more

.gitignore

@@ -32,3 +32,5 @@ report.[0-9]_.[0-9]_.[0-9]_.[0-9]_.json
 
 # Finder (MacOS) folder config
 .DS_Store
+
+/data/

Makefile

@@ -0,0 +1,15 @@
+.PHONY: setup dev-recreate dev-create dev-destroy
+
+setup:
+	./scripts/setup-server.sh
+
+dev-destroy:
+	colima delete -f
+
+dev-create:
+	colima start --network-address --kubernetes -m 8 --mount ${PWD}/data:/data:w --k3s-arg="--disable=helm-controller,local-storage"
+
+dev-recreate: dev-destroy dev-create setup
+
+server-install:
+	curl -sfL https://get.k3s.io | sh -s - --disable traefik,local-storage,helm-controller

README.md

@@ -1,282 +1,6 @@
-# homelab-operator
+## Bootstrap repo
-
-A Kubernetes operator designed for homelab environments that simplifies the
-management of PostgreSQL databases and Kubernetes secrets. Built with TypeScript
-and designed to run efficiently in resource-constrained environments.
-
-## Features
-
-- **PostgreSQL Database Management**: Automatically create and manage PostgreSQL
-  databases and roles
-- **Secret Management**: Generate and manage Kubernetes secrets with
-  configurable data
-- **Owner References**: Automatic cleanup when resources are deleted
-- **Status Tracking**: Comprehensive status conditions and error reporting
-- **Lightweight**: Minimal resource footprint suitable for homelab environments
-
-## Architecture
-
-The operator manages two main Custom Resource Definitions (CRDs):
-
-### PostgresDatabase
-
-Manages PostgreSQL databases and their associated roles:
-
-- Creates a PostgreSQL role with a secure random password
-- Creates a database owned by that role
-- Generates a Kubernetes secret containing database credentials
-- Ensures proper cleanup through owner references
-
-### SecretRequest
-
-Generates Kubernetes secrets with configurable data:
-
-- Supports custom secret names
-- Configurable data fields with various encodings
-- Automatic secret lifecycle management
-
-## Installation
-
-### Prerequisites
-
-- Kubernetes cluster (1.20+)
-- PostgreSQL instance accessible from the cluster
-- Helm 3.x (for chart-based installation)
-
-### Using Helm Chart
-
-1. Clone the repository:
-
-```bash
-git clone <repository-url>
-cd homelab-operator
-```
-
-2. Install using Helm:
-
-```bash
-helm install homelab-operator ./chart \
-  --set-string env.POSTGRES_HOST=<your-postgres-host> \
-  --set-string env.POSTGRES_USER=<admin-user> \
-  --set-string env.POSTGRES_PASSWORD=<admin-password>
-```
-
-### Using kubectl
-
-1. Build and push the Docker image:
-
-```bash
-docker build -t your-registry/homelab-operator:latest .
-docker push your-registry/homelab-operator:latest
-```
-
-2. Apply the Kubernetes manifests:
-
-```bash
-kubectl apply -f chart/templates/
-```
-
-## Configuration
-
-The operator is configured through environment variables:
-
-| Variable            | Description                              | Required | Default |
-| ------------------- | ---------------------------------------- | -------- | ------- |
-| `POSTGRES_HOST`     | PostgreSQL server hostname               | Yes      | -       |
-| `POSTGRES_USER`     | PostgreSQL admin username                | Yes      | -       |
-| `POSTGRES_PASSWORD` | PostgreSQL admin password                | Yes      | -       |
-| `POSTGRES_PORT`     | PostgreSQL server port                   | No       | 5432    |
-| `LOG_LEVEL`         | Logging level (debug, info, warn, error) | No       | info    |
-
-## Usage
-
-### PostgreSQL Database
-
-Create a PostgreSQL database with an associated role:
-
-```yaml
-apiVersion: homelab.mortenolsen.pro/v1
-kind: PostgresDatabase
-metadata:
-  name: my-app-db
-  namespace: my-namespace
-spec: {}
-```
-
-This will create:
-
-- A PostgreSQL role named `my-app-db`
-- A PostgreSQL database named `my-namespace_my-app-db` owned by the role
-- A Kubernetes secret `postgres-database-my-app-db` containing:
-  - `name`: Base64-encoded database name
-  - `user`: Base64-encoded username
-  - `password`: Base64-encoded password
-
-### Secret Request
-
-Generate a Kubernetes secret with custom data:
-
-```yaml
-apiVersion: homelab.mortenolsen.pro/v1
-kind: SecretRequest
-metadata:
-  name: my-secret
-  namespace: my-namespace
-spec:
-  secretName: app-config
-  data:
-    - key: api-key
-      value: "my-api-key"
