Concept: encrypt init command for SOPS bootstrap

Signed-off-by: Hidde Beydals <hello@hidde.co>

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,46 @@
+---
+name: Bug report
+about: Create a report to help us improve Flux v2
+title: ''
+assignees: ''
+
+---
+
+<!--
+
+Find out more about your support options and getting help at
+
+   https://fluxcd.io/support/
+
+-->
+
+### Describe the bug
+
+A clear and concise description of what the bug is.
+
+### To Reproduce
+
+Steps to reproduce the behaviour:
+
+1. Provide Flux install instructions
+2. Provide a GitHub repository with Kubernetes manifests
+
+### Expected behavior
+
+A clear and concise description of what you expected to happen.
+
+### Additional context
+
+- Kubernetes version:
+- Git provider:
+- Container registry provider:
+
+Below please provide the output of the following commands:
+
+```cli
+flux --version
+flux check
+kubectl -n <namespace> get all
+kubectl -n <namespace> logs deploy/source-controller
+kubectl -n <namespace> logs deploy/kustomize-controller
+```

.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -1,84 +0,0 @@
----
-name: Bug report
-description: Create a report to help us improve Flux
-body:
-- type: markdown
-  attributes:
-    value: |
-      ## Support
-      Find out more about your support options and getting help at: https://fluxcd.io/support/
-- type: textarea
-  validations:
-    required: true
-  attributes:
-    label: Describe the bug
-    description: A clear description of what the bug is.
-- type: textarea
-  validations:
-    required: true
-  attributes:
-    label: Steps to reproduce
-    description: |
-      Steps to reproduce the problem.
-    placeholder: |
-      For example:
-      1. Install Flux with the additional image automation controllers
-      2. Run command '...'
-      3. See error
-- type: textarea
-  validations:
-    required: true
-  attributes:
-    label: Expected behavior
-    description: A brief description of what you expected to happen.
-- type: textarea
-  attributes:
-    label: Screenshots and recordings
-    description: |
-      If applicable, add screenshots to help explain your problem. You can also record an asciinema session: https://asciinema.org/
-- type: input
-  validations:
-    required: true
-  attributes:
-    label: OS / Distro
-    description: The OS / distro you are executing `flux` on. If not applicable, write `N/A`.
-    placeholder: e.g. Windows 10, Ubuntu 20.04, Arch Linux, macOS 10.15...
-- type: input
-  validations:
-    required: true
-  attributes:
-    label: Flux version
-    description: Run `flux version --client`. If not applicable, write `N/A`.
-    placeholder: e.g. v0.20.1
-- type: textarea
-  validations:
-    required: true
-  attributes:
-    label: Flux check
-    description: Run `flux check`. If not applicable, write `N/A`.
-    placeholder: |
-      For example:
-      ► checking prerequisites
-      ✔ Kubernetes 1.21.1 >=1.19.0-0
-      ► checking controllers
-      ✔ all checks passed
-- type: input
-  attributes:
-    label: Git provider
-    description: If applicable, add the Git provider you are having problems with, e.g. GitHub (Enterprise), GitLab, etc.
-- type: input
-  attributes:
-    label: Container Registry provider
-    description: If applicable, add the Container Registry provider you are having problems with, e.g. DockerHub, GitHub Packages, Quay.io, etc.
-- type: textarea
-  attributes:
-    label: Additional context
-    description: Add any other context about the problem here. This can be logs (e.g. output from `flux logs`), environment specific caveats, etc.
-- type: checkboxes
-  id: terms
-  attributes:
-    label: Code of Conduct
-    description: By submitting this issue, you agree to follow our [Code of Conduct](https://github.com/fluxcd/.github/blob/main/CODE_OF_CONDUCT.md)
-    options:
-    - label: I agree to follow this project's Code of Conduct
-      required: true

.github/aur/flux-bin/.SRCINFO.template

@@ -8,15 +8,10 @@ pkgbase = flux-bin
 	arch = armv7h
 	arch = aarch64
 	license = APACHE
-	optdepends = bash-completion: auto-completion for flux in Bash
+	optdepends = kubectl
-	optdepends = zsh-completions: auto-completion for flux in ZSH
+	source_x86_64 = flux-bin-${PKGVER}.tar.gz::https://github.com/fluxcd/flux2/releases/download/v1/flux_${PKGVER}_linux_amd64.tar.gz
-	source_x86_64 = ${PKGNAME}-${PKGVER}.tar.gz::https://github.com/fluxcd/flux2/releases/download/v${PKGVER}/flux_${PKGVER}_linux_amd64.tar.gz
+	source_armv6h = flux-bin-${PKGVER}.tar.gz::https://github.com/fluxcd/flux2/releases/download/v1/flux_${PKGVER}_linux_arm.tar.gz
-	sha256sums_x86_64 = ${SHA256SUM_AMD64}
+	source_armv7h = flux-bin-${PKGVER}.tar.gz::https://github.com/fluxcd/flux2/releases/download/v1/flux_${PKGVER}_linux_arm.tar.gz
-	source_armv6h = ${PKGNAME}-${PKGVER}.tar.gz::https://github.com/fluxcd/flux2/releases/download/v${PKGVER}/flux_${PKGVER}_linux_arm.tar.gz
+	source_aarch64 = flux-bin-${PKGVER}.tar.gz::https://github.com/fluxcd/flux2/releases/download/v1/flux_${PKGVER}_linux_arm64.tar.gz
-	sha256sums_armv6h = ${SHA256SUM_ARM}
-	source_armv7h = ${PKGNAME}-${PKGVER}.tar.gz::https://github.com/fluxcd/flux2/releases/download/v${PKGVER}/flux_${PKGVER}_linux_arm.tar.gz
-	sha256sums_armv7h = ${SHA256SUM_ARM}
-	source_aarch64 = ${PKGNAME}-${PKGVER}.tar.gz::https://github.com/fluxcd/flux2/releases/download/v${PKGVER}/flux_${PKGVER}_linux_arm64.tar.gz
-	sha256sums_aarch64 = ${SHA256SUM_ARM64}
 
 pkgname = flux-bin

.github/aur/flux-bin/PKGBUILD.template

@@ -8,8 +8,9 @@ pkgdesc="Open and extensible continuous delivery solution for Kubernetes"
 url="https://fluxcd.io/"
 arch=("x86_64" "armv6h" "armv7h" "aarch64")
 license=("APACHE")
-optdepends=('bash-completion: auto-completion for flux in Bash'
+optdepends=('kubectl: for apply actions on the Kubernetes cluster',
-            'zsh-completions: auto-completion for flux in ZSH')
+'bash-completion: auto-completion for flux in Bash',
+'zsh-completions: auto-completion for flux in ZSH')
 source_x86_64=(
   "${pkgname}-${pkgver}.tar.gz::https://github.com/fluxcd/flux2/releases/download/v${pkgver}/flux_${pkgver}_linux_amd64.tar.gz"
 )

.github/aur/flux-go/.SRCINFO.template

@@ -10,6 +10,7 @@ pkgbase = flux-go
 	license = APACHE
 	makedepends = go
 	depends = glibc
+	optdepends = kubectl
 	provides = flux-bin
 	conflicts = flux-bin
   replaces = flux-cli

.github/aur/flux-go/PKGBUILD.template

@@ -12,8 +12,9 @@ provides=("flux-bin")
 conflicts=("flux-bin")
 replaces=("flux-cli")
 depends=("glibc")
-makedepends=('go>=1.17', 'kustomize>=3.0')
+makedepends=('go>=1.16', 'kustomize>=3.0')
-optdepends=('bash-completion: auto-completion for flux in Bash',
+optdepends=('kubectl: for apply actions on the Kubernetes cluster',
+'bash-completion: auto-completion for flux in Bash',
 'zsh-completions: auto-completion for flux in ZSH')
 source=(
   "${pkgname}-${pkgver}.tar.gz::https://github.com/fluxcd/flux2/archive/v${pkgver}.tar.gz"
@@ -30,20 +31,12 @@ build() {
   export CGO_CXXFLAGS="$CXXFLAGS"
   export CGO_CPPFLAGS="$CPPFLAGS"
   export GOFLAGS="-buildmode=pie -trimpath -mod=readonly -modcacherw"
-  make cmd/flux/.manifests.done
+  ./manifests/scripts/bundle.sh "${PWD}/manifests" "${PWD}/cmd/flux/manifests"
   go build -ldflags "-linkmode=external -X main.VERSION=${pkgver}" -o ${_srcname} ./cmd/flux
 }
 
 check() {
   cd "flux2-${pkgver}"
-  case $CARCH in
-    aarch64)
-      export ENVTEST_ARCH=arm64
-      ;;
-    armv6h|armv7h)
-      export ENVTEST_ARCH=arm
-      ;;
-  esac
   make test
 }
 

.github/aur/flux-scm/.SRCINFO.template

@@ -10,6 +10,7 @@ pkgbase = flux-scm
 	license = APACHE
 	makedepends = go
 	depends = glibc
+	optdepends = kubectl
 	provides = flux-bin
 	conflicts = flux-bin
 	source = git+https://github.com/fluxcd/flux2.git

.github/aur/flux-scm/PKGBUILD.template

@@ -11,8 +11,9 @@ license=("APACHE")
 provides=("flux-bin")
 conflicts=("flux-bin")
 depends=("glibc")
-makedepends=('go>=1.17', 'kustomize>=3.0', 'git')
+makedepends=('go>=1.16', 'kustomize>=3.0')
-optdepends=('bash-completion: auto-completion for flux in Bash',
+optdepends=('kubectl: for apply actions on the Kubernetes cluster',
+'bash-completion: auto-completion for flux in Bash',
 'zsh-completions: auto-completion for flux in ZSH')
 source=(
   "git+https://github.com/fluxcd/flux2.git"
@@ -32,20 +33,12 @@ build() {
   export CGO_CXXFLAGS="$CXXFLAGS"
   export CGO_CPPFLAGS="$CPPFLAGS"
   export GOFLAGS="-buildmode=pie -trimpath -mod=readonly -modcacherw"
-  make cmd/flux/.manifests.done
+  make cmd/flux/manifests
   go build -ldflags "-linkmode=external -X main.VERSION=${pkgver}" -o ${_srcname} ./cmd/flux
 }
 
 check() {
   cd "flux2"
-  case $CARCH in
-    aarch64)
-      export ENVTEST_ARCH=arm64
-      ;;
-    armv6h|armv7h)
-      export ENVTEST_ARCH=arm
-      ;;
-  esac
   make test
 }
 

.github/runners/README.md

@@ -1,72 +0,0 @@
-# Flux ARM64 GitHub runners
-
-The Flux ARM64 end-to-end tests run on Equinix instances provisioned with Docker and GitHub self-hosted runners.
-
-## Current instances
-
-| Runner        | Instance            | Region |
-|---------------|---------------------|--------|
-| equinix-arm-1 | flux-equinix-arm-01 | AMS1   |
-| equinix-arm-2 | flux-equinix-arm-01 | AMS1   |
-| equinix-arm-3 | flux-equinix-arm-01 | AMS1   |
-| equinix-arm-4 | flux-equinix-arm-02 | DFW2   |
-| equinix-arm-5 | flux-equinix-arm-02 | DFW2   |
-| equinix-arm-6 | flux-equinix-arm-02 | DFW2   |
-
-## Instance setup
-
-In order to add a new runner to the GitHub Actions pool,
-first create a server on Equinix with the following configuration:
-- Type: c2.large.arm
-- OS: Ubuntu 20.04
-
-### Install prerequisites
-
-- SSH into a newly created instance
-```shell
-ssh root@<instance-public-IP>
-``` 
-
-- Create the ubuntu user
-```shell
-adduser ubuntu
-usermod -aG sudo ubuntu
-su - ubuntu
-```
-
-- Create the prerequisites dir
-```shell
-mkdir -p prereq && cd prereq
-```
-
-- Download the prerequisites script
-```shell
-curl -sL https://raw.githubusercontent.com/fluxcd/flux2/main/.github/runners/prereq.sh > prereq.sh \
-  && chmod +x ./prereq.sh
-```
-
-- Install the prerequisites
-```shell
-sudo ./prereq.sh
-```
-
-### Install runners
-
-- Retrieve the GitHub runner token from the repository [settings page](https://github.com/fluxcd/flux2/settings/actions/runners/new?arch=arm64&os=linux)
-
-- Create 3 directories `runner1`, `runner2`, `runner3`
-
-- In each dir run:
-```shell
-curl -sL https://raw.githubusercontent.com/fluxcd/flux2/main/.github/runners/runner-setup.sh > runner-setup.sh \
-  && chmod +x ./runner-setup.sh
-
-./runner-setup.sh equinix-arm-<NUMBER> <TOKEN>
-```
-
-- Reboot the instance
-```shell
-sudo reboot
-```
-
-- Navigate to the GitHub repository [runners page](https://github.com/fluxcd/flux2/settings/actions/runners) and check the runner status

.github/runners/prereq.sh

@@ -1,68 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright 2021 The Flux authors. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# This script installs the prerequisites for running Flux end-to-end tests with Docker and GitHub self-hosted runners.
-
-set -eu
-
-KIND_VERSION=0.14.0
-KUBECTL_VERSION=1.24.0
-KUSTOMIZE_VERSION=4.5.4
-HELM_VERSION=3.8.2
-GITHUB_RUNNER_VERSION=2.291.1
-PACKAGES="apt-transport-https ca-certificates software-properties-common build-essential libssl-dev gnupg lsb-release jq pkg-config"
-
-# install prerequisites
-apt-get update \
-  && apt-get install -y -q ${PACKAGES} \
-  && apt-get clean \
-  && rm -rf /var/lib/apt/lists/*
-
-# install docker
-curl -fsSL https://get.docker.com -o get-docker.sh \
-  && chmod +x get-docker.sh
-./get-docker.sh
-systemctl enable docker.service
-systemctl enable containerd.service
-usermod -aG docker ubuntu
-
-# install kind
-curl -Lo ./kind https://kind.sigs.k8s.io/dl/v${KIND_VERSION}/kind-linux-arm64
-install -o root -g root -m 0755 kind /usr/local/bin/kind
-
-# install kubectl
-curl -LO "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/arm64/kubectl"
-install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
-
-# install kustomize
-curl -Lo ./kustomize.tar.gz https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2Fv${KUSTOMIZE_VERSION}/kustomize_v${KUSTOMIZE_VERSION}_linux_arm64.tar.gz \
-  && tar -zxvf kustomize.tar.gz \
-  && rm kustomize.tar.gz
-install -o root -g root -m 0755 kustomize /usr/local/bin/kustomize
-
-# install helm
-curl -Lo ./helm.tar.gz https://get.helm.sh/helm-v${HELM_VERSION}-linux-arm64.tar.gz \
-  && tar -zxvf helm.tar.gz \
-  && rm helm.tar.gz
-install -o root -g root -m 0755 linux-arm64/helm /usr/local/bin/helm
-
-# download runner
-curl -o actions-runner-linux-arm64.tar.gz -L https://github.com/actions/runner/releases/download/v${GITHUB_RUNNER_VERSION}/actions-runner-linux-arm64-${GITHUB_RUNNER_VERSION}.tar.gz \
-  && tar xzf actions-runner-linux-arm64.tar.gz \
-  && rm actions-runner-linux-arm64.tar.gz
-
-# install runner dependencies
-./bin/installdependencies.sh

.github/runners/runner-setup.sh

@@ -1,37 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright 2021 The Flux authors. All rights reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# This script installs a GitHub self-hosted ARM64 runner for running Flux end-to-end tests.
-
-set -eu
-
-RUNNER_NAME=$1
-REPOSITORY_TOKEN=$2
-REPOSITORY_URL=${3:-https://github.com/fluxcd/flux2}
-
-GITHUB_RUNNER_VERSION=2.285.1
-
-# download runner
-curl -o actions-runner-linux-arm64.tar.gz -L https://github.com/actions/runner/releases/download/v${GITHUB_RUNNER_VERSION}/actions-runner-linux-arm64-${GITHUB_RUNNER_VERSION}.tar.gz \
-  && tar xzf actions-runner-linux-arm64.tar.gz \
-  && rm actions-runner-linux-arm64.tar.gz
-
-# register runner with GitHub
-./config.sh --unattended --url ${REPOSITORY_URL} --token ${REPOSITORY_TOKEN} --name ${RUNNER_NAME}
-
-# start runner
-sudo ./svc.sh install
-sudo ./svc.sh start

.github/workflows/bootstrap.yaml

@@ -12,28 +12,25 @@ jobs:
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2
       - name: Restore Go cache
-        uses: actions/cache@v3
+        uses: actions/cache@v1
         with:
           path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go1.18-${{ hashFiles('**/go.sum') }}
+          key: ${{ runner.os }}-go1.16-${{ hashFiles('**/go.sum') }}
           restore-keys: |
-            ${{ runner.os }}-go1.18-
+            ${{ runner.os }}-go1.16-
       - name: Setup Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v2
         with:
-          go-version: 1.18.x
+          go-version: 1.16.x
       - name: Setup Kubernetes
         uses: engineerd/setup-kind@v0.5.0
-        with:
-          version: v0.11.1
-          image: kindest/node:v1.21.1@sha256:69860bda5563ac81e3c0057d654b5253219618a22ec3a346306239bba8cfa1a6
       - name: Setup Kustomize
         uses: fluxcd/pkg//actions/kustomize@main
       - name: Build
         run: |
-          make cmd/flux/.manifests.done
+          make cmd/flux/manifests
           go build -o /tmp/flux ./cmd/flux
       - name: Set outputs
         id: vars
@@ -64,65 +61,21 @@ jobs:
           --team=team-z
         env:
           GITHUB_TOKEN: ${{ secrets.GITPROVIDER_BOT_TOKEN }}
-      - name: bootstrap customize
+      - name: uninstall
+        run: |
+          /tmp/flux uninstall -s --keep-namespace
+          kubectl delete ns flux-system --timeout=10m --wait=true
+      - name: bootstrap reinstall
         run: |
-          make setup-bootstrap-patch
           /tmp/flux bootstrap github --manifests ./manifests/install/ \
           --owner=fluxcd-testing \
           --repository=${{ steps.vars.outputs.test_repo_name }} \
           --branch=main \
           --path=test-cluster \
           --team=team-z
-          if [ $(kubectl get deployments.apps source-controller -o jsonpath='{.spec.template.spec.securityContext.runAsUser}') != "10000" ]; then
-          echo "Bootstrap not customized as controller is not running as user 10000" && exit 1
-          fi
         env:
           GITHUB_TOKEN: ${{ secrets.GITPROVIDER_BOT_TOKEN }}
-          GITHUB_REPO_NAME: ${{ steps.vars.outputs.test_repo_name }}
-          GITHUB_ORG_NAME: fluxcd-testing
-      - name: libgit2
-        run: |
-          /tmp/flux create source git test-libgit2 \
-          --url=ssh://git@github.com/fluxcd-testing/${{ steps.vars.outputs.test_repo_name }} \
-          --git-implementation=libgit2 \
-          --secret-ref=flux-system \
-          --branch=main
-      - name: uninstall
-        run: |
-          /tmp/flux uninstall -s --keep-namespace
-          kubectl delete ns flux-system --timeout=10m --wait=true
-      - name: test image automation
-        run: |
-          make setup-image-automation
-          /tmp/flux bootstrap github --manifests ./manifests/install/ \
-          --owner=fluxcd-testing \
-          --repository=${{ steps.vars.outputs.test_repo_name }} \
-          --branch=main \
-          --path=test-cluster \
-          --read-write-key
-          /tmp/flux reconcile image repository podinfo
-          /tmp/flux reconcile image update flux-system
-          /tmp/flux get images all
-          
-          retries=10
-          count=0
-          ok=false
-          until ${ok}; do
-              /tmp/flux get image update flux-system | grep 'commit' && ok=true || ok=false
-              count=$(($count + 1))
-              if [[ ${count} -eq ${retries} ]]; then
-                  echo "No more retries left"
-                  exit 1
-              fi
-              sleep 6
-              /tmp/flux reconcile image update flux-system
-          done
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITPROVIDER_BOT_TOKEN }}
-          GITHUB_REPO_NAME: ${{ steps.vars.outputs.test_repo_name }}
-          GITHUB_ORG_NAME: fluxcd-testing
       - name: delete repository
-        if: ${{ always() }}
         run: |
           curl \
             -X DELETE \

.github/workflows/e2e-arm64.yaml

@@ -6,32 +6,104 @@ on:
     branches: [ main, update-components ]
 
 jobs:
-  test:
+  ampere:
-    # Hosted on Equinix
+    # Runner info
-    # Docs: https://github.com/fluxcd/flux2/tree/main/.github/runners
+    # Owner: Stefan Prodan
-    runs-on: [self-hosted, Linux, ARM64, equinix]
+    # VM: Oracle Cloud VM.Standard.A1.Flex 4CPU 24GB RAM
+    # OS: Linux 5.4.0-1045-oracle #49-Ubuntu SMP aarch64
+    # Packages: docker, kind, kubectl, kustomize
+    runs-on: [self-hosted, Linux, ARM64]
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2
       - name: Setup Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v2
         with:
-          go-version: 1.18.x
+          go-version: 1.16.x
       - name: Prepare
         id: prep
         run: |
           echo ::set-output name=CLUSTER::arm64-${GITHUB_SHA:0:7}-$(date +%s)
           echo ::set-output name=CONTEXT::kind-arm64-${GITHUB_SHA:0:7}-$(date +%s)
+      - name: Run unit tests
+        run: make test
+      - name: Check if working tree is dirty
+        run: |
+          if [[ $(git diff --stat) != '' ]]; then
+            git diff
+            echo 'run make test and commit changes'
+            exit 1
+          fi
       - name: Build
         run: |
-          make build
+          go build -o /tmp/flux ./cmd/flux
       - name: Setup Kubernetes Kind
         run: |
-          kind create cluster --name ${{ steps.prep.outputs.CLUSTER }} --kubeconfig=/tmp/${{ steps.prep.outputs.CLUSTER }}
+          kind create cluster --name ${{ steps.prep.outputs.CLUSTER }}
-      - name: Run e2e tests
+      - name: flux check --pre
-        run: TEST_KUBECONFIG=/tmp/${{ steps.prep.outputs.CLUSTER }} make e2e
+        run: |
+          /tmp/flux check --pre \
+          --context ${{ steps.prep.outputs.CONTEXT }}
+      - name: flux install
+        run: |
+          /tmp/flux install \
+          --components-extra=image-reflector-controller,image-automation-controller \
+          --context ${{ steps.prep.outputs.CONTEXT }}
+      - name: flux create source git
+        run: |
+          /tmp/flux create source git podinfo-gogit \
+            --git-implementation=go-git \
+            --url https://github.com/stefanprodan/podinfo  \
+            --tag-semver=">1.0.0" \
+            --context ${{ steps.prep.outputs.CONTEXT }}
+          /tmp/flux create source git podinfo-libgit2 \
+            --git-implementation=libgit2 \
+            --url https://github.com/stefanprodan/podinfo  \
+            --branch="master" \
+            --context ${{ steps.prep.outputs.CONTEXT }}
+      - name: flux create kustomization
+        run: |
+          /tmp/flux create kustomization podinfo \
+            --source=podinfo-gogit \
+            --path="./deploy/overlays/dev" \
+            --prune=true \
+            --interval=5m \
+            --validation=client \
+            --health-check="Deployment/frontend.dev" \
+            --health-check="Deployment/backend.dev" \
+            --health-check-timeout=3m \
+            --context ${{ steps.prep.outputs.CONTEXT }}
+      - name: flux create tenant
+        run: |
+          /tmp/flux create tenant dev-team \
+            --with-namespace=apps \
+            --context ${{ steps.prep.outputs.CONTEXT }}
+      - name: flux create helmrelease
+        run: |
+          /tmp/flux -n apps create source helm podinfo \
+            --url https://stefanprodan.github.io/podinfo \
+            --context ${{ steps.prep.outputs.CONTEXT }}
+
+          /tmp/flux -n apps create hr podinfo-helm \
+            --source=HelmRepository/podinfo \
+            --chart=podinfo \
+            --chart-version="6.0.x" \
+            --service-account=dev-team \
+            --context ${{ steps.prep.outputs.CONTEXT }}
+      - name: flux get all
+        run: |
+          /tmp/flux get all --all-namespaces \
+            --context ${{ steps.prep.outputs.CONTEXT }}
+      - name: flux uninstall
+        run: |
+          /tmp/flux uninstall -s \
+            --context ${{ steps.prep.outputs.CONTEXT }}
+      - name: Debug failure
+        if: failure()
+        run: |
+          kubectl --context ${{ steps.prep.outputs.CONTEXT }} -n flux-system get all
+          /tmp/flux logs --all-namespaces
       - name: Cleanup
         if: always()
         run: |
           kind delete cluster --name ${{ steps.prep.outputs.CLUSTER }}
-          rm /tmp/${{ steps.prep.outputs.CLUSTER }}

.github/workflows/e2e-azure.yaml

@@ -1,66 +0,0 @@
-name: e2e-azure
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron:  '0 6 * * *'
-  push:
-    branches: [ azure* ]
-
-jobs:
-  e2e:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Restore Go cache
-        uses: actions/cache@v3
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go1.18-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go1.18-
-      - name: Setup Go
-        uses: actions/setup-go@v2
-        with:
-          go-version: 1.18.x
-      - name: Install libgit2
-        run: |
-          sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 648ACFD622F3D138
-          sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 0E98404D386FA1D9
-          echo "deb http://deb.debian.org/debian unstable main" | sudo tee -a /etc/apt/sources.list
-          echo "deb-src http://deb.debian.org/debian unstable main" | sudo tee -a /etc/apt/sources.list
-          sudo apt-get update
-          sudo apt-get install -y --allow-downgrades libgit2-dev/unstable zlib1g-dev/unstable libssh2-1-dev/unstable libpcre3-dev/unstable
-      - name: Setup Flux CLI
-        run: |
-          make build
-          mkdir -p $HOME/.local/bin
-          mv ./bin/flux $HOME/.local/bin
-      - name: Setup SOPS
-        run: |
-          wget https://github.com/mozilla/sops/releases/download/v3.7.1/sops-v3.7.1.linux
-          chmod +x sops-v3.7.1.linux
-          mkdir -p $HOME/.local/bin
-          mv sops-v3.7.1.linux $HOME/.local/bin/sops
-      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v1
-        with:
-          terraform_version: 1.0.7
-          terraform_wrapper: false
-      - name: Setup Azure CLI
-        run: |
-          curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
-      - name: Run Azure e2e tests
-        env:
-          ARM_CLIENT_ID: ${{ secrets.ARM_CLIENT_ID }}
-          ARM_CLIENT_SECRET: ${{ secrets.ARM_CLIENT_SECRET }}
-          ARM_SUBSCRIPTION_ID: ${{ secrets.ARM_SUBSCRIPTION_ID }}
-          ARM_TENANT_ID: ${{ secrets.ARM_TENANT_ID }}
-        run: |
-          echo $HOME
-          echo $PATH
-          ls $HOME/.local/bin
-          az login --service-principal -u ${ARM_CLIENT_ID} -p ${ARM_CLIENT_SECRET} -t ${ARM_TENANT_ID}
-          cd ./tests/azure
-          go test -v -coverprofile cover.out -timeout 60m .

