Skip to content

[RFC-0014] Inter-controller mTLS via SPIFFE #1623

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
matheuscscp merged 1 commit into from
Oct 22, 2026
Merged

[RFC-0014] Inter-controller mTLS via SPIFFE #1623

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions docs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,8 @@

| Name | Type | Description |
|----------------------------------------|---------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `--authorized-artifact-server-spiffe-id` | strings | SPIFFE ID of an artifact server authorized to serve artifacts to helm-controller. Can be repeated. When set, the artifact fetcher uses SPIFFE mTLS. |
| `--authorized-event-server-spiffe-id` | strings | SPIFFE ID of an event server authorized to receive events from helm-controller. Can be repeated. When set, the event recorder uses SPIFFE mTLS. |
| `--concurrent` | int | The number of concurrent HelmRelease reconciles. (default 4) |
| `--default-kubeconfig-service-account` | string | Default service account used for kubeconfig. |
| `--default-service-account` | string | Default service account used for impersonation. |
Expand Down Expand Up @@ -40,6 +42,36 @@
| `--watch-label-selector` | string | Watch for resources with matching labels e.g. 'sharding.fluxcd.io/key=shard1'. |
| `--feature-gates` | mapStringBool | A comma separated list of key=value pairs defining the state of experimental features. |

### SPIFFE mTLS

When at least one of the repeatable flags `--authorized-artifact-server-spiffe-id`
or `--authorized-event-server-spiffe-id` is set, helm-controller acquires an
X.509-SVID from the SPIFFE Workload API. The `SPIFFE_ENDPOINT_SOCKET` environment
variable must point to the Workload API socket.

- `--authorized-artifact-server-spiffe-id` authorizes the given SPIFFE IDs of
artifact servers from which helm-controller fetches artifacts. When set, the
artifact fetcher uses mTLS.
- `--authorized-event-server-spiffe-id` authorizes the given SPIFFE IDs of
event servers to which helm-controller sends events. When set, the event
recorder uses mTLS.

Each traffic type is protected independently. SPIFFE mTLS is transparent to the
Flux API: the scheme of `.status.artifact.url` does not change.

Each flag value is interpreted as follows:

- `spiffe://<trust domain>/<path>` authorizes exactly that SPIFFE ID.
- `spiffe://<trust domain>/<path>/` (with a trailing slash) authorizes any
SPIFFE ID with that path prefix.
- `spiffe://<trust domain>` (without a path) authorizes any SPIFFE ID in that
trust domain.

Whenever `<trust domain>` equals the special value `self`, helm-controller
understands it as the trust domain of the controller's own X509-SVID.

Invalid values cause helm-controller to fail at startup.