-      encoding: base64
-    - key: database-url
-      value: "postgresql://user:pass@host:5432/db"
-    - key: random-token
-      length: 32
-      chars: "abcdefghijklmnopqrstuvwxyz0123456789"
-```
-
-### Accessing Created Resources
-
-To retrieve database credentials:
-
-```bash
-# Get the secret
-kubectl get secret postgres-database-my-app-db -o jsonpath='{.data.user}' | base64 -d
-kubectl get secret postgres-database-my-app-db -o jsonpath='{.data.password}' | base64 -d
-kubectl get secret postgres-database-my-app-db -o jsonpath='{.data.name}' | base64 -d
-```
-
-## Development
-
-### Prerequisites
-
-- [Bun](https://bun.sh/) runtime
-- [pnpm](https://pnpm.io/) package manager
-- Docker (for building images)
-- Access to a Kubernetes cluster for testing
-
-### Setup
-
-1. Clone the repository:
-
-```bash
-git clone <repository-url>
-cd homelab-operator
-```
-
-2. Install dependencies:
-
-```bash
-pnpm install
-```
-
-3. Set up development environment:
-
-```bash
-cp .env.example .env
-# Edit .env with your PostgreSQL connection details
-```
-
-### Running Locally
-
-For development, you can run the operator locally against a remote cluster:
-
-```bash
-# Ensure kubectl is configured for your development cluster
-export KUBECONFIG=~/.kube/config
-
-# Set PostgreSQL connection environment variables
-export POSTGRES_HOST=localhost
-export POSTGRES_USER=postgres
-export POSTGRES_PASSWORD=yourpassword
-
-# Run the operator
-bun run src/index.ts
-```
-
-### Development with Docker Compose
-
-A development environment with PostgreSQL is provided:
-
-```bash
-docker-compose -f docker-compose.dev.yaml up -d
-```
-
-### Building
-
-Build the Docker image:
-
-```bash
-docker build -t homelab-operator:latest .
-```
-
-### Testing
-
-```bash
-# Run linting
-pnpm run test:lint
-
-# Apply test resources
-kubectl apply -f test.yaml
-```
-
-## Contributing
-
-1. Fork the repository
-2. Create a feature branch: `git checkout -b feature/new-feature`
-3. Make your changes and add tests
-4. Run linting: `pnpm run test:lint`
-5. Commit your changes: `git commit -am 'Add new feature'`
-6. Push to the branch: `git push origin feature/new-feature`
-7. Submit a pull request
-
-## Project Structure
 
 ```
-├── chart/                 # Helm chart for deployment
+brew install fluxcd/tap/flux
-├── src/
+make setup-server
-│   ├── crds/             # Custom Resource Definitions
-│   │   ├── postgres/     # PostgreSQL database management
-│   │   └── secrets/      # Secret generation
-│   ├── custom-resource/   # Base CRD framework
-│   ├── database/         # Database migrations
-│   ├── services/         # Core services
-│   │   ├── config/       # Configuration management
-│   │   ├── k8s.ts        # Kubernetes API client
-│   │   ├── log/          # Logging service
-│   │   ├── postgres/     # PostgreSQL service
-│   │   └── secrets/      # Secret management
-│   └── utils/            # Utilities and constants
-├── Dockerfile            # Container build configuration
-└── docker-compose.dev.yaml  # Development environment
-```
-
-## License
-
-This project is licensed under the MIT License - see the LICENSE file for
-details.
-
-## Support
-
-For support and questions:
-
-- Create an issue in the GitHub repository
-- Check existing issues for similar problems
-- Review the logs using `kubectl logs -l app=homelab-operator`
-
-## Status Monitoring
-
-Monitor the operator status:
-
-```bash
-# Check operator logs
-kubectl logs -l app=homelab-operator -f
-
-# Check CRD status
-kubectl get postgresdatabases
-kubectl get secretrequests
-
-# Describe resources for detailed status
-kubectl describe postgresdatabase my-app-db
-kubectl describe secretrequest my-secret
 ```

cert-issuer.yaml

@@ -0,0 +1,19 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: alice@alice.com
+    privateKeySecretRef:
+      name: letsencrypt-prod-account-key
+    solvers:
+      - dns01:
+          cloudflare:
+            email: alice@alice.com
+            apiTokenSecretRef:
+              name: cloudflare-api-token
+              key: api-token

docs/writing-custom-resources.md

@@ -0,0 +1,901 @@
+# Writing Custom Resources
+
+This guide explains how to create and implement custom resources in the
+homelab-operator.
