigjson: eyJtYXNrIjoiKipTT1BTKioifQ==
-kind: Secret
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: podinfo
-    kustomize.toolkit.fluxcd.io/namespace: {{ .fluxns }}
-  name: docker-secret
-  namespace: default
-type: kubernetes.io/dockerconfigjson
---
-apiVersion: v1
-kind: Secret
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: podinfo
-    kustomize.toolkit.fluxcd.io/namespace: {{ .fluxns }}
-  name: secret-basic-auth-stringdata
-  namespace: default
-stringData:
-  password: KipTT1BTKio=
-  username: KipTT1BTKio=
-type: kubernetes.io/basic-auth
---
-apiVersion: v1
-data:
-  token: KipTT1BTKio=
-kind: Secret
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: podinfo
-    kustomize.toolkit.fluxcd.io/namespace: {{ .fluxns }}
-  name: podinfo-token-77t89m9b67
-  namespace: default
-type: Opaque
---
-apiVersion: v1
-data:
-  password: MWYyZDFlMmU2N2Rm
-  username: YWRtaW4=
-kind: Secret
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: podinfo
-    kustomize.toolkit.fluxcd.io/namespace: {{ .fluxns }}
-  name: db-user-pass-bkbd782d2c
-  namespace: default
-type: Opaque
--- a/cmd/flux/testdata/build-kustomization/podinfo-source.yaml
+++ b/cmd/flux/testdata/build-kustomization/podinfo-source.yaml
@@ -1,16 +0,0 @@
---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: {{ .fluxns }}
---
-apiVersion: source.toolkit.fluxcd.io/v1beta1
-kind: GitRepository
-metadata:
-  name: podinfo
-  namespace: {{ .fluxns }}
-spec:
-  interval: 30s
-  ref:
-    branch: master
-  url: https://github.com/stefanprodan/podinfo
--- a/cmd/flux/testdata/build-kustomization/podinfo-without-service-result.yaml
+++ b/cmd/flux/testdata/build-kustomization/podinfo-without-service-result.yaml
@@ -1,101 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: podinfo
-    kustomize.toolkit.fluxcd.io/namespace: {{ .fluxns }}
-  name: podinfo
-  namespace: default
-spec:
-  minReadySeconds: 3
-  progressDeadlineSeconds: 60
-  revisionHistoryLimit: 5
-  selector:
-    matchLabels:
-      app: podinfo
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 0
-    type: RollingUpdate
-  template:
-    metadata:
-      annotations:
-        prometheus.io/port: "9797"
-        prometheus.io/scrape: "true"
-      labels:
-        app: podinfo
-    spec:
-      containers:
-      - command:
-        - ./podinfo
-        - --port=9898
-        - --port-metrics=9797
-        - --grpc-port=9999
-        - --grpc-service-name=podinfo
-        - --level=info
-        - --random-delay=false
-        - --random-error=false
-        env:
-        - name: PODINFO_UI_COLOR
-          value: '#34577c'
-        image: ghcr.io/stefanprodan/podinfo:6.0.3
-        imagePullPolicy: IfNotPresent
-        livenessProbe:
-          exec:
-            command:
-            - podcli
-            - check
-            - http
-            - localhost:9898/healthz
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
-        name: podinfod
-        ports:
-        - containerPort: 9898
-          name: http
-          protocol: TCP
-        - containerPort: 9797
-          name: http-metrics
-          protocol: TCP
-        - containerPort: 9999
-          name: grpc
-          protocol: TCP
-        readinessProbe:
-          exec:
-            command:
-            - podcli
-            - check
-            - http
-            - localhost:9898/readyz
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
-        resources:
-          limits:
-            cpu: 2000m
-            memory: 512Mi
-          requests:
-            cpu: 100m
-            memory: 64Mi
---
-apiVersion: autoscaling/v2beta2
-kind: HorizontalPodAutoscaler
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: podinfo
-    kustomize.toolkit.fluxcd.io/namespace: {{ .fluxns }}
-  name: podinfo
-  namespace: default
-spec:
-  maxReplicas: 4
-  metrics:
-  - resource:
-      name: cpu