.github/workflows/e2e.yaml

@@ -4,46 +4,39 @@ on:
   push:
     branches: [ main ]
   pull_request:
-    branches: [ main, oci ]
+    branches: [ main ]
 
 jobs:
   kind:
     runs-on: ubuntu-latest
-    services:
-      registry:
-        image: registry:2
-        ports:
-          - 5000:5000
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2
       - name: Restore Go cache
-        uses: actions/cache@v3
+        uses: actions/cache@v1
         with:
           path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go1.18-${{ hashFiles('**/go.sum') }}
+          key: ${{ runner.os }}-go1.16-${{ hashFiles('**/go.sum') }}
           restore-keys: |
-            ${{ runner.os }}-go1.18-
+            ${{ runner.os }}-go1.16-
       - name: Setup Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v2
         with:
-          go-version: 1.18.x
+          go-version: 1.16.x
       - name: Setup Kubernetes
         uses: engineerd/setup-kind@v0.5.0
         with:
-          version: v0.11.1
+          version: "v0.10.0"
-          image: kindest/node:v1.20.7
+          image: kindest/node:v1.20.2@sha256:8f7ea6e7642c0da54f04a7ee10431549c0257315b3a634f6ef2fecaaedb19bab
           config: .github/kind/config.yaml # disable KIND-net
       - name: Setup Calico for network policy
         run: |
-          kubectl apply -f https://docs.projectcalico.org/v3.20/manifests/calico.yaml
+          kubectl apply -f https://docs.projectcalico.org/v3.16/manifests/calico.yaml
           kubectl -n kube-system set env daemonset/calico-node FELIX_IGNORELOOSERPF=true
       - name: Setup Kustomize
         uses: fluxcd/pkg//actions/kustomize@main
-      - name: Run tests
+      - name: Run test
         run: make test
-      - name: Run e2e tests
-        run: TEST_KUBECONFIG=$HOME/.kube/config make e2e
       - name: Check if working tree is dirty
         run: |
           if [[ $(git diff --stat) != '' ]]; then
@@ -81,13 +74,6 @@ jobs:
             --tag-semver=">=3.2.3" \
             --export | kubectl apply -f -
           /tmp/flux delete source git podinfo-export --silent
-      - name: flux create source git libgit2 semver
-        run: |
-          /tmp/flux create source git podinfo-libgit2 \
-            --url https://github.com/stefanprodan/podinfo  \
-            --tag-semver=">=3.2.3" \
-            --git-implementation=libgit2
-          /tmp/flux delete source git podinfo-libgit2 --silent
       - name: flux get sources git
         run: |
           /tmp/flux get sources git
@@ -101,15 +87,10 @@ jobs:
             --path="./deploy/overlays/dev" \
             --prune=true \
             --interval=5m \
+            --validation=client \
             --health-check="Deployment/frontend.dev" \
             --health-check="Deployment/backend.dev" \
             --health-check-timeout=3m
-      - name: flux trace
-        run: |
-          /tmp/flux trace frontend \
-            --kind=deployment \
-            --api-version=apps/v1 \
-            --namespace=dev
       - name: flux reconcile kustomization --with-source
         run: |
           /tmp/flux reconcile kustomization podinfo --with-source
@@ -173,36 +154,6 @@ jobs:
       - name: flux delete source git
         run: |
           /tmp/flux delete source git podinfo --silent
-      - name: flux oci artifacts
-        run: |
-          /tmp/flux push artifact oci://localhost:5000/fluxcd/flux:${{ github.sha }} \
-            --path="./manifests" \
-            --source="${{ github.repositoryUrl }}" \
-            --revision="${{ github.ref }}/${{ github.sha }}"
-          /tmp/flux tag artifact oci://localhost:5000/fluxcd/flux:${{ github.sha }} \
-            --tag latest
-          /tmp/flux list artifacts oci://localhost:5000/fluxcd/flux
-      - name: flux oci repositories
-        run: |
-          /tmp/flux create source oci podinfo-oci \
-            --url oci://ghcr.io/stefanprodan/manifests/podinfo \
-            --tag-semver 6.1.x \
-            --interval 10m
-          /tmp/flux create kustomization podinfo-oci \
-            --source=OCIRepository/podinfo-oci \
-            --path="./kustomize" \
-            --prune=true \
-            --interval=5m \
-            --target-namespace=default \
-            --wait=true \
-            --health-check-timeout=3m
-          /tmp/flux reconcile source oci podinfo-oci
-          /tmp/flux suspend source oci podinfo-oci
-          /tmp/flux get sources oci
-          /tmp/flux resume source oci podinfo-oci
-          /tmp/flux export source oci podinfo-oci
-          /tmp/flux delete ks podinfo-oci --silent
-          /tmp/flux delete source oci podinfo-oci --silent
       - name: flux create tenant
         run: |
           /tmp/flux create tenant dev-team --with-namespace=apps
@@ -213,6 +164,26 @@ jobs:
             --chart=podinfo \
             --chart-version="5.0.x" \
             --service-account=dev-team
+      - name: flux create image repository
+        run: |
+          /tmp/flux create image repository podinfo \
+            --image=ghcr.io/stefanprodan/podinfo \
+            --interval=1m
+      - name: flux create image policy
+        run: |
+          /tmp/flux create image policy podinfo \
+            --image-ref=podinfo \
+            --interval=1m \
+            --select-semver=5.0.x
+      - name: flux create image policy podinfo-select-alpha
+        run: |
+          /tmp/flux create image policy podinfo-alpha \
+            --image-ref=podinfo \
+            --interval=1m \
+            --select-alpha=desc
+      - name: flux get image policy
+        run: |
+          /tmp/flux get image policy podinfo | grep '5.0.3'
       - name: flux2-kustomize-helm-example
         run: |
           /tmp/flux create source git flux-system \
@@ -222,14 +193,7 @@ jobs:
           /tmp/flux create kustomization flux-system \
           --source=flux-system \
           --path=./clusters/staging
-          kubectl -n flux-system wait kustomization/infrastructure --for=condition=ready --timeout=5m
+          kubectl -n flux-system wait kustomization/apps --for=condition=ready --timeout=2m
-          kubectl -n flux-system wait kustomization/apps --for=condition=ready --timeout=5m
-          kubectl -n nginx wait helmrelease/nginx --for=condition=ready --timeout=5m
-          kubectl -n redis wait helmrelease/redis --for=condition=ready --timeout=5m
-          kubectl -n podinfo wait helmrelease/podinfo --for=condition=ready --timeout=5m
-      - name: flux tree
-        run: |
-          /tmp/flux tree kustomization flux-system | grep Service/podinfo
       - name: flux check
         run: |
           /tmp/flux check
@@ -241,7 +205,6 @@ jobs:
         run: |
           kubectl version --client --short
           kubectl -n flux-system get all
-          kubectl -n flux-system describe pods
           kubectl -n flux-system get kustomizations -oyaml
           kubectl -n flux-system logs deploy/source-controller
           kubectl -n flux-system logs deploy/kustomize-controller

.github/workflows/rebase.yaml

@@ -0,0 +1,21 @@
+name: rebase
+
+on:
+  pull_request:
+    types: [ opened ]
+  issue_comment:
+    types: [ created ]
+
+jobs:
+  rebase:
+    if: github.event.issue.pull_request != '' && contains(github.event.comment.body, '/rebase') && (github.event.comment.author_association == 'CONTRIBUTOR' || github.event.comment.author_association == 'MEMBER' || github.event.comment.author_association == 'OWNER')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout the latest code
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: Automatic Rebase
+        uses: cirrus-actions/rebase@1.3.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}

.github/workflows/release.yaml

@@ -4,79 +4,71 @@ on:
   push:
     tags: [ 'v*' ]
 
-permissions:
-  contents: write # needed to write releases
-  id-token: write # needed for keyless signing
-  packages: write # needed for ghcr access
-
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2
       - name: Unshallow
         run: git fetch --prune --unshallow
       - name: Setup Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v2
         with:
-          go-version: 1.18.x
+          go-version: 1.16.x
       - name: Setup QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v1
+        with:
+          platforms: all
       - name: Setup Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v1
-      - name: Setup Syft
+        with:
-        uses: anchore/sbom-action/download-syft@v0
+          buildkitd-flags: "--debug"
-      - name: Setup Cosign
-        uses: sigstore/cosign-installer@main
-      - name: Setup Kustomize
-        uses: fluxcd/pkg//actions/kustomize@main
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v1
         with:
           registry: ghcr.io
           username: fluxcdbot
           password: ${{ secrets.GHCR_TOKEN }}
       - name: Login to Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v1
         with:
           username: fluxcdbot
           password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
-      - name: Generate manifests
-        run: |
-          make cmd/flux/.manifests.done
-          ./manifests/scripts/bundle.sh "" ./output manifests.tar.gz
-          kustomize build ./manifests/install > ./output/install.yaml
-      - name: Build CRDs
-        run: |
-          kustomize build manifests/crds > all-crds.yaml
-      # Pinned to commit before https://github.com/fluxcd/pkg/pull/189 due to
-      # introduction faulty behavior.
-      - name: Generate OpenAPI JSON schemas from CRDs
-        uses: fluxcd/pkg//actions/crdjsonschema@49e26aa2ee9e734c3233c560253fd9542afe18ae
-        with:
-          crd: all-crds.yaml
-          output: schemas
-      - name: Archive the OpenAPI JSON schemas
-        run: |
-          tar -czvf ./output/crd-schemas.tar.gz -C schemas .
       - name: Download release notes utility
         env:
           GH_REL_URL: https://github.com/buchanae/github-release-notes/releases/download/0.2.0/github-release-notes-linux-amd64-0.2.0.tar.gz
         run: cd /tmp && curl -sSL ${GH_REL_URL} | tar xz && sudo mv github-release-notes /usr/local/bin/
       - name: Generate release notes
         run: |
-          NOTES="./output/notes.md"
+          echo 'CHANGELOG' > /tmp/release.txt
-          echo '## CLI Changelog' > ${NOTES}
+          github-release-notes -org fluxcd -repo toolkit -since-latest-release -include-author >> /tmp/release.txt
-          github-release-notes -org fluxcd -repo flux2 -since-latest-release -include-author >> ${NOTES}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Setup Kustomize
+        uses: fluxcd/pkg//actions/kustomize@main
+      - name: Generate manifests
+        run: |
+          make cmd/flux/manifests
+          ./manifests/scripts/bundle.sh "" ./output manifests.tar.gz
+          kustomize build ./manifests/install > ./output/install.yaml
+      - name: Build CRDs
+        run: |
+          kustomize build manifests/crds > all-crds.yaml
+      - name: Generate OpenAPI JSON schemas from CRDs
+        uses: fluxcd/pkg//actions/crdjsonschema@main
+        with:
+          crd: all-crds.yaml
+          output: schemas
+      - name: Archive the OpenAPI JSON schemas
+        run: |
+          tar -czvf ./output/crd-schemas.tar.gz -C schemas .
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v3
+        uses: goreleaser/goreleaser-action@v1
         with:
           version: latest
-          args: release --release-notes=output/notes.md --skip-validate
+          args: release --release-notes=/tmp/release.txt --skip-validate
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           HOMEBREW_TAP_GITHUB_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}

.github/workflows/scan.yaml

@@ -1,4 +1,4 @@
-name: scan
+name: Scan
 
 on:
   push:
@@ -8,16 +8,12 @@ on:
   schedule:
     - cron: '18 10 * * 3'
 
-permissions:
-  contents: read # for actions/checkout to fetch code
-  security-events: write # for codeQL to write security events
-
 jobs:
   fossa:
     name: FOSSA
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v2
       - name: Run FOSSA scan and upload build data
         uses: fossa-contrib/fossa-action@v1
         with:
@@ -30,12 +26,12 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v2
       - name: Setup Kustomize
         uses: fluxcd/pkg//actions/kustomize@main
       - name: Build manifests
         run: |
-          make cmd/flux/.manifests.done
+          make cmd/flux/manifests
       - name: Run Snyk to check for vulnerabilities
         uses: snyk/actions/golang@master
         continue-on-error: true
@@ -53,12 +49,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@v1
         with:
           languages: go
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v2
+        uses: github/codeql-action/autobuild@v1
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@v1

.github/workflows/update.yaml

@@ -12,11 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v2
       - name: Setup Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v2
         with:
-          go-version: 1.18.x
+          go-version: 1.16.x
       - name: Update component versions
         id: update
         run: |
@@ -42,7 +42,8 @@ jobs:
 
             if [[ "${MOD_VERSION}" != "${LATEST_VERSION}" ]]; then
               go mod edit -require="github.com/fluxcd/$1/api@${LATEST_VERSION}"
-              make tidy
+              rm go.sum
+              go mod tidy
               changed=true
             fi
 

.gitignore

@@ -19,8 +19,6 @@ dist/
 bin/
 output/
 cmd/flux/manifests/
-cmd/flux/.manifests.done
-testbin/
 
 # Docs
 site/

.goreleaser.yml

@@ -40,36 +40,6 @@ archives:
     format: zip
     files:
       - none*
-source:
-  enabled: true
-  name_template: '{{ .ProjectName }}_{{ .Version }}_source_code'
-sboms:
-  - id: source
-    artifacts: source
-    documents:
-      - "{{ .ProjectName }}_{{ .Version }}_sbom.spdx.json"
-release:
-  extra_files:
-    - glob: output/crd-schemas.tar.gz
-    - glob: output/manifests.tar.gz
-    - glob: output/install.yaml
-checksum:
-  extra_files:
-    - glob: output/crd-schemas.tar.gz
-    - glob: output/manifests.tar.gz
-    - glob: output/install.yaml
-signs:
-  - cmd: cosign
-    env:
-      - COSIGN_EXPERIMENTAL=1
-    certificate: '${artifact}.pem'
-    args:
-      - sign-blob
-      - '--output-certificate=${certificate}'
-      - '--output-signature=${signature}'
-      - '${artifact}'
-    artifacts: checksum
-    output: true
 brews:
   - name: flux
     tap:
@@ -79,17 +49,9 @@ brews:
     folder: Formula
     homepage: "https://fluxcd.io/"
     description: "Flux CLI"
-    install: |
+    dependencies:
-      bin.install "flux"
+      - name: kubectl
-
+        type: optional
-      bash_output = Utils.safe_popen_read(bin/"flux", "completion", "bash")
-      (bash_completion/"flux").write bash_output
-
-      zsh_output = Utils.safe_popen_read(bin/"flux", "completion", "zsh")
-      (zsh_completion/"_flux").write zsh_output
-
-      fish_output = Utils.safe_popen_read(bin/"flux", "completion", "fish")
-      (fish_completion/"flux.fish").write fish_output
     test: |
       system "#{bin}/flux --version"
 publishers:
@@ -108,12 +70,17 @@ publishers:
       - AUR_BOT_SSH_PRIVATE_KEY={{ .Env.AUR_BOT_SSH_PRIVATE_KEY }}
     cmd: |
       .github/aur/flux-go/publish.sh {{ .Version }}
+release:
+  extra_files:
+    - glob: ./output/crd-schemas.tar.gz
+    - glob: ./output/manifests.tar.gz
+    - glob: ./output/install.yaml
 dockers:
 - image_templates:
     - 'fluxcd/flux-cli:{{ .Tag }}-amd64'
     - 'ghcr.io/fluxcd/flux-cli:{{ .Tag }}-amd64'
   dockerfile: Dockerfile
-  use: buildx
+  use_buildx: true
   goos: linux
   goarch: amd64
   build_flag_templates:
@@ -129,7 +96,7 @@ dockers:
     - 'fluxcd/flux-cli:{{ .Tag }}-arm64'
     - 'ghcr.io/fluxcd/flux-cli:{{ .Tag }}-arm64'
   dockerfile: Dockerfile
-  use: buildx
+  use_buildx: true
   goos: linux
   goarch: arm64
   build_flag_templates:
@@ -145,7 +112,7 @@ dockers:
     - 'fluxcd/flux-cli:{{ .Tag }}-arm'
     - 'ghcr.io/fluxcd/flux-cli:{{ .Tag }}-arm'
   dockerfile: Dockerfile
-  use: buildx
+  use_buildx: true
   goos: linux
   goarch: arm
   goarm: 7
@@ -169,12 +136,3 @@ docker_manifests:
     - 'ghcr.io/fluxcd/flux-cli:{{ .Tag }}-amd64'
     - 'ghcr.io/fluxcd/flux-cli:{{ .Tag }}-arm64'
     - 'ghcr.io/fluxcd/flux-cli:{{ .Tag }}-arm'
-docker_signs:
-  - cmd: cosign
-    env:
-      - COSIGN_EXPERIMENTAL=1
-    args:
-      - sign
-      - '${artifact}'
-    artifacts: all
-    output: true

CONTRIBUTING.md

@@ -30,7 +30,7 @@ you can sign your commit automatically with `git commit -s`.
 
 For realtime communications we use Slack: To join the conversation, simply
 join the [CNCF](https://slack.cncf.io/) Slack workspace and use the
-[#flux-contributors](https://cloud-native.slack.com/messages/flux-contributors/) channel.
+[#flux-dev](https://cloud-native.slack.com/messages/flux-dev/) channel.
 
 To discuss ideas and specifications we use [Github
 Discussions](https://github.com/fluxcd/flux2/discussions).
@@ -63,65 +63,20 @@ To get started with developing controllers, you might want to review
 walks you through writing a short and concise controller that watches out
 for source changes.
 
-## How to run the test suite
+### How to run the test suite
 
 Prerequisites:
 
-* go >= 1.17
+* go >= 1.16
-* kubectl >= 1.20
+* kubectl >= 1.18
-* kustomize >= 4.4
+* kustomize >= 3.1
-* coreutils (on Mac OS)
 
-Install the [controller-runtime/envtest](https://github.com/kubernetes-sigs/controller-runtime/tree/master/tools/setup-envtest) binaries with:
+You can run the unit tests by simply doing
-
-```bash
-make install-envtest
-```
-
-Then you can run the unit tests with:
 
 ```bash
 make test
 ```
 
-After [installing Kubernetes kind](https://kind.sigs.k8s.io/docs/user/quick-start#installation) on your machine,
-create a cluster for testing with:
-
-```bash
-make setup-kind
-```
-
-Then you can run the end-to-end tests with:
-
-```bash
-make e2e
-```
-
-When the output of the Flux CLI changes, to automatically update the golden
-files used in the test, pass `-update` flag to the test as:
-
-```bash
-make e2e TEST_ARGS="-update"
-```
-
-Since not all packages use golden files for testing, `-update` argument must be
-passed only for the packages that use golden files. Use the variables
-`TEST_PKG_PATH` for unit tests and `E2E_TEST_PKG_PATH` for e2e tests, to set the
-path of the target test package:
-
-```bash
-# Unit test
-make test TEST_PKG_PATH="./cmd/flux" TEST_ARGS="-update"
-# e2e test
-make e2e E2E_TEST_PKG_PATH="./cmd/flux" TEST_ARGS="-update"
-```
-
-Teardown the e2e environment with:
-
-```bash
-make cleanup-kind
-```
-
 ## Acceptance policy
 
 These things will make a PR more likely to be accepted:

Dockerfile

@@ -1,15 +1,15 @@
-FROM alpine:3.16 as builder
+FROM alpine:3.13 as builder
 
 RUN apk add --no-cache ca-certificates curl
 
 ARG ARCH=linux/amd64
-ARG KUBECTL_VER=1.24.1
+ARG KUBECTL_VER=1.20.4
 
 RUN curl -sL https://storage.googleapis.com/kubernetes-release/release/v${KUBECTL_VER}/bin/${ARCH}/kubectl \
     -o /usr/local/bin/kubectl && chmod +x /usr/local/bin/kubectl && \
     kubectl version --client=true
 
-FROM alpine:3.16 as flux-cli
+FROM alpine:3.13 as flux-cli
 
 # Create minimal nsswitch.conf file to prioritize the usage of /etc/hosts over DNS queries.
 # https://github.com/gliderlabs/docker-alpine/issues/367#issuecomment-354316460
@@ -20,5 +20,4 @@ RUN apk add --no-cache ca-certificates
 COPY --from=builder /usr/local/bin/kubectl /usr/local/bin/
 COPY --chmod=755 flux /usr/local/bin/
 
-USER 65534:65534
 ENTRYPOINT [ "flux" ]

MAINTAINERS

@@ -2,7 +2,17 @@ The maintainers are generally available in Slack at
 https://cloud-native.slack.com in #flux (https://cloud-native.slack.com/messages/CLAJ40HV3)
 (obtain an invitation at https://slack.cncf.io/).
 
-The Flux2 maintainers team is identical with the core maintainers of the project
+These maintainers are shared with other Flux v2-related git
-as listed in
+repositories under https://github.com/fluxcd, as noted in their
+respective MAINTAINERS files.
 
-    https://github.com/fluxcd/community/blob/main/CORE-MAINTAINERS
+For convenience, they are reflected in the GitHub team
+@fluxcd/flux2-maintainers -- if the list here changes, that team also
+should.
+
+In alphabetical order:
+
+Aurel Canciu, Sortlist <aurel@sortlist.com> (github: @relu, slack: relu)
+Hidde Beydals, Weaveworks <hidde@weave.works> (github: @hiddeco, slack: hidde)
+Philip Laine, Xenit <philip.laine@xenit.se> (github: @phillebaba, slack: phillebaba)
+Stefan Prodan, Weaveworks <stefan@weave.works> (github: @stefanprodan, slack: stefanprodan)

Makefile

@@ -1,24 +1,12 @@
-VERSION?=$(shell grep 'VERSION' cmd/flux/main.go | awk '{ print $$4 }' | head -n 1 | tr -d '"')
+VERSION?=$(shell grep 'VERSION' cmd/flux/main.go | awk '{ print $$4 }' | tr -d '"')
-DEV_VERSION?=0.0.0-$(shell git rev-parse --abbrev-ref HEAD)-$(shell git rev-parse --short HEAD)-$(shell date +%s)
+EMBEDDED_MANIFESTS_TARGET=cmd/flux/manifests
-EMBEDDED_MANIFESTS_TARGET=cmd/flux/.manifests.done
-TEST_KUBECONFIG?=/tmp/flux-e2e-test-kubeconfig
-# Architecture to use envtest with
-ENVTEST_ARCH ?= amd64
-
-# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
-ifeq (,$(shell go env GOBIN))
-GOBIN=$(shell go env GOPATH)/bin
-else
-GOBIN=$(shell go env GOBIN)
-endif
 
 rwildcard=$(foreach d,$(wildcard $(addsuffix *,$(1))),$(call rwildcard,$(d)/,$(2)) $(filter $(subst *,%,$(2)),$(d)))
 
 all: test build
 
 tidy:
-	go mod tidy -compat=1.17
+	go mod tidy
-	cd tests/azure && go mod tidy -compat=1.17
 
 fmt:
 	go fmt ./...
@@ -26,73 +14,17 @@ fmt:
 vet:
 	go vet ./...
 
-setup-kind:
+test: $(EMBEDDED_MANIFESTS_TARGET) tidy fmt vet
-	kind create cluster --name=flux-e2e-test --kubeconfig=$(TEST_KUBECONFIG) --config=.github/kind/config.yaml
+	go test ./... -coverprofile cover.out
-	kubectl --kubeconfig=$(TEST_KUBECONFIG) apply -f https://docs.projectcalico.org/v3.16/manifests/calico.yaml
-	kubectl --kubeconfig=$(TEST_KUBECONFIG) -n kube-system set env daemonset/calico-node FELIX_IGNORELOOSERPF=true
-
-cleanup-kind:
-	kind delete cluster --name=flux-e2e-test
-	rm $(TEST_KUBECONFIG)
-
-KUBEBUILDER_ASSETS?="$(shell $(ENVTEST) --arch=$(ENVTEST_ARCH) use -i $(ENVTEST_KUBERNETES_VERSION) --bin-dir=$(ENVTEST_ASSETS_DIR) -p path)"
-TEST_PKG_PATH="./..."
-test: $(EMBEDDED_MANIFESTS_TARGET) tidy fmt vet install-envtest
-	KUBEBUILDER_ASSETS="$(KUBEBUILDER_ASSETS)" go test $(TEST_PKG_PATH) -coverprofile cover.out --tags=unit $(TEST_ARGS)
-
-E2E_TEST_PKG_PATH="./cmd/flux/..."
-e2e: $(EMBEDDED_MANIFESTS_TARGET) tidy fmt vet
-	TEST_KUBECONFIG=$(TEST_KUBECONFIG) go test $(E2E_TEST_PKG_PATH) -coverprofile e2e.cover.out --tags=e2e -v -failfast $(TEST_ARGS)
-
-test-with-kind: install-envtest
-	make setup-kind
-	make e2e
-	make cleanup-kind
 
 $(EMBEDDED_MANIFESTS_TARGET): $(call rwildcard,manifests/,*.yaml *.json)
 	./manifests/scripts/bundle.sh
-	touch $@
 
 build: $(EMBEDDED_MANIFESTS_TARGET)
-	CGO_ENABLED=0 go build -ldflags="-s -w -X main.VERSION=$(VERSION)" -o ./bin/flux ./cmd/flux
+	CGO_ENABLED=0 go build -o ./bin/flux ./cmd/flux
 
-build-dev: $(EMBEDDED_MANIFESTS_TARGET)
-	CGO_ENABLED=0 go build -ldflags="-s -w -X main.VERSION=$(DEV_VERSION)" -o ./bin/flux ./cmd/flux
-
-.PHONY: install
 install:
-	CGO_ENABLED=0 go install ./cmd/flux
+	go install cmd/flux
 
 install-dev:
 	CGO_ENABLED=0 go build -o /usr/local/bin ./cmd/flux
-
-setup-bootstrap-patch:
-	go run ./tests/bootstrap/main.go
-
-setup-image-automation:
-	cd tests/image-automation && go run main.go
-
-ENVTEST_ASSETS_DIR=$(shell pwd)/testbin
-ENVTEST_KUBERNETES_VERSION?=latest
-install-envtest: setup-envtest
-	mkdir -p ${ENVTEST_ASSETS_DIR}
-	$(ENVTEST) use $(ENVTEST_KUBERNETES_VERSION) --arch=$(ENVTEST_ARCH) --bin-dir=$(ENVTEST_ASSETS_DIR)
-
-ENVTEST = $(shell pwd)/bin/setup-envtest
-.PHONY: envtest
-setup-envtest: ## Download envtest-setup locally if necessary.
-	$(call go-install-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest@latest)
-
-# go-install-tool will 'go install' any package $2 and install it to $1.
-PROJECT_DIR := $(shell dirname $(abspath $(lastword $(MAKEFILE_LIST))))
-define go-install-tool
-@[ -f $(1) ] || { \
-set -e ;\
-TMP_DIR=$$(mktemp -d) ;\
-cd $$TMP_DIR ;\
-go mod init tmp ;\
-echo "Downloading $(2)" ;\
-GOBIN=$(PROJECT_DIR)/bin go install $(2) ;\
-rm -rf $$TMP_DIR ;\
-}
-endef

README.md

@@ -20,15 +20,59 @@ Flux v2 is constructed with the [GitOps Toolkit](#gitops-toolkit), a
 set of composable APIs and specialized tools for building Continuous
 Delivery on top of Kubernetes.
 
-Flux is a Cloud Native Computing Foundation ([CNCF](https://www.cncf.io/)) project.
+## Flux installation
 
-## Quickstart and documentation
+With [Homebrew](https://brew.sh) for macOS and Linux:
 
-To get started check out this [guide](https://fluxcd.io/docs/get-started/)
+```sh
-on how to bootstrap Flux on Kubernetes and deploy a sample application in a GitOps manner.
+brew install fluxcd/tap/flux
+```
 
-For more comprehensive documentation, see the following guides:
+With [GoFish](https://gofi.sh) for Windows, macOS and Linux:
-- [Ways of structuring your repositories](https://fluxcd.io/docs/guides/repository-structure/)
+
+```sh
+gofish install flux
+```
+
+With Bash for macOS and Linux:
+
+```sh
+curl -s https://fluxcd.io/install.sh | sudo bash
+
+# enable completions in ~/.bash_profile
+. <(flux completion bash)
+```
+
+Arch Linux (AUR) packages:
+
+- [flux-bin](https://aur.archlinux.org/packages/flux-bin): install the latest
+  stable version using a pre-build binary (recommended)
+- [flux-go](https://aur.archlinux.org/packages/flux-go): build the latest
+  stable version from source code
+- [flux-scm](https://aur.archlinux.org/packages/flux-scm): build the latest
+  (unstable) version from source code from our git `main` branch
+
+Binaries for macOS AMD64/ARM64, Linux AMD64/ARM/ARM64 and Windows are available to
+download on the [release page](https://github.com/fluxcd/flux2/releases).
+
+A multi-arch container image with `kubectl` and `flux` is available on Docker Hub and GitHub:
+
+* `docker.io/fluxcd/flux-cli:<version>`
+* `ghcr.io/fluxcd/flux-cli:<version>`
+
+Verify that your cluster satisfies the prerequisites with:
+
+```sh
+flux check --pre
+```
+
+## Get started
+
+To get started with Flux, start [browsing the
+documentation](https://fluxcd.io/docs/) or get started with one of
+the following guides:
+
+- [Get started with Flux](https://fluxcd.io/docs/get-started/)
 - [Manage Helm Releases](https://fluxcd.io/docs/guides/helmreleases/)
 - [Automate image updates to Git](https://fluxcd.io/docs/guides/image-update/)  
 - [Manage Kubernetes secrets with Mozilla SOPS](https://fluxcd.io/docs/guides/mozilla-sops/)  
@@ -89,9 +133,7 @@ new contributors and there are a multitude of ways to get involved.
 
 ### Events
 
-Check out our **[events calendar](https://fluxcd.io/#calendar)**,
+Check out our **[events calendar](https://fluxcd.io/community/#talks)**,
-both with upcoming talks, events and meetings you can attend.
+both with upcoming talks you can attend or past events videos you can watch.
-Or view the **[resources section](https://fluxcd.io/resources)**
-with past events videos you can watch.
 
