Update Flux to v2.6.0

.github/workflows/test.yaml

@@ -29,7 +29,7 @@ jobs:
       - name: Create cluster
         run: make up
         env:
-          KIND_NODE_IMAGE: ghcr.io/fluxcd/kindest/node:v1.30.0-amd64
+          KIND_NODE_IMAGE: ghcr.io/fluxcd/kindest/node:v1.33.0-amd64
       - name: Push modules
         run: make timoni-push
       - name: Install Flux

RESULTS.md

@@ -19,6 +19,29 @@ registry at the same time.
 - App manifests (Deployment scaled to zero, Service Account, Service, Ingress)
 
 
+## Flux v2.6.0
+
+| Objects | Type          | Flux component       | Duration | Max Memory |
+|---------|---------------|----------------------|----------|------------|
+| 100     | OCIRepository | source-controller    | 24s      | 38Mi       |
+| 100     | Kustomization | kustomize-controller | 28s      | 32Mi       |
+| 100     | HelmChart     | source-controller    | 24s      | 40Mi       |
+| 100     | HelmRelease   | helm-controller      | 27s      | 190Mi      |
+| 500     | OCIRepository | source-controller    | 43s      | 65Mi       |
+| 500     | Kustomization | kustomize-controller | 2m2s     | 122Mi      |
+| 500     | HelmChart     | source-controller    | 48s      | 68Mi       |
+| 500     | HelmRelease   | helm-controller      | 2m10s    | 240Mi      |
+| 1000    | OCIRepository | source-controller    | 1m25s    | 67Mi       |
+| 1000    | Kustomization | kustomize-controller | 4m16s    | 175Mi      |
+| 1000    | HelmChart     | source-controller    | 1m20s    | 110Mi      |
+| 1000    | HelmRelease   | helm-controller      | 5m12s    | 350Mi      |
+
+### Observations
+
+Compared to Flux v2.5 & Kubernetes 1.30, Flux v2.6 on Kubernetes 1.33
+has a major performance improvement in the reconciliation speed of HelmRelease
+objects, especially when the cluster has hundreds of CRDs registered.
+
 ## Flux v2.5.0
 
 | Objects | Type          | Flux component       | Duration | Max Memory |

manifests/bases/helm-controller/kustomization.yaml

@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- https://github.com/fluxcd/helm-controller/releases/download/v1.2.0/helm-controller.crds.yaml
-- https://github.com/fluxcd/helm-controller/releases/download/v1.2.0/helm-controller.deployment.yaml
+- https://github.com/fluxcd/helm-controller/releases/download/v1.3.0/helm-controller.crds.yaml
+- https://github.com/fluxcd/helm-controller/releases/download/v1.3.0/helm-controller.deployment.yaml
 - account.yaml
 transformers:
 - labels.yaml

manifests/bases/image-automation-controller/kustomization.yaml

@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- https://github.com/fluxcd/image-automation-controller/releases/download/v0.40.0/image-automation-controller.crds.yaml
-- https://github.com/fluxcd/image-automation-controller/releases/download/v0.40.0/image-automation-controller.deployment.yaml
+- https://github.com/fluxcd/image-automation-controller/releases/download/v0.41.0/image-automation-controller.crds.yaml
+- https://github.com/fluxcd/image-automation-controller/releases/download/v0.41.0/image-automation-controller.deployment.yaml
 - account.yaml
 transformers:
 - labels.yaml

manifests/bases/image-reflector-controller/kustomization.yaml

@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- https://github.com/fluxcd/image-reflector-controller/releases/download/v0.34.0/image-reflector-controller.crds.yaml
-- https://github.com/fluxcd/image-reflector-controller/releases/download/v0.34.0/image-reflector-controller.deployment.yaml
+- https://github.com/fluxcd/image-reflector-controller/releases/download/v0.35.0/image-reflector-controller.crds.yaml
+- https://github.com/fluxcd/image-reflector-controller/releases/download/v0.35.0/image-reflector-controller.deployment.yaml
 - account.yaml
 transformers:
 - labels.yaml

manifests/bases/kustomize-controller/kustomization.yaml

@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- https://github.com/fluxcd/kustomize-controller/releases/download/v1.5.0/kustomize-controller.crds.yaml
-- https://github.com/fluxcd/kustomize-controller/releases/download/v1.5.0/kustomize-controller.deployment.yaml
+- https://github.com/fluxcd/kustomize-controller/releases/download/v1.6.0/kustomize-controller.crds.yaml
+- https://github.com/fluxcd/kustomize-controller/releases/download/v1.6.0/kustomize-controller.deployment.yaml
 - account.yaml
 transformers:
 - labels.yaml