-      target:
-        averageUtilization: 99
-        type: Utilization
-    type: Resource
-  minReplicas: 2
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: podinfo
--- a/cmd/flux/testdata/build-kustomization/podinfo/deployment.yaml
+++ b/cmd/flux/testdata/build-kustomization/podinfo/deployment.yaml
@@ -1,74 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: podinfo
-spec:
-  minReadySeconds: 3
-  revisionHistoryLimit: 5
-  progressDeadlineSeconds: 60
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 0
-    type: RollingUpdate
-  selector:
-    matchLabels:
-      app: podinfo
-  template:
-    metadata:
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "9797"
-      labels:
-        app: podinfo
-    spec:
-      containers:
-      - name: podinfod
-        image: ghcr.io/stefanprodan/podinfo:6.0.10
-        imagePullPolicy: IfNotPresent
-        ports:
-        - name: http
-          containerPort: 9898
-          protocol: TCP
-        - name: http-metrics
-          containerPort: 9797
-          protocol: TCP
-        - name: grpc
-          containerPort: 9999
-          protocol: TCP
-        command:
-        - ./podinfo
-        - --port=9898
-        - --port-metrics=9797
-        - --grpc-port=9999
-        - --grpc-service-name=podinfo
-        - --level=info
-        - --random-delay=false
-        - --random-error=false
-        env:
-        - name: PODINFO_UI_COLOR
-          value: "#34577c"
-        livenessProbe:
-          exec:
-            command:
-            - podcli
-            - check
-            - http
-            - localhost:9898/healthz
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
-        readinessProbe:
-          exec:
-            command:
-            - podcli
-            - check
-            - http
-            - localhost:9898/readyz
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
-        resources:
-          limits:
-            cpu: 2000m
-            memory: 512Mi
-          requests:
-            cpu: 100m
-            memory: 64Mi
--- a/cmd/flux/testdata/build-kustomization/podinfo/dockerconfigjson-sops-secret.yaml
+++ b/cmd/flux/testdata/build-kustomization/podinfo/dockerconfigjson-sops-secret.yaml
@@ -1,27 +0,0 @@
-apiVersion: v1
-data:
-  .dockerconfigjson: ENC[AES256_GCM,data:KHCFH3hNnc+PMfWLFEPjebf3W4z4WXbGFAANRZyZC+07z7wlrTALJM6rn8YslW4tMAWCoAYxblC5WRCszTy0h9rw0U/RGOv5H0qCgnNg/FILFUqhwo9pNfrUH+MEP4M9qxxbLKZwObpHUE7DUsKx1JYAxsI=,iv:q48lqUbUQD+0cbYcjNMZMJLRdGHi78ZmDhNAT2th9tg=,tag:QRI2SZZXQrAcdql3R5AH2g==,type:str]
-kind: Secret
-metadata:
-  name: docker-secret
-type: kubernetes.io/dockerconfigjson
-sops:
-  kms: []
-  gcp_kms: []
-  azure_kv: []
-  hc_vault: []
-  age:
-    - recipient: age10la2ge0wtvx3qr7datqf7rs4yngxszdal927fs9rukamr8u2pshsvtz7ce
-      enc: |
-        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3eU1CTEJhVXZ4eEVYYkVV
-        OU90TEcrR2pYckttN0pBanJoSUZWSW1RQXlRCkUydFJ3V1NZUTBuVFF0aC9GUEcw
-        bUdhNjJWTkoyL1FUVi9Dc1dxUDBkM0UKLS0tIE1sQXkwcWdGaEFuY0RHQTVXM0J6
-        dWpJcThEbW15V3dXYXpPZklBdW1Hd1kKoIAdmGNPrEctV8h1w8KuvQ5S+BGmgqN9
-        MgpNmUhJjWhgcQpb5BRYpQesBOgU5TBGK7j58A6DMDKlSiYZsdQchQ==
-        -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2022-02-03T16:03:17Z"
-  mac: ENC[AES256_GCM,data:AHdYSawajwgAFwlmDN1IPNmT9vWaYKzyVIra2d6sPcjTbZ8/p+VRSRpVm4XZFFsaNnW5AUJaouwXnKYDTmJDXKlr/rQcu9kXqsssQgdzcXaA6l5uJlgsnml8ba7J3OK+iEKMax23mwQEx2EUskCd9ENOwFDkunP02sxqDNOz20k=,iv:8F5OamHt3fAVorf6p+SoIrWoqkcATSGWVoM0EK87S4M=,tag:E1mxXnc7wWkEX5BxhpLtng==,type:str]
-  pgp: []
-  encrypted_regex: ^(data|stringData)$
-  version: 3.7.1
--- a/cmd/flux/testdata/build-kustomization/podinfo/hpa.yaml
+++ b/cmd/flux/testdata/build-kustomization/podinfo/hpa.yaml
@@ -1,20 +0,0 @@
-apiVersion: autoscaling/v2beta2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: podinfo
