Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[RFC-0003] Select layer by OCI media type #3014

Merged
merged 3 commits into from
Aug 23, 2022
Merged

[RFC-0003] Select layer by OCI media type #3014

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
16d3180
[RFC-0003] OCI select layer by media type
stefanprodan Aug 22, 2022
db0920b
Clarify the layer selection behaviour
stefanprodan Aug 22, 2022
463d241
Update TODOs for RFC-0003
stefanprodan Aug 23, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 24 additions & 2 deletions rfcs/0003-kubernetes-oci/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@

**Creation date:** 2022-03-31

**Last update:** 2022-08-11
**Last update:** 2022-08-22

## Summary

Expand Down Expand Up @@ -134,6 +134,27 @@ spec:
name: cosign-key
```

### Layer selection

By default, Flux assumes that the first layer of the OCI artifact contains the Kubernetes configuration.
For multi-layer artifacts created by other tools than Flux CLI
(e.g. [oras](https://github.com/oras-project/oras),
[crane](https://github.com/google/go-containerregistry/tree/main/cmd/crane)),
users can specify the [media type](https://github.com/opencontainers/image-spec/blob/v1.0.2/media-types.md) of the layer
which contains the tarball with Kubernetes manifests.

```yaml
spec:
layerSelector:
mediaType: "application/deployment.content.v1.tar+gzip"
```

If the layer selector matches more than one layer,
the first layer matching the specified media type will be used.
Note that Flux requires that the OCI layer is
[compressed](https://github.com/opencontainers/image-spec/blob/v1.0.2/layer.md#gzip-media-types)
in the `tar+gzip` format.

### Pull artifacts from private repositories

For authentication purposes, Flux users can choose between supplying static credentials with Kubernetes secrets
Expand Down Expand Up @@ -438,4 +459,5 @@ The feature is enabled by default.

### TODOs

* Add support for verifying the OCI artifacts with cosign
* [Add support for verifying the OCI artifacts with cosign](https://github.com/fluxcd/source-controller/issues/863)
* [Select layer by OCI media type](https://github.com/fluxcd/source-controller/pull/871)