Skip to content

feat: expose RemoteURL on KustomizationRefs #1882

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gianlucam76 merged 1 commit into from
Jul 18, 2026
Merged

feat: expose RemoteURL on KustomizationRefs #1882

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 51 additions & 4 deletions api/v1beta1/spec.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -546,24 +546,30 @@ type ProvenanceVerification struct {
KeyringSecretRef corev1.SecretReference `json:"keyringSecretRef"`
}

// +kubebuilder:validation:XValidation:rule="has(self.remoteURL) != has(self.kind)",message="either remoteURL or kind must be set, but not both"
type KustomizationRef struct {
// Namespace of the referenced resource.
// For ClusterProfile namespace can be left empty. In such a case, namespace will
// be implicit set to cluster's namespace.
// For Profile namespace must be left empty. The Profile namespace will be used.
// Namespace can be expressed as a template and instantiate using any cluster field.
Namespace string `json:"namespace"`
// Not used when RemoteURL is set.
// +optional
Namespace string `json:"namespace,omitempty"`

// Name of the referenced resource.
// Name can be expressed as a template and instantiate using any cluster field.
// +kubebuilder:validation:MinLength=1
Name string `json:"name"`
// Required when RemoteURL is not set.
// +optional
Name string `json:"name,omitempty"`

// Kind of the resource. Supported kinds are:
// - flux GitRepository;OCIRepository;Bucket
// - ConfigMap/Secret
// Required when RemoteURL is not set.
// +kubebuilder:validation:Enum=GitRepository;OCIRepository;Bucket;ConfigMap;Secret
Kind string `json:"kind"`
// +optional
Kind string `json:"kind,omitempty"`

// Path to the directory containing the kustomization.yaml file, or the
// set of plain YAMLs a kustomization.yaml should be generated for.
Expand Down Expand Up @@ -668,6 +674,47 @@ type KustomizationRef struct {
// +kubebuilder:default:=false
// +optional
Force bool `json:"force,omitempty"`

// RemoteURL configures fetching the Kustomize directory content from an HTTP/HTTPS
// endpoint or an OCI registry, without requiring a Flux GitRepository/OCIRepository/Bucket
// or a ConfigMap/Secret.
// When set, Kind/Name/Namespace must be omitted.
// +optional
RemoteURL *RemoteKustomizeURL `json:"remoteURL,omitempty"`
}

// RemoteKustomizeURL groups all fields related to fetching a Kustomize directory from a
// remote source. Unlike PolicyRef's RemoteURL, which serves a single raw YAML/JSON document,
// the content here must preserve a directory tree, since kustomize build resolves files
// referenced by relative path (bases, resources, patches, generator files, and so on).
// Supports HTTP/HTTPS endpoints and OCI registries.
type RemoteKustomizeURL struct {
// URL is the remote source serving the Kustomize directory content.
// Sveltos fetches the content on every reconciliation and redeploys if the
// content hash has changed.
// Supported schemes:
// "http://" or "https://" — HTTP/HTTPS endpoint serving a gzipped tarball
// (.tar.gz) of the Kustomize directory
// "oci://" — OCI registry artifact whose layers are extracted
// the same way, preserving the directory tree
// +kubebuilder:validation:Pattern=`^(https?|oci)://`
URL string `json:"url"`

// Interval defines how often Sveltos re-fetches the source to detect changes.
// Defaults to 5 minutes.
// +optional
Interval *metav1.Duration `json:"interval,omitempty"`

// SecretRef references a Secret in the management cluster containing optional
// credentials for fetching the source. Both Name and Namespace must be set,
// allowing the Secret to live in any namespace (e.g. projectsveltos) so that
// a single Secret can be shared across clusters without replication.
// Supported Secret keys:
// "token" — Bearer token (Authorization: Bearer <token>)
// "username"+"password" — HTTP Basic Auth or OCI registry basic auth
// "caFile" — PEM-encoded CA certificate for TLS verification
// +optional
SecretRef *corev1.SecretReference `json:"secretRef,omitempty"`
}

// StopMatchingBehavior indicates what will happen when Cluster stops matching
Expand Down
30 changes: 30 additions & 0 deletions api/v1beta1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