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: podinfo
-  minReplicas: 2
-  maxReplicas: 4
-  metrics:
-  - type: Resource
-    resource:
-      name: cpu
-      target:
-        type: Utilization
-        # scale up if usage is above
-        # 99% of the requested CPU (100m)
-        averageUtilization: 99
--- a/cmd/flux/testdata/build-kustomization/podinfo/kustomization.yaml
+++ b/cmd/flux/testdata/build-kustomization/podinfo/kustomization.yaml
@@ -1,16 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
- ./deployment.yaml
- ./hpa.yaml
- ./service.yaml
- ./dockerconfigjson-sops-secret.yaml
- ./stringdata-secret.yaml
-secretGenerator:
- - files:
-   - token=token.encrypted
-   name: podinfo-token
- - literals:
-   - username=admin
-   - password=1f2d1e2e67df
-   name: db-user-pass
--- a/cmd/flux/testdata/build-kustomization/podinfo/service.yaml
+++ b/cmd/flux/testdata/build-kustomization/podinfo/service.yaml
@@ -1,17 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: podinfo
-spec:
-  type: ClusterIP
-  selector:
-    app: podinfo
-  ports:
-    - name: http
-      port: 9898
-      protocol: TCP
-      targetPort: http
-    - port: 9999
-      targetPort: grpc
-      protocol: TCP
-      name: grpc
--- a/cmd/flux/testdata/build-kustomization/podinfo/stringdata-secret.yaml
+++ b/cmd/flux/testdata/build-kustomization/podinfo/stringdata-secret.yaml
@@ -1,28 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: secret-basic-auth-stringdata
-type: kubernetes.io/basic-auth
-stringData:
-    username: ENC[AES256_GCM,data:uKiQR48=,iv:jh2lgyAVu7igJAgoJsnOGhjxFyvUAa9lvT21u3hhqpU=,tag:zXM2JEpk3ZEH7WfkcWXXkw==,type:str]
-    password: ENC[AES256_GCM,data:PyhZmNhy929JGQ==,iv:PBqPaJmSw21+kn4gIlg5VdjLNZyf613z5RUTCesBoVw=,tag:Hjc7DsuUrtsz7PYPdNkL3g==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age10la2ge0wtvx3qr7datqf7rs4yngxszdal927fs9rukamr8u2pshsvtz7ce
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJd0xxbDZhYjVoZzY4YWhK
-            d2NvMVgrSGRVUGhHRGg3R1FpVURnbmh1TDBzCjcwby85M3JaK09QVk0yZFNMb2NL
-            c2NQZW5hS1FhYlBHU0VoUzBVYzZYUUUKLS0tIEdaNEw2Y0VjVHpZc3pyYUtLVmJk
-            NmN3K2VLU0NiZ1d0VHBYbGlCM1lrNmMKeWz3yfFbMNE+ly21oLfc1XnDSPRmnlPP
-            wIs8lk/qrzVZ45C9GdWnnPeGZZiia46Yop9TxseUS8gCjJ6KCxJCAg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2022-02-06T12:51:07Z"
-    mac: ENC[AES256_GCM,data:jtdzwj19uxdxvnmXg1HkAkDA6XlKMJOYFy7uLI5t/t11LwGop5Yeo7a4nQEEELehRx9J7B6U6NiySxAxBxWx5uW5vI5c8+069VV6dkiCIefnYSzuoIhQafjlFl1/KvH7VEjIWfHYuXF09v9PEKXkxEHUYDpS3QqQ3ymHRRI08pU=,  iv:xX3E7F+AM29Pm8G5oqxRfYu9E7tEBGIaHeCJYgrtFmc=,tag:MJPGusNvu05z939jg8PAwQ==,type:str]
-    pgp: []
-    encrypted_regex: ^(data|stringData)$
-    version: 3.7.1
--- a/cmd/flux/testdata/build-kustomization/podinfo/token.encrypted
+++ b/cmd/flux/testdata/build-kustomization/podinfo/token.encrypted
@@ -1,20 +0,0 @@
- {
-     "data": "ENC[AES256_GCM,data:oBe5PlPmfQCUUc4sqKImjw==,iv:MLLEW15QC9kRdVVagJnzLCSk0xZGWIpAeTfHzyxT10g=,tag:K3GkBCGS+ut4Tpk6ndb0CA==,type:str]",
-     "sops": {
-         "kms": null,
-         "gcp_kms": null,
-         "azure_kv": null,
-         "hc_vault": null,
-         "age": [
-             {
-                 "recipient": "age10la2ge0wtvx3qr7datqf7rs4yngxszdal927fs9rukamr8u2pshsvtz7ce",
-                 "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+                                                                                                                IFgyNTUxOSA1L2RpZHRrK1FSVmYrd1Va\nY0hxWFQzSDBsT1k3WjNtYmU1QmliaDJycXlNCnF1YjdNOThVbVNvMG9rNS9ZUXZw\nMnV0bnRUMGNtejFPbzM4U2UzWkszeVkKLS0tIGJ6UGhxMUV3YmVJTHlJSUJpRVRZ\nVjd0RVRadU8wekxXTHIrYUplYkN2aEEK0I/   MCEtXRk+b/N2G1JF3vHQT24dShWYD\nw+JIUSA3aLf2sv0zr2MdUEdVWBJoM8nT4D4xVbBORD+669W+9nDeSw==\n-----END AGE ENCRYPTED FILE-----\n"
-             }
-         ],
-         "lastmodified": "2021-11-26T16:34:51Z",