### Feature Gates

| Name | Default Value | Description |
Expand Down
23 changes: 14 additions & 9 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,23 +21,25 @@ require (
github.com/fluxcd/pkg/apis/acl v0.12.0
github.com/fluxcd/pkg/apis/event v0.32.0
github.com/fluxcd/pkg/apis/kustomize v1.23.0
github.com/fluxcd/pkg/apis/meta v1.36.1-0.20261020182949-c5194b17fdad
github.com/fluxcd/pkg/auth v0.63.1-0.20261020182949-c5194b17fdad
github.com/fluxcd/pkg/cache v0.17.1-0.20261020182949-c5194b17fdad
github.com/fluxcd/pkg/apis/meta v1.36.1-0.20261021122630-1ab1573eaf5b
github.com/fluxcd/pkg/auth v0.63.1-0.20261021122630-1ab1573eaf5b
github.com/fluxcd/pkg/cache v0.17.1-0.20261021122630-1ab1573eaf5b
github.com/fluxcd/pkg/chartutil v1.32.0
github.com/fluxcd/pkg/runtime v0.120.1-0.20261020182949-c5194b17fdad
github.com/fluxcd/pkg/http/fetch v0.28.1-0.20261021122630-1ab1573eaf5b
github.com/fluxcd/pkg/runtime v0.120.1-0.20261021122630-1ab1573eaf5b
github.com/fluxcd/pkg/spiffe v0.0.0-20261021122630-1ab1573eaf5b
github.com/fluxcd/pkg/ssa v0.80.0
github.com/fluxcd/pkg/testserver v0.15.0
github.com/fluxcd/source-controller/api v1.9.6
github.com/go-logr/logr v1.4.4
github.com/google/cel-go v0.29.2
github.com/google/go-cmp v0.7.0
github.com/hashicorp/go-retryablehttp v0.7.8
github.com/mitchellh/copystructure v1.2.0
github.com/onsi/gomega v1.43.0
github.com/opencontainers/go-digest v1.0.1-0.20231025023718-d50d2fec9c98
github.com/opencontainers/go-digest/blake3 v0.0.0-20250116041648-1e56c6daea3b
github.com/spf13/pflag v1.0.10
github.com/spiffe/go-spiffe/v2 v2.9.0
github.com/wI2L/jsondiff v0.7.1
go.uber.org/zap v1.28.0
golang.org/x/text v0.43.0
Expand Down Expand Up @@ -73,6 +75,7 @@ require (
github.com/Masterminds/goutils v1.1.1 // indirect
github.com/Masterminds/sprig/v3 v3.3.0 // indirect
github.com/Masterminds/squirrel v1.5.4 // indirect
github.com/Microsoft/go-winio v0.6.2 // indirect
github.com/ProtonMail/go-crypto v1.4.1 // indirect
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
Expand Down Expand Up @@ -111,11 +114,13 @@ require (
github.com/extism/go-sdk v1.7.1 // indirect
github.com/fatih/color v1.19.0 // indirect
github.com/felixge/httpsnoop v1.1.0 // indirect
github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261020182949-c5194b17fdad // indirect
github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261021122630-1ab1573eaf5b // indirect
github.com/fluxcd/pkg/tar v1.3.0 // indirect
github.com/fsnotify/fsnotify v1.10.1 // indirect
github.com/fxamacker/cbor/v2 v2.9.3 // indirect
github.com/go-errors/errors v1.5.1 // indirect
github.com/go-gorp/gorp/v3 v3.1.0 // indirect
github.com/go-jose/go-jose/v4 v4.1.5 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-logr/zapr v1.3.0 // indirect
github.com/go-openapi/jsonpointer v1.0.0 // indirect
Expand Down Expand Up @@ -144,12 +149,13 @@ require (
github.com/googleapis/gax-go/v2 v2.24.0 // indirect
github.com/gosuri/uitable v0.0.4 // indirect
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
github.com/huandu/xstrings v1.5.0 // indirect
github.com/ianlancetaylor/demangle v0.0.0-20240805132620-81f5be970eca // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/jmoiron/sqlx v1.4.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/klauspost/cpuid/v2 v2.2.5 // indirect
github.com/klauspost/cpuid/v2 v2.2.10 // indirect
github.com/kylelemons/godebug v1.1.0 // indirect
github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
Expand Down Expand Up @@ -181,7 +187,6 @@ require (
github.com/sirupsen/logrus v1.9.4 // indirect
github.com/spf13/cast v1.7.0 // indirect