59 changes: 54 additions & 5 deletions config/crd/bases/config.projectsveltos.io_clusterprofiles.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -780,6 +780,7 @@ spec:
Kind of the resource. Supported kinds are:
- flux GitRepository;OCIRepository;Bucket
- ConfigMap/Secret
Required when RemoteURL is not set.
enum:
- GitRepository
- OCIRepository
Expand All @@ -791,7 +792,7 @@ spec:
description: |-
Name of the referenced resource.
Name can be expressed as a template and instantiate using any cluster field.
minLength: 1
Required when RemoteURL is not set.
type: string
namespace:
description: |-
Expand All @@ -800,6 +801,7 @@ spec:
be implicit set to cluster's namespace.
For Profile namespace must be left empty. The Profile namespace will be used.
Namespace can be expressed as a template and instantiate using any cluster field.
Not used when RemoteURL is set.
type: string
optional:
default: false
Expand All @@ -817,6 +819,54 @@ spec:
When expressed as templates, the values are filled in using information from
resources within the management cluster before deployment (Cluster and TemplateResourceRefs)
type: string
remoteURL:
description: |-
RemoteURL configures fetching the Kustomize directory content from an HTTP/HTTPS
endpoint or an OCI registry, without requiring a Flux GitRepository/OCIRepository/Bucket
or a ConfigMap/Secret.
When set, Kind/Name/Namespace must be omitted.
properties:
interval:
description: |-
Interval defines how often Sveltos re-fetches the source to detect changes.
Defaults to 5 minutes.
type: string
secretRef:
description: |-
SecretRef references a Secret in the management cluster containing optional
credentials for fetching the source. Both Name and Namespace must be set,
allowing the Secret to live in any namespace (e.g. projectsveltos) so that
a single Secret can be shared across clusters without replication.
Supported Secret keys:
"token" — Bearer token (Authorization: Bearer <token>)
"username"+"password" — HTTP Basic Auth or OCI registry basic auth
"caFile" — PEM-encoded CA certificate for TLS verification
properties:
name:
description: name is unique within a namespace to reference
a secret resource.
type: string
namespace:
description: namespace defines the space within which
the secret name must be unique.
type: string
type: object
x-kubernetes-map-type: atomic
url:
description: |-
URL is the remote source serving the Kustomize directory content.
Sveltos fetches the content on every reconciliation and redeploys if the
content hash has changed.
Supported schemes:
"http://" or "https://" — HTTP/HTTPS endpoint serving a gzipped tarball
(.tar.gz) of the Kustomize directory
"oci://" — OCI registry artifact whose layers are extracted
the same way, preserving the directory tree
pattern: ^(https?|oci)://
type: string
required:
- url
type: object
skipNamespaceCreation:
default: false
description: |-
Expand Down Expand Up @@ -919,11 +969,10 @@ spec:
- name
type: object
type: array
required:
- kind
- name
- namespace
type: object
x-kubernetes-validations:
- message: either remoteURL or kind must be set, but not both
rule: has(self.remoteURL) != has(self.kind)
type: array
x-kubernetes-list-type: atomic
maxConsecutiveFailures:
Expand Down
59 changes: 54 additions & 5 deletions config/crd/bases/config.projectsveltos.io_clusterpromotions.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -682,6 +682,7 @@ spec:
Kind of the resource. Supported kinds are:
- flux GitRepository;OCIRepository;Bucket
- ConfigMap/Secret
Required when RemoteURL is not set.
enum:
- GitRepository
- OCIRepository
Expand All @@ -693,7 +694,7 @@ spec:
description: |-
Name of the referenced resource.
Name can be expressed as a template and instantiate using any cluster field.
minLength: 1
Required when RemoteURL is not set.
type: string
namespace:
description: |-
Expand All @@ -702,6 +703,7 @@ spec:
be implicit set to cluster's namespace.
For Profile namespace must be left empty. The Profile namespace will be used.
Namespace can be expressed as a template and instantiate using any cluster field.
Not used when RemoteURL is set.
type: string
optional:
default: false
Expand All @@ -719,6 +721,54 @@ spec:
When expressed as templates, the values are filled in using information from
resources within the management cluster before deployment (Cluster and TemplateResourceRefs)
type: string
remoteURL:
description: |-
RemoteURL configures fetching the Kustomize directory content from an HTTP/HTTPS
endpoint or an OCI registry, without requiring a Flux GitRepository/OCIRepository/Bucket
or a ConfigMap/Secret.
When set, Kind/Name/Namespace must be omitted.
properties:
interval:
description: |-
Interval defines how often Sveltos re-fetches the source to detect changes.
Defaults to 5 minutes.
type: string
secretRef:
description: |-
SecretRef references a Secret in the management cluster containing optional
credentials for fetching the source. Both Name and Namespace must be set,
allowing the Secret to live in any namespace (e.g. projectsveltos) so that
a single Secret can be shared across clusters without replication.
Supported Secret keys:
"token" — Bearer token (Authorization: Bearer <token>)
"username"+"password" — HTTP Basic Auth or OCI registry basic auth
"caFile" — PEM-encoded CA certificate for TLS verification
properties:
name:
description: name is unique within a namespace to
reference a secret resource.
type: string
namespace:
description: namespace defines the space within
which the secret name must be unique.
type: string
type: object
x-kubernetes-map-type: atomic
url:
description: |-
URL is the remote source serving the Kustomize directory content.
Sveltos fetches the content on every reconciliation and redeploys if the
content hash has changed.
Supported schemes:
"http://" or "https://" — HTTP/HTTPS endpoint serving a gzipped tarball
(.tar.gz) of the Kustomize directory
"oci://" — OCI registry artifact whose layers are extracted
the same way, preserving the directory tree
pattern: ^(https?|oci)://
type: string
required:
- url
type: object
skipNamespaceCreation:
default: false
description: |-
Expand Down Expand Up @@ -821,11 +871,10 @@ spec:
- name
type: object
type: array
required:
- kind
- name
- namespace
type: object
x-kubernetes-validations:
- message: either remoteURL or kind must be set, but not both
rule: has(self.remoteURL) != has(self.kind)
type: array
x-kubernetes-list-type: atomic
maxConsecutiveFailures:
Expand Down
Loading