-         "mac": "ENC[AES256_GCM,data:COGzf5YCHNNP6z4JaEKrjN3M8f5+Q1uKUKTMHwj388/ICmLyi2sSrTmj7PP+X7M9jTVwa8wVgYTpNLiVJx+LcxqvIXM0Tyo+/Cu1zrfao98aiACP8+TSEDiFQNtEus23H+d/X1hqMwRHDI3kQ+                      6scgEGnqY57r3RDSA3E8EhHr4=,iv:LxitVIYm8srZVqFueJh9loClA44Y2Z3XAVYmxesMmOg=,tag:Y8qFD8UGlDfwNSv7xlcn6A==,type:str]",
-         "pgp": null,
-         "unencrypted_suffix": "_unencrypted",
-         "version": "3.7.1"
-     }
- }
--- a/cmd/flux/testdata/check/check_pre.golden
+++ b/cmd/flux/testdata/check/check_pre.golden
@@ -1,3 +1,3 @@
 ► checking prerequisites
-✔ Kubernetes {{ .serverVersion }} >=1.20.6-0
+✔ Kubernetes {{ .serverVersion }} >=1.19.0-0
 ✔ prerequisites checks passed
--- a/cmd/flux/testdata/create_secret/git/ecdsa-password.private
+++ b/cmd/flux/testdata/create_secret/git/ecdsa-password.private
@@ -1,10 +0,0 @@
-----BEGIN OPENSSH PRIVATE KEY-----
-b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABA9i7hZ7m
-UBPxF7GuUswZiXAAAAEAAAAAEAAABoAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlz
-dHAyNTYAAABBBOOAQfhwylg6WhJRXha2K1dJY5BG12nsS7YyFlKPAovOAC8d8rTOzjjDWu
-kG24JVRrXoWUN6eWWvxDvMd5pZT1wAAADAepYZPGTQnH6genhU+y9aD1GFO8BsODIllxEq
-T8n2eLAmPWYLv4HhgtmbqtsOmTE9sVM5ynYj/dAX1SreoGeoMEVFIt1cYtWgyuJccEiK4t
-1JQLFLMKnBRTY+yIdD6gX7tLRRL/jqzMR4XZF5/Yf48lvU4h+ljuOitWH3ea9142izl2Wk
-eXAfeoezJaDntZUUEYvKMI5U6iWVni+c7vOcJFTZgBeV4i54ua06tY5mE/mWARldiSDtJG
-yGEOankDnf
-----END OPENSSH PRIVATE KEY-----
--- a/cmd/flux/testdata/create_secret/git/ecdsa.private
+++ b/cmd/flux/testdata/create_secret/git/ecdsa.private
@@ -1,9 +0,0 @@
-----BEGIN OPENSSH PRIVATE KEY-----
-b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
-1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQTuiu+gGwLIu9E5J4vRshoIBHScKx4Y
-f9oniWMsLFHXq5p9GJ/eb9Cr3jgNACnGOIGOqlwBQvP5rCJuaJ0pCRKUAAAAuNE1GtvRNR
-rbAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBO6K76AbAsi70Tkn
-i9GyGggEdJwrHhh/2ieJYywsUdermn0Yn95v0KveOA0AKcY4gY6qXAFC8/msIm5onSkJEp
-QAAAAhAPaO6PiN+1238KMrHg34M7XdftGypt2/UKEz2L2Pf40yAAAAH3NvbXRvY2hpb255
-ZWt3ZXJlQFNvbXRvY2hpcy1NQlA=
-----END OPENSSH PRIVATE KEY-----
--- a/cmd/flux/testdata/create_secret/git/git-ssh-secret-password.yaml
+++ b/cmd/flux/testdata/create_secret/git/git-ssh-secret-password.yaml
@@ -7,17 +7,46 @@ metadata:
 stringData:
  identity: |
    -----BEGIN OPENSSH PRIVATE KEY-----
-    b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABA9i7hZ7m
-    UBPxF7GuUswZiXAAAAEAAAAAEAAABoAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlz
-    dHAyNTYAAABBBOOAQfhwylg6WhJRXha2K1dJY5BG12nsS7YyFlKPAovOAC8d8rTOzjjDWu
-    kG24JVRrXoWUN6eWWvxDvMd5pZT1wAAADAepYZPGTQnH6genhU+y9aD1GFO8BsODIllxEq
-    T8n2eLAmPWYLv4HhgtmbqtsOmTE9sVM5ynYj/dAX1SreoGeoMEVFIt1cYtWgyuJccEiK4t
-    1JQLFLMKnBRTY+yIdD6gX7tLRRL/jqzMR4XZF5/Yf48lvU4h+ljuOitWH3ea9142izl2Wk
-    eXAfeoezJaDntZUUEYvKMI5U6iWVni+c7vOcJFTZgBeV4i54ua06tY5mE/mWARldiSDtJG
-    yGEOankDnf
+    b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABAZPOy4O0
+    XmgKgRJuR9WaShAAAAEAAAAAEAAAGXAAAAB3NzaC1yc2EAAAADAQABAAABgQDmuJnVljOr
+    pA3OiaAkCJuPT+lHRb/Kuc7fByldlYihsrNjWKVa9xB844mNrpntevFJ6ESEE13ElY2O8M
+    /L58Eh4hmrzqBDtk7XnP/bJVdHAOGvEYavLEeN9K9nZdYYnyOae4OMZacA4oHxUSyrSWvl
+    LDTOOZnFYlCkVXogBcvCrg+HZe/FaHmB4R3ni9eojsX/gQII970SD6d2DLhCW3r+qNW03S
+    O8bj28xyjGLhVgNPyRimWkeZ8DpiJKm2Ccf2oYqtVp1wtrihz4QZ30cZ0KWxdf2iJKCMhp
+    e5B2F8Gw3+3ZWWA8xmg1buDwLkGmroibPY9hUAzt05E8THuwpl7GA/8xdge+LCcCdBhx+i
+    WYhcPrQOCD/5ajRM7OkjJbJwRxdZgdYDSUvQNnHYh02pj+ZYjQBARhSRCEkFnxklyNjzSD
+    ETwXO5tW57CmcegLS8ig3Z3WcgBX0sdDsttMBmlWt4fb6qPB6ctTjx/wlkC0YlHXuI+Fzm
+    CyAP8ikQk63ckAAAWQy3GOOOYpvMAgXIDYUJZnCiy4jnzpt3vX0kIpWogfwqT8QwbuhhDb
+    ogQT6mZqt88nKUlRv3eRPmeG6MebsuweMw6WJfP0ZARFJS9+nXfNSJGN+Tqze252C1w2uu
+    vlzK1GnY5pnZzpaZAf/d+UAtNXDYdWA1DlJsNsBXgIJVkc47sp/cv6EGced+UXuV+Yr80s
+    ECqqOqa+IZWxd+Buca2EWQhG2loLlk6JQ8D+vNm3yhPCrb+1BcoZgxGItL70TdLtUCsmpP
