source.toolkit.fluxcd.io_ocirepositories.yaml

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.19.0
  name: ocirepositories.source.toolkit.fluxcd.io
spec:
  group: source.toolkit.fluxcd.io
  names:
    kind: OCIRepository
    listKind: OCIRepositoryList
    plural: ocirepositories
    shortNames:
    - ocirepo
    singular: ocirepository
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .spec.url
      name: URL
      type: string
    - jsonPath: .status.conditions[?(@.type=="Ready")].status
      name: Ready
      type: string
    - jsonPath: .status.conditions[?(@.type=="Ready")].message
      name: Status
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1
    schema:
      openAPIV3Schema:
        description: OCIRepository is the Schema for the ocirepositories API
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: OCIRepositorySpec defines the desired state of OCIRepository
            properties:
              certSecretRef:
                description: |-
                  CertSecretRef can be given the name of a Secret containing
                  either or both of

                  - a PEM-encoded client certificate (`tls.crt`) and private
                  key (`tls.key`);
                  - a PEM-encoded CA certificate (`ca.crt`)

                  and whichever are supplied, will be used for connecting to the
                  registry. The client cert and key are useful if you are
                  authenticating with a certificate; the CA cert is useful if
                  you are using a self-signed server certificate. The Secret must
                  be of type `Opaque` or `kubernetes.io/tls`.
                properties:
                  name:
                    description: Name of the referent.
                    type: string
                required:
                - name
                type: object
              ignore:
                description: |-
                  Ignore overrides the set of excluded patterns in the .sourceignore format
                  (which is the same as .gitignore). If not provided, a default will be used,
                  consult the documentation for your version to find out what those are.
                type: string
              insecure:
                description: Insecure allows connecting to a non-TLS HTTP container
                  registry.
                type: boolean
              interval:
                description: |-
                  Interval at which the OCIRepository URL is checked for updates.
                  This interval is approximate and may be subject to jitter to ensure
                  efficient use of resources.
                pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$
                type: string
              layerSelector:
                description: |-
                  LayerSelector specifies which layer should be extracted from the OCI artifact.
                  When not specified, the first layer found in the artifact is selected.
                properties:
                  mediaType:
                    description: |-
                      MediaType specifies the OCI media type of the layer
                      which should be extracted from the OCI Artifact. The
                      first layer matching this type is selected.
                    type: string
                  operation:
                    description: |-
                      Operation specifies how the selected layer should be processed.
                      By default, the layer compressed content is extracted to storage.
                      When the operation is set to 'copy', the layer compressed content
                      is persisted to storage as it is.
                    enum:
                    - extract
                    - copy
                    type: string
                type: object
              provider:
                default: generic
                description: |-
                  The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.
                  When not specified, defaults to 'generic'.
                enum:
                - generic
                - aws
                - azure
                - gcp
                type: string
              proxySecretRef:
                description: |-
                  ProxySecretRef specifies the Secret containing the proxy configuration
                  to use while communicating with the container registry.
                properties:
                  name:
                    description: Name of the referent.
                    type: string
                required:
                - name
                type: object
              ref:
                description: |-
                  The OCI reference to pull and monitor for changes,
                  defaults to the latest tag.
                properties:
                  digest:
                    description: |-
                      Digest is the image digest to pull, takes precedence over SemVer.
                      The value should be in the format 'sha256:<HASH>'.
                    type: string
                  semver:
                    description: |-
                      SemVer is the range of tags to pull selecting the latest within
                      the range, takes precedence over Tag.
                    type: string
                  semverFilter:
                    description: SemverFilter is a regex pattern to filter the tags
                      within the SemVer range.
                    type: string
                  tag:
                    description: Tag is the image tag to pull, defaults to latest.
                    type: string
                type: object
              secretRef:
                description: |-
                  SecretRef contains the secret name containing the registry login
                  credentials to resolve image metadata.
                  The secret must be of type kubernetes.io/dockerconfigjson.
                properties:
                  name:
                    description: Name of the referent.
                    type: string
                required:
                - name
                type: object
              serviceAccountName:
                description: |-
                  ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
                  the image pull if the service account has attached pull secrets. For more information:
                  https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account
                type: string
              suspend:
                description: This flag tells the controller to suspend the reconciliation
                  of this source.
                type: boolean
              timeout:
                default: 60s
                description: The timeout for remote OCI Repository operations like
                  pulling, defaults to 60s.
                pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$
                type: string
              url:
                description: |-
                  URL is a reference to an OCI artifact repository hosted
                  on a remote container registry.
                pattern: ^oci://.*$
                type: string
              verify:
                description: |-
                  Verify contains the secret name containing the trusted public keys
                  used to verify the signature and specifies which provider to use to check
                  whether OCI image is authentic.
                properties:
                  matchOIDCIdentity:
                    description: |-
                      MatchOIDCIdentity specifies the identity matching criteria to use
                      while verifying an OCI artifact which was signed using Cosign keyless
                      signing. The artifact's identity is deemed to be verified if any of the
                      specified matchers match against the identity.
                    items:
                      description: |-
                        OIDCIdentityMatch specifies options for verifying the certificate identity,
                        i.e. the issuer and the subject of the certificate.
                      properties:
                        issuer:
                          description: |-
                            Issuer specifies the regex pattern to match against to verify
                            the OIDC issuer in the Fulcio certificate. The pattern must be a
                            valid Go regular expression.
                          type: string
                        subject:
                          description: |-
                            Subject specifies the regex pattern to match against to verify
                            the identity subject in the Fulcio certificate. The pattern must
                            be a valid Go regular expression.
                          type: string
                      required:
                      - issuer
                      - subject
                      type: object
                    type: array
                  provider:
                    default: cosign
                    description: Provider specifies the technology used to sign the
                      OCI Artifact.
                    enum:
                    - cosign
                    - notation
                    type: string
                  secretRef:
                    description: |-
                      SecretRef specifies the Kubernetes Secret containing the
                      trusted public keys.
                    properties:
                      name:
                        description: Name of the referent.
                        type: string
                    required:
                    - name
                    type: object
                  trustedRootSecretRef:
                    description: |-
                      TrustedRootSecretRef specifies the Kubernetes Secret containing a
                      Sigstore trusted_root.json file. This enables verification against
                      self-hosted Sigstore infrastructure (custom Fulcio CA, self-hosted
                      Rekor instance). The Secret must contain a key named "trusted_root.json".
                    properties:
                      name:
                        description: Name of the referent.
                        type: string
                    required:
                    - name
                    type: object
                required:
                - provider
                type: object
            required:
            - interval
            - url
            type: object
          status:
            default:
              observedGeneration: -1
            description: OCIRepositoryStatus defines the observed state of OCIRepository
            properties:
              artifact:
                description: Artifact represents the output of the last successful
                  OCI Repository sync.
                properties:
                  digest:
                    description: Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
                    pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$
                    type: string
                  lastUpdateTime:
                    description: |-
                      LastUpdateTime is the timestamp corresponding to the last update of the
                      Artifact.
                    format: date-time
                    type: string
                  metadata:
                    additionalProperties:
                      type: string
                    description: Metadata holds upstream information such as OCI annotations.
                    type: object
                  path:
                    description: |-
                      Path is the relative file path of the Artifact. It can be used to locate
                      the file in the root of the Artifact storage on the local file system of
                      the controller managing the Source.
                    type: string
                  revision:
                    description: |-
                      Revision is a human-readable identifier traceable in the origin source
                      system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
                    type: string
                  size:
                    description: Size is the number of bytes in the file.
                    format: int64
                    type: integer
                  url:
                    description: |-
                      URL is the HTTP address of the Artifact as exposed by the controller
                      managing the Source. It can be used to retrieve the Artifact for
                      consumption, e.g. by another controller applying the Artifact contents.
                    type: string
                required:
                - digest
                - lastUpdateTime
                - path
                - revision
                - url
                type: object
              conditions:
                description: Conditions holds the conditions for the OCIRepository.
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
              lastHandledReconcileAt:
                description: |-
                  LastHandledReconcileAt holds the value of the most recent
                  reconcile request value, so a change of the annotation value
                  can be detected.
                type: string
              observedGeneration:
                description: ObservedGeneration is the last observed generation.
                format: int64
                type: integer
              observedIgnore:
                description: |-
                  ObservedIgnore is the observed exclusion patterns used for constructing
                  the source artifact.
                type: string
              observedLayerSelector:
                description: |-
                  ObservedLayerSelector is the observed layer selector used for constructing
                  the source artifact.
                properties:
                  mediaType:
                    description: |-
                      MediaType specifies the OCI media type of the layer
                      which should be extracted from the OCI Artifact. The
                      first layer matching this type is selected.
                    type: string
                  operation:
                    description: |-
                      Operation specifies how the selected layer should be processed.
                      By default, the layer compressed content is extracted to storage.
                      When the operation is set to 'copy', the layer compressed content
                      is persisted to storage as it is.
                    enum:
                    - extract
                    - copy
                    type: string
                type: object
              url:
                description: URL is the download link for the artifact output of the
                  last OCI Repository sync.
                type: string
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}