+
+## Overview
+
+Custom resources in this operator follow a structured pattern that includes:
+
+- **Specification schemas** using Zod for runtime validation
+- **Resource implementations** that extend the base `CustomResource` class
+- **Manifest creation** helpers for generating Kubernetes resources
+- **Reconciliation logic** to manage the desired state
+
+## Project Structure
+
+Each custom resource should be organized in its own directory under
+`src/custom-resouces/` with the following structure:
+
+```
+src/custom-resouces/{resource-name}/
+├── {resource-name}.ts              # Main definition file
+├── {resource-name}.schemas.ts      # Zod validation schemas
+├── {resource-name}.resource.ts     # Resource implementation
+└── {resource-name}.create-manifests.ts # Manifest generation helpers
+```
+
+## Quick Start
+
+This section walks through creating a complete custom resource from scratch.
+We'll build a `MyResource` that manages a web application with a deployment and
+service.
+
+### 1. Define Your Resource
+
+The main definition file registers your custom resource with the operator
+framework. This file serves as the entry point that ties together your schemas,
+implementation, and Kubernetes CRD definition.
+
+Create the main definition file (`{resource-name}.ts`):
+
+```typescript
+import { createCustomResourceDefinition } from "../../services/custom-resources/custom-resources.ts";
+import { GROUP } from "../../utils/consts.ts";
+
+import { MyResourceResource } from "./my-resource.resource.ts";
+import { myResourceSpecSchema } from "./my-resource.schemas.ts";
+
+const myResourceDefinition = createCustomResourceDefinition({
+  group: GROUP, // Uses your operator's API group (homelab.mortenolsen.pro)
+  version: "v1", // API version for this resource
+  kind: "MyResource", // The Kubernetes kind name (PascalCase)
+  names: {
+    plural: "myresources", // Plural name for kubectl (lowercase)
+    singular: "myresource", // Singular name for kubectl (lowercase)
+  },
+  spec: myResourceSpecSchema, // Zod schema for validation
+  create: (options) => new MyResourceResource(options), // Factory function
+});
+
+export { myResourceDefinition };
+```
+
+**Key Points:**
+
+- The `group` should always use the `GROUP` constant to maintain consistency
+- `kind` should be descriptive and follow Kubernetes naming conventions
+  (PascalCase)
+- `names.plural` is used in kubectl commands (`kubectl get myresources`)
+- The `create` function instantiates your resource implementation when a CR is
+  detected
+
+### 2. Create Validation Schemas
+
+Schemas define the structure and validation rules for your custom resource's
+specification. Using Zod provides runtime type safety and automatic validation
+of user input.
+
+Define your spec schema (`{resource-name}.schemas.ts`):
+
+```typescript
+import { z } from "zod";
+
+const myResourceSpecSchema = z.object({
+  // Required fields - these must be provided by users
+  hostname: z.string(), // Base hostname for the application
+  port: z.number().min(1).max(65535), // Container port (validated range)
+
+  // Optional fields with defaults - provide sensible fallbacks
+  replicas: z.number().min(1).default(1), // Number of pod replicas
+
+  // Enums - restrict to specific values with defaults
+  protocol: z.enum(["http", "https"]).default("https"),
+
+  // Nested objects - for complex configuration
+  database: z.object({
+    host: z.string(), // Database hostname
+    port: z.number(), // Database port
+    name: z.string(), // Database name
+  }).optional(), // Entire database config is optional
+});
+
+// Additional schemas for secrets, status, etc.
+// Separate schemas help organize different data types
+const myResourceSecretSchema = z.object({
+  apiKey: z.string(), // API key for external services
+  password: z.string(), // Database or service password
+});
+
+export { myResourceSecretSchema, myResourceSpecSchema };
+```
+
+**Schema Design Best Practices:**
+
+- **Required vs Optional**: Make fields required only when absolutely necessary
+- **Defaults**: Provide sensible defaults to reduce user configuration burden
+- **Validation**: Use Zod's built-in validators (`.min()`, `.max()`, `.email()`,
+  etc.)
+- **Enums**: Restrict values to prevent invalid configurations
+- **Nested Objects**: Group related configuration together
+- **Separate Schemas**: Create different schemas for different purposes (spec,
+  secrets, status)
+
+### 3. Implement the Resource
+
+The resource implementation is the core of your custom resource. It contains the
+business logic for managing Kubernetes resources and maintains the desired
+state. This class extends `CustomResource` and implements the reconciliation
+logic.