+    y+ejnIxiHl79CjSNANBA7SgjJCQWYjFTcNUb98pGMsMVKIqczNtUZrL6WiSBrLDl5luFIb
+    bZi6iQsjVU6AUd+rcTSsdCec7xnoDddytmh2oG0tHG9wlCQh9yo0NBGaBQP/euqiSgIAvZ
+    zTJTy1AUo/M6FRdMpuGoDrxDPDGj/Q4OsUQzDS0c10WHGv2TLIoloa/FvhjdOn4pXOOIOB
+    nzgRn1xEHwgmSsyyiQP8gCEWM3XgLTOZIS+B4AT6hFPGCbbRetqwKF6qG68xsoLmQ5BXJN
+    kdIKqT7BlAvvX7t80XnvWiuZUjBS2qyTJ3FWCkyaxQVmrNsfZbg4qRJ377+ip3BwuaTl3X
+    VuZEEEy6+cwc+fRL8hPbKKIAcSLjRJnGHMiPvEFcL7yMkmGhv/vd78QdF/0XfVqCGr1gH3
+    gO3O//2Bdcp7Vo9QGqlK66Cusk5HiVSv6StQdqoauW2bxF4JKm3azHL1wWkyWtf2FQD425
+    0V+qib4Qz4KALj9uPwUyP6umDSk1NSBEMohGYpbm/O/Hpr6x2XET6kYbcK/sb5pDlZ81QQ
+    A6GJ87fQyVe0FeoWwg256LiNyDTqFUKm0R508hlnzaAtMnW8TvSqmjrKfLy9YU8IaF0dcS
+    kLheF4EwU2B5exumCx5JDe/xbVw5M8bx5m9lMx1NxGwNr2HtLvgMdQCwI5KchBzC+SIfGd
+    h94Gv39xRGKAhgtBzRRC5LLnRHeBWuLroWY/MoPDH5dWsMvSDkDjaGWHczlPNeN+epv17O
+    G5rR4oyVBfbR5+/qB//1c8avbBrmMLZoFaGMYSQaX8kTcus/Xu5qoDvxlkT4mjb6VvjMq0
+    iPUDNz8hAXv6NUlAViMGNV/sKhNcHRmwqkai79p0JJ+Ni635YNY2E7mS6QwVce1KCsUMet
+    xjeDItSaLLQTaC2LfLybL9/3ppJiaOusnSN+J+yHvUIu7IsI2a9OpGRGhYIU/25r2KBtFV
+    GdSGLNOdI3CB+J6eDXwkt3BmkIVYABc12o94PAXShnCgXK4u6tcowkNKVjyIrE64tckBsr
+    l08apsj7SkTbly34MucgKya0pwBQKUXEUSHCQ70h8q4fK0dWrs7ahODXdwj0Lrp6My5eFR
+    sV24X8U7kPailGowAVh9f/7afZs9CURwlUDjaXKWewGyQ7j3WVHOXSikOfxxbdQ+19juDO
+    1h7Gtk+fKLsq0har0KDnVFSvP16f3ETKfAp5/acmXE4dnJGoo5k2Ak0QUBNIH163biBKS0
+    Y6ePms4PghUFWINzaReZi1E4NiXdWKgOLXJBta7fg+ISFCocYdBRk9w3VUZa/1IvgzNg3l
+    QxyLLH4YPcAGiSPpwcHhWxh/OMY4m6av9BslsG9ajXBpVto0X3oEa78ZuJVVXWAP2E891g
+    I/atxZ+fBkght3oIMiIuyWPeKZVNvdx1eKCU76jCEXxMrlAM47OZEJnaeMdhqPA1ICqERx
+    2L9Tq2W30mgwwP/QaDOiqNBn3UWt28ly+LqUOoQKt/w/z9YZUlpN090rs1iWOTkpamXTYd
+    o+WewKF1Ax4TbsSfNX7P1ROTeIsQCisu3iFWkym9QZ/2RcZYcEPGGAR3ve8rPS2tsy9nL8
+    4TDo1LUXShRgQxOEAsPNJ4440vY=
    -----END OPENSSH PRIVATE KEY-----
  identity.pub: |
-    ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOOAQfhwylg6WhJRXha2K1dJY5BG12nsS7YyFlKPAovOAC8d8rTOzjjDWukG24JVRrXoWUN6eWWvxDvMd5pZT1w=
-  known_hosts: github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
+    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDmuJnVljOrpA3OiaAkCJuPT+lHRb/Kuc7fByldlYihsrNjWKVa9xB844mNrpntevFJ6ESEE13ElY2O8M/L58Eh4hmrzqBDtk7XnP/bJVdHAOGvEYavLEeN9K9nZdYYnyOae4OMZacA4oHxUSyrSWvlLDTOOZnFYlCkVXogBcvCrg+HZe/FaHmB4R3ni9eojsX/gQII970SD6d2DLhCW3r+qNW03SO8bj28xyjGLhVgNPyRimWkeZ8DpiJKm2Ccf2oYqtVp1wtrihz4QZ30cZ0KWxdf2iJKCMhpe5B2F8Gw3+3ZWWA8xmg1buDwLkGmroibPY9hUAzt05E8THuwpl7GA/8xdge+LCcCdBhx+iWYhcPrQOCD/5ajRM7OkjJbJwRxdZgdYDSUvQNnHYh02pj+ZYjQBARhSRCEkFnxklyNjzSDETwXO5tW57CmcegLS8ig3Z3WcgBX0sdDsttMBmlWt4fb6qPB6ctTjx/wlkC0YlHXuI+FzmCyAP8ikQk63ck=
+  known_hosts: github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
  password: password

--- a/cmd/flux/testdata/create_secret/git/git-ssh-secret.yaml
+++ b/cmd/flux/testdata/create_secret/git/git-ssh-secret.yaml
@@ -7,15 +7,44 @@ metadata:
 stringData:
  identity: |
    -----BEGIN OPENSSH PRIVATE KEY-----
-    b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
-    1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQTuiu+gGwLIu9E5J4vRshoIBHScKx4Y
-    f9oniWMsLFHXq5p9GJ/eb9Cr3jgNACnGOIGOqlwBQvP5rCJuaJ0pCRKUAAAAuNE1GtvRNR
-    rbAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBO6K76AbAsi70Tkn
-    i9GyGggEdJwrHhh/2ieJYywsUdermn0Yn95v0KveOA0AKcY4gY6qXAFC8/msIm5onSkJEp
-    QAAAAhAPaO6PiN+1238KMrHg34M7XdftGypt2/UKEz2L2Pf40yAAAAH3NvbXRvY2hpb255
-    ZWt3ZXJlQFNvbXRvY2hpcy1NQlA=
+    b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
+    NhAAAAAwEAAQAAAYEAyF0WPHSGTC1fELE2N+2Inas2VsN8XyeGjMtrPfWIchOz2YCLt1of
+    HCUMgE8x2/v7tN3hZ0s5q8lqW7O9zyc6dnVvEYlmMfd0zG6ThenwANOW5pQhgRqrEKQdQA
+    OGlAUdDh9aSeynl5+1miEPGrmG2csVw2XOZBNgoqkqu13LJBUx0mJhJ4+h45KYnCfRnzJc
+    5kJ1halTbcT52aFQnX0GwtrykiHJvF/3J35Zktg60pspLFgYuRulRmQzfkNSYg494XXitn
+    V5b5H8seGeiMnS7b0yDjjVWoMfdOvn2W/qbAPKr8ro0eGEx/fZAzHj5hvLDgqJkQ+IvfrI