github.com/spf13/cobra v1.10.2 // indirect
github.com/spiffe/go-spiffe/v2 v2.9.0 // indirect
github.com/stretchr/testify v1.12.1 // indirect
github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834 // indirect
github.com/tetratelabs/wazero v1.12.0 // indirect
Expand All @@ -191,7 +196,7 @@ require (
github.com/tidwall/sjson v1.2.5 // indirect
github.com/x448/float16 v0.8.4 // indirect
github.com/xlab/treeprint v1.2.0 // indirect
github.com/zeebo/blake3 v0.2.3 // indirect
github.com/zeebo/blake3 v0.2.4 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 // indirect
go.opentelemetry.io/otel v1.46.0 // indirect
Expand Down
38 changes: 22 additions & 16 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,8 @@ github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe
github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0=
github.com/Masterminds/squirrel v1.5.4 h1:uUcX/aBc8O7Fg9kaISIUsHXdKuqehiXAMQTYX8afzqM=
github.com/Masterminds/squirrel v1.5.4/go.mod h1:NNaOrjSoIDfDA40n7sr2tPNZRfjzjA400rg+riTZj10=
github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM=
github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
Expand Down Expand Up @@ -150,24 +152,30 @@ github.com/fluxcd/cli-utils v1.4.0 h1:zlTiCWcVDQvvwZXILYeu5rpbnGt1sS+w32y3+rkOpi
github.com/fluxcd/cli-utils v1.4.0/go.mod h1:OupUOj2boEKTbiguMbGMz5Z/d59JUcb1c7pPESe8Pjw=
github.com/fluxcd/pkg/apis/acl v0.12.0 h1:UWpZDqKxpKDW38wdXIMHV8Uv3POPu2vUrra0JH1frH0=
github.com/fluxcd/pkg/apis/acl v0.12.0/go.mod h1:PJrGIu5Bw/6/siO95uhS+pi5oKSU+gVJqHqsPHb8Kok=
github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261020182949-c5194b17fdad h1:SAzeZibDaqyyq7CaccwDEySCcsOMGGuHmEN28LcRPvM=
github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261020182949-c5194b17fdad/go.mod h1:bEwkDgBjLXMVJ2BwmVbbj32PkirmNSicabgl2Jvw7Dk=
github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261021122630-1ab1573eaf5b h1:/n7p1+Yyu88dVjg3ezqCM0p96VUwMxtjgSb6cELFiQg=
github.com/fluxcd/pkg/apis/crypto v0.4.1-0.20261021122630-1ab1573eaf5b/go.mod h1:bEwkDgBjLXMVJ2BwmVbbj32PkirmNSicabgl2Jvw7Dk=
github.com/fluxcd/pkg/apis/event v0.32.0 h1:3zyjdUspwQN+EQJPlUXwCvCMbeqtB+azlNmeenAcbuE=
github.com/fluxcd/pkg/apis/event v0.32.0/go.mod h1:ALma8dTqo+NbI+z4BawSzt0pAPjetCSNNUSSS/9p0VU=
github.com/fluxcd/pkg/apis/kustomize v1.23.0 h1:tT/sUURyh6ixQG4+Y/ZoUu+hh5/DQLRraWBgy42ubqQ=
github.com/fluxcd/pkg/apis/kustomize v1.23.0/go.mod h1:Jm/LmEsqJIldhhTmhkORAq8JKVZK3ZV2Q88rntjGxEI=
github.com/fluxcd/pkg/apis/meta v1.36.1-0.20261020182949-c5194b17fdad h1:p/W9d+gf9FuNNmiwUZJT7ReGzTzwuYLUago5szqkq5I=
github.com/fluxcd/pkg/apis/meta v1.36.1-0.20261020182949-c5194b17fdad/go.mod h1:1MLvK2Xu3UdTKBzg+Q1Oj7H9PHeiKsUB1UW3uwxAwiM=
github.com/fluxcd/pkg/auth v0.63.1-0.20261020182949-c5194b17fdad h1:lUjY+hEXSYG8RdJhuNYl5mjkrnLpwuG/+A+iSybCRlE=
github.com/fluxcd/pkg/auth v0.63.1-0.20261020182949-c5194b17fdad/go.mod h1:gWbB4MzuHWalVyI0o4lE84aINidor9+S63ithckm+94=
github.com/fluxcd/pkg/cache v0.17.1-0.20261020182949-c5194b17fdad h1:Lf7S9vl776ZW7SDxdQtZcEu1vjWroZS86ePd8gost4M=
github.com/fluxcd/pkg/cache v0.17.1-0.20261020182949-c5194b17fdad/go.mod h1:OW3fncHhPnPZFZav5FdEa//cyMHSndI0JS+IM69LXOU=
github.com/fluxcd/pkg/apis/meta v1.36.1-0.20261021122630-1ab1573eaf5b h1:g/s+m/jU7cPJ+8IIIXbDD19G7TQAKbiUvqTt5GuywlM=
github.com/fluxcd/pkg/apis/meta v1.36.1-0.20261021122630-1ab1573eaf5b/go.mod h1:1MLvK2Xu3UdTKBzg+Q1Oj7H9PHeiKsUB1UW3uwxAwiM=
github.com/fluxcd/pkg/auth v0.63.1-0.20261021122630-1ab1573eaf5b h1:uqRL6xKRFwUi7AXrPj7BSRAqQYz7rxNMNjSK2W6YqB0=