+
+Create the resource implementation (`{resource-name}.resource.ts`):
+
+```typescript
+import type { KubernetesObject } from "@kubernetes/client-node";
+import deepEqual from "deep-equal";
+
+import {
+  CustomResource,
+  type CustomResourceOptions,
+  type SubresourceResult,
+} from "../../services/custom-resources/custom-resources.custom-resource.ts";
+import {
+  ResourceReference,
+  ResourceService,
+} from "../../services/resources/resources.ts";
+
+import type { myResourceSpecSchema } from "./my-resource.schemas.ts";
+import {
+  createDeploymentManifest,
+  createServiceManifest,
+} from "./my-resource.create-manifests.ts";
+
+class MyResourceResource extends CustomResource<typeof myResourceSpecSchema> {
+  #deploymentResource = new ResourceReference();
+  #serviceResource = new ResourceReference();
+
+  constructor(options: CustomResourceOptions<typeof myResourceSpecSchema>) {
+    super(options);
+    const resourceService = this.services.get(ResourceService);
+
+    // Initialize resource references
+    this.#deploymentResource.current = resourceService.get({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      name: this.name,
+      namespace: this.namespace,
+    });
+
+    this.#serviceResource.current = resourceService.get({
+      apiVersion: "v1",
+      kind: "Service",
+      name: this.name,
+      namespace: this.namespace,
+    });
+
+    // Set up event handlers for reconciliation
+    this.#deploymentResource.on("changed", this.queueReconcile);
+    this.#serviceResource.on("changed", this.queueReconcile);
+  }
+
+  #reconcileDeployment = async (): Promise<SubresourceResult> => {
+    const manifest = createDeploymentManifest({
+      name: this.name,
+      namespace: this.namespace,
+      ref: this.ref,
+      spec: this.spec,
+    });
+
+    if (!this.#deploymentResource.current?.exists) {
+      await this.#deploymentResource.current?.patch(manifest);
+      return {
+        ready: false,
+        syncing: true,
+        reason: "Creating",
+        message: "Creating deployment",
+      };
+    }
+
+    if (!deepEqual(this.#deploymentResource.current.spec, manifest.spec)) {
+      await this.#deploymentResource.current.patch(manifest);
+      return {
+        ready: false,
+        syncing: true,
+        reason: "Updating",
+        message: "Deployment needs updates",
+      };
+    }
+
+    // Check if deployment is ready
+    const deployment = this.#deploymentResource.current;
+    const isReady =
+      deployment.status?.readyReplicas === deployment.status?.replicas;
+
+    return {
+      ready: isReady,
+      reason: isReady ? "Ready" : "Pending",
+      message: isReady ? "Deployment is ready" : "Waiting for pods to be ready",
+    };
+  };
+
+  #reconcileService = async (): Promise<SubresourceResult> => {
+    const manifest = createServiceManifest({
+      name: this.name,
+      namespace: this.namespace,
+      ref: this.ref,
+      spec: this.spec,
+    });
+
+    if (!deepEqual(this.#serviceResource.current?.spec, manifest.spec)) {
+      await this.#serviceResource.current?.patch(manifest);
+      return {
+        ready: false,
+        syncing: true,
+        reason: "Updating",
+        message: "Service needs updates",
+      };
+    }
+
+    return { ready: true };
+  };
+
+  public reconcile = async () => {
+    if (!this.exists || this.metadata.deletionTimestamp) {
+      return;
+    }
+
+    // Reconcile subresources
+    await this.reconcileSubresource("Deployment", this.#reconcileDeployment);
+    await this.reconcileSubresource("Service", this.#reconcileService);
+
+    // Update overall ready condition
+    const deploymentReady =
+      this.conditions.get("Deployment")?.status === "True";
+    const serviceReady = this.conditions.get("Service")?.status === "True";
+
+    await this.conditions.set("Ready", {
+      status: deploymentReady && serviceReady ? "True" : "False",
+      reason: deploymentReady && serviceReady ? "Ready" : "Pending",
+      message: deploymentReady && serviceReady
+        ? "All resources are ready"
+        : "Waiting for resources to be ready",
+    });
+  };
+}
+
+export { MyResourceResource };
+```
+
+**Resource Implementation Breakdown:**
+
+**Constructor Setup:**
+
+- **Resource References**: Create `ResourceReference` objects to track managed
+  Kubernetes resources
+- **Service Access**: Use dependency injection to access operator services
+  (`ResourceService`)
+- **Event Handlers**: Listen for changes in managed resources to trigger
+  reconciliation
+- **Resource Registration**: Register references for Deployment and Service that
+  will be managed
+
+**Reconciliation Methods:**
+
+- **`#reconcileDeployment`**: Manages the application's Deployment resource
+  - Creates manifests using helper functions
+  - Checks if resource exists and creates/updates as needed
+  - Uses `deepEqual` to avoid unnecessary updates