+    xcLRmbpJfxTJ+Pm99hSRXZTLztksCQXFy7qtqZrxxpj7zeMPqJJ8VmU5xm0vUHJKX+lKMN
+    X8TnZOZU8URXK5nF91F2SSopQXIa2O7Xtq/AuAU2A8tQnyLfnPMbIJK4VYkuQVbcO4AtVi
+    Y0rNKEJQDomF2EgAQOEPPj950gt6ZG7zRvON5UWPAAAFgD981gI/fNYCAAAAB3NzaC1yc2
+    EAAAGBAMhdFjx0hkwtXxCxNjftiJ2rNlbDfF8nhozLaz31iHITs9mAi7daHxwlDIBPMdv7
+    +7Td4WdLOavJaluzvc8nOnZ1bxGJZjH3dMxuk4Xp8ADTluaUIYEaqxCkHUADhpQFHQ4fWk
+    nsp5eftZohDxq5htnLFcNlzmQTYKKpKrtdyyQVMdJiYSePoeOSmJwn0Z8yXOZCdYWpU23E
+    +dmhUJ19BsLa8pIhybxf9yd+WZLYOtKbKSxYGLkbpUZkM35DUmIOPeF14rZ1eW+R/LHhno
+    jJ0u29Mg441VqDH3Tr59lv6mwDyq/K6NHhhMf32QMx4+Ybyw4KiZEPiL36yMXC0Zm6SX8U
+    yfj5vfYUkV2Uy87ZLAkFxcu6rama8caY+83jD6iSfFZlOcZtL1BySl/pSjDV/E52TmVPFE
+    VyuZxfdRdkkqKUFyGtju17avwLgFNgPLUJ8i35zzGyCSuFWJLkFW3DuALVYmNKzShCUA6J
+    hdhIAEDhDz4/edILemRu80bzjeVFjwAAAAMBAAEAAAGBAIffsIOg1a31GsG8GzOELqAVik
+    z+VmpE6Ja0H+6tgjEyMUWvSZA2WmCAs2CT1BEFaaU2znN47QwVE75KPs6rIJdSfdaboaUC
+    1b8IwZwPj8VPt8Z379yYVCd906Qkf/ADI7f/BQCarvBAyytRfee2pr8tXH3cnUD6bw7/v0
+    2+hlLa2KV+N7pXSgaE1F8ZFatqwNsZeI8Cy+PlrzWpknyqW5pqVhNJPIA1Z+rtYRsW7ZUC
+    ycIbn/Bv0f3RV6YpS0XZt2OvJtDp9XTOoRKCWeM0VpKqV6ACzL+Gi2lso4iw75zDZaPl+s
+    BNtozqE1GR6ee6NVNhXlcqHw2B6HCE0NqS87YI+nsLVQQ803Z36LUmQYsgCqFL7zCVwNkb
+    BBbbp2jxWRYKf7ZyNef+knVn5N2oj0x+J1fTD8SGHFrF04oIpf1fx3TcIGk8n9TA1EJPHK
+    VkOQLjbMWkPqyJEj62WdyDOYdpz/It4a6xpHaLCneUCZzEKas3OXY+IoPdNVU1zQSC2QAA
+    AMEA3gStXY04rdwWssOO+8zeHtAgTH3wIfSJYz/TcDX/MMWarmZevdv+7OzMAI7jcerkV4
+    H+wux+xl1UZ1mjgcX70tdsEXo4MdDXJNELM3Fps+be245s9EpfzF3w1x43KBeab++0TrT6
+    N5km0G61NUHwcA5flT4dsPFqwwBQLUYnr1JnbEy+FxILHH/Pr0BoxtRS3cPc/TPJEJwSgR
+    OJI/U3TIRy7A/ruN53MWg6+KOwNVBT7/ZgtJ+Bwo+nM1a3hvnFAAAAwQDr58RqF7JBmAdZ
+    tuZA6dd2sJDrWDeQ0ExUcJnHtSgLDMflssazsv1U263UKDejXw3XqLNI8rvcmdAiDvTnAv
+    nb97ofHI4wOVjA+MC///CgnvZ69Nm9RIo5EBuIg8QWq3q65Hpiea2/rQn8V2uzmNHPLOEC
+    oPv4DqUeYqOx1yW5UqmCF+ZVYbzwabuEPs/1TeE6cWQgOIe75ttsNtHyWWBH307vCFYDOD
+    EOmdToAZ0KWKxVfwIFr6CUxOKvBNntLYMAAADBANluSOCSTBvZPb/I0UJuJR3vGGSjlqwT
+    9YhcT0P2Hz2QDobo3gCGkBkLwDUkaioj/vSwYnJvidQD8FM2yfydV68o7Mhq4BbDy9K66T
+    jqWOu7AgU/aTriPfiMV7KaqfVsKhOGSlOTTxf0HpsG38yiiLXlhI2V2kdskMTTR4n3nr+H
+    tZB+zPNKJUviC/DcLo2mizjfGvGUk6DBRShVEmOIfcRUwoeBYn24tKjs/s6WIuDtGFAFZW
+    6erRhI2tHZsEN2BQAAAAd0ZXN0a2V5AQI=
    -----END OPENSSH PRIVATE KEY-----
  identity.pub: |
-    ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBO6K76AbAsi70Tkni9GyGggEdJwrHhh/2ieJYywsUdermn0Yn95v0KveOA0AKcY4gY6qXAFC8/msIm5onSkJEpQ=
-  known_hosts: github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
+    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDIXRY8dIZMLV8QsTY37YidqzZWw3xfJ4aMy2s99YhyE7PZgIu3Wh8cJQyATzHb+/u03eFnSzmryWpbs73PJzp2dW8RiWYx93TMbpOF6fAA05bmlCGBGqsQpB1AA4aUBR0OH1pJ7KeXn7WaIQ8auYbZyxXDZc5kE2CiqSq7XcskFTHSYmEnj6HjkpicJ9GfMlzmQnWFqVNtxPnZoVCdfQbC2vKSIcm8X/cnflmS2DrSmyksWBi5G6VGZDN+Q1JiDj3hdeK2dXlvkfyx4Z6IydLtvTIOONVagx906+fZb+psA8qvyujR4YTH99kDMePmG8sOComRD4i9+sjFwtGZukl/FMn4+b32FJFdlMvO2SwJBcXLuq2pmvHGmPvN4w+oknxWZTnGbS9Qckpf6Uow1fxOdk5lTxRFcrmcX3UXZJKilBchrY7te2r8C4BTYDy1CfIt+c8xsgkrhViS5BVtw7gC1WJjSs0oQlAOiYXYSABA4Q8+P3nSC3pkbvNG843lRY8=
+  known_hosts: github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==

--- a/cmd/flux/testdata/create_secret/git/rsa-password.private
+++ b/cmd/flux/testdata/create_secret/git/rsa-password.private
@@ -0,0 +1,39 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABAZPOy4O0
+XmgKgRJuR9WaShAAAAEAAAAAEAAAGXAAAAB3NzaC1yc2EAAAADAQABAAABgQDmuJnVljOr
+pA3OiaAkCJuPT+lHRb/Kuc7fByldlYihsrNjWKVa9xB844mNrpntevFJ6ESEE13ElY2O8M
+/L58Eh4hmrzqBDtk7XnP/bJVdHAOGvEYavLEeN9K9nZdYYnyOae4OMZacA4oHxUSyrSWvl
+LDTOOZnFYlCkVXogBcvCrg+HZe/FaHmB4R3ni9eojsX/gQII970SD6d2DLhCW3r+qNW03S
+O8bj28xyjGLhVgNPyRimWkeZ8DpiJKm2Ccf2oYqtVp1wtrihz4QZ30cZ0KWxdf2iJKCMhp
+e5B2F8Gw3+3ZWWA8xmg1buDwLkGmroibPY9hUAzt05E8THuwpl7GA/8xdge+LCcCdBhx+i
+WYhcPrQOCD/5ajRM7OkjJbJwRxdZgdYDSUvQNnHYh02pj+ZYjQBARhSRCEkFnxklyNjzSD
