SPIFFE holds the configuration for the SPIFFE integration.
When set, the operator configures the Flux controllers to use
the SPIFFE Workload API and optionally enables object identity
and mTLS between the controllers.
The flux-operator pod must also be configured with the same Workload API
and, when used, Broker API settings, but does not need the inter-controller
flags.
brokerAPI
object
BrokerAPI holds the configuration for the SPIFFE Broker API.
When set, enables the object-level SPIFFE features.
endpoint
string required
Endpoint is the address of the SPIFFE Broker API endpoint,
e.g. 'dns:///spiffe-broker.example.com:443'.
The flux-operator pod accepts the same --spiffe-broker-endpoint flag
as the Flux controllers. For OLM installations, the endpoint can be
set with the SPIFFE_BROKER_ENDPOINT environment variable.
ids
[]string required
IDs is the list of SPIFFE IDs or SPIFFE ID prefixes authorized
for the SPIFFE Broker API endpoint. SPIFFE IDs ending with a slash
are treated as prefixes.
The flux-operator pod accepts the same repeatable --spiffe-broker-id
flag as the Flux controllers. For OLM installations, the IDs can be
set with the SPIFFE_BROKER_IDS environment variable as a comma-separated
list.
mtls
object
MTLS holds the configuration for mTLS between the Flux controllers.
The flux-operator reads the controller SPIFFE IDs from .status.spiffe.
componentIDTemplate
string required
ComponentIDTemplate is the SPIFFE ID template for the Flux controllers.
The '{component}' placeholder is replaced with the name of each
installed component. A trailing slash indicates a SPIFFE ID prefix.
The flux-operator ID is derived from this template with 'flux-operator'
as the component name, and is only authorized when the operator has a
SPIFFE Workload API source. The template must resolve to the operator
pod's actual SPIFFE ID.
When the operator has a SPIFFE Workload API source, its ID is added to
notification-controller as an authorized notifier. When the operator's
embedded Web UI is enabled, it is also added to source-controller and
source-watcher as an authorized artifact client for the Web UI artifact
downloads. Enabling or disabling the embedded Web UI changes these
controller arguments and rolls out the affected controllers.
For a standalone Web UI, use ExtraArtifactClients and ExtraNotifiers.
pattern: ^spiffe://[a-z0-9._-]{1,255}(?:/(?:[a-zA-Z0-9_-]|[.][a-zA-Z0-9_-]|[{]component[}])[a-zA-Z0-9._-]*(?:[{]component[}][a-zA-Z0-9._-]*)*)+(?:/)?$
enabled
boolean required
Enabled enables mTLS between the Flux controllers.
extraArtifactClients
[]string
ExtraArtifactClients is a list of additional SPIFFE IDs added to
source-controller and source-watcher as authorized artifact clients,
e.g. the standalone Web UI or the Flux MCP Server.
extraArtifactServers
[]string
ExtraArtifactServers is a list of additional SPIFFE IDs added to
kustomize-controller, helm-controller and source-watcher as authorized
artifact servers, e.g. an external source controller.
extraNotifiers
[]string
ExtraNotifiers is a list of additional SPIFFE IDs added to
notification-controller as authorized notifiers, e.g. the standalone
Web UI or the Flux MCP Server.
receivers
[]string
Receivers is the list of SPIFFE IDs of external Ingress or Gateway
controllers authorized to send webhook requests to notification-controller.
Setting at least one ID makes the receiver accept only SPIFFE mTLS clients.
workloadAPI
object required
WorkloadAPI holds the configuration for the SPIFFE Workload API.
It is required for enabling any of the SPIFFE features and is used
to render the go-spiffe environment variable and the SPIFFE CSI volume.
csiDriver
string
CSIDriver is the name of the SPIFFE CSI driver used to mount
the Workload API socket into the Flux controller pods.
When set, the operator mounts the CSI volume at /spiffe-workload-api
and the endpoint must be a unix socket under that path.
When omitted, no CSI volume is configured.
pattern: ^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?)*$
endpoint
string required
Endpoint is the address of the SPIFFE Workload API endpoint,
in the form 'unix:///<absolute path>', 'unix:/<absolute path>'
or 'tcp://<ip>:<port>',
e.g. 'unix:///spiffe-workload-api/agent.sock'.
The flux-operator pod must be configured with the same endpoint
through the SPIFFE_ENDPOINT_SOCKET environment variable.
pattern: ^(?:unix:(?:///[!$&->@-~]+|/[!$&-.0->@-~][!$&->@-~]*)|tcp://(?:[0-9]{1,3}(?:\.[0-9]{1,3}){3}|\[[0-9a-fA-F:.]+\]):[0-9]{1,5})$