refactor(flux): migrate default apps to OCI source - #2165
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
konflate — summaryNote +0 added · 50 changed · −540 removed — 590 resources · 99 apps · 90 not shown Blast radius
Warning ⚠ Cautions
Caution 51 render failures
Image changes
konflate · rendered |
|
Checked the mechanical migration and it looks correct — no blocking issues. What I verified:
Two non-blocking operational notes for the stack, both consequences of this step rather than defects in it:
|
Blocking:
|
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| prune: true | ||
| sourceRef: | ||
| kind: GitRepository | ||
| kind: OCIRepository |
There was a problem hiding this comment.
Anchoring the blocking issue here since it applies identically to all 68 sourceRef blocks in this PR: OCIRepository/flux-system resolves to oci://ghcr.io/jfroy/flatops/cluster:latest, which currently returns 403 denied for an unauthenticated pull, and neither kubernetes/cluster/ocirepository.yaml nor source-controller carries a credential. konflate failed to render 51 of these Kustomizations for exactly that reason. Make the GHCR package public or add a secretRef before merging — details in the top-level comment.
|
Mechanical correctness checks out. Verified:
Three operational notes, none of them a defect in the diff: 1. 2. The swap itself can take up to an hour to take effect. These child Kustomization objects are still applied by 3. Spec-vs-content source skew is now real for future commits. Child Kustomization specs come from Git while their rendered content comes from the OCI artifact, which only appears after the Unrelated to this PR, but noticed while checking coverage: |
|
The sweep itself checks out: all 66 Three things worth acting on before this goes further. 1. "Ready" is not the merge precondition you want — "current" is. The PR body says this is safe to merge once the OCI source is Ready and verified. But 2. Nothing alerts on a Ready-but-stale artifact.
3. Confirm konflate still renders these before step 4. konflate is the only pre-merge validation this repo has (no test suite, per AGENTS.md), and its config knows only Minor: Also expected-to-work, but worth an eyeball post-merge: the |
|
Checked this as a mechanical migration and it holds up. Notes from verifying it rather than from reading it: Migration is complete and self-consistent
One consequence to expect, not a defect
Nit, pre-existing
|
|
The mechanical part checks out: all 66 One operational risk worth a decision before this lands, because it is created by this PR and only removed by step 4: The Git and OCI sources refresh on very different schedules, so ks.yaml definitions and the app manifests they parameterize are no longer applied atomically.
Concretely, for any merge touching both an app's manifests and its
Cheapest fix while the stack is in flight is to add the Git source to the same Receiver so both refresh off the one webhook: resources:
- apiVersion: source.toolkit.fluxcd.io/v1
kind: OCIRepository
name: flux-system
- apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
name: flux-systemOtherwise this is acceptable as long as step 4 follows quickly and interim merges avoid combining manifest changes with Two smaller notes:
|
1 participant
Summary
GitRepository/flux-systemto the already-bootstrappedOCIRepository/flux-systemThis is safe to merge only after the bootstrap OCI source is Ready and verified. FluxInstance and the root Kustomizations remain Git-backed at this stage, providing a rollback path while application sources move to OCI.
Stack