+ETwXO5tW57CmcegLS8ig3Z3WcgBX0sdDsttMBmlWt4fb6qPB6ctTjx/wlkC0YlHXuI+Fzm
+CyAP8ikQk63ckAAAWQy3GOOOYpvMAgXIDYUJZnCiy4jnzpt3vX0kIpWogfwqT8QwbuhhDb
+ogQT6mZqt88nKUlRv3eRPmeG6MebsuweMw6WJfP0ZARFJS9+nXfNSJGN+Tqze252C1w2uu
+vlzK1GnY5pnZzpaZAf/d+UAtNXDYdWA1DlJsNsBXgIJVkc47sp/cv6EGced+UXuV+Yr80s
+ECqqOqa+IZWxd+Buca2EWQhG2loLlk6JQ8D+vNm3yhPCrb+1BcoZgxGItL70TdLtUCsmpP
+y+ejnIxiHl79CjSNANBA7SgjJCQWYjFTcNUb98pGMsMVKIqczNtUZrL6WiSBrLDl5luFIb
+bZi6iQsjVU6AUd+rcTSsdCec7xnoDddytmh2oG0tHG9wlCQh9yo0NBGaBQP/euqiSgIAvZ
+zTJTy1AUo/M6FRdMpuGoDrxDPDGj/Q4OsUQzDS0c10WHGv2TLIoloa/FvhjdOn4pXOOIOB
+nzgRn1xEHwgmSsyyiQP8gCEWM3XgLTOZIS+B4AT6hFPGCbbRetqwKF6qG68xsoLmQ5BXJN
+kdIKqT7BlAvvX7t80XnvWiuZUjBS2qyTJ3FWCkyaxQVmrNsfZbg4qRJ377+ip3BwuaTl3X
+VuZEEEy6+cwc+fRL8hPbKKIAcSLjRJnGHMiPvEFcL7yMkmGhv/vd78QdF/0XfVqCGr1gH3
+gO3O//2Bdcp7Vo9QGqlK66Cusk5HiVSv6StQdqoauW2bxF4JKm3azHL1wWkyWtf2FQD425
+0V+qib4Qz4KALj9uPwUyP6umDSk1NSBEMohGYpbm/O/Hpr6x2XET6kYbcK/sb5pDlZ81QQ
+A6GJ87fQyVe0FeoWwg256LiNyDTqFUKm0R508hlnzaAtMnW8TvSqmjrKfLy9YU8IaF0dcS
+kLheF4EwU2B5exumCx5JDe/xbVw5M8bx5m9lMx1NxGwNr2HtLvgMdQCwI5KchBzC+SIfGd
+h94Gv39xRGKAhgtBzRRC5LLnRHeBWuLroWY/MoPDH5dWsMvSDkDjaGWHczlPNeN+epv17O
+G5rR4oyVBfbR5+/qB//1c8avbBrmMLZoFaGMYSQaX8kTcus/Xu5qoDvxlkT4mjb6VvjMq0
+iPUDNz8hAXv6NUlAViMGNV/sKhNcHRmwqkai79p0JJ+Ni635YNY2E7mS6QwVce1KCsUMet
+xjeDItSaLLQTaC2LfLybL9/3ppJiaOusnSN+J+yHvUIu7IsI2a9OpGRGhYIU/25r2KBtFV
+GdSGLNOdI3CB+J6eDXwkt3BmkIVYABc12o94PAXShnCgXK4u6tcowkNKVjyIrE64tckBsr
+l08apsj7SkTbly34MucgKya0pwBQKUXEUSHCQ70h8q4fK0dWrs7ahODXdwj0Lrp6My5eFR
+sV24X8U7kPailGowAVh9f/7afZs9CURwlUDjaXKWewGyQ7j3WVHOXSikOfxxbdQ+19juDO
+1h7Gtk+fKLsq0har0KDnVFSvP16f3ETKfAp5/acmXE4dnJGoo5k2Ak0QUBNIH163biBKS0
+Y6ePms4PghUFWINzaReZi1E4NiXdWKgOLXJBta7fg+ISFCocYdBRk9w3VUZa/1IvgzNg3l
+QxyLLH4YPcAGiSPpwcHhWxh/OMY4m6av9BslsG9ajXBpVto0X3oEa78ZuJVVXWAP2E891g
+I/atxZ+fBkght3oIMiIuyWPeKZVNvdx1eKCU76jCEXxMrlAM47OZEJnaeMdhqPA1ICqERx
+2L9Tq2W30mgwwP/QaDOiqNBn3UWt28ly+LqUOoQKt/w/z9YZUlpN090rs1iWOTkpamXTYd
+o+WewKF1Ax4TbsSfNX7P1ROTeIsQCisu3iFWkym9QZ/2RcZYcEPGGAR3ve8rPS2tsy9nL8
+4TDo1LUXShRgQxOEAsPNJ4440vY=
+-----END OPENSSH PRIVATE KEY-----
--- a/cmd/flux/testdata/create_secret/git/rsa.private
+++ b/cmd/flux/testdata/create_secret/git/rsa.private
@@ -0,0 +1,38 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAYEAyF0WPHSGTC1fELE2N+2Inas2VsN8XyeGjMtrPfWIchOz2YCLt1of
+HCUMgE8x2/v7tN3hZ0s5q8lqW7O9zyc6dnVvEYlmMfd0zG6ThenwANOW5pQhgRqrEKQdQA
+OGlAUdDh9aSeynl5+1miEPGrmG2csVw2XOZBNgoqkqu13LJBUx0mJhJ4+h45KYnCfRnzJc
+5kJ1halTbcT52aFQnX0GwtrykiHJvF/3J35Zktg60pspLFgYuRulRmQzfkNSYg494XXitn
+V5b5H8seGeiMnS7b0yDjjVWoMfdOvn2W/qbAPKr8ro0eGEx/fZAzHj5hvLDgqJkQ+IvfrI
+xcLRmbpJfxTJ+Pm99hSRXZTLztksCQXFy7qtqZrxxpj7zeMPqJJ8VmU5xm0vUHJKX+lKMN
+X8TnZOZU8URXK5nF91F2SSopQXIa2O7Xtq/AuAU2A8tQnyLfnPMbIJK4VYkuQVbcO4AtVi
+Y0rNKEJQDomF2EgAQOEPPj950gt6ZG7zRvON5UWPAAAFgD981gI/fNYCAAAAB3NzaC1yc2
+EAAAGBAMhdFjx0hkwtXxCxNjftiJ2rNlbDfF8nhozLaz31iHITs9mAi7daHxwlDIBPMdv7
+7Td4WdLOavJaluzvc8nOnZ1bxGJZjH3dMxuk4Xp8ADTluaUIYEaqxCkHUADhpQFHQ4fWk
+nsp5eftZohDxq5htnLFcNlzmQTYKKpKrtdyyQVMdJiYSePoeOSmJwn0Z8yXOZCdYWpU23E
+dmhUJ19BsLa8pIhybxf9yd+WZLYOtKbKSxYGLkbpUZkM35DUmIOPeF14rZ1eW+R/LHhno
+jJ0u29Mg441VqDH3Tr59lv6mwDyq/K6NHhhMf32QMx4+Ybyw4KiZEPiL36yMXC0Zm6SX8U
+yfj5vfYUkV2Uy87ZLAkFxcu6rama8caY+83jD6iSfFZlOcZtL1BySl/pSjDV/E52TmVPFE
+VyuZxfdRdkkqKUFyGtju17avwLgFNgPLUJ8i35zzGyCSuFWJLkFW3DuALVYmNKzShCUA6J
+hdhIAEDhDz4/edILemRu80bzjeVFjwAAAAMBAAEAAAGBAIffsIOg1a31GsG8GzOELqAVik
+z+VmpE6Ja0H+6tgjEyMUWvSZA2WmCAs2CT1BEFaaU2znN47QwVE75KPs6rIJdSfdaboaUC
+1b8IwZwPj8VPt8Z379yYVCd906Qkf/ADI7f/BQCarvBAyytRfee2pr8tXH3cnUD6bw7/v0
+2+hlLa2KV+N7pXSgaE1F8ZFatqwNsZeI8Cy+PlrzWpknyqW5pqVhNJPIA1Z+rtYRsW7ZUC
+ycIbn/Bv0f3RV6YpS0XZt2OvJtDp9XTOoRKCWeM0VpKqV6ACzL+Gi2lso4iw75zDZaPl+s
+BNtozqE1GR6ee6NVNhXlcqHw2B6HCE0NqS87YI+nsLVQQ803Z36LUmQYsgCqFL7zCVwNkb
+BBbbp2jxWRYKf7ZyNef+knVn5N2oj0x+J1fTD8SGHFrF04oIpf1fx3TcIGk8n9TA1EJPHK