+  - Returns status indicating readiness state
+- **`#reconcileService`**: Manages the Service resource for network access
+  - Similar pattern to deployment but typically simpler
+  - Services are usually ready immediately after creation
+
+**Main Reconcile Loop:**
+
+- **Deletion Check**: Early return if resource is being deleted
+- **Subresource Management**: Calls individual reconciliation methods
+- **Condition Updates**: Aggregates status from all subresources
+- **Status Reporting**: Updates the overall "Ready" condition
+
+**Key Design Patterns:**
+
+- **Private Methods**: Use `#` for private reconciliation methods
+- **Async/Await**: All reconciliation is asynchronous
+- **Resource References**: Track external resources with type safety
+- **Condition Management**: Provide clear status through Kubernetes conditions
+- **Event-Driven**: React to changes in managed resources automatically
+
+### 4. Create Manifest Helpers
+
+Manifest helpers are pure functions that generate Kubernetes resource
+definitions. They transform your custom resource's specification into standard
+Kubernetes objects. This separation keeps your reconciliation logic clean and
+makes manifests easy to test and modify.
+
+Define manifest creation functions (`{resource-name}.create-manifests.ts`):
+
+```typescript
+type CreateDeploymentManifestOptions = {
+  name: string;
+  namespace: string;
+  ref: any; // Owner reference
+  spec: {
+    hostname: string;
+    port: number;
+    replicas: number;
+  };
+};
+
+const createDeploymentManifest = (
+  options: CreateDeploymentManifestOptions,
+) => ({
+  apiVersion: "apps/v1",
+  kind: "Deployment",
+  metadata: {
+    name: options.name,
+    namespace: options.namespace,
+    ownerReferences: [options.ref],
+  },
+  spec: {
+    replicas: options.spec.replicas,
+    selector: {
+      matchLabels: {
+        app: options.name,
+      },
+    },
+    template: {
+      metadata: {
+        labels: {
+          app: options.name,
+        },
+      },
+      spec: {
+        containers: [
+          {
+            name: options.name,
+            image: "nginx:latest",
+            ports: [
+              {
+                containerPort: options.spec.port,
+              },
+            ],
+            env: [
+              {
+                name: "HOSTNAME",
+                value: options.spec.hostname,
+              },
+            ],
+          },
+        ],
+      },
+    },
+  },
+});
+
+type CreateServiceManifestOptions = {
+  name: string;
+  namespace: string;
+  ref: any;
+  spec: {
+    port: number;
+  };
+};
+
+const createServiceManifest = (options: CreateServiceManifestOptions) => ({
+  apiVersion: "v1",
+  kind: "Service",
+  metadata: {
+    name: options.name,
+    namespace: options.namespace,
+    ownerReferences: [options.ref],
+  },
+  spec: {
+    selector: {
+      app: options.name,
+    },
+    ports: [
+      {
+        port: 80,
+        targetPort: options.spec.port,
+      },
+    ],
+  },
+});
+
+export { createDeploymentManifest, createServiceManifest };
+```
+
+**Manifest Helper Patterns:**
+
+**Type Definitions:**
+
+- **Options Types**: Define clear interfaces for function parameters
+- **Structured Input**: Group related parameters in nested objects
+- **Type Safety**: Leverage TypeScript to catch configuration errors at compile
+  time
+
+**Deployment Manifest:**
+
+- **Owner References**: Ensures garbage collection when parent resource is
+  deleted
+- **Labels & Selectors**: Consistent labeling for pod selection and organization
+- **Container Configuration**: Maps custom resource spec to container settings
+- **Environment Variables**: Passes configuration from spec to running
+  containers
+- **Port Configuration**: Exposes application ports based on spec
+
+**Service Manifest:**
+
+- **Service Discovery**: Creates stable network endpoint for the deployment
+- **Port Mapping**: Routes external traffic to container ports
+- **Selector Matching**: Uses same labels as deployment for proper routing
+- **Owner References**: Links service lifecycle to custom resource
+
+**Best Practices for Manifest Helpers:**
+
+- **Pure Functions**: No side effects, same input always produces same output
+- **Immutable Objects**: Return new objects rather than modifying inputs
+- **Validation**: Let TypeScript catch type mismatches
+- **Consistent Naming**: Use predictable patterns for resource names
+- **Owner References**: Always set for proper cleanup
+- **Documentation**: Comment non-obvious configuration choices
+
+### 5. Register Your Resource
+
+Add your resource to `src/custom-resouces/custom-resources.ts`:
+
+```typescript
+import { myResourceDefinition } from "./my-resource/my-resource.ts";
+
+const customResources = [
+  // ... existing resources
+  myResourceDefinition,
+];
+```
+
+## Core Concepts
+
+These fundamental patterns are used throughout the operator framework.