 We look forward to seeing you with us!

action/README.md

@@ -10,21 +10,11 @@ Usage:
         run: flux -v
 ```
 
+Note that this action can only be used on GitHub **Linux AMD64** runners.
 The latest stable version of the `flux` binary is downloaded from
 GitHub [releases](https://github.com/fluxcd/flux2/releases)
 and placed at `/usr/local/bin/flux`.
 
-Note that this action can only be used on GitHub **Linux** runners.
-You can change the arch (defaults to `amd64`) with:
-
-```yaml
-    steps:
-      - name: Setup Flux CLI
-        uses: fluxcd/flux2/action@main
-        with:
-          arch: arm64 # can be amd64, arm64 or arm
-```
-
 You can download a specific version with:
 
 ```yaml
@@ -32,7 +22,7 @@ You can download a specific version with:
       - name: Setup Flux CLI
         uses: fluxcd/flux2/action@main
         with:
-          version: 0.32.0
+          version: 0.8.0
 ```
 
 ### Automate Flux updates
@@ -74,92 +64,6 @@ jobs:
               ${{ steps.update.outputs.flux_version }}
 ```
 
-### Push Kubernetes manifests to container registries
-
-Example workflow for publishing Kubernetes manifests bundled as OCI artifacts to GitHub Container Registry:
-
-```yaml
-name: push-artifact-staging
-
-on:
-  push:
-    branches:
-      - 'main'
-
-permissions:
-  packages: write # needed for ghcr.io access
-
-env:
-  OCI_REPO: "oci://ghcr.io/my-org/manifests/${{ github.event.repository.name }}"
-
-jobs:
-  kubernetes:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Setup Flux CLI
-        uses: fluxcd/flux2/action@main
-      - name: Login to GHCR
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Generate manifests
-        run: |
-          kustomize build ./manifests/staging > ./deploy/app.yaml
-      - name: Push manifests
-        run: |
-          flux push artifact $OCI_REPO:$(git rev-parse --short HEAD) \
-            --path="./deploy" \
-            --source="$(git config --get remote.origin.url)" \
-            --revision="$(git branch --show-current)/$(git rev-parse HEAD)"
-      - name: Deploy manifests to staging
-        run: |
-          flux tag artifact $OCI_REPO:$(git rev-parse --short HEAD) --tag staging
-```
-
-Example workflow for publishing Kubernetes manifests bundled as OCI artifacts to Docker Hub:
-
-```yaml
-name: push-artifact-production
-
-on:
-  push:
-    tags:
-      - '*'
-
-env:
-  OCI_REPO: "oci://docker.io/my-org/app-config"
-
-jobs:
-  kubernetes:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Setup Flux CLI
-        uses: fluxcd/flux2/action@main
-      - name: Login to Docker Hub
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Generate manifests
-        run: |
-          kustomize build ./manifests/production > ./deploy/app.yaml
-      - name: Push manifests
-        run: |
-          flux push artifact $OCI_REPO:$(git tag --points-at HEAD) \
-            --path="./deploy" \
-            --source="$(git config --get remote.origin.url)" \
-            --revision="$(git tag --points-at HEAD)/$(git rev-parse HEAD)"
-      - name: Deploy manifests to production
-        run: |
-          flux tag artifact $OCI_REPO:$(git tag --points-at HEAD) --tag production
-```
-
 ### End-to-end testing
 
 Example workflow for running Flux in Kubernetes Kind:

action/action.yml

@@ -8,40 +8,26 @@ inputs:
   version:
     description: "Flux version e.g. 0.8.0 (defaults to latest stable release)"
     required: false
-  arch:
-    description: "arch can be amd64, arm64 or arm"
-    required: true
-    default: "amd64"
-  bindir:
-    description: "Optional location of the Flux binary. Will not use sudo if set. Updates System Path."
-    required: false
 runs:
   using: composite
   steps:
     - name: "Download flux binary to tmp"
       shell: bash
       run: |
-        ARCH=${{ inputs.arch }}
         VERSION=${{ inputs.version }}
 
         if [ -z $VERSION ]; then
           VERSION=$(curl https://api.github.com/repos/fluxcd/flux2/releases/latest -sL | grep tag_name | sed -E 's/.*"([^"]+)".*/\1/' | cut -c 2-)
         fi
 
-        BIN_URL="https://github.com/fluxcd/flux2/releases/download/v${VERSION}/flux_${VERSION}_linux_${ARCH}.tar.gz"
+        BIN_URL="https://github.com/fluxcd/flux2/releases/download/v${VERSION}/flux_${VERSION}_linux_amd64.tar.gz"
         curl -sL ${BIN_URL} -o /tmp/flux.tar.gz
         mkdir -p /tmp/flux
         tar -C /tmp/flux/ -zxvf /tmp/flux.tar.gz
-    - name: "Copy Flux binary to execute location"
+    - name: "Add flux binary to /usr/local/bin"
       shell: bash
       run: |
-        BINDIR=${{ inputs.bindir }}
+        sudo cp /tmp/flux/flux /usr/local/bin
-        if [ -z $BINDIR ]; then
-          sudo cp /tmp/flux/flux /usr/local/bin
-        else
-          cp /tmp/flux/flux "${BINDIR}"
-          echo "${BINDIR}" >> $GITHUB_PATH
-        fi
     - name: "Cleanup tmp"
       shell: bash
       run: |

cmd/flux/alert.go

@@ -25,9 +25,8 @@ import (
 // notificationv1.Alert
 
 var alertType = apiType{
-	kind:         notificationv1.AlertKind,
+	kind:      notificationv1.AlertKind,
-	humanKind:    "alert",
+	humanKind: "alert",
-	groupVersion: notificationv1.GroupVersion,
 }
 
 type alertAdapter struct {
@@ -38,10 +37,6 @@ func (a alertAdapter) asClientObject() client.Object {
 	return a.Alert
 }
 
-func (a alertAdapter) deepCopyClientObject() client.Object {
-	return a.Alert.DeepCopy()
-}
-
 // notificationv1.Alert
 
 type alertListAdapter struct {

cmd/flux/alert_provider.go

@@ -25,9 +25,8 @@ import (
 // notificationv1.Provider
 
 var alertProviderType = apiType{
-	kind:         notificationv1.ProviderKind,
+	kind:      notificationv1.ProviderKind,
-	humanKind:    "alert provider",
+	humanKind: "alert provider",
-	groupVersion: notificationv1.GroupVersion,
 }
 
 type alertProviderAdapter struct {
@@ -38,10 +37,6 @@ func (a alertProviderAdapter) asClientObject() client.Object {
 	return a.Provider
 }
 
-func (a alertProviderAdapter) deepCopyClientObject() client.Object {
-	return a.Provider.DeepCopy()
-}
-
 // notificationv1.Provider
 
 type alertProviderListAdapter struct {

cmd/flux/bootstrap.go

@@ -19,13 +19,12 @@ package main
 import (
 	"crypto/elliptic"
 	"fmt"
-	"strings"
+	"io/ioutil"
 
 	"github.com/spf13/cobra"
 
 	"github.com/fluxcd/flux2/internal/flags"
 	"github.com/fluxcd/flux2/internal/utils"
-	"github.com/fluxcd/flux2/pkg/manifestgen"
 	"github.com/fluxcd/flux2/pkg/manifestgen/sourcesecret"
 )
 
@@ -68,10 +67,6 @@ type bootstrapFlags struct {
 	authorName  string
 	authorEmail string
 
-	gpgKeyRingPath string
-	gpgPassphrase  string
-	gpgKeyID       string
-
 	commitMessageAppendix string
 }
 
@@ -88,7 +83,7 @@ func init() {
 	bootstrapCmd.PersistentFlags().StringSliceVar(&bootstrapArgs.defaultComponents, "components", rootArgs.defaults.Components,
 		"list of components, accepts comma-separated values")
 	bootstrapCmd.PersistentFlags().StringSliceVar(&bootstrapArgs.extraComponents, "components-extra", nil,
-		"list of components in addition to those supplied or defaulted, accepts values such as 'image-reflector-controller,image-automation-controller'")
+		"list of components in addition to those supplied or defaulted, accepts comma-separated values")
 
 	bootstrapCmd.PersistentFlags().StringVar(&bootstrapArgs.registry, "registry", "ghcr.io/fluxcd",
 		"container registry where the toolkit images are published")
@@ -123,10 +118,6 @@ func init() {
 	bootstrapCmd.PersistentFlags().StringVar(&bootstrapArgs.authorName, "author-name", "Flux", "author name for Git commits")
 	bootstrapCmd.PersistentFlags().StringVar(&bootstrapArgs.authorEmail, "author-email", "", "author email for Git commits")
 
-	bootstrapCmd.PersistentFlags().StringVar(&bootstrapArgs.gpgKeyRingPath, "gpg-key-ring", "", "path to GPG key ring for signing commits")
-	bootstrapCmd.PersistentFlags().StringVar(&bootstrapArgs.gpgPassphrase, "gpg-passphrase", "", "passphrase for decrypting GPG private key")
-	bootstrapCmd.PersistentFlags().StringVar(&bootstrapArgs.gpgKeyID, "gpg-key-id", "", "key id for selecting a particular key")
-
 	bootstrapCmd.PersistentFlags().StringVar(&bootstrapArgs.commitMessageAppendix, "commit-message-appendix", "", "string to add to the commit messages, e.g. '[ci skip]'")
 
 	bootstrapCmd.PersistentFlags().Var(&bootstrapArgs.arch, "arch", bootstrapArgs.arch.Description())
@@ -140,7 +131,7 @@ func NewBootstrapFlags() bootstrapFlags {
 	return bootstrapFlags{
 		logLevel:           flags.LogLevel(rootArgs.defaults.LogLevel),
 		requiredComponents: []string{"source-controller", "kustomize-controller"},
-		keyAlgorithm:       flags.PublicKeyAlgorithm(sourcesecret.ECDSAPrivateKeyAlgorithm),
+		keyAlgorithm:       flags.PublicKeyAlgorithm(sourcesecret.RSAPrivateKeyAlgorithm),
 		keyRSABits:         2048,
 		keyECDSACurve:      flags.ECDSACurve{Curve: elliptic.P384()},
 	}
@@ -154,7 +145,7 @@ func buildEmbeddedManifestBase() (string, error) {
 	if !isEmbeddedVersion(bootstrapArgs.version) {
 		return "", nil
 	}
-	tmpBaseDir, err := manifestgen.MkdirTempAbs("", "flux-manifests-")
+	tmpBaseDir, err := ioutil.TempDir("", "flux-manifests-")
 	if err != nil {
 		return "", err
 	}
@@ -183,10 +174,6 @@ func mapTeamSlice(s []string, defaultPermission string) map[string]string {
 	m := make(map[string]string, len(s))
 	for _, v := range s {
 		m[v] = defaultPermission
-		if s := strings.Split(v, ":"); len(s) == 2 {
-			m[s[0]] = s[1]
-		}
 	}
-
 	return m
 }

cmd/flux/bootstrap_bitbucket_server.go

@@ -1,281 +0,0 @@
-/*
-Copyright 2021 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"time"
-
-	"github.com/go-git/go-git/v5/plumbing/transport/http"
-	"github.com/spf13/cobra"
-
-	"github.com/fluxcd/flux2/internal/bootstrap"
-	"github.com/fluxcd/flux2/internal/bootstrap/git/gogit"
-	"github.com/fluxcd/flux2/internal/bootstrap/provider"
-	"github.com/fluxcd/flux2/internal/flags"
-	"github.com/fluxcd/flux2/internal/utils"
-	"github.com/fluxcd/flux2/pkg/manifestgen"
-	"github.com/fluxcd/flux2/pkg/manifestgen/install"
-	"github.com/fluxcd/flux2/pkg/manifestgen/sourcesecret"
-	"github.com/fluxcd/flux2/pkg/manifestgen/sync"
-)
-
-var bootstrapBServerCmd = &cobra.Command{
-	Use:   "bitbucket-server",
-	Short: "Bootstrap toolkit components in a Bitbucket Server repository",
-	Long: `The bootstrap bitbucket-server command creates the Bitbucket Server repository if it doesn't exists and
-commits the toolkit components manifests to the master branch.
-Then it configures the target cluster to synchronize with the repository.
-If the toolkit components are present on the cluster,
-the bootstrap command will perform an upgrade if needed.`,
-	Example: `  # Create a Bitbucket Server API token and export it as an env var
-  export BITBUCKET_TOKEN=<my-token>
-
-  # Run bootstrap for a private repository using HTTPS token authentication
-  flux bootstrap bitbucket-server --owner=<project> --username=<user> --repository=<repository name> --hostname=<domain> --token-auth
-
-  # Run bootstrap for a private repository using SSH authentication
-  flux bootstrap bitbucket-server --owner=<project> --username=<user> --repository=<repository name> --hostname=<domain>
-
-  # Run bootstrap for a repository path
-  flux bootstrap bitbucket-server --owner=<project> --username=<user> --repository=<repository name> --path=dev-cluster --hostname=<domain>
-
-  # Run bootstrap for a public repository on a personal account
-  flux bootstrap bitbucket-server --owner=<user> --repository=<repository name> --private=false --personal --hostname=<domain> --token-auth
-
-  # Run bootstrap for a an existing repository with a branch named main
-  flux bootstrap bitbucket-server --owner=<project> --username=<user> --repository=<repository name> --branch=main --hostname=<domain> --token-auth`,
-	RunE: bootstrapBServerCmdRun,
-}
-
-const (
-	bServerDefaultPermission = "push"
-	bServerTokenEnvVar       = "BITBUCKET_TOKEN"
-)
-
-type bServerFlags struct {
-	owner        string
-	repository   string
-	interval     time.Duration
-	personal     bool
-	username     string
-	private      bool
-	hostname     string
-	path         flags.SafeRelativePath
-	teams        []string
-	readWriteKey bool
-	reconcile    bool
-}
-
-var bServerArgs bServerFlags
-
-func init() {
-	bootstrapBServerCmd.Flags().StringVar(&bServerArgs.owner, "owner", "", "Bitbucket Server user or project name")
-	bootstrapBServerCmd.Flags().StringVar(&bServerArgs.repository, "repository", "", "Bitbucket Server repository name")
-	bootstrapBServerCmd.Flags().StringSliceVar(&bServerArgs.teams, "group", []string{}, "Bitbucket Server groups to be given write access (also accepts comma-separated values)")
-	bootstrapBServerCmd.Flags().BoolVar(&bServerArgs.personal, "personal", false, "if true, the owner is assumed to be a Bitbucket Server user; otherwise a group")
-	bootstrapBServerCmd.Flags().StringVarP(&bServerArgs.username, "username", "u", "git", "authentication username")
-	bootstrapBServerCmd.Flags().BoolVar(&bServerArgs.private, "private", true, "if true, the repository is setup or configured as private")
-	bootstrapBServerCmd.Flags().DurationVar(&bServerArgs.interval, "interval", time.Minute, "sync interval")
-	bootstrapBServerCmd.Flags().StringVar(&bServerArgs.hostname, "hostname", "", "Bitbucket Server hostname")
-	bootstrapBServerCmd.Flags().Var(&bServerArgs.path, "path", "path relative to the repository root, when specified the cluster sync will be scoped to this path")
-	bootstrapBServerCmd.Flags().BoolVar(&bServerArgs.readWriteKey, "read-write-key", false, "if true, the deploy key is configured with read/write permissions")
-	bootstrapBServerCmd.Flags().BoolVar(&bServerArgs.reconcile, "reconcile", false, "if true, the configured options are also reconciled if the repository already exists")
-
-	bootstrapCmd.AddCommand(bootstrapBServerCmd)
-}
-
-func bootstrapBServerCmdRun(cmd *cobra.Command, args []string) error {
-	bitbucketToken := os.Getenv(bServerTokenEnvVar)
-	if bitbucketToken == "" {
-		var err error
-		bitbucketToken, err = readPasswordFromStdin("Please enter your Bitbucket personal access token (PAT): ")
-		if err != nil {
-			return fmt.Errorf("could not read token: %w", err)
-		}
-	}
-
-	if bServerArgs.hostname == "" {
-		return fmt.Errorf("invalid hostname %q", bServerArgs.hostname)
-	}
-
-	if err := bootstrapValidate(); err != nil {
-		return err
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
-	defer cancel()
-
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
-	if err != nil {
-		return err
-	}
-
-	// Manifest base
-	if ver, err := getVersion(bootstrapArgs.version); err == nil {
-		bootstrapArgs.version = ver
-	}
-	manifestsBase, err := buildEmbeddedManifestBase()
-	if err != nil {
-		return err
-	}
-	defer os.RemoveAll(manifestsBase)
-
-	user := bServerArgs.username
-	if bServerArgs.personal {
-		user = bServerArgs.owner
-	}
-
-	var caBundle []byte
-	if bootstrapArgs.caFile != "" {
-		var err error
-		caBundle, err = os.ReadFile(bootstrapArgs.caFile)
-		if err != nil {
-			return fmt.Errorf("unable to read TLS CA file: %w", err)
-		}
-	}
-
-	// Build Bitbucket Server provider
-	providerCfg := provider.Config{
-		Provider: provider.GitProviderStash,
-		Hostname: bServerArgs.hostname,
-		Username: user,
-		Token:    bitbucketToken,
-		CaBundle: caBundle,
-	}
-
-	providerClient, err := provider.BuildGitProvider(providerCfg)
-	if err != nil {
-		return err
-	}
-
-	// Lazy go-git repository
-	tmpDir, err := manifestgen.MkdirTempAbs("", "flux-bootstrap-")
-	if err != nil {
-		return fmt.Errorf("failed to create temporary working dir: %w", err)
-	}
-	defer os.RemoveAll(tmpDir)
-	gitClient := gogit.New(tmpDir, &http.BasicAuth{
-		Username: user,
-		Password: bitbucketToken,
-	})
-
-	// Install manifest config
-	installOptions := install.Options{
-		BaseURL:                rootArgs.defaults.BaseURL,
-		Version:                bootstrapArgs.version,
-		Namespace:              *kubeconfigArgs.Namespace,
-		Components:             bootstrapComponents(),
-		Registry:               bootstrapArgs.registry,
-		ImagePullSecret:        bootstrapArgs.imagePullSecret,
-		WatchAllNamespaces:     bootstrapArgs.watchAllNamespaces,
-		NetworkPolicy:          bootstrapArgs.networkPolicy,
-		LogLevel:               bootstrapArgs.logLevel.String(),
-		NotificationController: rootArgs.defaults.NotificationController,
-		ManifestFile:           rootArgs.defaults.ManifestFile,
-		Timeout:                rootArgs.timeout,
-		TargetPath:             bServerArgs.path.ToSlash(),
-		ClusterDomain:          bootstrapArgs.clusterDomain,
-		TolerationKeys:         bootstrapArgs.tolerationKeys,
-	}
-	if customBaseURL := bootstrapArgs.manifestsPath; customBaseURL != "" {
-		installOptions.BaseURL = customBaseURL
-	}
-
-	// Source generation and secret config
-	secretOpts := sourcesecret.Options{
-		Name:         bootstrapArgs.secretName,
-		Namespace:    *kubeconfigArgs.Namespace,
-		TargetPath:   bServerArgs.path.String(),
-		ManifestFile: sourcesecret.MakeDefaultOptions().ManifestFile,
-	}
-	if bootstrapArgs.tokenAuth {
-		if bServerArgs.personal {
-			secretOpts.Username = bServerArgs.owner
-		} else {
-			secretOpts.Username = bServerArgs.username
-		}
-		secretOpts.Password = bitbucketToken
-
-		if bootstrapArgs.caFile != "" {
-			secretOpts.CAFilePath = bootstrapArgs.caFile
-		}
-	} else {
-		secretOpts.PrivateKeyAlgorithm = sourcesecret.PrivateKeyAlgorithm(bootstrapArgs.keyAlgorithm)
-		secretOpts.RSAKeyBits = int(bootstrapArgs.keyRSABits)
-		secretOpts.ECDSACurve = bootstrapArgs.keyECDSACurve.Curve
-		secretOpts.SSHHostname = bServerArgs.hostname
-
-		if bootstrapArgs.privateKeyFile != "" {
-			secretOpts.PrivateKeyPath = bootstrapArgs.privateKeyFile
-		}
-		if bootstrapArgs.sshHostname != "" {
-			secretOpts.SSHHostname = bootstrapArgs.sshHostname
-		}
-	}
-
-	// Sync manifest config
-	syncOpts := sync.Options{
-		Interval:          bServerArgs.interval,
-		Name:              *kubeconfigArgs.Namespace,
-		Namespace:         *kubeconfigArgs.Namespace,
-		Branch:            bootstrapArgs.branch,
-		Secret:            bootstrapArgs.secretName,
-		TargetPath:        bServerArgs.path.ToSlash(),
-		ManifestFile:      sync.MakeDefaultOptions().ManifestFile,
-		GitImplementation: sourceGitArgs.gitImplementation.String(),
-		RecurseSubmodules: bootstrapArgs.recurseSubmodules,
-	}
-
-	// Bootstrap config
-	bootstrapOpts := []bootstrap.GitProviderOption{
-		bootstrap.WithProviderRepository(bServerArgs.owner, bServerArgs.repository, bServerArgs.personal),
-		bootstrap.WithBranch(bootstrapArgs.branch),
-		bootstrap.WithBootstrapTransportType("https"),
-		bootstrap.WithAuthor(bootstrapArgs.authorName, bootstrapArgs.authorEmail),
-		bootstrap.WithCommitMessageAppendix(bootstrapArgs.commitMessageAppendix),
-		bootstrap.WithProviderTeamPermissions(mapTeamSlice(bServerArgs.teams, bServerDefaultPermission)),
-		bootstrap.WithReadWriteKeyPermissions(bServerArgs.readWriteKey),
-		bootstrap.WithKubeconfig(kubeconfigArgs, kubeclientOptions),
-		bootstrap.WithLogger(logger),
-		bootstrap.WithCABundle(caBundle),
-		bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyRingPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
-	}
-	if bootstrapArgs.sshHostname != "" {
-		bootstrapOpts = append(bootstrapOpts, bootstrap.WithSSHHostname(bootstrapArgs.sshHostname))
-	}
-	if bootstrapArgs.tokenAuth {
-		bootstrapOpts = append(bootstrapOpts, bootstrap.WithSyncTransportType("https"))
-	}
-	if !bServerArgs.private {
-		bootstrapOpts = append(bootstrapOpts, bootstrap.WithProviderRepositoryConfig("", "", "public"))
-	}
-	if bServerArgs.reconcile {
-		bootstrapOpts = append(bootstrapOpts, bootstrap.WithReconcile())
-	}
-
-	// Setup bootstrapper with constructed configs
-	b, err := bootstrap.NewGitProviderBootstrapper(gitClient, providerClient, kubeClient, bootstrapOpts...)
-	if err != nil {
-		return err
-	}
-
-	// Run
-	return bootstrap.Run(ctx, b, manifestsBase, installOptions, secretOpts, syncOpts, rootArgs.pollInterval, rootArgs.timeout)
-}

cmd/flux/bootstrap_git.go

@@ -19,6 +19,7 @@ package main
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
 	"net/url"
 	"os"
 	"strings"
@@ -35,7 +36,6 @@ import (
 	"github.com/fluxcd/flux2/internal/bootstrap/git/gogit"
 	"github.com/fluxcd/flux2/internal/flags"
 	"github.com/fluxcd/flux2/internal/utils"
-	"github.com/fluxcd/flux2/pkg/manifestgen"
 	"github.com/fluxcd/flux2/pkg/manifestgen/install"
 	"github.com/fluxcd/flux2/pkg/manifestgen/sourcesecret"
 	"github.com/fluxcd/flux2/pkg/manifestgen/sync"
@@ -54,9 +54,6 @@ command will perform an upgrade if needed.`,
   # Run bootstrap for a Git repository and authenticate using a password
   flux bootstrap git --url=https://example.com/repository.git --password=<password>
 
-  # Run bootstrap for a Git repository and authenticate using a password from environment variable
-  GIT_PASSWORD=<password> && flux bootstrap git --url=https://example.com/repository.git
-
   # Run bootstrap for a Git repository with a passwordless private key
   flux bootstrap git --url=ssh://git@example.com/repository.git --private-key-file=<path/to/private.key>
 
@@ -67,19 +64,14 @@ command will perform an upgrade if needed.`,
 }
 
 type gitFlags struct {
-	url                 string
+	url      string
-	interval            time.Duration
+	interval time.Duration
-	path                flags.SafeRelativePath
+	path     flags.SafeRelativePath
-	username            string
+	username string
-	password            string
+	password string
-	silent              bool
+	silent   bool
-	insecureHttpAllowed bool
 }
 
-const (
-	gitPasswordEnvVar = "GIT_PASSWORD"
-)
-
 var gitArgs gitFlags
 
 func init() {
@@ -89,25 +81,11 @@ func init() {
 	bootstrapGitCmd.Flags().StringVarP(&gitArgs.username, "username", "u", "git", "basic authentication username")
 	bootstrapGitCmd.Flags().StringVarP(&gitArgs.password, "password", "p", "", "basic authentication password")
 	bootstrapGitCmd.Flags().BoolVarP(&gitArgs.silent, "silent", "s", false, "assumes the deploy key is already setup, skips confirmation")
-	bootstrapGitCmd.Flags().BoolVar(&gitArgs.insecureHttpAllowed, "allow-insecure-http", false, "allows http git url connections")
 
 	bootstrapCmd.AddCommand(bootstrapGitCmd)
 }
 
 func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
-	gitPassword := os.Getenv(gitPasswordEnvVar)
-	if gitPassword != "" && gitArgs.password == "" {
-		gitArgs.password = gitPassword
-	}
-	if bootstrapArgs.tokenAuth && gitArgs.password == "" {
-		var err error
-		gitPassword, err = readPasswordFromStdin("Please enter your Git repository password: ")
-		if err != nil {
-			return fmt.Errorf("could not read token: %w", err)
-		}
-		gitArgs.password = gitPassword
-	}
-
 	if err := bootstrapValidate(); err != nil {
 		return err
 	}
@@ -124,7 +102,7 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
 
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
@@ -140,7 +118,7 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
 	defer os.RemoveAll(manifestsBase)
 
 	// Lazy go-git repository
-	tmpDir, err := manifestgen.MkdirTempAbs("", "flux-bootstrap-")
+	tmpDir, err := ioutil.TempDir("", "flux-bootstrap-")
 	if err != nil {
 		return fmt.Errorf("failed to create temporary working dir: %w", err)
 	}
@@ -151,7 +129,7 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
 	installOptions := install.Options{
 		BaseURL:                rootArgs.defaults.BaseURL,
 		Version:                bootstrapArgs.version,
-		Namespace:              *kubeconfigArgs.Namespace,
+		Namespace:              rootArgs.namespace,
 		Components:             bootstrapComponents(),
 		Registry:               bootstrapArgs.registry,
 		ImagePullSecret:        bootstrapArgs.imagePullSecret,
@@ -172,7 +150,7 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
 	// Source generation and secret config
 	secretOpts := sourcesecret.Options{
 		Name:         bootstrapArgs.secretName,
-		Namespace:    *kubeconfigArgs.Namespace,
+		Namespace:    rootArgs.namespace,
 		TargetPath:   gitArgs.path.String(),
 		ManifestFile: sourcesecret.MakeDefaultOptions().ManifestFile,
 	}
@@ -184,29 +162,18 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
 			secretOpts.CAFilePath = bootstrapArgs.caFile
 		}
 
-		// Remove port of the given host when not syncing over HTTP/S to not assume port for protocol
-		// This _might_ be overwritten later on by e.g. --ssh-hostname
-		if repositoryURL.Scheme != "https" && repositoryURL.Scheme != "http" {
-			repositoryURL.Host = repositoryURL.Hostname()
-		}
-
 		// Configure repository URL to match auth config for sync.
 		repositoryURL.User = nil
 		repositoryURL.Scheme = "https"
+		repositoryURL.Host = repositoryURL.Hostname()
 	} else {
 		secretOpts.PrivateKeyAlgorithm = sourcesecret.PrivateKeyAlgorithm(bootstrapArgs.keyAlgorithm)
 		secretOpts.Password = gitArgs.password
 		secretOpts.RSAKeyBits = int(bootstrapArgs.keyRSABits)
 		secretOpts.ECDSACurve = bootstrapArgs.keyECDSACurve.Curve
 
-		// Configure repository URL to match auth config for sync
+		// Configure repository URL to match auth config for sync.
-
+		repositoryURL.User = url.User(gitArgs.username)
-		// Override existing user when user is not already set
-		// or when a username was passed in
-		if repositoryURL.User == nil || gitArgs.username != "git" {
-			repositoryURL.User = url.User(gitArgs.username)
-		}
-
 		repositoryURL.Scheme = "ssh"
 		if bootstrapArgs.sshHostname != "" {
 			repositoryURL.Host = bootstrapArgs.sshHostname
@@ -222,8 +189,8 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
 	// Sync manifest config
 	syncOpts := sync.Options{
 		Interval:          gitArgs.interval,
-		Name:              *kubeconfigArgs.Namespace,
+		Name:              rootArgs.namespace,
-		Namespace:         *kubeconfigArgs.Namespace,
+		Namespace:         rootArgs.namespace,
 		URL:               repositoryURL.String(),
 		Branch:            bootstrapArgs.branch,
 		Secret:            bootstrapArgs.secretName,
@@ -233,26 +200,15 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
 		RecurseSubmodules: bootstrapArgs.recurseSubmodules,
 	}
 
-	var caBundle []byte
-	if bootstrapArgs.caFile != "" {
-		var err error
-		caBundle, err = os.ReadFile(bootstrapArgs.caFile)
-		if err != nil {
-			return fmt.Errorf("unable to read TLS CA file: %w", err)
-		}
-	}
-
 	// Bootstrap config
 	bootstrapOpts := []bootstrap.GitOption{
 		bootstrap.WithRepositoryURL(gitArgs.url),
 		bootstrap.WithBranch(bootstrapArgs.branch),
 		bootstrap.WithAuthor(bootstrapArgs.authorName, bootstrapArgs.authorEmail),
 		bootstrap.WithCommitMessageAppendix(bootstrapArgs.commitMessageAppendix),
-		bootstrap.WithKubeconfig(kubeconfigArgs, kubeclientOptions),
+		bootstrap.WithKubeconfig(rootArgs.kubeconfig, rootArgs.kubecontext),
 		bootstrap.WithPostGenerateSecretFunc(promptPublicKey),
 		bootstrap.WithLogger(logger),
-		bootstrap.WithCABundle(caBundle),
-		bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyRingPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
 	}
 
 	// Setup bootstrapper with constructed configs
@@ -271,14 +227,6 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
 // SSH-agent is attempted.
 func transportForURL(u *url.URL) (transport.AuthMethod, error) {
 	switch u.Scheme {
-	case "http":
-		if !gitArgs.insecureHttpAllowed {
-			return nil, fmt.Errorf("scheme http is insecure, pass --allow-insecure-http=true to allow it")
-		}
-		return &http.BasicAuth{
-			Username: gitArgs.username,
-			Password: gitArgs.password,
-		}, nil
 	case "https":
 		return &http.BasicAuth{
 			Username: gitArgs.username,

cmd/flux/bootstrap_github.go

@@ -19,6 +19,7 @@ package main
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
 	"os"
 	"time"
 
@@ -30,7 +31,6 @@ import (
 	"github.com/fluxcd/flux2/internal/bootstrap/provider"
 	"github.com/fluxcd/flux2/internal/flags"
 	"github.com/fluxcd/flux2/internal/utils"
-	"github.com/fluxcd/flux2/pkg/manifestgen"
 	"github.com/fluxcd/flux2/pkg/manifestgen/install"
 	"github.com/fluxcd/flux2/pkg/manifestgen/sourcesecret"
 	"github.com/fluxcd/flux2/pkg/manifestgen/sync"
@@ -53,9 +53,6 @@ the bootstrap command will perform an upgrade if needed.`,
   # Run bootstrap for a private repository and assign organization teams to it
   flux bootstrap github --owner=<organization> --repository=<repository name> --team=<team1 slug> --team=<team2 slug>
 