+VkOQLjbMWkPqyJEj62WdyDOYdpz/It4a6xpHaLCneUCZzEKas3OXY+IoPdNVU1zQSC2QAA
+AMEA3gStXY04rdwWssOO+8zeHtAgTH3wIfSJYz/TcDX/MMWarmZevdv+7OzMAI7jcerkV4
+H+wux+xl1UZ1mjgcX70tdsEXo4MdDXJNELM3Fps+be245s9EpfzF3w1x43KBeab++0TrT6
+N5km0G61NUHwcA5flT4dsPFqwwBQLUYnr1JnbEy+FxILHH/Pr0BoxtRS3cPc/TPJEJwSgR
+OJI/U3TIRy7A/ruN53MWg6+KOwNVBT7/ZgtJ+Bwo+nM1a3hvnFAAAAwQDr58RqF7JBmAdZ
+tuZA6dd2sJDrWDeQ0ExUcJnHtSgLDMflssazsv1U263UKDejXw3XqLNI8rvcmdAiDvTnAv
+nb97ofHI4wOVjA+MC///CgnvZ69Nm9RIo5EBuIg8QWq3q65Hpiea2/rQn8V2uzmNHPLOEC
+oPv4DqUeYqOx1yW5UqmCF+ZVYbzwabuEPs/1TeE6cWQgOIe75ttsNtHyWWBH307vCFYDOD
+EOmdToAZ0KWKxVfwIFr6CUxOKvBNntLYMAAADBANluSOCSTBvZPb/I0UJuJR3vGGSjlqwT
+9YhcT0P2Hz2QDobo3gCGkBkLwDUkaioj/vSwYnJvidQD8FM2yfydV68o7Mhq4BbDy9K66T
+jqWOu7AgU/aTriPfiMV7KaqfVsKhOGSlOTTxf0HpsG38yiiLXlhI2V2kdskMTTR4n3nr+H
+tZB+zPNKJUviC/DcLo2mizjfGvGUk6DBRShVEmOIfcRUwoeBYn24tKjs/s6WIuDtGFAFZW
+6erRhI2tHZsEN2BQAAAAd0ZXN0a2V5AQI=
+-----END OPENSSH PRIVATE KEY-----
--- a/cmd/flux/testdata/diff-kustomization/deployment.yaml
+++ b/cmd/flux/testdata/diff-kustomization/deployment.yaml
@@ -1,78 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-      kustomize.toolkit.fluxcd.io/name: podinfo
-      kustomize.toolkit.fluxcd.io/namespace: {{ .fluxns }}
-  name: podinfo
-  namespace: default
-spec:
-  minReadySeconds: 3
-  revisionHistoryLimit: 5
-  progressDeadlineSeconds: 60
-  strategy:
-    rollingUpdate:
-      maxUnavailable: 0
-    type: RollingUpdate
-  selector:
-    matchLabels:
-      app: podinfo
-  template:
-    metadata:
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "9797"
-      labels:
-        app: podinfo
-    spec:
-      containers:
-      - name: podinfod
-        image: ghcr.io/stefanprodan/podinfo:6.0.10
-        imagePullPolicy: IfNotPresent
-        ports:
-        - name: http
-          containerPort: 9898
-          protocol: TCP
-        - name: http-metrics
-          containerPort: 9797
-          protocol: TCP
-        - name: grpc
-          containerPort: 9999
-          protocol: TCP
-        command:
-        - ./podinfo
-        - --port=9898
-        - --port-metrics=9797
-        - --grpc-port=9999
-        - --grpc-service-name=podinfo
-        - --level=info
-        - --random-delay=false
-        - --random-error=false
-        env:
-        - name: PODINFO_UI_COLOR
-          value: "#34577c"
-        livenessProbe:
-          exec:
-            command:
-            - podcli
-            - check
-            - http
-            - localhost:9898/healthz
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
-        readinessProbe:
-          exec:
-            command:
-            - podcli
-            - check
-            - http
-            - localhost:9898/readyz
-          initialDelaySeconds: 5
-          timeoutSeconds: 5
-        resources:
-          limits:
-            cpu: 2000m
-            memory: 512Mi
-          requests:
-            cpu: 100m
-            memory: 64Mi
--- a/cmd/flux/testdata/diff-kustomization/diff-with-deployment.golden
+++ b/cmd/flux/testdata/diff-kustomization/diff-with-deployment.golden
@@ -1,6 +0,0 @@
-► HorizontalPodAutoscaler/default/podinfo created
-► Service/default/podinfo created
-► Secret/default/docker-secret created
-► Secret/default/secret-basic-auth-stringdata created
-► Secret/default/podinfo-token-77t89m9b67 created
-► Secret/default/db-user-pass-bkbd782d2c created
--- a/cmd/flux/testdata/diff-kustomization/diff-with-dockerconfigjson-sops-secret.golden
+++ b/cmd/flux/testdata/diff-kustomization/diff-with-dockerconfigjson-sops-secret.golden
@@ -1,6 +0,0 @@
-► Deployment/default/podinfo created
-► HorizontalPodAutoscaler/default/podinfo created
-► Service/default/podinfo created
-► Secret/default/secret-basic-auth-stringdata created
-► Secret/default/podinfo-token-77t89m9b67 created
-► Secret/default/db-user-pass-bkbd782d2c created
--- a/Show More
+++ b/Show More