+Understanding them is essential for building robust custom resources.
+
+### Resource References
+
+`ResourceReference` objects provide a strongly-typed way to track and manage
+Kubernetes resources that your custom resource creates or depends on. They
+automatically handle resource watching, caching, and change notifications.
+
+Use `ResourceReference` to manage related Kubernetes resources:
+
+```typescript
+import {
+  ResourceReference,
+  ResourceService,
+} from "../../services/resources/resources.ts";
+
+class MyResource extends CustomResource<typeof myResourceSpecSchema> {
+  #deploymentResource = new ResourceReference();
+
+  constructor(options: CustomResourceOptions<typeof myResourceSpecSchema>) {
+    super(options);
+    const resourceService = this.services.get(ResourceService);
+
+    this.#deploymentResource.current = resourceService.get({
+      apiVersion: "apps/v1",
+      kind: "Deployment",
+      name: this.name,
+      namespace: this.namespace,
+    });
+
+    // Listen for changes
+    this.#deploymentResource.on("changed", this.queueReconcile);
+  }
+}
+```
+
+**Why Resource References Matter:**
+
+- **Automatic Watching**: Changes to referenced resources trigger reconciliation
+- **Type Safety**: Get compile-time checking for resource properties
+- **Lifecycle Management**: Easily check if resources exist and their current
+  state
+- **Event Handling**: React to external changes without polling
+- **Caching**: Avoid repeated API calls for the same resource data
+
+### Conditions
+
+Kubernetes conditions provide a standardized way to communicate resource status.
+They follow the Kubernetes convention of expressing current state, reasons for
+that state, and human-readable messages. Conditions are crucial for operators
+and users to understand what's happening with resources.
+
+Use conditions to track the status of your resource:
+
+```typescript
+// Set a condition
+await this.conditions.set("Ready", {
+  status: "True",
+  reason: "AllResourcesReady",
+  message: "All subresources are ready",
+});
+
+// Get a condition
+const isReady = this.conditions.get("Ready")?.status === "True";
+```
+
+**Condition Best Practices:**
+
+- **Standard Names**: Use common condition types like "Ready", "Available",
+  "Progressing"
+- **Clear Status**: Use "True", "False", or "Unknown" following Kubernetes
+  conventions
+- **Descriptive Reasons**: Provide specific reason codes for troubleshooting
+- **Helpful Messages**: Include actionable information for users
+- **Consistent Updates**: Always update conditions during reconciliation
+
+### Subresource Reconciliation
+
+The `reconcileSubresource` method provides a standardized way to manage
+individual components of your custom resource. It automatically handles
+condition updates, error management, and status aggregation. This pattern keeps
+your main reconciliation loop clean and ensures consistent error handling.
+
+Use `reconcileSubresource` to manage individual components:
+
+```typescript
+public reconcile = async () => {
+  // This automatically manages conditions and error handling
+  await this.reconcileSubresource("Deployment", this.#reconcileDeployment);
+  await this.reconcileSubresource("Service", this.#reconcileService);
+};
+```
+
+**Subresource Reconciliation Benefits:**
+
+- **Automatic Condition Management**: Sets conditions based on reconciliation
+  results
+- **Error Isolation**: Failures in one subresource don't stop others
+- **Status Aggregation**: Combines individual component status into overall
+  status
+- **Consistent Patterns**: Same error handling and retry logic across all
+  components
+- **Observability**: Clear visibility into which components are having issues
+
+### Deep Equality Checks
+
+Deep equality checks prevent unnecessary API calls and resource churn.
+Kubernetes resources should only be updated when their desired state actually
+differs from their current state. This improves performance and reduces cluster
+load.
