fix(flux): let source-controller trust the internal CA #208

Merged

grachevko merged 1 commit from fix/flux-internal-ca into main

2026-09-24 18:09:44 +00:00

hermes commented

2026-09-24 18:05:49 +00:00

Collaborator

The mirrored charts (harbor 1.19.2, vault 0.34.1) are pulled from oci://harbor.grachevko.ru/charts/<name> and the OCIRepository fails with x509: certificate signed by unknown authority: that certificate is signed by the internal CA, while the node-level trust (talos/all/55-registry-harbor.yaml) covers kubelet only and does not extend to the Flux controllers.

source-controller receives the CA the same way every other pod in this repository does: the ConfigMap internal-ca, which the trust-manager Bundle already distributes into all namespaces, mounted into the pod with SSL_CERT_FILE pointing at it. The bundle carries the system roots as well (useDefaultCAs: true), so pulling from public registries keeps working.

Chosen over OCIRepository.spec.certSecretRef (per-object CA, available since source-controller v1.9.5): that path needs a Secret with ca.crt in each app namespace, and the only declarative way to produce one is enabling trust-manager secretTargets, which this repository deliberately avoided (see the reasoning in kubernetes/apps/harbor/harbor/app/helmrelease.yaml). This patch adds no RBAC and keeps no copy of the CA, and it covers any future source behind the same certificate.

Verified

The patch was applied with kustomize to the real source-controller Deployment of Flux 2.9.5 (ghcr.io/fluxcd/source-controller:v1.9.5, the version .mise/config.toml pins). The merge is additive: SSL_CERT_FILE and the internal-ca volume and mount are added, while the existing env (RUNTIME_NAMESPACE, TUF_ROOT, GOMEMLIMIT), mounts (data, tmp), volumes and resources stay as they are.
flux-local test --enable-helm --all-namespaces --path kubernetes/flux/cluster --sources flux-system=. on this branch: 128 passed, no failures.
The patch has the same form as the patches already in this file, which are in effect in the cluster.

Watch after merge

source-controller restarts with the new volume; afterwards the OCIRepository of harbor and vault must turn Ready and x509: certificate signed by unknown authority must disappear from its logs. Check the OCIRepository status rather than the HelmRelease: an unreconciled source leaves the release on its last revision.

Rollback

Revert the commit: source-controller returns to the image trust store, and the two OCIRepositories go back to failing with the same x509 error (the charts themselves are unaffected).

The mirrored charts (harbor 1.19.2, vault 0.34.1) are pulled from `oci://harbor.grachevko.ru/charts/<name>` and the OCIRepository fails with `x509: certificate signed by unknown authority`: that certificate is signed by the internal CA, while the node-level trust (`talos/all/55-registry-harbor.yaml`) covers kubelet only and does not extend to the Flux controllers. source-controller receives the CA the same way every other pod in this repository does: the ConfigMap `internal-ca`, which the trust-manager Bundle already distributes into all namespaces, mounted into the pod with `SSL_CERT_FILE` pointing at it. The bundle carries the system roots as well (`useDefaultCAs: true`), so pulling from public registries keeps working. Chosen over `OCIRepository.spec.certSecretRef` (per-object CA, available since source-controller v1.9.5): that path needs a Secret with `ca.crt` in each app namespace, and the only declarative way to produce one is enabling trust-manager `secretTargets`, which this repository deliberately avoided (see the reasoning in `kubernetes/apps/harbor/harbor/app/helmrelease.yaml`). This patch adds no RBAC and keeps no copy of the CA, and it covers any future source behind the same certificate. ## Verified - The patch was applied with kustomize to the real source-controller Deployment of Flux 2.9.5 (`ghcr.io/fluxcd/source-controller:v1.9.5`, the version `.mise/config.toml` pins). The merge is additive: `SSL_CERT_FILE` and the `internal-ca` volume and mount are added, while the existing env (`RUNTIME_NAMESPACE`, `TUF_ROOT`, `GOMEMLIMIT`), mounts (`data`, `tmp`), volumes and resources stay as they are. - `flux-local test --enable-helm --all-namespaces --path kubernetes/flux/cluster --sources flux-system=.` on this branch: 128 passed, no failures. - The patch has the same form as the patches already in this file, which are in effect in the cluster. ## Watch after merge source-controller restarts with the new volume; afterwards the OCIRepository of harbor and vault must turn Ready and `x509: certificate signed by unknown authority` must disappear from its logs. Check the OCIRepository status rather than the HelmRelease: an unreconciled source leaves the release on its last revision. ## Rollback Revert the commit: source-controller returns to the image trust store, and the two OCIRepositories go back to failing with the same x509 error (the charts themselves are unaffected).

hermes added 1 commit

2026-09-24 18:05:49 +00:00

fix(flux): let source-controller trust the internal CA

Flate / Flate - Filter (pull_request) Successful in 3s

Details

Flate / Flate (pull_request) Successful in 20s

Details

Flate / Flate - Success (pull_request) Successful in 3s

Details

b0a67e2893

The mirrored charts (harbor 1.19.2, vault 0.34.1) are pulled from
`oci://harbor.grachevko.ru/charts/<name>` and the OCIRepository fails with
`x509: certificate signed by unknown authority`: that certificate is signed by the internal CA,
while the node-level trust (`talos/all/55-registry-harbor.yaml`) covers kubelet only and does not
extend to the Flux controllers.

source-controller receives the CA the same way every other pod in this repository does: the
ConfigMap `internal-ca`, which the trust-manager Bundle already distributes into all namespaces,
mounted into the pod with `SSL_CERT_FILE` pointing at it. The bundle carries the system roots as
well (`useDefaultCAs: true`), so public registries keep working.

Chosen over `OCIRepository.spec.certSecretRef` (per-object CA, available since source-controller
v1.9.5): that path needs a Secret with `ca.crt` in each app namespace, and the only declarative way
to produce one is enabling trust-manager `secretTargets`, which this repository deliberately avoided
(see the reasoning in `kubernetes/apps/harbor/harbor/app/helmrelease.yaml`). This patch adds no RBAC
and keeps no copy of the CA, and it covers any future source behind the same certificate.

## Verified

- The patch was applied with kustomize to the real source-controller Deployment of Flux 2.9.5
  (`ghcr.io/fluxcd/source-controller:v1.9.5`, the version `.mise/config.toml` pins). The merge is
  additive: `SSL_CERT_FILE` and the `internal-ca` volume and mount are added, while the existing env
  (`RUNTIME_NAMESPACE`, `TUF_ROOT`, `GOMEMLIMIT`), mounts (`data`, `tmp`), volumes and resources stay
  as they are.
- `flux-local test --enable-helm --all-namespaces --path kubernetes/flux/cluster --sources
  flux-system=.` on this branch: 128 passed, no failures.
- The patch has the same form as the patches already in this file, which are in effect in the
  cluster.

## Watch after merge

source-controller restarts with the new volume; afterwards the OCIRepository of harbor and vault
must turn Ready and `x509: certificate signed by unknown authority` must disappear from its logs.
Check the OCIRepository status rather than the HelmRelease: an unreconciled source leaves the release
on its last revision.