-  # Run bootstrap for a private repository and assign organization teams with their access level(e.g maintain, admin) to it
-  flux bootstrap github --owner=<organization> --repository=<repository name> --team=<team1 slug>:<access-level>
-
   # Run bootstrap for a repository path
   flux bootstrap github --owner=<organization> --repository=<repository name> --path=dev-cluster
 
@@ -97,7 +94,7 @@ var githubArgs githubFlags
 func init() {
 	bootstrapGitHubCmd.Flags().StringVar(&githubArgs.owner, "owner", "", "GitHub user or organization name")
 	bootstrapGitHubCmd.Flags().StringVar(&githubArgs.repository, "repository", "", "GitHub repository name")
-	bootstrapGitHubCmd.Flags().StringSliceVar(&githubArgs.teams, "team", []string{}, "GitHub team and the access to be given to it(team:maintain). Defaults to maintainer access if no access level is specified (also accepts comma-separated values)")
+	bootstrapGitHubCmd.Flags().StringSliceVar(&githubArgs.teams, "team", []string{}, "GitHub team to be given maintainer access (also accepts comma-separated values)")
 	bootstrapGitHubCmd.Flags().BoolVar(&githubArgs.personal, "personal", false, "if true, the owner is assumed to be a GitHub user; otherwise an org")
 	bootstrapGitHubCmd.Flags().BoolVar(&githubArgs.private, "private", true, "if true, the repository is setup or configured as private")
 	bootstrapGitHubCmd.Flags().DurationVar(&githubArgs.interval, "interval", time.Minute, "sync interval")
@@ -112,11 +109,7 @@ func init() {
 func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
 	ghToken := os.Getenv(ghTokenEnvVar)
 	if ghToken == "" {
-		var err error
+		return fmt.Errorf("%s environment variable not found", ghTokenEnvVar)
-		ghToken, err = readPasswordFromStdin("Please enter your GitHub personal access token (PAT): ")
-		if err != nil {
-			return fmt.Errorf("could not read token: %w", err)
-		}
 	}
 
 	if err := bootstrapValidate(); err != nil {
@@ -126,7 +119,7 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
 
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
@@ -141,20 +134,11 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
 	}
 	defer os.RemoveAll(manifestsBase)
 
-	var caBundle []byte
-	if bootstrapArgs.caFile != "" {
-		var err error
-		caBundle, err = os.ReadFile(bootstrapArgs.caFile)
-		if err != nil {
-			return fmt.Errorf("unable to read TLS CA file: %w", err)
-		}
-	}
 	// Build GitHub provider
 	providerCfg := provider.Config{
 		Provider: provider.GitProviderGitHub,
 		Hostname: githubArgs.hostname,
 		Token:    ghToken,
-		CaBundle: caBundle,
 	}
 	providerClient, err := provider.BuildGitProvider(providerCfg)
 	if err != nil {
@@ -162,7 +146,7 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
 	}
 
 	// Lazy go-git repository
-	tmpDir, err := manifestgen.MkdirTempAbs("", "flux-bootstrap-")
+	tmpDir, err := ioutil.TempDir("", "flux-bootstrap-")
 	if err != nil {
 		return fmt.Errorf("failed to create temporary working dir: %w", err)
 	}
@@ -176,7 +160,7 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
 	installOptions := install.Options{
 		BaseURL:                rootArgs.defaults.BaseURL,
 		Version:                bootstrapArgs.version,
-		Namespace:              *kubeconfigArgs.Namespace,
+		Namespace:              rootArgs.namespace,
 		Components:             bootstrapComponents(),
 		Registry:               bootstrapArgs.registry,
 		ImagePullSecret:        bootstrapArgs.imagePullSecret,
@@ -197,7 +181,7 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
 	// Source generation and secret config
 	secretOpts := sourcesecret.Options{
 		Name:         bootstrapArgs.secretName,
-		Namespace:    *kubeconfigArgs.Namespace,
+		Namespace:    rootArgs.namespace,
 		TargetPath:   githubArgs.path.ToSlash(),
 		ManifestFile: sourcesecret.MakeDefaultOptions().ManifestFile,
 	}
@@ -222,8 +206,8 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
 	// Sync manifest config
 	syncOpts := sync.Options{
 		Interval:          githubArgs.interval,
-		Name:              *kubeconfigArgs.Namespace,
+		Name:              rootArgs.namespace,
-		Namespace:         *kubeconfigArgs.Namespace,
+		Namespace:         rootArgs.namespace,
 		Branch:            bootstrapArgs.branch,
 		Secret:            bootstrapArgs.secretName,
 		TargetPath:        githubArgs.path.ToSlash(),
@@ -241,10 +225,8 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
 		bootstrap.WithCommitMessageAppendix(bootstrapArgs.commitMessageAppendix),
 		bootstrap.WithProviderTeamPermissions(mapTeamSlice(githubArgs.teams, ghDefaultPermission)),
 		bootstrap.WithReadWriteKeyPermissions(githubArgs.readWriteKey),
-		bootstrap.WithKubeconfig(kubeconfigArgs, kubeclientOptions),
+		bootstrap.WithKubeconfig(rootArgs.kubeconfig, rootArgs.kubecontext),
 		bootstrap.WithLogger(logger),
-		bootstrap.WithCABundle(caBundle),
-		bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyRingPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
 	}
 	if bootstrapArgs.sshHostname != "" {
 		bootstrapOpts = append(bootstrapOpts, bootstrap.WithSSHHostname(bootstrapArgs.sshHostname))

cmd/flux/bootstrap_gitlab.go

@@ -19,6 +19,7 @@ package main
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
 	"os"
 	"regexp"
 	"strings"
@@ -32,7 +33,6 @@ import (
 	"github.com/fluxcd/flux2/internal/bootstrap/provider"
 	"github.com/fluxcd/flux2/internal/flags"
 	"github.com/fluxcd/flux2/internal/utils"
-	"github.com/fluxcd/flux2/pkg/manifestgen"
 	"github.com/fluxcd/flux2/pkg/manifestgen/install"
 	"github.com/fluxcd/flux2/pkg/manifestgen/sourcesecret"
 	"github.com/fluxcd/flux2/pkg/manifestgen/sync"
@@ -109,11 +109,7 @@ func init() {
 func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
 	glToken := os.Getenv(glTokenEnvVar)
 	if glToken == "" {
-		var err error
+		return fmt.Errorf("%s environment variable not found", glTokenEnvVar)
-		glToken, err = readPasswordFromStdin("Please enter your GitLab personal access token (PAT): ")
-		if err != nil {
-			return fmt.Errorf("could not read token: %w", err)
-		}
 	}
 
 	if projectNameIsValid, err := regexp.MatchString(gitlabProjectRegex, gitlabArgs.repository); err != nil || !projectNameIsValid {
@@ -130,7 +126,7 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
 
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
@@ -145,21 +141,11 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
 	}
 	defer os.RemoveAll(manifestsBase)
 
-	var caBundle []byte
-	if bootstrapArgs.caFile != "" {
-		var err error
-		caBundle, err = os.ReadFile(bootstrapArgs.caFile)
-		if err != nil {
-			return fmt.Errorf("unable to read TLS CA file: %w", err)
-		}
-	}
-
 	// Build GitLab provider
 	providerCfg := provider.Config{
 		Provider: provider.GitProviderGitLab,
 		Hostname: gitlabArgs.hostname,
 		Token:    glToken,
-		CaBundle: caBundle,
 	}
 	// Workaround for: https://github.com/fluxcd/go-git-providers/issues/55
 	if hostname := providerCfg.Hostname; hostname != glDefaultDomain &&
@@ -173,7 +159,7 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
 	}
 
 	// Lazy go-git repository
-	tmpDir, err := manifestgen.MkdirTempAbs("", "flux-bootstrap-")
+	tmpDir, err := ioutil.TempDir("", "flux-bootstrap-")
 	if err != nil {
 		return fmt.Errorf("failed to create temporary working dir: %w", err)
 	}
@@ -187,7 +173,7 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
 	installOptions := install.Options{
 		BaseURL:                rootArgs.defaults.BaseURL,
 		Version:                bootstrapArgs.version,
-		Namespace:              *kubeconfigArgs.Namespace,
+		Namespace:              rootArgs.namespace,
 		Components:             bootstrapComponents(),
 		Registry:               bootstrapArgs.registry,
 		ImagePullSecret:        bootstrapArgs.imagePullSecret,
@@ -208,7 +194,7 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
 	// Source generation and secret config
 	secretOpts := sourcesecret.Options{
 		Name:         bootstrapArgs.secretName,
-		Namespace:    *kubeconfigArgs.Namespace,
+		Namespace:    rootArgs.namespace,
 		TargetPath:   gitlabArgs.path.String(),
 		ManifestFile: sourcesecret.MakeDefaultOptions().ManifestFile,
 	}
@@ -236,8 +222,8 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
 	// Sync manifest config
 	syncOpts := sync.Options{
 		Interval:          gitlabArgs.interval,
-		Name:              *kubeconfigArgs.Namespace,
+		Name:              rootArgs.namespace,
-		Namespace:         *kubeconfigArgs.Namespace,
+		Namespace:         rootArgs.namespace,
 		Branch:            bootstrapArgs.branch,
 		Secret:            bootstrapArgs.secretName,
 		TargetPath:        gitlabArgs.path.ToSlash(),
@@ -255,10 +241,8 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
 		bootstrap.WithCommitMessageAppendix(bootstrapArgs.commitMessageAppendix),
 		bootstrap.WithProviderTeamPermissions(mapTeamSlice(gitlabArgs.teams, glDefaultPermission)),
 		bootstrap.WithReadWriteKeyPermissions(gitlabArgs.readWriteKey),
-		bootstrap.WithKubeconfig(kubeconfigArgs, kubeclientOptions),
+		bootstrap.WithKubeconfig(rootArgs.kubeconfig, rootArgs.kubecontext),
 		bootstrap.WithLogger(logger),
-		bootstrap.WithCABundle(caBundle),
-		bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyRingPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
 	}
 	if bootstrapArgs.sshHostname != "" {
 		bootstrapOpts = append(bootstrapOpts, bootstrap.WithSSHHostname(bootstrapArgs.sshHostname))

cmd/flux/build_artifact.go

@@ -1,73 +0,0 @@
-/*
-Copyright 2022 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"fmt"
-	"os"
-
-	"github.com/spf13/cobra"
-
-	oci "github.com/fluxcd/pkg/oci/client"
-)
-
-var buildArtifactCmd = &cobra.Command{
-	Use:   "artifact",
-	Short: "Build artifact",
-	Long:  `The build artifact command creates a tgz file with the manifests from the given directory.`,
-	Example: `  # Build the given manifests directory into an artifact
-  flux build artifact --path ./path/to/local/manifests --output ./path/to/artifact.tgz
-
-  # List the files bundled in the artifact
-  tar -ztvf ./path/to/artifact.tgz
-`,
-	RunE: buildArtifactCmdRun,
-}
-
-type buildArtifactFlags struct {
-	output string
-	path   string
-}
-
-var buildArtifactArgs buildArtifactFlags
-
-func init() {
-	buildArtifactCmd.Flags().StringVar(&buildArtifactArgs.path, "path", "", "Path to the directory where the Kubernetes manifests are located.")
-	buildArtifactCmd.Flags().StringVarP(&buildArtifactArgs.output, "output", "o", "artifact.tgz", "Path to where the artifact tgz file should be written.")
-	buildCmd.AddCommand(buildArtifactCmd)
-}
-
-func buildArtifactCmdRun(cmd *cobra.Command, args []string) error {
-	if buildArtifactArgs.path == "" {
-		return fmt.Errorf("invalid path %q", buildArtifactArgs.path)
-	}
-
-	if fs, err := os.Stat(buildArtifactArgs.path); err != nil || !fs.IsDir() {
-		return fmt.Errorf("invalid path '%s', must point to an existing directory", buildArtifactArgs.path)
-	}
-
-	logger.Actionf("building artifact from %s", buildArtifactArgs.path)
-
-	ociClient := oci.NewLocalClient()
-	if err := ociClient.Build(buildArtifactArgs.output, buildArtifactArgs.path); err != nil {
-		return fmt.Errorf("bulding artifact failed, error: %w", err)
-	}
-
-	logger.Successf("artifact created at %s", buildArtifactArgs.output)
-
-	return nil
-}

cmd/flux/build_kustomization.go

@@ -1,113 +0,0 @@
-/*
-Copyright 2021 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"fmt"
-	"os"
-	"os/signal"
-
-	"github.com/spf13/cobra"
-
-	"github.com/fluxcd/flux2/internal/build"
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
-)
-
-var buildKsCmd = &cobra.Command{
-	Use:     "kustomization",
-	Aliases: []string{"ks"},
-	Short:   "Build Kustomization",
-	Long: `The build command queries the Kubernetes API and fetches the specified Flux Kustomization. 
-It then uses the fetched in cluster flux kustomization to perform needed transformation on the local kustomization.yaml
-pointed at by --path. The local kustomization.yaml is generated if it does not exist. Finally it builds the overlays using the local kustomization.yaml, and write the resulting multi-doc YAML to stdout.
-
-It is possible to specify a Flux kustomization file using --kustomization-file.`,
-	Example: `# Build the local manifests as they were built on the cluster
-flux build kustomization my-app --path ./path/to/local/manifests
-
-# Build using a local flux kustomization file
-flux build kustomization my-app --path ./path/to/local/manifests --kustomization-file ./path/to/local/my-app.yaml`,
-	ValidArgsFunction: resourceNamesCompletionFunc(kustomizev1.GroupVersion.WithKind(kustomizev1.KustomizationKind)),
-	RunE:              buildKsCmdRun,
-}
-
-type buildKsFlags struct {
-	kustomizationFile string
-	path              string
-}
-
-var buildKsArgs buildKsFlags
-
-func init() {
-	buildKsCmd.Flags().StringVar(&buildKsArgs.path, "path", "", "Path to the manifests location.")
-	buildKsCmd.Flags().StringVar(&buildKsArgs.kustomizationFile, "kustomization-file", "", "Path to the Flux Kustomization YAML file.")
-	buildCmd.AddCommand(buildKsCmd)
-}
-
-func buildKsCmdRun(cmd *cobra.Command, args []string) error {
-	if len(args) < 1 {
-		return fmt.Errorf("%s name is required", kustomizationType.humanKind)
-	}
-	name := args[0]
-
-	if buildKsArgs.path == "" {
-		return fmt.Errorf("invalid resource path %q", buildKsArgs.path)
-	}
-
-	if fs, err := os.Stat(buildKsArgs.path); err != nil || !fs.IsDir() {
-		return fmt.Errorf("invalid resource path %q", buildKsArgs.path)
-	}
-
-	if buildKsArgs.kustomizationFile != "" {
-		if fs, err := os.Stat(buildKsArgs.kustomizationFile); os.IsNotExist(err) || fs.IsDir() {
-			return fmt.Errorf("invalid kustomization file %q", buildKsArgs.kustomizationFile)
-		}
-	}
-
-	builder, err := build.NewBuilder(kubeconfigArgs, kubeclientOptions, name, buildKsArgs.path, build.WithTimeout(rootArgs.timeout), build.WithKustomizationFile(buildKsArgs.kustomizationFile))
-	if err != nil {
-		return err
-	}
-
-	// create a signal channel
-	sigc := make(chan os.Signal, 1)
-	signal.Notify(sigc, os.Interrupt)
-
-	errChan := make(chan error)
-	go func() {
-		manifests, err := builder.Build()
-		if err != nil {
-			errChan <- err
-		}
-
-		cmd.Print(string(manifests))
-		errChan <- nil
-	}()
-
-	select {
-	case <-sigc:
-		fmt.Println("Build cancelled... exiting.")
-		return builder.Cancel()
-	case err := <-errChan:
-		if err != nil {
-			return err
-		}
-	}
-
-	return nil
-
-}

cmd/flux/build_kustomization_test.go

@@ -1,190 +0,0 @@
-//go:build unit
-// +build unit
-
-/*
-Copyright 2021 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"bytes"
-	"os"
-	"testing"
-	"text/template"
-)
-
-func setup(t *testing.T, tmpl map[string]string) {
-	t.Helper()
-	testEnv.CreateObjectFile("./testdata/build-kustomization/podinfo-source.yaml", tmpl, t)
-	testEnv.CreateObjectFile("./testdata/build-kustomization/podinfo-kustomization.yaml", tmpl, t)
-}
-
-func TestBuildKustomization(t *testing.T) {
-	tests := []struct {
-		name       string
-		args       string
-		resultFile string
-		assertFunc string
-	}{
-		{
-			name:       "no args",
-			args:       "build kustomization podinfo",
-			resultFile: "invalid resource path \"\"",
-			assertFunc: "assertError",
-		},
-		{
-			name:       "build podinfo",
-			args:       "build kustomization podinfo --path ./testdata/build-kustomization/podinfo",
-			resultFile: "./testdata/build-kustomization/podinfo-result.yaml",
-			assertFunc: "assertGoldenTemplateFile",
-		},
-		{
-			name:       "build podinfo without service",
-			args:       "build kustomization podinfo --path ./testdata/build-kustomization/delete-service",
-			resultFile: "./testdata/build-kustomization/podinfo-without-service-result.yaml",
-			assertFunc: "assertGoldenTemplateFile",
-		},
-		{
-			name:       "build deployment and configmap with var substitution",
-			args:       "build kustomization podinfo --path ./testdata/build-kustomization/var-substitution",
-			resultFile: "./testdata/build-kustomization/podinfo-with-var-substitution-result.yaml",
-			assertFunc: "assertGoldenTemplateFile",
-		},
-	}
-
-	tmpl := map[string]string{
-		"fluxns": allocateNamespace("flux-system"),
-	}
-	setup(t, tmpl)
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			var assert assertFunc
-
-			switch tt.assertFunc {
-			case "assertGoldenTemplateFile":
-				assert = assertGoldenTemplateFile(tt.resultFile, tmpl)
-			case "assertError":
-				assert = assertError(tt.resultFile)
-			}
-
-			cmd := cmdTestCase{
-				args:   tt.args + " -n " + tmpl["fluxns"],
-				assert: assert,
-			}
-
-			cmd.runTestCmd(t)
-		})
-	}
-}
-
-func TestBuildLocalKustomization(t *testing.T) {
-	podinfo := `apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
-kind: Kustomization
-metadata:
-  name: podinfo
-  namespace: {{ .fluxns }}
-spec:
-  interval: 5m0s
-  path: ./kustomize
-  force: true
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: podinfo
-  targetNamespace: default
-  postBuild:
-    substitute:
-      cluster_env: "prod"
-      cluster_region: "eu-central-1"
-`
-
-	tests := []struct {
-		name       string
-		args       string
-		resultFile string
-		assertFunc string
-	}{
-		{
-			name:       "no args",
-			args:       "build kustomization podinfo --kustomization-file ./wrongfile/ --path ./testdata/build-kustomization/podinfo",
-			resultFile: "invalid kustomization file \"./wrongfile/\"",
-			assertFunc: "assertError",
-		},
-		{
-			name:       "build podinfo",
-			args:       "build kustomization podinfo --kustomization-file ./testdata/build-kustomization/podinfo.yaml --path ./testdata/build-kustomization/podinfo",
-			resultFile: "./testdata/build-kustomization/podinfo-result.yaml",
-			assertFunc: "assertGoldenTemplateFile",
-		},
-		{
-			name:       "build podinfo without service",
-			args:       "build kustomization podinfo --kustomization-file ./testdata/build-kustomization/podinfo.yaml --path ./testdata/build-kustomization/delete-service",
-			resultFile: "./testdata/build-kustomization/podinfo-without-service-result.yaml",
-			assertFunc: "assertGoldenTemplateFile",
-		},
-		{
-			name:       "build deployment and configmap with var substitution",
-			args:       "build kustomization podinfo --kustomization-file ./testdata/build-kustomization/podinfo.yaml --path ./testdata/build-kustomization/var-substitution",
-			resultFile: "./testdata/build-kustomization/podinfo-with-var-substitution-result.yaml",
-			assertFunc: "assertGoldenTemplateFile",
-		},
-	}
-
-	tmpl := map[string]string{
-		"fluxns": allocateNamespace("flux-system"),
-	}
-
-	testEnv.CreateObjectFile("./testdata/build-kustomization/podinfo-source.yaml", tmpl, t)
-
-	temp, err := template.New("podinfo").Parse(podinfo)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	var b bytes.Buffer
-	err = temp.Execute(&b, tmpl)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = os.WriteFile("./testdata/build-kustomization/podinfo.yaml", b.Bytes(), 0666)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	defer os.Remove("./testdata/build-kustomization/podinfo.yaml")
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			var assert assertFunc
-
-			switch tt.assertFunc {
-			case "assertGoldenTemplateFile":
-				assert = assertGoldenTemplateFile(tt.resultFile, tmpl)
-			case "assertError":
-				assert = assertError(tt.resultFile)
-			}
-
-			cmd := cmdTestCase{
-				args:   tt.args + " -n " + tmpl["fluxns"],
-				assert: assert,
-			}
-
-			cmd.runTestCmd(t)
-		})
-	}
-}

cmd/flux/check.go

@@ -18,20 +18,21 @@ package main
 
 import (
 	"context"
+	"encoding/json"
 	"os"
+	"os/exec"
 	"time"
 
 	"github.com/Masterminds/semver/v3"
 	"github.com/spf13/cobra"
 	v1 "k8s.io/api/apps/v1"
-	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	apimachineryversion "k8s.io/apimachinery/pkg/version"
 	"k8s.io/client-go/kubernetes"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	"github.com/fluxcd/pkg/version"
 
 	"github.com/fluxcd/flux2/internal/utils"
-	"github.com/fluxcd/flux2/pkg/manifestgen"
 	"github.com/fluxcd/flux2/pkg/manifestgen/install"
 	"github.com/fluxcd/flux2/pkg/status"
 )
@@ -53,11 +54,10 @@ type checkFlags struct {
 	pre             bool
 	components      []string
 	extraComponents []string
-	pollInterval    time.Duration
 }
 
-var kubernetesConstraints = []string{
+type kubectlVersion struct {
-	">=1.20.6-0",
+	ClientVersion *apimachineryversion.Info `json:"clientVersion"`
 }
 
 var checkArgs checkFlags
@@ -69,18 +69,23 @@ func init() {
 		"list of components, accepts comma-separated values")
 	checkCmd.Flags().StringSliceVar(&checkArgs.extraComponents, "components-extra", nil,
 		"list of components in addition to those supplied or defaulted, accepts comma-separated values")
-	checkCmd.Flags().DurationVar(&checkArgs.pollInterval, "poll-interval", 5*time.Second,
-		"how often the health checker should poll the cluster for the latest state of the resources.")
 	rootCmd.AddCommand(checkCmd)
 }
 
 func runCheckCmd(cmd *cobra.Command, args []string) error {
+	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
+	defer cancel()
+
 	logger.Actionf("checking prerequisites")
 	checkFailed := false
 
 	fluxCheck()
 
-	if !kubernetesCheck(kubernetesConstraints) {
+	if !kubectlCheck(ctx, ">=1.18.0-0") {
+		checkFailed = true
+	}
+
+	if !kubernetesCheck(">=1.16.0-0") {
 		checkFailed = true
 	}
 
@@ -96,17 +101,9 @@ func runCheckCmd(cmd *cobra.Command, args []string) error {
 	if !componentsCheck() {
 		checkFailed = true
 	}
-
-	logger.Actionf("checking crds")
-	if !crdsCheck() {
-		checkFailed = true
-	}
-
 	if checkFailed {
-		logger.Failuref("check failed")
 		os.Exit(1)
 	}
-
 	logger.Successf("all checks passed")
 	return nil
 }
@@ -133,8 +130,44 @@ func fluxCheck() {
 	}
 }
 
-func kubernetesCheck(constraints []string) bool {
+func kubectlCheck(ctx context.Context, constraint string) bool {
-	cfg, err := utils.KubeConfig(kubeconfigArgs, kubeclientOptions)
+	_, err := exec.LookPath("kubectl")
+	if err != nil {
+		logger.Failuref("kubectl not found")
+		return false
+	}
+
+	kubectlArgs := []string{"version", "--client", "--output", "json"}
+	output, err := utils.ExecKubectlCommand(ctx, utils.ModeCapture, rootArgs.kubeconfig, rootArgs.kubecontext, kubectlArgs...)
+	if err != nil {
+		logger.Failuref("kubectl version can't be determined")
+		return false
+	}
+
+	kv := &kubectlVersion{}
+	if err = json.Unmarshal([]byte(output), kv); err != nil {
+		logger.Failuref("kubectl version output can't be unmarshalled")
+		return false
+	}
+
+	v, err := version.ParseVersion(kv.ClientVersion.GitVersion)
+	if err != nil {
+		logger.Failuref("kubectl version can't be parsed")
+		return false
+	}
+
+	c, _ := semver.NewConstraint(constraint)
+	if !c.Check(v) {
+		logger.Failuref("kubectl version %s < %s", v.Original(), constraint)
+		return false
+	}
+
+	logger.Successf("kubectl %s %s", v.String(), constraint)
+	return true
+}
+
+func kubernetesCheck(constraint string) bool {
+	cfg, err := utils.KubeConfig(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		logger.Failuref("Kubernetes client initialization failed: %s", err.Error())
 		return false
@@ -158,23 +191,13 @@ func kubernetesCheck(constraints []string) bool {
 		return false
 	}
 
-	var valid bool
+	c, _ := semver.NewConstraint(constraint)
-	var vrange string
+	if !c.Check(v) {
-	for _, constraint := range constraints {
+		logger.Failuref("Kubernetes version %s < %s", v.Original(), constraint)
-		c, _ := semver.NewConstraint(constraint)
-		if c.Check(v) {
-			valid = true
-			vrange = constraint
-			break
-		}
-	}
-
-	if !valid {
-		logger.Failuref("Kubernetes version %s does not match %s", v.Original(), constraints[0])
 		return false
 	}
 
-	logger.Successf("Kubernetes %s %s", v.String(), vrange)
+	logger.Successf("Kubernetes %s %s", v.String(), constraint)
 	return true
 }
 
@@ -182,32 +205,25 @@ func componentsCheck() bool {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
 
-	kubeConfig, err := utils.KubeConfig(kubeconfigArgs, kubeclientOptions)
+	kubeConfig, err := utils.KubeConfig(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return false
 	}
 
-	statusChecker, err := status.NewStatusChecker(kubeConfig, checkArgs.pollInterval, rootArgs.timeout, logger)
+	statusChecker, err := status.NewStatusChecker(kubeConfig, time.Second, rootArgs.timeout, logger)
 	if err != nil {
 		return false
 	}
 