+
+Use `deepEqual` to avoid unnecessary updates:
+
+```typescript
+import deepEqual from "deep-equal";
+
+if (!deepEqual(currentResource.spec, desiredManifest.spec)) {
+  await currentResource.patch(desiredManifest);
+}
+```
+
+**Deep Equality Benefits:**
+
+- **Performance**: Avoids unnecessary API calls to Kubernetes
+- **Reduced Churn**: Prevents resource version conflicts and unnecessary events
+- **Stability**: Reduces reconciliation loops and system noise
+- **Efficiency**: Lets you focus compute on actual changes
+- **Observability**: Cleaner audit logs with only meaningful changes
+
+**When to Use Deep Equality:**
+
+- **Spec Comparisons**: Before updating any Kubernetes resource
+- **Status Updates**: Only update status when values actually change
+- **Metadata Updates**: Check labels and annotations before patching
+- **Complex Objects**: Especially useful for nested configuration objects
+
+## Advanced Patterns
+
+These patterns handle more complex scenarios like secret management, resource
+dependencies, and sophisticated error handling. Use these when building
+production-ready operators that need to handle real-world complexity.
+
+### Working with Secrets
+
+Many resources need to manage secrets. Here's a pattern for secret management:
+
+```typescript
+import { SecretService } from "../../services/secrets/secrets.ts";
+
+class MyResource extends CustomResource<typeof myResourceSpecSchema> {
+  constructor(options: CustomResourceOptions<typeof myResourceSpecSchema>) {
+    super(options);
+    const secretService = this.services.get(SecretService);
+
+    // Get or create a secret
+    this.secretRef = secretService.get({
+      name: `${this.name}-secret`,
+      namespace: this.namespace,
+    });
+  }
+
+  #ensureSecret = async () => {
+    const secretData = {
+      apiKey: generateApiKey(),
+      password: generatePassword(),
+    };
+
+    if (!this.secretRef.current?.exists) {
+      await this.secretRef.current?.patch({
+        apiVersion: "v1",
+        kind: "Secret",
+        metadata: {
+          name: this.secretRef.current.name,
+          namespace: this.secretRef.current.namespace,
+          ownerReferences: [this.ref],
+        },
+        data: secretData,
+      });
+    }
+  };
+}
+```
+
+### Cross-Resource Dependencies
+
+When your resource depends on other custom resources:
+
+```typescript
+class MyResource extends CustomResource<typeof myResourceSpecSchema> {
+  #dependentResource = new ResourceReference();
+
+  constructor(options: CustomResourceOptions<typeof myResourceSpecSchema>) {
+    super(options);
+    const resourceService = this.services.get(ResourceService);
+
+    // Reference another custom resource
+    this.#dependentResource.current = resourceService.get({
+      apiVersion: "homelab.mortenolsen.pro/v1",
+      kind: "PostgresDatabase",
+      name: this.spec.database,
+      namespace: this.namespace,
+    });
+
+    this.#dependentResource.on("changed", this.queueReconcile);
+  }
+
+  #reconcileApp = async (): Promise<SubresourceResult> => {
+    // Check if dependency is ready
+    const dependency = this.#dependentResource.current;
+    if (!dependency?.exists) {
+      return {
+        ready: false,
+        failed: true,
+        reason: "MissingDependency",
+        message: `PostgresDatabase ${this.spec.database} not found`,
+      };
+    }
+
+    const dependencyReady = dependency.status?.conditions?.find(
+      (c) => c.type === "Ready" && c.status === "True",
+    );
+
+    if (!dependencyReady) {
+      return {
+        ready: false,
+        reason: "WaitingForDependency",
+        message:
+          `Waiting for PostgresDatabase ${this.spec.database} to be ready`,
+      };
+    }
+
+    // Continue with reconciliation...
+  };
+}
+```
+
+### Error Handling
+
+Proper error handling in reconciliation:
+
+```typescript
+#reconcileDeployment = async (): Promise<SubresourceResult> => {
+  try {
+    // Reconciliation logic...
+    return { ready: true };
+  } catch (error) {
+    return {
+      ready: false,
+      failed: true,
+      reason: 'ReconciliationError',
+      message: `Failed to reconcile deployment: ${error.message}`,
+    };
+  }
+};
+```
+
+## Example Usage
+
+Once your custom resource is implemented and registered, users can create
+instances using standard Kubernetes manifests. The operator will automatically
+detect new resources and begin reconciliation based on your implementation
+logic.