manifests/bases/notification-controller/kustomization.yaml

@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- https://github.com/fluxcd/notification-controller/releases/download/v1.5.0/notification-controller.crds.yaml
-- https://github.com/fluxcd/notification-controller/releases/download/v1.5.0/notification-controller.deployment.yaml
+- https://github.com/fluxcd/notification-controller/releases/download/v1.6.0/notification-controller.crds.yaml
+- https://github.com/fluxcd/notification-controller/releases/download/v1.6.0/notification-controller.deployment.yaml
 - account.yaml
 transformers:
 - labels.yaml

manifests/bases/source-controller/kustomization.yaml

@@ -1,8 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- https://github.com/fluxcd/source-controller/releases/download/v1.5.0/source-controller.crds.yaml
-- https://github.com/fluxcd/source-controller/releases/download/v1.5.0/source-controller.deployment.yaml
+- https://github.com/fluxcd/source-controller/releases/download/v1.6.0/source-controller.crds.yaml
+- https://github.com/fluxcd/source-controller/releases/download/v1.6.0/source-controller.deployment.yaml
 - account.yaml
 transformers:
 - labels.yaml

manifests/rbac/controller.yaml

@@ -69,6 +69,18 @@ rules:
   - update
   - patch
   - delete
+# required for object-level workload identity
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts/token
+  verbs:
+  - create
+# required for flow control
+- nonResourceURLs:
+  - /livez/ping
+  verbs:
+  - head
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

timoni/modules/flux-ks-bench/cue.mod/gen/source.toolkit.fluxcd.io/bucket/v1/types_gen.cue

@@ -1,6 +1,6 @@
 // Code generated by timoni. DO NOT EDIT.
 
-//timoni:generate timoni vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.4.1/source-controller.crds.yaml
+//timoni:generate timoni mod vendor crd -f https://github.com/fluxcd/source-controller/releases/download/v1.6.0/source-controller.crds.yaml
 
 package v1
 
@@ -52,15 +52,15 @@ import "strings"
 // an object storage bucket.
 #BucketSpec: {
 	// BucketName is the name of the object storage bucket.
-	bucketName: string
+	bucketName!: string
 	certSecretRef?: {
 		// Name of the referent.
-		name: string
+		name!: string
 	}
 
 	// Endpoint is the object storage address the BucketName is
 	// located at.
-	endpoint: string
+	endpoint!: string
 
 	// Ignore overrides the set of excluded patterns in the
 	// .sourceignore format
@@ -77,7 +77,7 @@ import "strings"
 	// This interval is approximate and may be subject to jitter to
 	// ensure
 	// efficient use of resources.
-	interval: =~"^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
+	interval!: =~"^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
 
 	// Prefix to use for server-side filtering of files in the Bucket.
 	prefix?: string
@@ -86,17 +86,17 @@ import "strings"
 	// Defaults to 'generic', which expects an S3 (API) compatible
 	// object
 	// storage.
-	provider?: "generic" | "aws" | "gcp" | "azure" | *"generic"
+	provider?: "generic" | "aws" | "gcp" | "azure"
 	proxySecretRef?: {
 		// Name of the referent.
-		name: string
+		name!: string
 	}
 
 	// Region of the Endpoint where the BucketName is located in.
 	region?: string
 	secretRef?: {
 		// Name of the referent.
-		name: string
+		name!: string
 	}
 
 	// STS specifies the required configuration to use a Security
@@ -109,19 +109,19 @@ import "strings"
 	sts?: {
 		certSecretRef?: {
 			// Name of the referent.
-			name: string
+			name!: string
 		}
 
 		// Endpoint is the HTTP/S endpoint of the Security Token Service
 		// from
 		// where temporary credentials will be fetched.
-		endpoint: =~"^(http|https)://.*$"
+		endpoint!: =~"^(http|https)://.*$"
 
 		// Provider of the Security Token Service.
-		provider: "aws" | "ldap"
+		provider!: "aws" | "ldap"
 		secretRef?: {
 			// Name of the referent.
-			name: string
+			name!: string
 		}
 	}
 
@@ -131,5 +131,5 @@ import "strings"
 	suspend?: bool
 
 	// Timeout for fetch operations, defaults to 60s.
-	timeout?: =~"^([0-9]+(\\.[0-9]+)?(ms|s|m))+$" | *"60s"
+	timeout?: =~"^([0-9]+(\\.[0-9]+)?(ms|s|m))+$"
 }