github.com/fluxcd/pkg/auth v0.63.1-0.20261021122630-1ab1573eaf5b/go.mod h1:gWbB4MzuHWalVyI0o4lE84aINidor9+S63ithckm+94=
github.com/fluxcd/pkg/cache v0.17.1-0.20261021122630-1ab1573eaf5b h1:wi9U1NDlqYmbVUMntuKU71vOqnSFSslDEMbbnBnzJDs=
github.com/fluxcd/pkg/cache v0.17.1-0.20261021122630-1ab1573eaf5b/go.mod h1:OW3fncHhPnPZFZav5FdEa//cyMHSndI0JS+IM69LXOU=
github.com/fluxcd/pkg/chartutil v1.32.0 h1:rqBhgiGsrS4am/jsCfKYlQvPQ+jATug10BtO95UHdq0=
github.com/fluxcd/pkg/chartutil v1.32.0/go.mod h1:pBqCvJVDLpKKnU+k9A+TnceZn+DnnivfVGhzNzHJXZU=
github.com/fluxcd/pkg/runtime v0.120.1-0.20261020182949-c5194b17fdad h1:AcQzxznBRZyRthcVgFjPV49uLfu7eDOoHO1B5WyRsO8=
github.com/fluxcd/pkg/runtime v0.120.1-0.20261020182949-c5194b17fdad/go.mod h1:Cw0CQ/tVKS9lgJoyKVouZr1qVnoJcYnSHw3QDzIOOjA=
github.com/fluxcd/pkg/http/fetch v0.28.1-0.20261021122630-1ab1573eaf5b h1:q+StvNk04P/dx7IMhw4oKmcfU870OpTIkaZMxgcn5u8=
github.com/fluxcd/pkg/http/fetch v0.28.1-0.20261021122630-1ab1573eaf5b/go.mod h1:SOq8vrzru2zipskTEguXzKHabn2ASyXESQ/DY93FafY=
github.com/fluxcd/pkg/runtime v0.120.1-0.20261021122630-1ab1573eaf5b h1:/S4RzBts7XoNrxXM0hUjmVzZ+fxrXcZ6VyHJfaiWIII=
github.com/fluxcd/pkg/runtime v0.120.1-0.20261021122630-1ab1573eaf5b/go.mod h1:Cw0CQ/tVKS9lgJoyKVouZr1qVnoJcYnSHw3QDzIOOjA=
github.com/fluxcd/pkg/spiffe v0.0.0-20261021122630-1ab1573eaf5b h1:I7Z3cEgoM+EqYpLkr0xI3a1z+Qh1WbZKDCOd8EeGYJg=
github.com/fluxcd/pkg/spiffe v0.0.0-20261021122630-1ab1573eaf5b/go.mod h1:tZ+T8ljAM9ZE0VriHSWM4vfvhlq5zv5bNcPKqwZK1lk=
github.com/fluxcd/pkg/ssa v0.80.0 h1:GgakpCFz4pY+unpOscPYlc5eVLUsB7hw9TmWSNr3yp8=
github.com/fluxcd/pkg/ssa v0.80.0/go.mod h1:mUwKP2+KZXm1mal1gSs9SjgcexyqzXbPfHKxdFv5ntM=
github.com/fluxcd/pkg/tar v1.3.0 h1:PbL5jNN5q/F6nXA8aCH+msM75BS6lSnPX2RNd48f8ls=
github.com/fluxcd/pkg/tar v1.3.0/go.mod h1:CbN3lQVWrYBZ4CwcK7ZzpxA++WiiM1RQHDOtNPJWuno=
github.com/fluxcd/pkg/testserver v0.15.0 h1:6Pao9oK1Cu5ssh9c7QoDnnyfPUtxHbw7gJ+5tSOmkWc=
github.com/fluxcd/pkg/testserver v0.15.0/go.mod h1:uSiItABsGd13YQDkYpIWeV1mww6KEYcH9wk/L4p2PKw=
github.com/fluxcd/source-controller/api v1.9.1-0.20261005091731-e47a59ad5d01 h1:QKNUNGjIV94G0JvE++lXtSzoEzyRlsEHMAuvo6I/VaM=
Expand Down Expand Up @@ -294,9 +302,8 @@ github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRt
github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k=
github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8=
github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
github.com/klauspost/cpuid/v2 v2.0.12/go.mod h1:g2LTdtYhdyuGPqyWyv7qRAmj1WBqxuObKfj5c0PQa7c=
github.com/klauspost/cpuid/v2 v2.2.5 h1:0E5MSMDEoAulmXNFquVs//DdoomxaoTY1kUhbc/qbZg=
github.com/klauspost/cpuid/v2 v2.2.5/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
Expand Down Expand Up @@ -431,8 +438,8 @@ github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
github.com/zeebo/assert v1.1.0 h1:hU1L1vLTHsnO8x8c9KAR5GmM5QscxHg5RNU5z5qbUWY=
github.com/zeebo/assert v1.1.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
github.com/zeebo/blake3 v0.2.3 h1:TFoLXsjeXqRNFxSbk35Dk4YtszE/MQQGK10BH4ptoTg=
github.com/zeebo/blake3 v0.2.3/go.mod h1:mjJjZpnsyIVtVgTOSpJ9vmRE4wgDeyt2HU3qXvvKCaQ=
github.com/zeebo/blake3 v0.2.4 h1:KYQPkhpRtcqh0ssGYcKLG1JYvddkEA8QwCM/yBqhaZI=
github.com/zeebo/blake3 v0.2.4/go.mod h1:7eeQ6d2iXWRGF6npfaxl2CU+xy2Fjo2gxeyZGCRUjcE=
github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
Expand Down Expand Up @@ -506,7 +513,6 @@ golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
Expand Down
5 changes: 4 additions & 1 deletion internal/controller/helmrelease_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ package controller