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return false
 	}
 
 	ok := true
-	selector := client.MatchingLabels{manifestgen.PartOfLabelKey: manifestgen.PartOfLabelValue}
+	selector := client.MatchingLabels{"app.kubernetes.io/instance": rootArgs.namespace}
 	var list v1.DeploymentList
-	ns := *kubeconfigArgs.Namespace
+	if err := kubeClient.List(ctx, &list, client.InNamespace(rootArgs.namespace), selector); err == nil {
-	if err := kubeClient.List(ctx, &list, client.InNamespace(ns), selector); err == nil {
-		if len(list.Items) == 0 {
-			logger.Failuref("no controllers found in the '%s' namespace with the label selector '%s=%s'",
-				ns, manifestgen.PartOfLabelKey, manifestgen.PartOfLabelValue)
-			return false
-		}
-
 		for _, d := range list.Items {
 			if ref, err := buildComponentObjectRefs(d.Name); err == nil {
 				if err := statusChecker.Assess(ref...); err != nil {
@@ -221,34 +237,3 @@ func componentsCheck() bool {
 	}
 	return ok
 }
-
-func crdsCheck() bool {
-	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
-	defer cancel()
-
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
-	if err != nil {
-		return false
-	}
-
-	ok := true
-	selector := client.MatchingLabels{manifestgen.PartOfLabelKey: manifestgen.PartOfLabelValue}
-	var list apiextensionsv1.CustomResourceDefinitionList
-	if err := kubeClient.List(ctx, &list, client.InNamespace(*kubeconfigArgs.Namespace), selector); err == nil {
-		if len(list.Items) == 0 {
-			logger.Failuref("no crds found with the label selector '%s=%s'",
-				manifestgen.PartOfLabelKey, manifestgen.PartOfLabelValue)
-			return false
-		}
-
-		for _, crd := range list.Items {
-			if len(crd.Status.StoredVersions) > 0 {
-				logger.Successf(crd.Name + "/" + crd.Status.StoredVersions[0])
-			} else {
-				ok = false
-				logger.Failuref("no stored versions for %s", crd.Name)
-			}
-		}
-	}
-	return ok
-}

cmd/flux/check_test.go

@@ -1,53 +0,0 @@
-//go:build e2e
-// +build e2e
-
-/*
-Copyright 2021 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"github.com/fluxcd/flux2/internal/utils"
-)
-
-func TestCheckPre(t *testing.T) {
-	jsonOutput, err := utils.ExecKubectlCommand(context.TODO(), utils.ModeCapture, *kubeconfigArgs.KubeConfig, *kubeconfigArgs.Context, "version", "--output", "json")
-	if err != nil {
-		t.Fatalf("Error running utils.ExecKubectlCommand: %v", err.Error())
-	}
-
-	var versions map[string]interface{}
-	if err := json.Unmarshal([]byte(jsonOutput), &versions); err != nil {
-		t.Fatalf("Error unmarshalling '%s': %v", jsonOutput, err.Error())
-	}
-
-	serverGitVersion := strings.TrimPrefix(
-		versions["serverVersion"].(map[string]interface{})["gitVersion"].(string),
-		"v")
-
-	cmd := cmdTestCase{
-		args: "check --pre",
-		assert: assertGoldenTemplateFile("testdata/check/check_pre.golden", map[string]string{
-			"serverVersion": serverGitVersion,
-		}),
-	}
-	cmd.runTestCmd(t)
-}

cmd/flux/completion.go

@@ -17,15 +17,7 @@ limitations under the License.
 package main
 
 import (
-	"context"
-	"strings"
-
-	"github.com/fluxcd/flux2/internal/utils"
 	"github.com/spf13/cobra"
-	"k8s.io/apimachinery/pkg/api/meta"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-	"k8s.io/client-go/dynamic"
 )
 
 var completionCmd = &cobra.Command{
@@ -37,76 +29,3 @@ var completionCmd = &cobra.Command{
 func init() {
 	rootCmd.AddCommand(completionCmd)
 }
-
-func contextsCompletionFunc(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-	rawConfig, err := kubeconfigArgs.ToRawKubeConfigLoader().RawConfig()
-	if err != nil {
-		return completionError(err)
-	}
-
-	var comps []string
-
-	for name := range rawConfig.Contexts {
-		if strings.HasPrefix(name, toComplete) {
-			comps = append(comps, name)
-		}
-	}
-
-	return comps, cobra.ShellCompDirectiveNoFileComp
-}
-
-func resourceNamesCompletionFunc(gvk schema.GroupVersionKind) func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-	return func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
-		ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
-		defer cancel()
-
-		cfg, err := utils.KubeConfig(kubeconfigArgs, kubeclientOptions)
-		if err != nil {
-			return completionError(err)
-		}
-
-		mapper, err := kubeconfigArgs.ToRESTMapper()
-		if err != nil {
-			return completionError(err)
-		}
-
-		mapping, err := mapper.RESTMapping(gvk.GroupKind(), gvk.Version)
-		if err != nil {
-			return completionError(err)
-		}
-
-		client, err := dynamic.NewForConfig(cfg)
-		if err != nil {
-			return completionError(err)
-		}
-
-		var dr dynamic.ResourceInterface
-		if mapping.Scope.Name() == meta.RESTScopeNameNamespace {
-			dr = client.Resource(mapping.Resource).Namespace(*kubeconfigArgs.Namespace)
-		} else {
-			dr = client.Resource(mapping.Resource)
-		}
-
-		list, err := dr.List(ctx, metav1.ListOptions{})
-		if err != nil {
-			return completionError(err)
-		}
-
-		var comps []string
-
-		for _, item := range list.Items {
-			name := item.GetName()
-
-			if strings.HasPrefix(name, toComplete) {
-				comps = append(comps, name)
-			}
-		}
-
-		return comps, cobra.ShellCompDirectiveNoFileComp
-	}
-}
-
-func completionError(err error) ([]string, cobra.ShellCompDirective) {
-	cobra.CompError(err.Error())
-	return nil, cobra.ShellCompDirectiveError
-}

cmd/flux/completion_zsh.go

@@ -17,7 +17,6 @@ limitations under the License.
 package main
 
 import (
-	"fmt"
 	"os"
 
 	"github.com/spf13/cobra"
@@ -28,12 +27,12 @@ var completionZshCmd = &cobra.Command{
 	Short: "Generates zsh completion scripts",
 	Example: `To load completion run
 
-. <(flux completion zsh)
+. <(flux completion zsh) && compdef _flux flux
 
 To configure your zsh shell to load completions for each session add to your zshrc
 
 # ~/.zshrc or ~/.profile
-command -v flux >/dev/null && . <(flux completion zsh)
+command -v flux >/dev/null && . <(flux completion zsh) && compdef _flux flux
 
 or write a cached file in one of the completion directories in your ${fpath}:
 
@@ -44,8 +43,6 @@ mv _flux ~/.oh-my-zsh/completions  # oh-my-zsh
 mv _flux ~/.zprezto/modules/completion/external/src/  # zprezto`,
 	Run: func(cmd *cobra.Command, args []string) {
 		rootCmd.GenZshCompletion(os.Stdout)
-		// Cobra doesn't source zsh completion file, explicitly doing it here
-		fmt.Println("compdef _flux flux")
 	},
 }
 

cmd/flux/create.go

@@ -19,7 +19,6 @@ package main
 import (
 	"context"
 	"fmt"
-	"regexp"
 	"strings"
 	"time"
 
@@ -52,18 +51,6 @@ func init() {
 	createCmd.PersistentFlags().BoolVar(&createArgs.export, "export", false, "export in YAML format to stdout")
 	createCmd.PersistentFlags().StringSliceVar(&createArgs.labels, "label", nil,
 		"set labels on the resource (can specify multiple labels with commas: label1=value1,label2=value2)")
-	createCmd.PersistentPreRunE = func(cmd *cobra.Command, args []string) error {
-		if len(args) < 1 {
-			return fmt.Errorf("name is required")
-		}
-
-		name := args[0]
-		if !validateObjectName(name) {
-			return fmt.Errorf("name '%s' is invalid, it should adhere to standard defined in RFC 1123, the name can only contain alphanumeric characters or '-'", name)
-		}
-
-		return nil
-	}
 	rootCmd.AddCommand(createCmd)
 }
 
@@ -117,7 +104,7 @@ func (names apiType) upsertAndWait(object upsertWaitable, mutate func() error) e
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
 
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions) // NB globals
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext) // NB globals
 	if err != nil {
 		return err
 	}
@@ -163,8 +150,3 @@ func parseLabels() (map[string]string, error) {
 
 	return result, nil
 }
-
-func validateObjectName(name string) bool {
-	r := regexp.MustCompile("^[a-z0-9]([a-z0-9\\-]){0,61}[a-z0-9]$")
-	return r.MatchString(name)
-}

cmd/flux/create_alert.go

@@ -63,6 +63,9 @@ func init() {
 }
 
 func createAlertCmdRun(cmd *cobra.Command, args []string) error {
+	if len(args) < 1 {
+		return fmt.Errorf("Alert name is required")
+	}
 	name := args[0]
 
 	if alertArgs.providerRef == "" {
@@ -99,7 +102,7 @@ func createAlertCmdRun(cmd *cobra.Command, args []string) error {
 	alert := notificationv1.Alert{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    sourceLabels,
 		},
 		Spec: notificationv1.AlertSpec{
@@ -119,7 +122,7 @@ func createAlertCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
 
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}

cmd/flux/create_alertprovider.go

@@ -73,6 +73,9 @@ func init() {
 }
 
 func createAlertProviderCmdRun(cmd *cobra.Command, args []string) error {
+	if len(args) < 1 {
+		return fmt.Errorf("Provider name is required")
+	}
 	name := args[0]
 
 	if alertProviderArgs.alertType == "" {
@@ -91,7 +94,7 @@ func createAlertProviderCmdRun(cmd *cobra.Command, args []string) error {
 	provider := notificationv1.Provider{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    sourceLabels,
 		},
 		Spec: notificationv1.ProviderSpec{
@@ -115,7 +118,7 @@ func createAlertProviderCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
 
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}

cmd/flux/create_helmrelease.go

@@ -20,9 +20,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"os"
+	"io/ioutil"
-	"strings"
-	"time"
 
 	"github.com/fluxcd/flux2/internal/flags"
 	"github.com/fluxcd/flux2/internal/utils"
@@ -110,26 +108,21 @@ var createHelmReleaseCmd = &cobra.Command{
 }
 
 type helmReleaseFlags struct {
-	name                string
+	name            string
-	source              flags.HelmChartSource
+	source          flags.HelmChartSource
-	dependsOn           []string
+	dependsOn       []string
-	chart               string
+	chart           string
-	chartVersion        string
+	chartVersion    string
-	targetNamespace     string
+	targetNamespace string
-	createNamespace     bool
+	createNamespace bool
-	valuesFiles         []string
+	valuesFiles     []string
-	valuesFrom          []string
+	valuesFrom      flags.HelmReleaseValuesFrom
-	saName              string
+	saName          string
-	crds                flags.CRDsPolicy
+	crds            flags.CRDsPolicy
-	reconcileStrategy   string
-	chartInterval       time.Duration
-	kubeConfigSecretRef string
 }
 
 var helmReleaseArgs helmReleaseFlags
 
-var supportedHelmReleaseValuesFromKinds = []string{"Secret", "ConfigMap"}
-
 func init() {
 	createHelmReleaseCmd.Flags().StringVar(&helmReleaseArgs.name, "release-name", "", "name used for the Helm release, defaults to a composition of '[<target-namespace>-]<HelmRelease-name>'")
 	createHelmReleaseCmd.Flags().Var(&helmReleaseArgs.source, "source", helmReleaseArgs.source.Description())
@@ -139,16 +132,16 @@ func init() {
 	createHelmReleaseCmd.Flags().StringVar(&helmReleaseArgs.targetNamespace, "target-namespace", "", "namespace to install this release, defaults to the HelmRelease namespace")
 	createHelmReleaseCmd.Flags().BoolVar(&helmReleaseArgs.createNamespace, "create-target-namespace", false, "create the target namespace if it does not exist")
 	createHelmReleaseCmd.Flags().StringVar(&helmReleaseArgs.saName, "service-account", "", "the name of the service account to impersonate when reconciling this HelmRelease")
-	createHelmReleaseCmd.Flags().StringVar(&helmReleaseArgs.reconcileStrategy, "reconcile-strategy", "ChartVersion", "the reconcile strategy for helm chart created by the helm release(accepted values: Revision and ChartRevision)")
-	createHelmReleaseCmd.Flags().DurationVarP(&helmReleaseArgs.chartInterval, "chart-interval", "", 0, "the interval of which to check for new chart versions")
 	createHelmReleaseCmd.Flags().StringSliceVar(&helmReleaseArgs.valuesFiles, "values", nil, "local path to values.yaml files, also accepts comma-separated values")
-	createHelmReleaseCmd.Flags().StringSliceVar(&helmReleaseArgs.valuesFrom, "values-from", nil, "a Kubernetes object reference that contains the values.yaml data key in the format '<kind>/<name>', where kind must be one of: (Secret,ConfigMap)")
+	createHelmReleaseCmd.Flags().Var(&helmReleaseArgs.valuesFrom, "values-from", helmReleaseArgs.valuesFrom.Description())
 	createHelmReleaseCmd.Flags().Var(&helmReleaseArgs.crds, "crds", helmReleaseArgs.crds.Description())
-	createHelmReleaseCmd.Flags().StringVar(&helmReleaseArgs.kubeConfigSecretRef, "kubeconfig-secret-ref", "", "the name of the Kubernetes Secret that contains a key with the kubeconfig file for connecting to a remote cluster")
 	createCmd.AddCommand(createHelmReleaseCmd)
 }
 
 func createHelmReleaseCmdRun(cmd *cobra.Command, args []string) error {
+	if len(args) < 1 {
+		return fmt.Errorf("HelmRelease name is required")
+	}
 	name := args[0]
 
 	if helmReleaseArgs.chart == "" {
@@ -164,15 +157,10 @@ func createHelmReleaseCmdRun(cmd *cobra.Command, args []string) error {
 		logger.Generatef("generating HelmRelease")
 	}
 
-	if !validateStrategy(helmReleaseArgs.reconcileStrategy) {
-		return fmt.Errorf("'%s' is an invalid reconcile strategy(valid: Revision, ChartVersion)",
-			helmReleaseArgs.reconcileStrategy)
-	}
-
 	helmRelease := helmv2.HelmRelease{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    sourceLabels,
 		},
 		Spec: helmv2.HelmReleaseSpec{
@@ -192,44 +180,20 @@ func createHelmReleaseCmdRun(cmd *cobra.Command, args []string) error {
 						Name:      helmReleaseArgs.source.Name,
 						Namespace: helmReleaseArgs.source.Namespace,
 					},
-					ReconcileStrategy: helmReleaseArgs.reconcileStrategy,
 				},
 			},
+			Install: &helmv2.Install{
+				CreateNamespace: helmReleaseArgs.createNamespace,
+			},
 			Suspend: false,
 		},
 	}
 
-	if helmReleaseArgs.kubeConfigSecretRef != "" {
-		helmRelease.Spec.KubeConfig = &helmv2.KubeConfig{
-			SecretRef: meta.SecretKeyReference{
-				Name: helmReleaseArgs.kubeConfigSecretRef,
-			},
-		}
-	}
-
-	if helmReleaseArgs.chartInterval != 0 {
-		helmRelease.Spec.Chart.Spec.Interval = &metav1.Duration{
-			Duration: helmReleaseArgs.chartInterval,
-		}
-	}
-
-	if helmReleaseArgs.createNamespace {
-		if helmRelease.Spec.Install == nil {
-			helmRelease.Spec.Install = &helmv2.Install{}
-		}
-
-		helmRelease.Spec.Install.CreateNamespace = helmReleaseArgs.createNamespace
-	}
-
 	if helmReleaseArgs.saName != "" {
 		helmRelease.Spec.ServiceAccountName = helmReleaseArgs.saName
 	}
 
 	if helmReleaseArgs.crds != "" {
-		if helmRelease.Spec.Install == nil {
-			helmRelease.Spec.Install = &helmv2.Install{}
-		}
-
 		helmRelease.Spec.Install.CRDs = helmv2.Create
 		helmRelease.Spec.Upgrade = &helmv2.Upgrade{CRDs: helmv2.CRDsPolicy(helmReleaseArgs.crds.String())}
 	}
@@ -237,7 +201,7 @@ func createHelmReleaseCmdRun(cmd *cobra.Command, args []string) error {
 	if len(helmReleaseArgs.valuesFiles) > 0 {
 		valuesMap := make(map[string]interface{})
 		for _, v := range helmReleaseArgs.valuesFiles {
-			data, err := os.ReadFile(v)
+			data, err := ioutil.ReadFile(v)
 			if err != nil {
 				return fmt.Errorf("reading values from %s failed: %w", v, err)
 			}
@@ -263,25 +227,11 @@ func createHelmReleaseCmdRun(cmd *cobra.Command, args []string) error {
 		helmRelease.Spec.Values = &apiextensionsv1.JSON{Raw: jsonRaw}
 	}
 
-	if len(helmReleaseArgs.valuesFrom) != 0 {
+	if helmReleaseArgs.valuesFrom.String() != "" {
-		values := []helmv2.ValuesReference{}
+		helmRelease.Spec.ValuesFrom = []helmv2.ValuesReference{{
-		for _, value := range helmReleaseArgs.valuesFrom {
+			Kind: helmReleaseArgs.valuesFrom.Kind,
-			sourceKind, sourceName := utils.ParseObjectKindName(value)
+			Name: helmReleaseArgs.valuesFrom.Name,
-			if sourceKind == "" {
+		}}
-				return fmt.Errorf("invalid Kubernetes object reference '%s', must be in format <kind>/<name>", value)
-			}
-			cleanSourceKind, ok := utils.ContainsEqualFoldItemString(supportedHelmReleaseValuesFromKinds, sourceKind)
-			if !ok {
-				return fmt.Errorf("reference kind '%s' is not supported, must be one of: %s",
-					sourceKind, strings.Join(supportedHelmReleaseValuesFromKinds, ", "))
-			}
-
-			values = append(values, helmv2.ValuesReference{
-				Name: sourceName,
-				Kind: cleanSourceKind,
-			})
-		}
-		helmRelease.Spec.ValuesFrom = values
 	}
 
 	if createArgs.export {
@@ -291,7 +241,7 @@ func createHelmReleaseCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
 
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
@@ -360,15 +310,3 @@ func isHelmReleaseReady(ctx context.Context, kubeClient client.Client,
 		return apimeta.IsStatusConditionTrue(helmRelease.Status.Conditions, meta.ReadyCondition), nil
 	}
 }
-
-func validateStrategy(input string) bool {
-	allowedStrategy := []string{"Revision", "ChartVersion"}
-
-	for _, strategy := range allowedStrategy {
-		if strategy == input {
-			return true
-		}
-	}
-
-	return false
-}

cmd/flux/create_image_policy.go

@@ -28,7 +28,7 @@ import (
 
 	"github.com/fluxcd/pkg/apis/meta"
 
-	imagev1 "github.com/fluxcd/image-reflector-controller/api/v1beta1"
+	imagev1 "github.com/fluxcd/image-reflector-controller/api/v1alpha2"
 )
 
 var createImagePolicyCmd = &cobra.Command{
@@ -84,6 +84,9 @@ func (obj imagePolicyAdapter) getObservedGeneration() int64 {
 }
 
 func createImagePolicyRun(cmd *cobra.Command, args []string) error {
+	if len(args) < 1 {
+		return fmt.Errorf("ImagePolicy name is required")
+	}
 	objectName := args[0]
 
 	if imagePolicyArgs.imageRef == "" {
@@ -98,11 +101,11 @@ func createImagePolicyRun(cmd *cobra.Command, args []string) error {
 	var policy = imagev1.ImagePolicy{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      objectName,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    labels,
 		},
 		Spec: imagev1.ImagePolicySpec{
-			ImageRepositoryRef: meta.NamespacedObjectReference{
+			ImageRepositoryRef: meta.LocalObjectReference{
 				Name: imagePolicyArgs.imageRef,
 			},
 		},

cmd/flux/create_image_repository.go

@@ -26,7 +26,7 @@ import (
 
 	"github.com/fluxcd/pkg/apis/meta"
 
-	imagev1 "github.com/fluxcd/image-reflector-controller/api/v1beta1"
+	imagev1 "github.com/fluxcd/image-reflector-controller/api/v1alpha2"
 )
 
 var createImageRepositoryCmd = &cobra.Command{
@@ -83,6 +83,9 @@ func init() {
 }
 
 func createImageRepositoryRun(cmd *cobra.Command, args []string) error {
+	if len(args) < 1 {
+		return fmt.Errorf("ImageRepository name is required")
+	}
 	objectName := args[0]
 
 	if imageRepoArgs.image == "" {
@@ -101,7 +104,7 @@ func createImageRepositoryRun(cmd *cobra.Command, args []string) error {
 	var repo = imagev1.ImageRepository{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      objectName,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    labels,
 		},
 		Spec: imagev1.ImageRepositorySpec{

cmd/flux/create_image_update.go

@@ -22,8 +22,8 @@ import (
 	"github.com/spf13/cobra"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	autov1 "github.com/fluxcd/image-automation-controller/api/v1beta1"
+	autov1 "github.com/fluxcd/image-automation-controller/api/v1alpha2"
-	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta1"
 )
 
 var createImageUpdateCmd = &cobra.Command{
@@ -49,40 +49,25 @@ mentioned in YAMLs in a git repository.`,
     --push-branch=image-updates \
     --author-name=flux \
     --author-email=flux@example.com \
-    --commit-template="{{range .Updated.Images}}{{println .}}{{end}}"
+    --commit-template="{{range .Updated.Images}}{{println .}}{{end}}"`,
-
-  # Configure image updates for a Git repository in a different namespace
-  flux create image update apps \
-    --namespace=apps \
-    --git-repo-ref=flux-system \
-    --git-repo-namespace=flux-system \
-    --git-repo-path="./clusters/my-cluster" \
-    --checkout-branch=main \
-    --push-branch=image-updates \
-    --author-name=flux \
-    --author-email=flux@example.com \
-    --commit-template="{{range .Updated.Images}}{{println .}}{{end}}"
-`,
 	RunE: createImageUpdateRun,
 }
 
 type imageUpdateFlags struct {
-	gitRepoName      string
+	gitRepoRef     string
-	gitRepoNamespace string
+	gitRepoPath    string
-	gitRepoPath      string
+	checkoutBranch string
-	checkoutBranch   string
+	pushBranch     string
-	pushBranch       string
+	commitTemplate string
-	commitTemplate   string
+	authorName     string
-	authorName       string
+	authorEmail    string
-	authorEmail      string
 }
 
 var imageUpdateArgs = imageUpdateFlags{}
 
 func init() {
 	flags := createImageUpdateCmd.Flags()
-	flags.StringVar(&imageUpdateArgs.gitRepoName, "git-repo-ref", "", "the name of a GitRepository resource with details of the upstream Git repository")
+	flags.StringVar(&imageUpdateArgs.gitRepoRef, "git-repo-ref", "", "the name of a GitRepository resource with details of the upstream Git repository")
-	flags.StringVar(&imageUpdateArgs.gitRepoNamespace, "git-repo-namespace", "", "the namespace of the GitRepository resource, defaults to the ImageUpdateAutomation namespace")
 	flags.StringVar(&imageUpdateArgs.gitRepoPath, "git-repo-path", "", "path to the directory containing the manifests to be updated, defaults to the repository root")
 	flags.StringVar(&imageUpdateArgs.checkoutBranch, "checkout-branch", "", "the branch to checkout")
 	flags.StringVar(&imageUpdateArgs.pushBranch, "push-branch", "", "the branch to push commits to, defaults to the checkout branch if not specified")
@@ -94,9 +79,12 @@ func init() {
 }
 
 func createImageUpdateRun(cmd *cobra.Command, args []string) error {
+	if len(args) < 1 {
+		return fmt.Errorf("ImageUpdateAutomation name is required")
+	}
 	objectName := args[0]
 
-	if imageUpdateArgs.gitRepoName == "" {
+	if imageUpdateArgs.gitRepoRef == "" {
 		return fmt.Errorf("a reference to a GitRepository is required (--git-repo-ref)")
 	}
 
@@ -120,14 +108,13 @@ func createImageUpdateRun(cmd *cobra.Command, args []string) error {
 	var update = autov1.ImageUpdateAutomation{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      objectName,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    labels,
 		},
 		Spec: autov1.ImageUpdateAutomationSpec{
-			SourceRef: autov1.CrossNamespaceSourceReference{
+			SourceRef: autov1.SourceReference{
-				Kind:      sourcev1.GitRepositoryKind,
+				Kind: sourcev1.GitRepositoryKind,
-				Name:      imageUpdateArgs.gitRepoName,
+				Name: imageUpdateArgs.gitRepoRef,
-				Namespace: imageUpdateArgs.gitRepoNamespace,
 			},
 
 			GitSpec: &autov1.GitSpec{

cmd/flux/create_kustomization.go

@@ -31,7 +31,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	helmv2 "github.com/fluxcd/helm-controller/api/v2beta1"
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta1"
 	"github.com/fluxcd/pkg/apis/meta"
 
 	"github.com/fluxcd/flux2/internal/flags"
@@ -42,38 +42,35 @@ var createKsCmd = &cobra.Command{
 	Use:     "kustomization [name]",
 	Aliases: []string{"ks"},
 	Short:   "Create or update a Kustomization resource",
-	Long:    "The create command generates a Kustomization resource for a given source.",
+	Long:    "The kustomization source create command generates a Kustomize resource for a given source.",
 	Example: `  # Create a Kustomization resource from a source at a given path
-  flux create kustomization kyverno \
+  flux create kustomization contour \
-    --source=GitRepository/kyverno \
+    --source=GitRepository/contour \
-    --path="./config/release" \
+    --path="./examples/contour/" \
     --prune=true \
-    --interval=60m \
+    --interval=10m \
-    --wait=true \
+    --validation=client \
+    --health-check="Deployment/contour.projectcontour" \
+    --health-check="DaemonSet/envoy.projectcontour" \
     --health-check-timeout=3m
 
   # Create a Kustomization resource that depends on the previous one
-  flux create kustomization kyverno-policies \
+  flux create kustomization webapp \
-    --depends-on=kyverno \
+    --depends-on=contour \
-    --source=GitRepository/kyverno-policies \
+    --source=GitRepository/webapp \
-    --path="./policies/flux" \
+    --path="./deploy/overlays/dev" \
     --prune=true \
-    --interval=5m
+    --interval=5m \
+    --validation=client
 
   # Create a Kustomization using a source from a different namespace
   flux create kustomization podinfo \
     --namespace=default \
     --source=GitRepository/podinfo.flux-system \
-    --path="./kustomize" \
+    --path="./deploy/overlays/dev" \
     --prune=true \
-    --interval=5m
+    --interval=5m \
-
+    --validation=client
-  # Create a Kustomization resource that references an OCIRepository
-  flux create kustomization podinfo \
-    --source=OCIRepository/podinfo \
-    --target-namespace=default \
-    --prune=true \
-    --interval=5m
 
   # Create a Kustomization resource that references a Bucket
   flux create kustomization secrets \
@@ -84,19 +81,17 @@ var createKsCmd = &cobra.Command{
 }
 
 type kustomizationFlags struct {
-	source              flags.KustomizationSource
+	source             flags.KustomizationSource
-	path                flags.SafeRelativePath
+	path               flags.SafeRelativePath
-	prune               bool
+	prune              bool
-	dependsOn           []string
+	dependsOn          []string
-	validation          string
+	validation         string
-	healthCheck         []string
+	healthCheck        []string
-	healthTimeout       time.Duration
+	healthTimeout      time.Duration
-	saName              string
+	saName             string
-	decryptionProvider  flags.DecryptionProvider
+	decryptionProvider flags.DecryptionProvider
-	decryptionSecret    string
+	decryptionSecret   string
-	targetNamespace     string
+	targetNamespace    string
-	wait                bool
-	kubeConfigSecretRef string
 }
 
 var kustomizationArgs = NewKustomizationFlags()
@@ -105,7 +100,6 @@ func init() {
 	createKsCmd.Flags().Var(&kustomizationArgs.source, "source", kustomizationArgs.source.Description())
 	createKsCmd.Flags().Var(&kustomizationArgs.path, "path", "path to the directory containing a kustomization.yaml file")
 	createKsCmd.Flags().BoolVar(&kustomizationArgs.prune, "prune", false, "enable garbage collection")
-	createKsCmd.Flags().BoolVar(&kustomizationArgs.wait, "wait", false, "enable health checking of all the applied resources")
 	createKsCmd.Flags().StringSliceVar(&kustomizationArgs.healthCheck, "health-check", nil, "workload to be included in the health assessment, in the format '<kind>/<name>.<namespace>'")
 	createKsCmd.Flags().DurationVar(&kustomizationArgs.healthTimeout, "health-check-timeout", 2*time.Minute, "timeout of health checking operations")
 	createKsCmd.Flags().StringVar(&kustomizationArgs.validation, "validation", "", "validate the manifests before applying them on the cluster, can be 'client' or 'server'")
@@ -114,9 +108,6 @@ func init() {
 	createKsCmd.Flags().Var(&kustomizationArgs.decryptionProvider, "decryption-provider", kustomizationArgs.decryptionProvider.Description())
 	createKsCmd.Flags().StringVar(&kustomizationArgs.decryptionSecret, "decryption-secret", "", "set the Kubernetes secret name that contains the OpenPGP private keys used for sops decryption")
 	createKsCmd.Flags().StringVar(&kustomizationArgs.targetNamespace, "target-namespace", "", "overrides the namespace of all Kustomization objects reconciled by this Kustomization")
-	createKsCmd.Flags().StringVar(&kustomizationArgs.kubeConfigSecretRef, "kubeconfig-secret-ref", "", "the name of the Kubernetes Secret that contains a key with the kubeconfig file for connecting to a remote cluster")
-	createKsCmd.Flags().MarkDeprecated("validation", "this arg is no longer used, all resources are validated using server-side apply dry-run")
-
 	createCmd.AddCommand(createKsCmd)
 }
 
@@ -127,6 +118,9 @@ func NewKustomizationFlags() kustomizationFlags {
 }
 
 func createKsCmdRun(cmd *cobra.Command, args []string) error {
+	if len(args) < 1 {
+		return fmt.Errorf("Kustomization name is required")
+	}
 	name := args[0]
 
 	if kustomizationArgs.path == "" {
@@ -148,7 +142,7 @@ func createKsCmdRun(cmd *cobra.Command, args []string) error {
 	kustomization := kustomizev1.Kustomization{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    kslabels,
 		},
 		Spec: kustomizev1.KustomizationSpec{
@@ -164,19 +158,12 @@ func createKsCmdRun(cmd *cobra.Command, args []string) error {
 				Namespace: kustomizationArgs.source.Namespace,
 			},
 			Suspend:         false,
+			Validation:      kustomizationArgs.validation,
 			TargetNamespace: kustomizationArgs.targetNamespace,
 		},
 	}
 
-	if kustomizationArgs.kubeConfigSecretRef != "" {
+	if len(kustomizationArgs.healthCheck) > 0 {
-		kustomization.Spec.KubeConfig = &kustomizev1.KubeConfig{
-			SecretRef: meta.SecretKeyReference{
-				Name: kustomizationArgs.kubeConfigSecretRef,
-			},
-		}
-	}
-
-	if len(kustomizationArgs.healthCheck) > 0 && !kustomizationArgs.wait {
 		healthChecks := make([]meta.NamespacedObjectKindReference, 0)
 		for _, w := range kustomizationArgs.healthCheck {
 			kindObj := strings.Split(w, "/")
@@ -217,13 +204,6 @@ func createKsCmdRun(cmd *cobra.Command, args []string) error {
 		}
 	}
 
-	if kustomizationArgs.wait {
-		kustomization.Spec.Wait = true
-		kustomization.Spec.Timeout = &metav1.Duration{
-			Duration: kustomizationArgs.healthTimeout,
-		}
-	}
-
 	if kustomizationArgs.saName != "" {
 		kustomization.Spec.ServiceAccountName = kustomizationArgs.saName
 	}
@@ -245,7 +225,7 @@ func createKsCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
 