import (
"context"
"crypto/tls"
"errors"
"fmt"
"strings"
Expand Down Expand Up @@ -106,6 +107,7 @@ type HelmReleaseReconciler struct {
DependencyRequeueInterval time.Duration
ArtifactFetchRetries int
ArtifactFetchTimeout time.Duration
ArtifactServerTLSConfig *tls.Config

// Feature gates

Expand Down Expand Up @@ -330,7 +332,8 @@ func (r *HelmReleaseReconciler) reconcileRelease(ctx context.Context,
}

// Load chart from artifact.
loadedChart, err := loader.SecureLoadChartFromURL(loader.NewRetryableHTTPClient(ctx, r.ArtifactFetchRetries, r.ArtifactFetchTimeout), source.GetArtifact().URL, source.GetArtifact().Digest)
loadedChart, err := loader.SecureLoadChartFromURL(ctx, source.GetArtifact().URL, source.GetArtifact().Digest,
r.ArtifactFetchRetries, r.ArtifactFetchTimeout, r.ArtifactServerTLSConfig)
if err != nil {
if errors.Is(err, loader.ErrFileNotFound) {
msg := fmt.Sprintf("Source not ready: artifact not found. Retrying in %s", r.DependencyRequeueInterval.String())
Expand Down
Loading
Loading