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}

cmd/flux/create_receiver.go

@@ -67,6 +67,9 @@ func init() {
 }
 
 func createReceiverCmdRun(cmd *cobra.Command, args []string) error {
+	if len(args) < 1 {
+		return fmt.Errorf("Receiver name is required")
+	}
 	name := args[0]
 
 	if receiverArgs.receiverType == "" {
@@ -106,7 +109,7 @@ func createReceiverCmdRun(cmd *cobra.Command, args []string) error {
 	receiver := notificationv1.Receiver{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    sourceLabels,
 		},
 		Spec: notificationv1.ReceiverSpec{
@@ -127,7 +130,7 @@ func createReceiverCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
 
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}

cmd/flux/create_secret_git.go

@@ -105,13 +105,16 @@ func init() {
 
 func NewSecretGitFlags() secretGitFlags {
 	return secretGitFlags{
-		keyAlgorithm: flags.PublicKeyAlgorithm(sourcesecret.ECDSAPrivateKeyAlgorithm),
+		keyAlgorithm: flags.PublicKeyAlgorithm(sourcesecret.RSAPrivateKeyAlgorithm),
 		rsaBits:      2048,
 		ecdsaCurve:   flags.ECDSACurve{Curve: elliptic.P384()},
 	}
 }
 
 func createSecretGitCmdRun(cmd *cobra.Command, args []string) error {
+	if len(args) < 1 {
+		return fmt.Errorf("secret name is required")
+	}
 	name := args[0]
 	if secretGitArgs.url == "" {
 		return fmt.Errorf("url is required")
@@ -129,7 +132,7 @@ func createSecretGitCmdRun(cmd *cobra.Command, args []string) error {
 
 	opts := sourcesecret.Options{
 		Name:         name,
-		Namespace:    *kubeconfigArgs.Namespace,
+		Namespace:    rootArgs.namespace,
 		Labels:       labels,
 		ManifestFile: sourcesecret.MakeDefaultOptions().ManifestFile,
 	}
@@ -158,7 +161,7 @@ func createSecretGitCmdRun(cmd *cobra.Command, args []string) error {
 	}
 
 	if createArgs.export {
-		rootCmd.Println(secret.Content)
+		fmt.Println(secret.Content)
 		return nil
 	}
 
@@ -173,14 +176,14 @@ func createSecretGitCmdRun(cmd *cobra.Command, args []string) error {
 
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
 	if err := upsertSecret(ctx, kubeClient, s); err != nil {
 		return err
 	}
-	logger.Actionf("git secret '%s' created in '%s' namespace", name, *kubeconfigArgs.Namespace)
+	logger.Actionf("secret '%s' created in '%s' namespace", name, rootArgs.namespace)
 
 	return nil
 }

cmd/flux/create_secret_git_test.go

@@ -1,44 +0,0 @@
-package main
-
-import (
-	"testing"
-)
-
-func TestCreateGitSecret(t *testing.T) {
-	tests := []struct {
-		name   string
-		args   string
-		assert assertFunc
-	}{
-		{
-			name:   "no args",
-			args:   "create secret git",
-			assert: assertError("name is required"),
-		},
-		{
-			name:   "basic secret",
-			args:   "create secret git podinfo-auth --url=https://github.com/stefanprodan/podinfo --username=my-username --password=my-password --namespace=my-namespace --export",
-			assert: assertGoldenFile("./testdata/create_secret/git/secret-git-basic.yaml"),
-		},
-		{
-			name:   "ssh key",
-			args:   "create secret git podinfo-auth --url=ssh://git@github.com/stefanprodan/podinfo --private-key-file=./testdata/create_secret/git/ecdsa.private --namespace=my-namespace --export",
-			assert: assertGoldenFile("testdata/create_secret/git/git-ssh-secret.yaml"),
-		},
-		{
-			name:   "ssh key with password",
-			args:   "create secret git podinfo-auth --url=ssh://git@github.com/stefanprodan/podinfo --private-key-file=./testdata/create_secret/git/ecdsa-password.private --password=password --namespace=my-namespace --export",
-			assert: assertGoldenFile("testdata/create_secret/git/git-ssh-secret-password.yaml"),
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cmd := cmdTestCase{
-				args:   tt.args,
-				assert: tt.assert,
-			}
-			cmd.runTestCmd(t)
-		})
-	}
-}

cmd/flux/create_secret_helm.go

@@ -18,6 +18,7 @@ package main
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/spf13/cobra"
 	corev1 "k8s.io/api/core/v1"
@@ -67,6 +68,9 @@ func init() {
 }
 
 func createSecretHelmCmdRun(cmd *cobra.Command, args []string) error {
+	if len(args) < 1 {
+		return fmt.Errorf("secret name is required")
+	}
 	name := args[0]
 
 	labels, err := parseLabels()
@@ -76,7 +80,7 @@ func createSecretHelmCmdRun(cmd *cobra.Command, args []string) error {
 
 	opts := sourcesecret.Options{
 		Name:         name,
-		Namespace:    *kubeconfigArgs.Namespace,
+		Namespace:    rootArgs.namespace,
 		Labels:       labels,
 		Username:     secretHelmArgs.username,
 		Password:     secretHelmArgs.password,
@@ -90,13 +94,13 @@ func createSecretHelmCmdRun(cmd *cobra.Command, args []string) error {
 	}
 
 	if createArgs.export {
-		rootCmd.Println(secret.Content)
+		fmt.Println(secret.Content)
 		return nil
 	}
 
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
@@ -108,6 +112,5 @@ func createSecretHelmCmdRun(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	logger.Actionf("helm secret '%s' created in '%s' namespace", name, *kubeconfigArgs.Namespace)
 	return nil
 }

cmd/flux/create_secret_helm_test.go

@@ -1,47 +0,0 @@
-/*
-Copyright 2022 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"testing"
-)
-
-func TestCreateHelmSecret(t *testing.T) {
-	tests := []struct {
-		name   string
-		args   string
-		assert assertFunc
-	}{
-		{
-			args:   "create secret helm",
-			assert: assertError("name is required"),
-		},
-		{
-			args:   "create secret helm helm-secret --username=my-username --password=my-password --namespace=my-namespace --export",
-			assert: assertGoldenFile("testdata/create_secret/helm/secret-helm.yaml"),
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cmd := cmdTestCase{
-				args:   tt.args,
-				assert: tt.assert,
-			}
-			cmd.runTestCmd(t)
-		})
-	}
-}

cmd/flux/create_secret_oci.go

@@ -1,121 +0,0 @@
-/*
-Copyright 2022 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/fluxcd/flux2/internal/utils"
-	"github.com/fluxcd/flux2/pkg/manifestgen/sourcesecret"
-	"github.com/google/go-containerregistry/pkg/name"
-	"github.com/spf13/cobra"
-	corev1 "k8s.io/api/core/v1"
-	"sigs.k8s.io/yaml"
-)
-
-var createSecretOCICmd = &cobra.Command{
-	Use:   "oci [name]",
-	Short: "Create or update a Kubernetes image pull secret",
-	Long:  `The create secret oci command generates a Kubernetes secret that can be used for OCIRepository authentication`,
-	Example: `  # Create an OCI authentication secret on disk and encrypt it with Mozilla SOPS
-  flux create secret oci podinfo-auth \
-    --url=ghcr.io \
-    --username=username \
-    --password=password \
-    --export > repo-auth.yaml
-
-  sops --encrypt --encrypted-regex '^(data|stringData)$' \
-    --in-place repo-auth.yaml
-	`,
-	RunE: createSecretOCICmdRun,
-}
-
-type secretOCIFlags struct {
-	url      string
-	password string
-	username string
-}
-
-var secretOCIArgs = secretOCIFlags{}
-
-func init() {
-	createSecretOCICmd.Flags().StringVar(&secretOCIArgs.url, "url", "", "oci repository address e.g ghcr.io/stefanprodan/charts")
-	createSecretOCICmd.Flags().StringVarP(&secretOCIArgs.username, "username", "u", "", "basic authentication username")
-	createSecretOCICmd.Flags().StringVarP(&secretOCIArgs.password, "password", "p", "", "basic authentication password")
-
-	createSecretCmd.AddCommand(createSecretOCICmd)
-}
-
-func createSecretOCICmdRun(cmd *cobra.Command, args []string) error {
-	if len(args) < 1 {
-		return fmt.Errorf("name is required")
-	}
-
-	secretName := args[0]
-
-	if secretOCIArgs.url == "" {
-		return fmt.Errorf("--url is required")
-	}
-
-	if secretOCIArgs.username == "" {
-		return fmt.Errorf("--username is required")
-	}
-
-	if secretOCIArgs.password == "" {
-		return fmt.Errorf("--password is required")
-	}
-
-	if _, err := name.ParseReference(secretOCIArgs.url); err != nil {
-		return fmt.Errorf("error parsing url: '%s'", err)
-	}
-
-	opts := sourcesecret.Options{
-		Name:      secretName,
-		Namespace: *kubeconfigArgs.Namespace,
-		Registry:  secretOCIArgs.url,
-		Password:  secretOCIArgs.password,
-		Username:  secretOCIArgs.username,
-	}
-
-	secret, err := sourcesecret.Generate(opts)
-	if err != nil {
-		return err
-	}
-
-	if createArgs.export {
-		rootCmd.Println(secret.Content)
-		return nil
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
-	defer cancel()
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
-	if err != nil {
-		return err
-	}
-	var s corev1.Secret
-	if err := yaml.Unmarshal([]byte(secret.Content), &s); err != nil {
-		return err
-	}
-	if err := upsertSecret(ctx, kubeClient, s); err != nil {
-		return err
-	}
-
-	logger.Actionf("oci secret '%s' created in '%s' namespace", secretName, *kubeconfigArgs.Namespace)
-	return nil
-}

cmd/flux/create_secret_tls.go

@@ -18,6 +18,7 @@ package main
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
@@ -66,6 +67,9 @@ func init() {
 }
 
 func createSecretTLSCmdRun(cmd *cobra.Command, args []string) error {
+	if len(args) < 1 {
+		return fmt.Errorf("secret name is required")
+	}
 	name := args[0]
 
 	labels, err := parseLabels()
@@ -75,7 +79,7 @@ func createSecretTLSCmdRun(cmd *cobra.Command, args []string) error {
 
 	opts := sourcesecret.Options{
 		Name:         name,
-		Namespace:    *kubeconfigArgs.Namespace,
+		Namespace:    rootArgs.namespace,
 		Labels:       labels,
 		CAFilePath:   secretTLSArgs.caFile,
 		CertFilePath: secretTLSArgs.certFile,
@@ -87,13 +91,13 @@ func createSecretTLSCmdRun(cmd *cobra.Command, args []string) error {
 	}
 
 	if createArgs.export {
-		rootCmd.Print(secret.Content)
+		fmt.Println(secret.Content)
 		return nil
 	}
 
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
@@ -105,6 +109,5 @@ func createSecretTLSCmdRun(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	logger.Actionf("tls secret '%s' created in '%s' namespace", name, *kubeconfigArgs.Namespace)
 	return nil
 }

cmd/flux/create_secret_tls_test.go

@@ -1,31 +0,0 @@
-package main
-
-import (
-	"testing"
-)
-
-func TestCreateTlsSecretNoArgs(t *testing.T) {
-	tests := []struct {
-		name   string
-		args   string
-		assert assertFunc
-	}{
-		{
-			args:   "create secret tls",
-			assert: assertError("name is required"),
-		},
-		{
-			args:   "create secret tls certs --namespace=my-namespace --cert-file=./testdata/create_secret/tls/test-cert.pem --key-file=./testdata/create_secret/tls/test-key.pem --export",
-			assert: assertGoldenFile("testdata/create_secret/tls/secret-tls.yaml"),
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cmd := cmdTestCase{
-				args:   tt.args,
-				assert: tt.assert,
-			}
-			cmd.runTestCmd(t)
-		})
-	}
-}

cmd/flux/create_source.go

@@ -17,8 +17,6 @@ limitations under the License.
 package main
 
 import (
-	"time"
-
 	"github.com/spf13/cobra"
 )
 
@@ -28,14 +26,6 @@ var createSourceCmd = &cobra.Command{
 	Long:  "The create source sub-commands generate sources.",
 }
 
-type createSourceFlags struct {
-	fetchTimeout time.Duration
-}
-
-var createSourceArgs createSourceFlags
-
 func init() {
-	createSourceCmd.PersistentFlags().DurationVar(&createSourceArgs.fetchTimeout, "fetch-timeout", createSourceArgs.fetchTimeout,
-		"set a timeout for fetch operations performed by source-controller (e.g. 'git clone' or 'helm repo update')")
 	createCmd.AddCommand(createSourceCmd)
 }

cmd/flux/create_source_bucket.go

@@ -19,8 +19,8 @@ package main
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
 	"os"
-	"strings"
 
 	"github.com/spf13/cobra"
 	corev1 "k8s.io/api/core/v1"
@@ -31,9 +31,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	"github.com/fluxcd/pkg/apis/meta"
-	"github.com/fluxcd/pkg/runtime/conditions"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta1"
-
-	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
 
 	"github.com/fluxcd/flux2/internal/flags"
 	"github.com/fluxcd/flux2/internal/utils"
@@ -64,18 +62,17 @@ For Buckets with static authentication, the credentials are stored in a Kubernet
 }
 
 type sourceBucketFlags struct {
-	name        string
+	name      string
-	provider    flags.SourceBucketProvider
+	provider  flags.SourceBucketProvider
-	endpoint    string
+	endpoint  string
-	accessKey   string
+	accessKey string
-	secretKey   string
+	secretKey string
-	region      string
+	region    string
-	insecure    bool
+	insecure  bool
-	secretRef   string
+	secretRef string
-	ignorePaths []string
 }
 
-var sourceBucketArgs = newSourceBucketFlags()
+var sourceBucketArgs = NewSourceBucketFlags()
 
 func init() {
 	createSourceBucketCmd.Flags().Var(&sourceBucketArgs.provider, "provider", sourceBucketArgs.provider.Description())
@@ -86,18 +83,20 @@ func init() {
 	createSourceBucketCmd.Flags().StringVar(&sourceBucketArgs.region, "region", "", "the bucket region")
 	createSourceBucketCmd.Flags().BoolVar(&sourceBucketArgs.insecure, "insecure", false, "for when connecting to a non-TLS S3 HTTP endpoint")
 	createSourceBucketCmd.Flags().StringVar(&sourceBucketArgs.secretRef, "secret-ref", "", "the name of an existing secret containing credentials")
-	createSourceBucketCmd.Flags().StringSliceVar(&sourceBucketArgs.ignorePaths, "ignore-paths", nil, "set paths to ignore in bucket resource (can specify multiple paths with commas: path1,path2)")
 
 	createSourceCmd.AddCommand(createSourceBucketCmd)
 }
 
-func newSourceBucketFlags() sourceBucketFlags {
+func NewSourceBucketFlags() sourceBucketFlags {
 	return sourceBucketFlags{
 		provider: flags.SourceBucketProvider(sourcev1.GenericBucketProvider),
 	}
 }
 
 func createSourceBucketCmdRun(cmd *cobra.Command, args []string) error {
+	if len(args) < 1 {
+		return fmt.Errorf("Bucket source name is required")
+	}
 	name := args[0]
 
 	if sourceBucketArgs.name == "" {
@@ -113,22 +112,16 @@ func createSourceBucketCmdRun(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	tmpDir, err := os.MkdirTemp("", name)
+	tmpDir, err := ioutil.TempDir("", name)
 	if err != nil {
 		return err
 	}
 	defer os.RemoveAll(tmpDir)
 
-	var ignorePaths *string
-	if len(sourceBucketArgs.ignorePaths) > 0 {
-		ignorePathsStr := strings.Join(sourceBucketArgs.ignorePaths, "\n")
-		ignorePaths = &ignorePathsStr
-	}
-
 	bucket := &sourcev1.Bucket{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    sourceLabels,
 		},
 		Spec: sourcev1.BucketSpec{
@@ -140,15 +133,9 @@ func createSourceBucketCmdRun(cmd *cobra.Command, args []string) error {
 			Interval: metav1.Duration{
 				Duration: createArgs.interval,
 			},
-			Ignore: ignorePaths,
 		},
 	}
-
+	if sourceHelmArgs.secretRef != "" {
-	if createSourceArgs.fetchTimeout > 0 {
-		bucket.Spec.Timeout = &metav1.Duration{Duration: createSourceArgs.fetchTimeout}
-	}
-
-	if sourceBucketArgs.secretRef != "" {
 		bucket.Spec.SecretRef = &meta.LocalObjectReference{
 			Name: sourceBucketArgs.secretRef,
 		}
@@ -161,7 +148,7 @@ func createSourceBucketCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
 
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
@@ -174,7 +161,7 @@ func createSourceBucketCmdRun(cmd *cobra.Command, args []string) error {
 		secret := corev1.Secret{
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      secretName,
-				Namespace: *kubeconfigArgs.Namespace,
+				Namespace: rootArgs.namespace,
 				Labels:    sourceLabels,
 			},
 			StringData: map[string]string{},
@@ -247,30 +234,3 @@ func upsertBucket(ctx context.Context, kubeClient client.Client,
 	logger.Successf("Bucket source updated")
 	return namespacedName, nil
 }
-
-func isBucketReady(ctx context.Context, kubeClient client.Client,
-	namespacedName types.NamespacedName, bucket *sourcev1.Bucket) wait.ConditionFunc {
-	return func() (bool, error) {
-		err := kubeClient.Get(ctx, namespacedName, bucket)
-		if err != nil {
-			return false, err
-		}
-
-		if c := conditions.Get(bucket, meta.ReadyCondition); c != nil {
-			// Confirm the Ready condition we are observing is for the
-			// current generation
-			if c.ObservedGeneration != bucket.GetGeneration() {
-				return false, nil
-			}
-
-			// Further check the Status
-			switch c.Status {
-			case metav1.ConditionTrue:
-				return true, nil
-			case metav1.ConditionFalse:
-				return false, fmt.Errorf(c.Message)
-			}
-		}
-		return false, nil
-	}
-}

cmd/flux/create_source_git.go

@@ -20,25 +20,23 @@ import (
 	"context"
 	"crypto/elliptic"
 	"fmt"
+	"io/ioutil"
 	"net/url"
 	"os"
-	"strings"
 
+	"github.com/fluxcd/pkg/apis/meta"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta1"
 	"github.com/manifoldco/promptui"
 	"github.com/spf13/cobra"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
+	apimeta "k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/wait"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/yaml"
 
-	"github.com/fluxcd/pkg/apis/meta"
-	"github.com/fluxcd/pkg/runtime/conditions"
-
-	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
-
 	"github.com/fluxcd/flux2/internal/flags"
 	"github.com/fluxcd/flux2/internal/utils"
 	"github.com/fluxcd/flux2/pkg/manifestgen/sourcesecret"
@@ -59,8 +57,6 @@ type sourceGitFlags struct {
 	caFile            string
 	privateKeyFile    string
 	recurseSubmodules bool
-	silent            bool
-	ignorePaths       []string
 }
 
 var createSourceGitCmd = &cobra.Command{
@@ -117,7 +113,6 @@ For private Git repositories, the basic authentication credentials are stored in
   # Create a source for a Git repository using basic authentication
   flux create source git podinfo \
     --url=https://github.com/stefanprodan/podinfo \
-    --branch=master \
     --username=username \
     --password=password`,
 	RunE: createSourceGitCmdRun,
@@ -141,21 +136,22 @@ func init() {
 	createSourceGitCmd.Flags().StringVar(&sourceGitArgs.privateKeyFile, "private-key-file", "", "path to a passwordless private key file used for authenticating to the Git SSH server")
 	createSourceGitCmd.Flags().BoolVar(&sourceGitArgs.recurseSubmodules, "recurse-submodules", false,
 		"when enabled, configures the GitRepository source to initialize and include Git submodules in the artifact it produces")
-	createSourceGitCmd.Flags().BoolVarP(&sourceGitArgs.silent, "silent", "s", false, "assumes the deploy key is already setup, skips confirmation")
-	createSourceGitCmd.Flags().StringSliceVar(&sourceGitArgs.ignorePaths, "ignore-paths", nil, "set paths to ignore in git resource (can specify multiple paths with commas: path1,path2)")
 
 	createSourceCmd.AddCommand(createSourceGitCmd)
 }
 
 func newSourceGitFlags() sourceGitFlags {
 	return sourceGitFlags{
-		keyAlgorithm:  flags.PublicKeyAlgorithm(sourcesecret.ECDSAPrivateKeyAlgorithm),
+		keyAlgorithm:  flags.PublicKeyAlgorithm(sourcesecret.RSAPrivateKeyAlgorithm),
 		keyRSABits:    2048,
 		keyECDSACurve: flags.ECDSACurve{Curve: elliptic.P384()},
 	}
 }
 
 func createSourceGitCmdRun(cmd *cobra.Command, args []string) error {
+	if len(args) < 1 {
+		return fmt.Errorf("GitRepository source name is required")
+	}
 	name := args[0]
 
 	if sourceGitArgs.url == "" {
@@ -175,14 +171,14 @@ func createSourceGitCmdRun(cmd *cobra.Command, args []string) error {
 	}
 
 	if sourceGitArgs.caFile != "" && u.Scheme == "ssh" {
-		return fmt.Errorf("specifying a CA file is not supported for Git over SSH")
+		return fmt.Errorf("specifing a CA file is not supported for Git over SSH")
 	}
 
 	if sourceGitArgs.recurseSubmodules && sourceGitArgs.gitImplementation == sourcev1.LibGit2Implementation {
 		return fmt.Errorf("recurse submodules requires --git-implementation=%s", sourcev1.GoGitImplementation)
 	}
 
-	tmpDir, err := os.MkdirTemp("", name)
+	tmpDir, err := ioutil.TempDir("", name)
 	if err != nil {
 		return err
 	}
@@ -193,16 +189,10 @@ func createSourceGitCmdRun(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	var ignorePaths *string
-	if len(sourceGitArgs.ignorePaths) > 0 {
-		ignorePathsStr := strings.Join(sourceGitArgs.ignorePaths, "\n")
-		ignorePaths = &ignorePathsStr
-	}
-
 	gitRepository := sourcev1.GitRepository{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    sourceLabels,
 		},
 		Spec: sourcev1.GitRepositorySpec{
@@ -212,14 +202,9 @@ func createSourceGitCmdRun(cmd *cobra.Command, args []string) error {
 			},
 			RecurseSubmodules: sourceGitArgs.recurseSubmodules,
 			Reference:         &sourcev1.GitRepositoryRef{},
-			Ignore:            ignorePaths,
 		},
 	}
 
-	if createSourceArgs.fetchTimeout > 0 {
-		gitRepository.Spec.Timeout = &metav1.Duration{Duration: createSourceArgs.fetchTimeout}
-	}
-
 	if sourceGitArgs.gitImplementation != "" {
 		gitRepository.Spec.GitImplementation = sourceGitArgs.gitImplementation.String()
 	}
@@ -245,7 +230,7 @@ func createSourceGitCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
 
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
@@ -254,7 +239,7 @@ func createSourceGitCmdRun(cmd *cobra.Command, args []string) error {
 	if sourceGitArgs.secretRef == "" {
 		secretOpts := sourcesecret.Options{
 			Name:         name,
-			Namespace:    *kubeconfigArgs.Namespace,
+			Namespace:    rootArgs.namespace,
 			ManifestFile: sourcesecret.MakeDefaultOptions().ManifestFile,
 		}
 		switch u.Scheme {
@@ -288,14 +273,12 @@ func createSourceGitCmdRun(cmd *cobra.Command, args []string) error {
 			}
 			if ppk, ok := s.StringData[sourcesecret.PublicKeySecretKey]; ok {
 				logger.Generatef("deploy key: %s", ppk)
-				if !sourceGitArgs.silent {
+				prompt := promptui.Prompt{
-					prompt := promptui.Prompt{
+					Label:     "Have you added the deploy key to your repository",
-						Label:     "Have you added the deploy key to your repository",
+					IsConfirm: true,
-						IsConfirm: true,
+				}
-					}
+				if _, err := prompt.Run(); err != nil {
-					if _, err := prompt.Run(); err != nil {
+					return fmt.Errorf("aborting")
-						return fmt.Errorf("aborting")
-					}
 				}
 			}
 			logger.Actionf("applying secret with repository credentials")
@@ -368,14 +351,7 @@ func isGitRepositoryReady(ctx context.Context, kubeClient client.Client,
 			return false, err
 		}
 
-		if c := conditions.Get(gitRepository, meta.ReadyCondition); c != nil {
+		if c := apimeta.FindStatusCondition(gitRepository.Status.Conditions, meta.ReadyCondition); c != nil {
-			// Confirm the Ready condition we are observing is for the
-			// current generation
-			if c.ObservedGeneration != gitRepository.GetGeneration() {
-				return false, nil
-			}
-
-			// Further check the Status
 			switch c.Status {
 			case metav1.ConditionTrue:
 				return true, nil

cmd/flux/create_source_git_test.go

@@ -1,196 +0,0 @@
-//go:build unit
-// +build unit
-
-/*
-Copyright 2021 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/fluxcd/pkg/apis/meta"
-	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
-	"k8s.io/apimachinery/pkg/api/errors"
-	apimeta "k8s.io/apimachinery/pkg/api/meta"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/util/wait"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-)
-
-var pollInterval = 50 * time.Millisecond
-var testTimeout = 10 * time.Second
-
-// Update the GitRepository once created to exercise test specific behavior
-type reconcileFunc func(repo *sourcev1.GitRepository)
-
-// reconciler waits for an object to be created, then invokes a test supplied
-// function to mutate that object, simulating a controller.
-// Test should invoke run() to run the background reconciler task which
-// polls to wait for the object to exist before applying the update function.
-// Any errors from the reconciler are asserted on test completion.
-type reconciler struct {
-	client    client.Client
-	name      types.NamespacedName
-	reconcile reconcileFunc
-}
-
-// Start the background task that waits for the object to exist then applies
-// the update function.
-func (r *reconciler) run(t *testing.T) {
-	result := make(chan error)
-	go func() {
-		defer close(result)
-		err := wait.PollImmediate(
-			pollInterval,
-			testTimeout,
-			r.conditionFunc)
-		result <- err
-	}()
-	t.Cleanup(func() {
-		if err := <-result; err != nil {
-			t.Errorf("Failure from test reconciler: '%v':", err.Error())
-		}
-	})
-}
-
-// A ConditionFunction that waits for the named GitRepository to be created,
-// then sets the ready condition to true.
-func (r *reconciler) conditionFunc() (bool, error) {
-	var repo sourcev1.GitRepository
-	if err := r.client.Get(context.Background(), r.name, &repo); err != nil {
-		if errors.IsNotFound(err) {
-			return false, nil // Keep polling until object is created
-		}
-		return true, err
-	}
-	r.reconcile(&repo)
-	err := r.client.Status().Update(context.Background(), &repo)
-	return true, err
-}
-
-func TestCreateSourceGitExport(t *testing.T) {
-	var command = "create source git podinfo --url=https://github.com/stefanprodan/podinfo --branch=master --ignore-paths .cosign,non-existent-dir/ -n default --interval 1m --export --timeout=" + testTimeout.String()
-
-	cases := []struct {
-		name   string
-		args   string
-		assert assertFunc
-	}{
-		{
-			"ExportSucceeded",
-			command,
-			assertGoldenFile("testdata/create_source_git/export.golden"),
-		},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			cmd := cmdTestCase{
-				args:   tc.args,
-				assert: tc.assert,
-			}
-			cmd.runTestCmd(t)
-		})
-	}
-}
-
-func TestCreateSourceGit(t *testing.T) {
-	// Default command used for multiple tests
-	var command = "create source git podinfo --url=https://github.com/stefanprodan/podinfo --branch=master --timeout=" + testTimeout.String()
-
-	cases := []struct {
-		name      string
-		args      string
-		assert    assertFunc
-		reconcile reconcileFunc
-	}{
-		{
-			"NoArgs",
-			"create source git",
-			assertError("name is required"),
-			nil,
-		}, {
-			"Succeeded",
-			command,
-			assertGoldenFile("testdata/create_source_git/success.golden"),
-			func(repo *sourcev1.GitRepository) {
-				newCondition := metav1.Condition{
-					Type:               meta.ReadyCondition,
-					Status:             metav1.ConditionTrue,
-					Reason:             sourcev1.GitOperationSucceedReason,
-					Message:            "succeeded message",
-					ObservedGeneration: repo.GetGeneration(),
-				}
-				apimeta.SetStatusCondition(&repo.Status.Conditions, newCondition)
-				repo.Status.Artifact = &sourcev1.Artifact{
-					Path:     "some-path",
-					Revision: "v1",
-				}
-			},
-		}, {
-			"Failed",
-			command,
-			assertError("failed message"),
-			func(repo *sourcev1.GitRepository) {
-				newCondition := metav1.Condition{
-					Type:               meta.ReadyCondition,
-					Status:             metav1.ConditionFalse,
-					Reason:             sourcev1.URLInvalidReason,
-					Message:            "failed message",
-					ObservedGeneration: repo.GetGeneration(),
-				}
-				apimeta.SetStatusCondition(&repo.Status.Conditions, newCondition)
-			},
-		}, {
-			"NoArtifact",
-			command,
-			assertError("GitRepository source reconciliation completed but no artifact was found"),
-			func(repo *sourcev1.GitRepository) {
-				// Updated with no artifact
-				newCondition := metav1.Condition{
-					Type:               meta.ReadyCondition,
-					Status:             metav1.ConditionTrue,
-					Reason:             sourcev1.GitOperationSucceedReason,
-					Message:            "succeeded message",
-					ObservedGeneration: repo.GetGeneration(),
-				}
-				apimeta.SetStatusCondition(&repo.Status.Conditions, newCondition)
-			},
-		},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			ns := allocateNamespace("podinfo")
-			setupTestNamespace(ns, t)
-			if tc.reconcile != nil {
-				r := reconciler{
-					client:    testEnv.client,
-					name:      types.NamespacedName{Namespace: ns, Name: "podinfo"},
-					reconcile: tc.reconcile,
-				}
-				r.run(t)
-			}
-			cmd := cmdTestCase{
-				args:   tc.args + " -n=" + ns,
-				assert: tc.assert,
-			}
-			cmd.runTestCmd(t)
-		})
-	}
-}

cmd/flux/create_source_helm.go

@@ -19,21 +19,22 @@ package main
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
 	"net/url"
 	"os"
 
 	"github.com/fluxcd/pkg/apis/meta"
-	"github.com/fluxcd/pkg/runtime/conditions"
 	"github.com/spf13/cobra"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
+	apimeta "k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/apimachinery/pkg/util/wait"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/yaml"
 
-	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta1"
 
 	"github.com/fluxcd/flux2/internal/utils"
 	"github.com/fluxcd/flux2/pkg/manifestgen/sourcesecret"
@@ -44,34 +45,23 @@ var createSourceHelmCmd = &cobra.Command{
 	Short: "Create or update a HelmRepository source",
 	Long: `The create source helm command generates a HelmRepository resource and waits for it to fetch the index.
 For private Helm repositories, the basic authentication credentials are stored in a Kubernetes secret.`,
-	Example: `  # Create a source for an HTTPS public Helm repository
+	Example: `  # Create a source for a public Helm repository
   flux create source helm podinfo \
     --url=https://stefanprodan.github.io/podinfo \
     --interval=10m
 
-  # Create a source for an HTTPS Helm repository using basic authentication
+  # Create a source for a Helm repository using basic authentication
   flux create source helm podinfo \
     --url=https://stefanprodan.github.io/podinfo \
     --username=username \
     --password=password
 
-  # Create a source for an HTTPS Helm repository using TLS authentication
+  # Create a source for a Helm repository using TLS authentication
   flux create source helm podinfo \
     --url=https://stefanprodan.github.io/podinfo \
     --cert-file=./cert.crt \
     --key-file=./key.crt \
-    --ca-file=./ca.crt
+    --ca-file=./ca.crt`,
-
-  # Create a source for an OCI Helm repository
-  flux create source helm podinfo \
-    --url=oci://ghcr.io/stefanprodan/charts/podinfo
-    --username=username \
-    --password=password
-
-  # Create a source for an OCI Helm repository using an existing secret with basic auth or dockerconfig credentials
-  flux create source helm podinfo \
-    --url=oci://ghcr.io/stefanprodan/charts/podinfo
-    --secret-ref=docker-config`,
 	RunE: createSourceHelmCmdRun,
 }
 
@@ -95,13 +85,16 @@ func init() {
 	createSourceHelmCmd.Flags().StringVar(&sourceHelmArgs.certFile, "cert-file", "", "TLS authentication cert file path")
 	createSourceHelmCmd.Flags().StringVar(&sourceHelmArgs.keyFile, "key-file", "", "TLS authentication key file path")
 	createSourceHelmCmd.Flags().StringVar(&sourceHelmArgs.caFile, "ca-file", "", "TLS authentication CA file path")
-	createSourceHelmCmd.Flags().StringVarP(&sourceHelmArgs.secretRef, "secret-ref", "", "", "the name of an existing secret containing TLS, basic auth or docker-config credentials")
+	createSourceHelmCmd.Flags().StringVarP(&sourceHelmArgs.secretRef, "secret-ref", "", "", "the name of an existing secret containing TLS or basic auth credentials")
 	createSourceHelmCmd.Flags().BoolVarP(&sourceHelmArgs.passCredentials, "pass-credentials", "", false, "pass credentials to all domains")
 
 	createSourceCmd.AddCommand(createSourceHelmCmd)
 }
 
 func createSourceHelmCmdRun(cmd *cobra.Command, args []string) error {
+	if len(args) < 1 {
+		return fmt.Errorf("HelmRepository source name is required")
+	}
 	name := args[0]
 
 	if sourceHelmArgs.url == "" {
@@ -113,7 +106,7 @@ func createSourceHelmCmdRun(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	tmpDir, err := os.MkdirTemp("", name)
+	tmpDir, err := ioutil.TempDir("", name)
 	if err != nil {
 		return err
 	}
@@ -126,7 +119,7 @@ func createSourceHelmCmdRun(cmd *cobra.Command, args []string) error {
 	helmRepository := &sourcev1.HelmRepository{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Labels:    sourceLabels,
 		},
 		Spec: sourcev1.HelmRepositorySpec{
@@ -137,18 +130,6 @@ func createSourceHelmCmdRun(cmd *cobra.Command, args []string) error {
 		},
 	}
 
-	url, err := url.Parse(sourceHelmArgs.url)
-	if err != nil {
-		return fmt.Errorf("failed to parse URL: %w", err)
-	}
-	if url.Scheme == sourcev1.HelmRepositoryTypeOCI {
-		helmRepository.Spec.Type = sourcev1.HelmRepositoryTypeOCI
-	}
-
-	if createSourceArgs.fetchTimeout > 0 {
-		helmRepository.Spec.Timeout = &metav1.Duration{Duration: createSourceArgs.fetchTimeout}
-	}
-
 	if sourceHelmArgs.secretRef != "" {
 		helmRepository.Spec.SecretRef = &meta.LocalObjectReference{
 			Name: sourceHelmArgs.secretRef,
@@ -163,7 +144,7 @@ func createSourceHelmCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
 
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
@@ -173,7 +154,7 @@ func createSourceHelmCmdRun(cmd *cobra.Command, args []string) error {
 		secretName := fmt.Sprintf("helm-%s", name)
 		secretOpts := sourcesecret.Options{
 			Name:         secretName,
-			Namespace:    *kubeconfigArgs.Namespace,
+			Namespace:    rootArgs.namespace,
 			Username:     sourceHelmArgs.username,
 			Password:     sourceHelmArgs.password,
 			CertFilePath: sourceHelmArgs.certFile,
@@ -215,11 +196,6 @@ func createSourceHelmCmdRun(cmd *cobra.Command, args []string) error {
 	}
 	logger.Successf("HelmRepository source reconciliation completed")
 
-	if helmRepository.Spec.Type == sourcev1.HelmRepositoryTypeOCI {
-		// OCI repos don't expose any artifact so we just return early here
-		return nil
-	}
-
 	if helmRepository.Status.Artifact == nil {
 		return fmt.Errorf("HelmRepository source reconciliation completed but no artifact was found")
 	}
@@ -266,14 +242,12 @@ func isHelmRepositoryReady(ctx context.Context, kubeClient client.Client,
 			return false, err
 		}
 
-		if c := conditions.Get(helmRepository, meta.ReadyCondition); c != nil {
+		// Confirm the state we are observing is for the current generation
-			// Confirm the Ready condition we are observing is for the
+		if helmRepository.Generation != helmRepository.Status.ObservedGeneration {
-			// current generation
+			return false, nil
-			if c.ObservedGeneration != helmRepository.GetGeneration() {
+		}
-				return false, nil
-			}
 
-			// Further check the Status
+		if c := apimeta.FindStatusCondition(helmRepository.Status.Conditions, meta.ReadyCondition); c != nil {
 			switch c.Status {
 			case metav1.ConditionTrue:
 				return true, nil

cmd/flux/create_source_helm_test.go

@@ -1,81 +0,0 @@
-//go:build unit
-// +build unit
-
-/*
-Copyright 2022 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"testing"
-)
-
-func TestCreateSourceHelm(t *testing.T) {
-	tests := []struct {
-		name       string
-		args       string
-		resultFile string
-		assertFunc string
-	}{
-		{
-			name:       "no args",
-			args:       "create source helm",
-			resultFile: "name is required",
-			assertFunc: "assertError",
-		},
-		{
-			name:       "OCI repo",
-			args:       "create source helm podinfo --url=oci://ghcr.io/stefanprodan/charts/podinfo --interval 5m --export",
-			resultFile: "./testdata/create_source_helm/oci.golden",
-			assertFunc: "assertGoldenTemplateFile",
-		},
-		{
-			name:       "OCI repo with Secret ref",
-			args:       "create source helm podinfo --url=oci://ghcr.io/stefanprodan/charts/podinfo --interval 5m --secret-ref=creds --export",
-			resultFile: "./testdata/create_source_helm/oci-with-secret.golden",
-			assertFunc: "assertGoldenTemplateFile",
-		},
-		{
-			name:       "HTTPS repo",
-			args:       "create source helm podinfo --url=https://stefanprodan.github.io/charts/podinfo --interval 5m --export",
-			resultFile: "./testdata/create_source_helm/https.golden",
-			assertFunc: "assertGoldenTemplateFile",
-		},
-	}
-
-	tmpl := map[string]string{
-		"fluxns": allocateNamespace("flux-system"),
-	}
-	setup(t, tmpl)
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			var assert assertFunc
-			switch tt.assertFunc {
-			case "assertGoldenTemplateFile":
-				assert = assertGoldenTemplateFile(tt.resultFile, tmpl)
-			case "assertError":
-				assert = assertError(tt.resultFile)
-			}
-
-			cmd := cmdTestCase{
-				args:   tt.args + " -n " + tmpl["fluxns"],
-				assert: assert,
-			}
-			cmd.runTestCmd(t)
-		})
-	}
-}

cmd/flux/create_source_oci.go

@@ -1,244 +0,0 @@
-/*
-Copyright 2022 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"context"
-	"fmt"
-	"strings"
-
-	"github.com/spf13/cobra"
-	"k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/apimachinery/pkg/util/wait"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-
-	"github.com/fluxcd/pkg/apis/meta"
-	"github.com/fluxcd/pkg/runtime/conditions"
-
-	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
-
-	"github.com/fluxcd/flux2/internal/flags"
-	"github.com/fluxcd/flux2/internal/utils"
-)
-
-var createSourceOCIRepositoryCmd = &cobra.Command{
-	Use:   "oci [name]",
-	Short: "Create or update an OCIRepository",
-	Long:  `The create source oci command generates an OCIRepository resource and waits for it to be ready.`,
-	Example: `  # Create an OCIRepository for a public container image
-  flux create source oci podinfo \
-    --url=oci://ghcr.io/stefanprodan/manifests/podinfo \
-    --tag=6.1.6 \
-    --interval=10m
-`,
-	RunE: createSourceOCIRepositoryCmdRun,
-}
-
-type sourceOCIRepositoryFlags struct {
-	url            string
-	tag            string
-	semver         string
-	digest         string
-	secretRef      string
-	serviceAccount string
-	certSecretRef  string
-	ignorePaths    []string
-	provider       flags.SourceOCIProvider
-}
-
-var sourceOCIRepositoryArgs = newSourceOCIFlags()
-
-func newSourceOCIFlags() sourceOCIRepositoryFlags {
-	return sourceOCIRepositoryFlags{
-		provider: flags.SourceOCIProvider(sourcev1.GenericOCIProvider),
-	}
-}
-
-func init() {
-	createSourceOCIRepositoryCmd.Flags().Var(&sourceOCIRepositoryArgs.provider, "provider", sourceOCIRepositoryArgs.provider.Description())
-	createSourceOCIRepositoryCmd.Flags().StringVar(&sourceOCIRepositoryArgs.url, "url", "", "the OCI repository URL")
-	createSourceOCIRepositoryCmd.Flags().StringVar(&sourceOCIRepositoryArgs.tag, "tag", "", "the OCI artifact tag")
-	createSourceOCIRepositoryCmd.Flags().StringVar(&sourceOCIRepositoryArgs.semver, "tag-semver", "", "the OCI artifact tag semver range")
-	createSourceOCIRepositoryCmd.Flags().StringVar(&sourceOCIRepositoryArgs.digest, "digest", "", "the OCI artifact digest")
-	createSourceOCIRepositoryCmd.Flags().StringVar(&sourceOCIRepositoryArgs.secretRef, "secret-ref", "", "the name of the Kubernetes image pull secret (type 'kubernetes.io/dockerconfigjson')")
-	createSourceOCIRepositoryCmd.Flags().StringVar(&sourceOCIRepositoryArgs.serviceAccount, "service-account", "", "the name of the Kubernetes service account that refers to an image pull secret")
-	createSourceOCIRepositoryCmd.Flags().StringVar(&sourceOCIRepositoryArgs.certSecretRef, "cert-ref", "", "the name of a secret to use for TLS certificates")
-	createSourceOCIRepositoryCmd.Flags().StringSliceVar(&sourceOCIRepositoryArgs.ignorePaths, "ignore-paths", nil, "set paths to ignore resources (can specify multiple paths with commas: path1,path2)")
-
-	createSourceCmd.AddCommand(createSourceOCIRepositoryCmd)
-}
-
-func createSourceOCIRepositoryCmdRun(cmd *cobra.Command, args []string) error {
-	name := args[0]
-
-	if sourceOCIRepositoryArgs.url == "" {
-		return fmt.Errorf("url is required")
-	}
-
-	if sourceOCIRepositoryArgs.semver == "" && sourceOCIRepositoryArgs.tag == "" && sourceOCIRepositoryArgs.digest == "" {
-		return fmt.Errorf("--tag, --tag-semver or --digest is required")
-	}
-
-	sourceLabels, err := parseLabels()
-	if err != nil {
-		return err
-	}
-
-	var ignorePaths *string
-	if len(sourceOCIRepositoryArgs.ignorePaths) > 0 {
-		ignorePathsStr := strings.Join(sourceOCIRepositoryArgs.ignorePaths, "\n")
-		ignorePaths = &ignorePathsStr
-	}
-
-	repository := &sourcev1.OCIRepository{
-		ObjectMeta: metav1.ObjectMeta{
-			Name:      name,
-			Namespace: *kubeconfigArgs.Namespace,
-			Labels:    sourceLabels,
-		},
-		Spec: sourcev1.OCIRepositorySpec{
-			Provider: sourceOCIRepositoryArgs.provider.String(),
-			URL:      sourceOCIRepositoryArgs.url,
-			Interval: metav1.Duration{
-				Duration: createArgs.interval,
-			},
-			Reference: &sourcev1.OCIRepositoryRef{},
-			Ignore:    ignorePaths,
-		},
-	}
-
-	if digest := sourceOCIRepositoryArgs.digest; digest != "" {
-		repository.Spec.Reference.Digest = digest
-	}
-	if semver := sourceOCIRepositoryArgs.semver; semver != "" {
-		repository.Spec.Reference.SemVer = semver
-	}
-	if tag := sourceOCIRepositoryArgs.tag; tag != "" {
-		repository.Spec.Reference.Tag = tag
-	}
-
-	if createSourceArgs.fetchTimeout > 0 {
-		repository.Spec.Timeout = &metav1.Duration{Duration: createSourceArgs.fetchTimeout}
-	}
-
-	if saName := sourceOCIRepositoryArgs.serviceAccount; saName != "" {
-		repository.Spec.ServiceAccountName = saName
-	}
-
-	if secretName := sourceOCIRepositoryArgs.secretRef; secretName != "" {
-		repository.Spec.SecretRef = &meta.LocalObjectReference{
-			Name: secretName,
-		}
-	}
-
-	if secretName := sourceOCIRepositoryArgs.certSecretRef; secretName != "" {
-		repository.Spec.CertSecretRef = &meta.LocalObjectReference{
-			Name: secretName,
-		}
-	}
-
-	if createArgs.export {
-		return printExport(exportOCIRepository(repository))
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
-	defer cancel()
-
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
-	if err != nil {
-		return err
-	}
-
-	logger.Actionf("applying OCIRepository")
-	namespacedName, err := upsertOCIRepository(ctx, kubeClient, repository)
-	if err != nil {
-		return err
-	}
-
-	logger.Waitingf("waiting for OCIRepository reconciliation")
-	if err := wait.PollImmediate(rootArgs.pollInterval, rootArgs.timeout,
-		isOCIRepositoryReady(ctx, kubeClient, namespacedName, repository)); err != nil {
-		return err
-	}
-	logger.Successf("OCIRepository reconciliation completed")
-
-	if repository.Status.Artifact == nil {
-		return fmt.Errorf("no artifact was found")
-	}
-	logger.Successf("fetched revision: %s", repository.Status.Artifact.Revision)
-	return nil
-}
-
-func upsertOCIRepository(ctx context.Context, kubeClient client.Client,
-	ociRepository *sourcev1.OCIRepository) (types.NamespacedName, error) {
-	namespacedName := types.NamespacedName{
-		Namespace: ociRepository.GetNamespace(),
-		Name:      ociRepository.GetName(),
-	}
-
-	var existing sourcev1.OCIRepository
-	err := kubeClient.Get(ctx, namespacedName, &existing)
-	if err != nil {
-		if errors.IsNotFound(err) {
-			if err := kubeClient.Create(ctx, ociRepository); err != nil {
-				return namespacedName, err
-			} else {
-				logger.Successf("OCIRepository created")
-				return namespacedName, nil
-			}
-		}
-		return namespacedName, err
-	}
-
-	existing.Labels = ociRepository.Labels
-	existing.Spec = ociRepository.Spec
-	if err := kubeClient.Update(ctx, &existing); err != nil {
-		return namespacedName, err
-	}
-	ociRepository = &existing
-	logger.Successf("OCIRepository updated")
-	return namespacedName, nil
-}
-
-func isOCIRepositoryReady(ctx context.Context, kubeClient client.Client,
-	namespacedName types.NamespacedName, ociRepository *sourcev1.OCIRepository) wait.ConditionFunc {
-	return func() (bool, error) {
-		err := kubeClient.Get(ctx, namespacedName, ociRepository)
-		if err != nil {
-			return false, err
-		}
-
-		if c := conditions.Get(ociRepository, meta.ReadyCondition); c != nil {
-			// Confirm the Ready condition we are observing is for the
-			// current generation
-			if c.ObservedGeneration != ociRepository.GetGeneration() {
-				return false, nil
-			}
-
-			// Further check the Status
-			switch c.Status {
-			case metav1.ConditionTrue:
-				return true, nil
-			case metav1.ConditionFalse:
-				return false, fmt.Errorf(c.Message)
-			}
-		}
-		return false, nil
-	}
-}

cmd/flux/create_source_oci_test.go

@@ -1,61 +0,0 @@
-/*
-Copyright 2022 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"testing"
-)
-
-func TestCreateSourceOCI(t *testing.T) {
-	tests := []struct {
-		name       string
-		args       string
-		assertFunc assertFunc
-	}{
-		{
-			name:       "NoArgs",
-			args:       "create source oci",
-			assertFunc: assertError("name is required"),
-		},
-		{
-			name:       "NoURL",
-			args:       "create source oci podinfo",
-			assertFunc: assertError("url is required"),
-		},
-		{
-			name:       "export manifest",
-			args:       "create source oci podinfo --url=oci://ghcr.io/stefanprodan/manifests/podinfo --tag=6.1.6 --interval 10m --export",
-			assertFunc: assertGoldenFile("./testdata/oci/export.golden"),
-		},
-		{
-			name:       "export manifest with secret",
-			args:       "create source oci podinfo --url=oci://ghcr.io/stefanprodan/manifests/podinfo --tag=6.1.6 --interval 10m --secret-ref=creds --export",
-			assertFunc: assertGoldenFile("./testdata/oci/export_with_secret.golden"),
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			cmd := cmdTestCase{
-				args:   tt.args,
-				assert: tt.assertFunc,
-			}
-
-			cmd.runTestCmd(t)
-		})
-	}
-}

cmd/flux/create_tenant.go

@@ -70,6 +70,9 @@ func init() {
 }
 
 func createTenantCmdRun(cmd *cobra.Command, args []string) error {
+	if len(args) < 1 {
+		return fmt.Errorf("tenant name is required")
+	}
 	tenant := args[0]
 	if err := validation.IsQualifiedName(tenant); len(err) > 0 {
 		return fmt.Errorf("invalid tenant name '%s': %v", tenant, err)
@@ -145,7 +148,7 @@ func createTenantCmdRun(cmd *cobra.Command, args []string) error {
 	}
 
 	if createArgs.export {
-		for i := range tenantArgs.namespaces {
+		for i, _ := range tenantArgs.namespaces {
 			if err := exportTenant(namespaces[i], accounts[i], roleBindings[i]); err != nil {
 				return err
 			}
@@ -156,12 +159,12 @@ func createTenantCmdRun(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
 
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
 
-	for i := range tenantArgs.namespaces {
+	for i, _ := range tenantArgs.namespaces {
 		logger.Actionf("applying namespace %s", namespaces[i].Name)
 		if err := upsertNamespace(ctx, kubeClient, namespaces[i]); err != nil {
 			return err

cmd/flux/create_test.go

@@ -1,55 +0,0 @@
-package main
-
-import (
-	"testing"
-
-	"k8s.io/apimachinery/pkg/util/rand"
-)
-
-func Test_validateObjectName(t *testing.T) {
-	tests := []struct {
-		name  string
-		valid bool
-	}{
-		{
-			name:  "flux-system",
-			valid: true,
-		},
-		{
-			name:  "-flux-system",
-			valid: false,
-		},
-		{
-			name:  "-flux-system-",
-			valid: false,
-		},
-		{
-			name:  "third.first",
-			valid: false,
-		},
-		{
-			name:  "THirdfirst",
-			valid: false,
-		},
-		{
-			name:  "THirdfirst",
-			valid: false,
-		},
-		{
-			name:  rand.String(63),
-			valid: true,
-		},
-		{
-			name:  rand.String(64),
-			valid: false,
-		},
-	}
-
-	for _, tt := range tests {
-		valid := validateObjectName(tt.name)
-		if valid != tt.valid {
-			t.Errorf("expected name %q to return %t for validateObjectName func but got %t",
-				tt.name, tt.valid, valid)
-		}
-	}
-}

cmd/flux/delete.go

@@ -60,13 +60,13 @@ func (del deleteCommand) run(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
 
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
 
 	namespacedName := types.NamespacedName{
-		Namespace: *kubeconfigArgs.Namespace,
+		Namespace: rootArgs.namespace,
 		Name:      name,
 	}
 
@@ -85,7 +85,7 @@ func (del deleteCommand) run(cmd *cobra.Command, args []string) error {
 		}
 	}
 
-	logger.Actionf("deleting %s %s in %s namespace", del.humanKind, name, *kubeconfigArgs.Namespace)
+	logger.Actionf("deleting %s %s in %s namespace", del.humanKind, name, rootArgs.namespace)
 	err = kubeClient.Delete(ctx, del.object.asClientObject())
 	if err != nil {
 		return err

cmd/flux/delete_alert.go

@@ -28,7 +28,6 @@ var deleteAlertCmd = &cobra.Command{
 	Long:  "The delete alert command removes the given Alert from the cluster.",
 	Example: `  # Delete an Alert and the Kubernetes resources created by it
   flux delete alert main`,
-	ValidArgsFunction: resourceNamesCompletionFunc(notificationv1.GroupVersion.WithKind(notificationv1.AlertKind)),
 	RunE: deleteCommand{
 		apiType: alertType,
 		object:  universalAdapter{&notificationv1.Alert{}},

cmd/flux/delete_alertprovider.go

@@ -28,7 +28,6 @@ var deleteAlertProviderCmd = &cobra.Command{
 	Long:  "The delete alert-provider command removes the given Provider from the cluster.",
 	Example: `  # Delete a Provider and the Kubernetes resources created by it
   flux delete alert-provider slack`,
-	ValidArgsFunction: resourceNamesCompletionFunc(notificationv1.GroupVersion.WithKind(notificationv1.ProviderKind)),
 	RunE: deleteCommand{
 		apiType: alertProviderType,
 		object:  universalAdapter{&notificationv1.Provider{}},

cmd/flux/delete_helmrelease.go

@@ -29,7 +29,6 @@ var deleteHelmReleaseCmd = &cobra.Command{
 	Long:    "The delete helmrelease command removes the given HelmRelease from the cluster.",
 	Example: `  # Delete a Helm release and the Kubernetes resources created by it
   flux delete hr podinfo`,
-	ValidArgsFunction: resourceNamesCompletionFunc(helmv2.GroupVersion.WithKind(helmv2.HelmReleaseKind)),
 	RunE: deleteCommand{
 		apiType: helmReleaseType,
 		object:  universalAdapter{&helmv2.HelmRelease{}},

cmd/flux/delete_image_policy.go

@@ -19,7 +19,7 @@ package main
 import (
 	"github.com/spf13/cobra"
 
-	imagev1 "github.com/fluxcd/image-reflector-controller/api/v1beta1"
+	imagev1 "github.com/fluxcd/image-reflector-controller/api/v1alpha2"
 )
 
 var deleteImagePolicyCmd = &cobra.Command{
@@ -28,7 +28,6 @@ var deleteImagePolicyCmd = &cobra.Command{
 	Long:  "The delete image policy command deletes the given ImagePolicy from the cluster.",
 	Example: `  # Delete an image policy
   flux delete image policy alpine3.x`,
-	ValidArgsFunction: resourceNamesCompletionFunc(imagev1.GroupVersion.WithKind(imagev1.ImagePolicyKind)),
 	RunE: deleteCommand{
 		apiType: imagePolicyType,
 		object:  universalAdapter{&imagev1.ImagePolicy{}},

cmd/flux/delete_image_repository.go

@@ -19,7 +19,7 @@ package main
 import (
 	"github.com/spf13/cobra"
 
-	imagev1 "github.com/fluxcd/image-reflector-controller/api/v1beta1"
+	imagev1 "github.com/fluxcd/image-reflector-controller/api/v1alpha2"
 )
 
 var deleteImageRepositoryCmd = &cobra.Command{
@@ -28,7 +28,6 @@ var deleteImageRepositoryCmd = &cobra.Command{
 	Long:  "The delete image repository command deletes the given ImageRepository from the cluster.",
 	Example: `  # Delete an image repository
   flux delete image repository alpine`,
-	ValidArgsFunction: resourceNamesCompletionFunc(imagev1.GroupVersion.WithKind(imagev1.ImageRepositoryKind)),
 	RunE: deleteCommand{
 		apiType: imageRepositoryType,
 		object:  universalAdapter{&imagev1.ImageRepository{}},

cmd/flux/delete_image_update.go

@@ -19,7 +19,7 @@ package main
 import (
 	"github.com/spf13/cobra"
 
-	autov1 "github.com/fluxcd/image-automation-controller/api/v1beta1"
+	autov1 "github.com/fluxcd/image-automation-controller/api/v1alpha2"
 )
 
 var deleteImageUpdateCmd = &cobra.Command{
@@ -28,7 +28,6 @@ var deleteImageUpdateCmd = &cobra.Command{
 	Long:  "The delete image update command deletes the given ImageUpdateAutomation from the cluster.",
 	Example: `  # Delete an image update automation
   flux delete image update latest-images`,
-	ValidArgsFunction: resourceNamesCompletionFunc(autov1.GroupVersion.WithKind(autov1.ImageUpdateAutomationKind)),
 	RunE: deleteCommand{
 		apiType: imageUpdateAutomationType,
 		object:  universalAdapter{&autov1.ImageUpdateAutomation{}},

cmd/flux/delete_kustomization.go

@@ -19,7 +19,7 @@ package main
 import (
 	"github.com/spf13/cobra"
 
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta1"
 )
 
 var deleteKsCmd = &cobra.Command{
@@ -27,9 +27,8 @@ var deleteKsCmd = &cobra.Command{
 	Aliases: []string{"ks"},
 	Short:   "Delete a Kustomization resource",
 	Long:    "The delete kustomization command deletes the given Kustomization from the cluster.",
-	Example: `  # Delete a kustomization and the Kubernetes resources created by it when prune is enabled
+	Example: `  # Delete a kustomization and the Kubernetes resources created by it
   flux delete kustomization podinfo`,
-	ValidArgsFunction: resourceNamesCompletionFunc(kustomizev1.GroupVersion.WithKind(kustomizev1.KustomizationKind)),
 	RunE: deleteCommand{
 		apiType: kustomizationType,
 		object:  universalAdapter{&kustomizev1.Kustomization{}},

cmd/flux/delete_receiver.go

@@ -28,7 +28,6 @@ var deleteReceiverCmd = &cobra.Command{
 	Long:  "The delete receiver command removes the given Receiver from the cluster.",
 	Example: `  # Delete an Receiver and the Kubernetes resources created by it
   flux delete receiver main`,
-	ValidArgsFunction: resourceNamesCompletionFunc(notificationv1.GroupVersion.WithKind(notificationv1.ReceiverKind)),
 	RunE: deleteCommand{
 		apiType: receiverType,
 		object:  universalAdapter{&notificationv1.Receiver{}},

cmd/flux/delete_source_bucket.go

@@ -19,7 +19,7 @@ package main
 import (
 	"github.com/spf13/cobra"
 
-	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta1"
 )
 
 var deleteSourceBucketCmd = &cobra.Command{
@@ -28,7 +28,6 @@ var deleteSourceBucketCmd = &cobra.Command{
 	Long:  "The delete source bucket command deletes the given Bucket from the cluster.",
 	Example: `  # Delete a Bucket source
   flux delete source bucket podinfo`,
-	ValidArgsFunction: resourceNamesCompletionFunc(sourcev1.GroupVersion.WithKind(sourcev1.BucketKind)),
 	RunE: deleteCommand{
 		apiType: bucketType,
 		object:  universalAdapter{&sourcev1.Bucket{}},

cmd/flux/delete_source_git.go

@@ -19,7 +19,7 @@ package main
 import (
 	"github.com/spf13/cobra"
 
-	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta1"
 )
 
 var deleteSourceGitCmd = &cobra.Command{
@@ -28,7 +28,6 @@ var deleteSourceGitCmd = &cobra.Command{
 	Long:  "The delete source git command deletes the given GitRepository from the cluster.",
 	Example: `  # Delete a Git repository
   flux delete source git podinfo`,
-	ValidArgsFunction: resourceNamesCompletionFunc(sourcev1.GroupVersion.WithKind(sourcev1.GitRepositoryKind)),
 	RunE: deleteCommand{
 		apiType: gitRepositoryType,
 		object:  universalAdapter{&sourcev1.GitRepository{}},

cmd/flux/delete_source_helm.go

@@ -19,7 +19,7 @@ package main
 import (
 	"github.com/spf13/cobra"
 
-	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta1"
 )
 
 var deleteSourceHelmCmd = &cobra.Command{
@@ -28,7 +28,6 @@ var deleteSourceHelmCmd = &cobra.Command{
 	Long:  "The delete source helm command deletes the given HelmRepository from the cluster.",
 	Example: `  # Delete a Helm repository
   flux delete source helm podinfo`,
-	ValidArgsFunction: resourceNamesCompletionFunc(sourcev1.GroupVersion.WithKind(sourcev1.HelmRepositoryKind)),
 	RunE: deleteCommand{
 		apiType: helmRepositoryType,
 		object:  universalAdapter{&sourcev1.HelmRepository{}},

cmd/flux/delete_source_oci.go

@@ -1,40 +0,0 @@
-/*
-Copyright 2022 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"github.com/spf13/cobra"
-
-	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
-)
-
-var deleteSourceOCIRepositoryCmd = &cobra.Command{
-	Use:   "oci [name]",
-	Short: "Delete an OCIRepository source",
-	Long:  "The delete source oci command deletes the given OCIRepository from the cluster.",
-	Example: `  # Delete an OCIRepository 
-  flux delete source oci podinfo`,
-	ValidArgsFunction: resourceNamesCompletionFunc(sourcev1.GroupVersion.WithKind(sourcev1.OCIRepositoryKind)),
-	RunE: deleteCommand{
-		apiType: ociRepositoryType,
-		object:  universalAdapter{&sourcev1.OCIRepository{}},
-	}.run,
-}
-
-func init() {
-	deleteSourceCmd.AddCommand(deleteSourceOCIRepositoryCmd)
-}

cmd/flux/diff.go

@@ -1,31 +0,0 @@
-/*
-Copyright 2021 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"github.com/spf13/cobra"
-)
-
-var diffCmd = &cobra.Command{
-	Use:   "diff",
-	Short: "Diff a flux resource",
-	Long:  "The diff command is used to do a server-side dry-run on flux resources, then prints the diff.",
-}
-
-func init() {
-	rootCmd.AddCommand(diffCmd)
-}

cmd/flux/diff_kustomization.go

@@ -1,124 +0,0 @@
-/*
-Copyright 2021 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"fmt"
-	"os"
-	"os/signal"
-
-	"github.com/spf13/cobra"
-
-	"github.com/fluxcd/flux2/internal/build"
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
-)
-
-var diffKsCmd = &cobra.Command{
-	Use:     "kustomization",
-	Aliases: []string{"ks"},
-	Short:   "Diff Kustomization",
-	Long: `The diff command does a build, then it performs a server-side dry-run and prints the diff.
-Exit status: 0 No differences were found. 1 Differences were found. >1 diff failed with an error.`,
-	Example: `# Preview local changes as they were applied on the cluster
-flux diff kustomization my-app --path ./path/to/local/manifests
-
-# Preview using a local flux kustomization file
-flux diff kustomization my-app --path ./path/to/local/manifests --kustomization-file ./path/to/local/my-app.yaml`,
-	ValidArgsFunction: resourceNamesCompletionFunc(kustomizev1.GroupVersion.WithKind(kustomizev1.KustomizationKind)),
-	RunE:              diffKsCmdRun,
-}
-
-type diffKsFlags struct {
-	kustomizationFile string
-	path              string
-	progressBar       bool
-}
-
-var diffKsArgs diffKsFlags
-
-func init() {
-	diffKsCmd.Flags().StringVar(&diffKsArgs.path, "path", "", "Path to a local directory that matches the specified Kustomization.spec.path.")
-	diffKsCmd.Flags().BoolVar(&diffKsArgs.progressBar, "progress-bar", true, "Boolean to set the progress bar. The default value is true.")
-	diffKsCmd.Flags().StringVar(&diffKsArgs.kustomizationFile, "kustomization-file", "", "Path to the Flux Kustomization YAML file.")
-	diffCmd.AddCommand(diffKsCmd)
-}
-
-func diffKsCmdRun(cmd *cobra.Command, args []string) error {
-	if len(args) < 1 {
-		return fmt.Errorf("%s name is required", kustomizationType.humanKind)
-	}
-	name := args[0]
-
-	if diffKsArgs.path == "" {
-		return &RequestError{StatusCode: 2, Err: fmt.Errorf("invalid resource path %q", diffKsArgs.path)}
-	}
-
-	if fs, err := os.Stat(diffKsArgs.path); err != nil || !fs.IsDir() {
-		return &RequestError{StatusCode: 2, Err: fmt.Errorf("invalid resource path %q", diffKsArgs.path)}
-	}
-
-	if diffKsArgs.kustomizationFile != "" {
-		if fs, err := os.Stat(diffKsArgs.kustomizationFile); os.IsNotExist(err) || fs.IsDir() {
-			return fmt.Errorf("invalid kustomization file %q", diffKsArgs.kustomizationFile)
-		}
-	}
-
-	var builder *build.Builder
-	var err error
-	if diffKsArgs.progressBar {
-		builder, err = build.NewBuilder(kubeconfigArgs, kubeclientOptions, name, diffKsArgs.path, build.WithTimeout(rootArgs.timeout), build.WithKustomizationFile(diffKsArgs.kustomizationFile), build.WithProgressBar())
-	} else {
-		builder, err = build.NewBuilder(kubeconfigArgs, kubeclientOptions, name, diffKsArgs.path, build.WithTimeout(rootArgs.timeout), build.WithKustomizationFile(diffKsArgs.kustomizationFile))
-	}
-
-	if err != nil {
-		return &RequestError{StatusCode: 2, Err: err}
-	}
-
-	// create a signal channel
-	sigc := make(chan os.Signal, 1)
-	signal.Notify(sigc, os.Interrupt)
-
-	errChan := make(chan error)
-	go func() {
-		output, hasChanged, err := builder.Diff()
-		if err != nil {
-			errChan <- &RequestError{StatusCode: 2, Err: err}
-		}
-
-		cmd.Print(output)
-
-		if hasChanged {
-			errChan <- &RequestError{StatusCode: 1, Err: fmt.Errorf("identified at least one change, exiting with non-zero exit code")}
-		} else {
-			errChan <- nil
-		}
-	}()
-
-	select {
-	case <-sigc:
-		fmt.Println("Build cancelled... exiting.")
-		return builder.Cancel()
-	case err := <-errChan:
-		if err != nil {
-			return err
-		}
-	}
-
-	return nil
-
-}

cmd/flux/diff_kustomization_test.go

@@ -1,145 +0,0 @@
-//go:build unit
-// +build unit
-
-/*
-Copyright 2021 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"context"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/fluxcd/flux2/internal/build"
-	"github.com/fluxcd/pkg/ssa"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-)
-
-func TestDiffKustomization(t *testing.T) {
-	tests := []struct {
-		name       string
-		args       string
-		objectFile string
-		assert     assertFunc
-	}{
-		{
-			name:       "no args",
-			args:       "diff kustomization podinfo",
-			objectFile: "",
-			assert:     assertError("invalid resource path \"\""),
-		},
-		{
-			name:       "diff nothing deployed",
-			args:       "diff kustomization podinfo --path ./testdata/build-kustomization/podinfo --progress-bar=false",
-			objectFile: "",
-			assert:     assertGoldenFile("./testdata/diff-kustomization/nothing-is-deployed.golden"),
-		},
-		{
-			name:       "diff with a deployment object",
-			args:       "diff kustomization podinfo --path ./testdata/build-kustomization/podinfo --progress-bar=false",
-			objectFile: "./testdata/diff-kustomization/deployment.yaml",
-			assert:     assertGoldenFile("./testdata/diff-kustomization/diff-with-deployment.golden"),
-		},
-		{
-			name:       "diff with a drifted service object",
-			args:       "diff kustomization podinfo --path ./testdata/build-kustomization/podinfo --progress-bar=false",
-			objectFile: "./testdata/diff-kustomization/service.yaml",
-			assert:     assertGoldenFile("./testdata/diff-kustomization/diff-with-drifted-service.golden"),
-		},
-		{
-			name:       "diff with a drifted secret object",
-			args:       "diff kustomization podinfo --path ./testdata/build-kustomization/podinfo --progress-bar=false",
-			objectFile: "./testdata/diff-kustomization/secret.yaml",
-			assert:     assertGoldenFile("./testdata/diff-kustomization/diff-with-drifted-secret.golden"),
-		},
-		{
-			name:       "diff with a drifted key in sops secret object",
-			args:       "diff kustomization podinfo --path ./testdata/build-kustomization/podinfo --progress-bar=false",
-			objectFile: "./testdata/diff-kustomization/key-sops-secret.yaml",
-			assert:     assertGoldenFile("./testdata/diff-kustomization/diff-with-drifted-key-sops-secret.golden"),
-		},
-		{
-			name:       "diff with a drifted value in sops secret object",
-			args:       "diff kustomization podinfo --path ./testdata/build-kustomization/podinfo --progress-bar=false",
-			objectFile: "./testdata/diff-kustomization/value-sops-secret.yaml",
-			assert:     assertGoldenFile("./testdata/diff-kustomization/diff-with-drifted-value-sops-secret.golden"),
-		},
-		{
-			name:       "diff with a sops dockerconfigjson secret object",
-			args:       "diff kustomization podinfo --path ./testdata/build-kustomization/podinfo --progress-bar=false",
-			objectFile: "./testdata/diff-kustomization/dockerconfigjson-sops-secret.yaml",
-			assert:     assertGoldenFile("./testdata/diff-kustomization/diff-with-dockerconfigjson-sops-secret.golden"),
-		},
-		{
-			name:       "diff with a sops stringdata secret object",
-			args:       "diff kustomization podinfo --path ./testdata/build-kustomization/podinfo --progress-bar=false",
-			objectFile: "./testdata/diff-kustomization/stringdata-sops-secret.yaml",
-			assert:     assertGoldenFile("./testdata/diff-kustomization/diff-with-drifted-stringdata-sops-secret.golden"),
-		},
-	}
-
-	tmpl := map[string]string{
-		"fluxns": allocateNamespace("flux-system"),
-	}
-
-	b, _ := build.NewBuilder(kubeconfigArgs, kubeclientOptions, "podinfo", "")
-
-	resourceManager, err := b.Manager()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	setup(t, tmpl)
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if tt.objectFile != "" {
-				resourceManager.ApplyAll(context.Background(), createObjectFromFile(tt.objectFile, tmpl, t), ssa.DefaultApplyOptions())
-			}
-			cmd := cmdTestCase{
-				args:   tt.args + " -n " + tmpl["fluxns"],
-				assert: tt.assert,
-			}
-			cmd.runTestCmd(t)
-			if tt.objectFile != "" {
-				testEnv.DeleteObjectFile(tt.objectFile, tmpl, t)
-			}
-		})
-	}
-}
-
-func createObjectFromFile(objectFile string, templateValues map[string]string, t *testing.T) []*unstructured.Unstructured {
-	buf, err := os.ReadFile(objectFile)
-	if err != nil {
-		t.Fatalf("Error reading file '%s': %v", objectFile, err)
-	}
-	content, err := executeTemplate(string(buf), templateValues)
-	if err != nil {
-		t.Fatalf("Error evaluating template file '%s': '%v'", objectFile, err)
-	}
-	clientObjects, err := readYamlObjects(strings.NewReader(content))
-	if err != nil {
-		t.Fatalf("Error decoding yaml file '%s': %v", objectFile, err)
-	}
-
-	if err := ssa.SetNativeKindsDefaults(clientObjects); err != nil {
-		t.Fatalf("Error setting native kinds defaults for '%s': %v", objectFile, err)
-	}
-
-	return clientObjects
-}

cmd/flux/encrypt.go

@@ -20,12 +20,20 @@ import (
 	"github.com/spf13/cobra"
 )
 
-var buildCmd = &cobra.Command{
+var encryptCmd = &cobra.Command{
-	Use:   "build",
+	Use:   "encrypt",
-	Short: "Build a flux resource",
+	Short: "Encrypt secrets using SOPS",
-	Long:  "The build command is used to build flux resources.",
+	Long:  "The encrypt sub-commands initialise and manage Secret encryption using SOPS.",
 }
 
-func init() {
+type encryptFlags struct {
-	rootCmd.AddCommand(buildCmd)
+	export bool
+}
+
+var encryptArgs encryptFlags
+
+func init() {
+	encryptCmd.PersistentFlags().BoolVar(&encryptArgs.export, "export", false, "export in YAML format to stdout")
+
+	rootCmd.AddCommand(encryptCmd)
 }

cmd/flux/encrypt_init.go

@@ -0,0 +1,113 @@
+/*
+Copyright 2021 The Flux authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"context"
+	"fmt"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+
+	"filippo.io/age"
+	"github.com/fluxcd/flux2/internal/utils"
+	"github.com/go-git/go-git/v5"
+	"github.com/spf13/cobra"
+	corev1 "k8s.io/api/core/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+var encryptInitCmd = &cobra.Command{
+	Use:   "init",
+	Short: "Init SOPS encryption with age identity",
+	Long:  "The encryption init command creates a new age identity and writes a .sops.yaml file to the current working directory.",
+	Example: `  # Init SOPS encryption with a new age identity
+  flux encryption init`,
+	RunE: encryptInitCmdRun,
+}
+
+func init() {
+	encryptCmd.AddCommand(encryptInitCmd)
+}
+
+func encryptInitCmdRun(cmd *cobra.Command, args []string) error {
+	// Confirm our current path is in a Git repository
+	path, err := os.Getwd()
+	if err != nil {
+		return err
+	}
+	if _, err := git.PlainOpen(path); err != nil {
+		if err == git.ErrRepositoryNotExists {
+			err = fmt.Errorf("'%s' is not in a Git repository", path)
+		}
+		return err
+	}
+
+	// Abort early if .sops.yaml already exists
+	sopsCfgPath := filepath.Join(path, ".sops.yaml")
+	if _, err := os.Stat(sopsCfgPath); err == nil || os.IsExist(err) {
+		return fmt.Errorf("'%s' already contains a .sops.yaml config", path)
+	}
+
+	// Generate a new identity
+	i, err := age.GenerateX25519Identity()
+	if err != nil {
+		return err
+	}
+	logger.Successf("Generated identity %s", i.Recipient().String())
+
+	// Attempt to configure identity in .sops.yaml
+	const sopsCfg = `creation_rules:
+  - path_regex: .*.yaml
+    encrypted_regex: ^(data|stringData)$
+    age: %s
+`
+	if err := ioutil.WriteFile(sopsCfgPath, []byte(fmt.Sprintf(sopsCfg, i.Recipient().String())), 0644); err != nil {
+		logger.Failuref("Failed to write recipient to .sops.yaml file")
+		return err
+	}
+	logger.Successf("Configured recipient in .sops.yaml file")
+
+	// Init client
+	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
+	defer cancel()
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
+	if err != nil {
+		return err
+	}
+
+	// Create a secret
+	secret := &corev1.Secret{
+		ObjectMeta: v1.ObjectMeta{
+			Name:      "sops-age",
+			Namespace: rootArgs.namespace,
+		},
+		StringData: map[string]string{
+			"flux-auto.age": i.String(),
+		},
+	}
+	if err := kubeClient.Create(ctx, secret); err != nil {
+		return err
+	}
+	logger.Successf(`Secret '%s' with private key created`, secret.Name)
+
+	// TODO(hidde): lookup kustomize based on path ref? Do direct cluster mutation? (Preferably not!)
+	//  Feels something is missing in general to provide a user experience improving bridge between "die hard"
+	//  `--export` and "please do not do this" direct-apply-to-cluster.
+
+	return nil
+}

cmd/flux/export.go

@@ -20,7 +20,6 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-
 	"github.com/spf13/cobra"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -74,19 +73,19 @@ func (export exportCommand) run(cmd *cobra.Command, args []string) error {
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
 
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
 
 	if exportArgs.all {
-		err = kubeClient.List(ctx, export.list.asClientList(), client.InNamespace(*kubeconfigArgs.Namespace))
+		err = kubeClient.List(ctx, export.list.asClientList(), client.InNamespace(rootArgs.namespace))
 		if err != nil {
 			return err
 		}
 
 		if export.list.len() == 0 {
-			return fmt.Errorf("no objects found in %s namespace", *kubeconfigArgs.Namespace)
+			return fmt.Errorf("no objects found in %s namespace", rootArgs.namespace)
 		}
 
 		for i := 0; i < export.list.len(); i++ {
@@ -97,7 +96,7 @@ func (export exportCommand) run(cmd *cobra.Command, args []string) error {
 	} else {
 		name := args[0]
 		namespacedName := types.NamespacedName{
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Name:      name,
 		}
 		err = kubeClient.Get(ctx, namespacedName, export.object.asClientObject())
@@ -114,8 +113,8 @@ func printExport(export interface{}) error {
 	if err != nil {
 		return err
 	}
-	rootCmd.Println("---")
+	fmt.Println("---")
-	rootCmd.Println(resourceToString(data))
+	fmt.Println(resourceToString(data))
 	return nil
 }
 

cmd/flux/export_alert.go

@@ -32,7 +32,6 @@ var exportAlertCmd = &cobra.Command{
 
   # Export a Alert
   flux export alert main > main.yaml`,
-	ValidArgsFunction: resourceNamesCompletionFunc(notificationv1.GroupVersion.WithKind(notificationv1.AlertKind)),
 	RunE: exportCommand{
 		object: alertAdapter{&notificationv1.Alert{}},
 		list:   alertListAdapter{&notificationv1.AlertList{}},

cmd/flux/export_alertprovider.go

@@ -32,7 +32,6 @@ var exportAlertProviderCmd = &cobra.Command{
 
   # Export a Provider
   flux export alert-provider slack > slack.yaml`,
-	ValidArgsFunction: resourceNamesCompletionFunc(notificationv1.GroupVersion.WithKind(notificationv1.ProviderKind)),
 	RunE: exportCommand{
 		object: alertProviderAdapter{&notificationv1.Provider{}},
 		list:   alertProviderListAdapter{&notificationv1.ProviderList{}},

cmd/flux/export_helmrelease.go

@@ -33,7 +33,6 @@ var exportHelmReleaseCmd = &cobra.Command{
 
   # Export a HelmRelease
   flux export hr my-app > app-release.yaml`,
-	ValidArgsFunction: resourceNamesCompletionFunc(helmv2.GroupVersion.WithKind(helmv2.HelmReleaseKind)),
 	RunE: exportCommand{
 		object: helmReleaseAdapter{&helmv2.HelmRelease{}},
 		list:   helmReleaseListAdapter{&helmv2.HelmReleaseList{}},

cmd/flux/export_image_policy.go

@@ -20,7 +20,7 @@ import (
 	"github.com/spf13/cobra"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	imagev1 "github.com/fluxcd/image-reflector-controller/api/v1beta1"
+	imagev1 "github.com/fluxcd/image-reflector-controller/api/v1alpha2"
 )
 
 var exportImagePolicyCmd = &cobra.Command{
@@ -32,7 +32,6 @@ var exportImagePolicyCmd = &cobra.Command{
 
   # Export a specific policy
   flux export image policy alpine1x > alpine1x.yaml`,
-	ValidArgsFunction: resourceNamesCompletionFunc(imagev1.GroupVersion.WithKind(imagev1.ImagePolicyKind)),
 	RunE: exportCommand{
 		object: imagePolicyAdapter{&imagev1.ImagePolicy{}},
 		list:   imagePolicyListAdapter{&imagev1.ImagePolicyList{}},

cmd/flux/export_image_repository.go

@@ -20,7 +20,7 @@ import (
 	"github.com/spf13/cobra"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	imagev1 "github.com/fluxcd/image-reflector-controller/api/v1beta1"
+	imagev1 "github.com/fluxcd/image-reflector-controller/api/v1alpha2"
 )
 
 var exportImageRepositoryCmd = &cobra.Command{
@@ -32,7 +32,6 @@ var exportImageRepositoryCmd = &cobra.Command{
 
   # Export a specific ImageRepository resource
   flux export image repository alpine > alpine.yaml`,
-	ValidArgsFunction: resourceNamesCompletionFunc(imagev1.GroupVersion.WithKind(imagev1.ImageRepositoryKind)),
 	RunE: exportCommand{
 		object: imageRepositoryAdapter{&imagev1.ImageRepository{}},
 		list:   imageRepositoryListAdapter{&imagev1.ImageRepositoryList{}},

cmd/flux/export_image_update.go

@@ -20,7 +20,7 @@ import (
 	"github.com/spf13/cobra"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	autov1 "github.com/fluxcd/image-automation-controller/api/v1beta1"
+	autov1 "github.com/fluxcd/image-automation-controller/api/v1alpha2"
 )
 
 var exportImageUpdateCmd = &cobra.Command{
@@ -32,7 +32,6 @@ var exportImageUpdateCmd = &cobra.Command{
 
   # Export a specific automation
   flux export image update latest-images > latest.yaml`,
-	ValidArgsFunction: resourceNamesCompletionFunc(autov1.GroupVersion.WithKind(autov1.ImageUpdateAutomationKind)),
 	RunE: exportCommand{
 		object: imageUpdateAutomationAdapter{&autov1.ImageUpdateAutomation{}},
 		list:   imageUpdateAutomationListAdapter{&autov1.ImageUpdateAutomationList{}},

cmd/flux/export_kustomization.go

@@ -20,7 +20,7 @@ import (
 	"github.com/spf13/cobra"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
+	kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta1"
 )
 
 var exportKsCmd = &cobra.Command{
@@ -33,7 +33,6 @@ var exportKsCmd = &cobra.Command{
 
   # Export a Kustomization
   flux export kustomization my-app > kustomization.yaml`,
-	ValidArgsFunction: resourceNamesCompletionFunc(kustomizev1.GroupVersion.WithKind(kustomizev1.KustomizationKind)),
 	RunE: exportCommand{
 		object: kustomizationAdapter{&kustomizev1.Kustomization{}},
 		list:   kustomizationListAdapter{&kustomizev1.KustomizationList{}},

cmd/flux/export_receiver.go

@@ -32,7 +32,6 @@ var exportReceiverCmd = &cobra.Command{
 
   # Export a Receiver
   flux export receiver main > main.yaml`,
-	ValidArgsFunction: resourceNamesCompletionFunc(notificationv1.GroupVersion.WithKind(notificationv1.ReceiverKind)),
 	RunE: exportCommand{
 		list:   receiverListAdapter{&notificationv1.ReceiverList{}},
 		object: receiverAdapter{&notificationv1.Receiver{}},

cmd/flux/export_secret.go

@@ -19,7 +19,6 @@ package main
 import (
 	"context"
 	"fmt"
-
 	"github.com/spf13/cobra"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -59,19 +58,19 @@ func (export exportWithSecretCommand) run(cmd *cobra.Command, args []string) err
 	ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
 	defer cancel()
 
-	kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
+	kubeClient, err := utils.KubeClient(rootArgs.kubeconfig, rootArgs.kubecontext)
 	if err != nil {
 		return err
 	}
 
 	if exportArgs.all {
-		err = kubeClient.List(ctx, export.list.asClientList(), client.InNamespace(*kubeconfigArgs.Namespace))
+		err = kubeClient.List(ctx, export.list.asClientList(), client.InNamespace(rootArgs.namespace))
 		if err != nil {
 			return err
 		}
 
 		if export.list.len() == 0 {
-			return fmt.Errorf("no objects found in %s namespace", *kubeconfigArgs.Namespace)
+			return fmt.Errorf("no objects found in %s namespace", rootArgs.namespace)
 		}
 
 		for i := 0; i < export.list.len(); i++ {
@@ -89,7 +88,7 @@ func (export exportWithSecretCommand) run(cmd *cobra.Command, args []string) err
 	} else {
 		name := args[0]
 		namespacedName := types.NamespacedName{
-			Namespace: *kubeconfigArgs.Namespace,
+			Namespace: rootArgs.namespace,
 			Name:      name,
 		}
 		err = kubeClient.Get(ctx, namespacedName, export.object.asClientObject())

cmd/flux/export_source_bucket.go

@@ -21,7 +21,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 
-	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta1"
 )
 
 var exportSourceBucketCmd = &cobra.Command{
@@ -33,7 +33,6 @@ var exportSourceBucketCmd = &cobra.Command{
 
   # Export a Bucket source including the static credentials
   flux export source bucket my-bucket --with-credentials > source.yaml`,
-	ValidArgsFunction: resourceNamesCompletionFunc(sourcev1.GroupVersion.WithKind(sourcev1.BucketKind)),
 	RunE: exportWithSecretCommand{
 		list:   bucketListAdapter{&sourcev1.BucketList{}},
 		object: bucketAdapter{&sourcev1.Bucket{}},

cmd/flux/export_source_git.go

@@ -21,7 +21,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 
-	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta1"
 )
 
 var exportSourceGitCmd = &cobra.Command{
@@ -33,7 +33,6 @@ var exportSourceGitCmd = &cobra.Command{
 
   # Export a GitRepository source including the SSH key pair or basic auth credentials
   flux export source git my-private-repo --with-credentials > source.yaml`,
-	ValidArgsFunction: resourceNamesCompletionFunc(sourcev1.GroupVersion.WithKind(sourcev1.GitRepositoryKind)),
 	RunE: exportWithSecretCommand{
 		object: gitRepositoryAdapter{&sourcev1.GitRepository{}},
 		list:   gitRepositoryListAdapter{&sourcev1.GitRepositoryList{}},

cmd/flux/export_source_helm.go

@@ -21,7 +21,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 
-	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
+	sourcev1 "github.com/fluxcd/source-controller/api/v1beta1"
 )
 
 var exportSourceHelmCmd = &cobra.Command{
@@ -33,7 +33,6 @@ var exportSourceHelmCmd = &cobra.Command{
 
   # Export a HelmRepository source including the basic auth credentials
   flux export source helm my-private-repo --with-credentials > source.yaml`,
-	ValidArgsFunction: resourceNamesCompletionFunc(sourcev1.GroupVersion.WithKind(sourcev1.HelmRepositoryKind)),
 	RunE: exportWithSecretCommand{
 		list:   helmRepositoryListAdapter{&sourcev1.HelmRepositoryList{}},
 		object: helmRepositoryAdapter{&sourcev1.HelmRepository{}},

cmd/flux/export_source_oci.go

@@ -1,92 +0,0 @@
-/*
-Copyright 2022 The Flux authors
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package main
-
-import (
-	"github.com/spf13/cobra"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/types"
-
-	sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
-)
-
-var exportSourceOCIRepositoryCmd = &cobra.Command{
-	Use:   "oci [name]",
-	Short: "Export OCIRepository sources in YAML format",
-	Long:  "The export source oci command exports one or all OCIRepository sources in YAML format.",
-	Example: `  # Export all OCIRepository sources
-  flux export source oci --all > sources.yaml
-
-  # Export a OCIRepository including the static credentials
-  flux export source oci my-app --with-credentials > source.yaml`,
-	ValidArgsFunction: resourceNamesCompletionFunc(sourcev1.GroupVersion.WithKind(sourcev1.OCIRepositoryKind)),
-	RunE: exportWithSecretCommand{
-		list:   ociRepositoryListAdapter{&sourcev1.OCIRepositoryList{}},
-		object: ociRepositoryAdapter{&sourcev1.OCIRepository{}},
-	}.run,
-}
-
-func init() {
-	exportSourceCmd.AddCommand(exportSourceOCIRepositoryCmd)
-}
-
-func exportOCIRepository(source *sourcev1.OCIRepository) interface{} {
-	gvk := sourcev1.GroupVersion.WithKind(sourcev1.OCIRepositoryKind)
-	export := sourcev1.OCIRepository{
-		TypeMeta: metav1.TypeMeta{
-			Kind:       gvk.Kind,
-			APIVersion: gvk.GroupVersion().String(),
-		},
-		ObjectMeta: metav1.ObjectMeta{
-			Name:        source.Name,
-			Namespace:   source.Namespace,
-			Labels:      source.Labels,
-			Annotations: source.Annotations,
-		},
-		Spec: source.Spec,
-	}
-	return export
-}
-
-func getOCIRepositorySecret(source *sourcev1.OCIRepository) *types.NamespacedName {
-	if source.Spec.SecretRef != nil {
-		namespacedName := types.NamespacedName{
-			Namespace: source.Namespace,
-			Name:      source.Spec.SecretRef.Name,
-		}
-
-		return &namespacedName
-	}
-
-	return nil
-}
-
-func (ex ociRepositoryAdapter) secret() *types.NamespacedName {
-	return getOCIRepositorySecret(ex.OCIRepository)
-}
-
-func (ex ociRepositoryListAdapter) secretItem(i int) *types.NamespacedName {
-	return getOCIRepositorySecret(&ex.OCIRepositoryList.Items[i])
-}
-
-func (ex ociRepositoryAdapter) export() interface{} {
-	return exportOCIRepository(ex.OCIRepository)
-}
-
-func (ex ociRepositoryListAdapter) exportItem(i int) interface{} {
-	return exportOCIRepository(&ex.OCIRepositoryList.Items[i])
-}