+
+```yaml
+apiVersion: homelab.mortenolsen.pro/v1
+kind: MyResource
+metadata:
+  name: my-app
+  namespace: default
+spec:
+  hostname: my-app.example.com
+  port: 8080
+  replicas: 3
+  protocol: https
+  database:
+    host: postgres.default.svc.cluster.local
+    port: 5432
+    name: myapp
+```
+
+**What happens when this resource is created:**
+
+1. **Validation**: The operator validates the spec against your Zod schema
+2. **Resource Creation**: Your `MyResourceResource` class is instantiated
+3. **Reconciliation**: The operator creates a Deployment with 3 replicas and a
+   Service
+4. **Status Updates**: Conditions are set to track deployment and service
+   readiness
+5. **Event Handling**: The operator watches for changes and re-reconciles as
+   needed
+
+Users can then monitor the resource status with:
+
+```bash
+kubectl get myresources my-app -o yaml
+kubectl describe myresource my-app
+```
+
+## Real Examples
+
+These examples show how the patterns described above are used in practice within
+the homelab-operator.
+
+### Simple Resource: Domain
+
+The `Domain` resource demonstrates a straightforward custom resource that
+manages external dependencies. It creates and manages TLS certificates through
+cert-manager and configures Istio gateways for HTTPS traffic routing.
+
+**What it does:**
+
+- Creates a cert-manager Certificate for TLS termination
+- Configures an Istio Gateway for traffic routing
+- Manages the lifecycle of both resources through owner references
+- Provides wildcard certificate support for subdomains
+
+```yaml
+apiVersion: homelab.mortenolsen.pro/v1
+kind: Domain
+metadata:
+  name: homelab
+  namespace: homelab
+spec:
+  hostname: local.olsen.cloud # Domain for certificate and gateway
+  issuer: letsencrypt-prod # cert-manager ClusterIssuer to use
+```
+
+**Key Implementation Features:**
+
+- **CRD Dependency Checking**: Validates that cert-manager and Istio CRDs exist
+- **Cross-Namespace Resources**: Certificate is created in the istio-ingress
+  namespace
+- **Status Aggregation**: Combines certificate and gateway readiness into
+  overall status
+- **Wildcard Support**: Automatically configures `*.hostname` for subdomains
+
+### Complex Resource: AuthentikServer
+
+The `AuthentikServer` resource showcases a complex custom resource with multiple
+dependencies and sophisticated reconciliation logic. It deploys a complete
+identity provider solution with database and Redis dependencies.
+
+**What it does:**
+
+- Deploys Authentik identity provider with proper configuration
+- Manages database schema and user creation
+- Configures Redis connection for session storage
+- Sets up domain integration for SSO endpoints
+- Handles secret generation and rotation
+
+```yaml
+apiVersion: homelab.mortenolsen.pro/v1
+kind: AuthentikServer
+metadata:
+  name: homelab
+  namespace: homelab
+spec:
+  domain: homelab # References a Domain resource
+  database: test2 # References a PostgresDatabase resource
+  redis: redis # References a Redis connection
+```
+
+**Key Implementation Features:**
+
+- **Resource Dependencies**: Waits for Domain, PostgresDatabase, and Redis
+  resources
+- **Secret Management**: Generates and manages API keys, passwords, and tokens
+- **Service Configuration**: Creates comprehensive Kubernetes manifests
+  (Deployment, Service, Ingress)
+- **Health Checking**: Monitors application readiness and database connectivity
+- **Cross-Resource Communication**: Uses other custom resources' status and
+  outputs
+
+### Database Resource: PostgresDatabase
+
+The `PostgresDatabase` resource illustrates how to manage stateful resources and
+external system integration. It creates databases within an existing PostgreSQL
+instance and manages user permissions.
+
+**What it does:**
+
+- Creates a new database in an existing PostgreSQL server
+- Generates dedicated database user with appropriate permissions
+- Manages connection secrets for applications
+- Handles database cleanup and user removal
+
+```yaml
+apiVersion: homelab.mortenolsen.pro/v1
+kind: PostgresDatabase
+metadata:
+  name: test2
+  namespace: homelab
+spec:
+  connection: homelab/db # References PostgreSQL connection (namespace/name)
+```
+
+**Key Implementation Features:**
+
+- **External System Integration**: Connects to existing PostgreSQL instances
+- **User Management**: Creates database-specific users with minimal required
+  permissions
+- **Secret Generation**: Provides connection details to consuming applications
+- **Cleanup Handling**: Safely removes databases and users when resource is
+  deleted
+- **Connection Validation**: Verifies connectivity before marking as ready
+
+**Common Patterns Across Examples:**
+
+- **Owner References**: All managed resources have proper ownership for garbage
+  collection
+- **Condition Management**: Consistent status reporting through Kubernetes
+  conditions
+- **Resource Dependencies**: Graceful handling of missing or unready
+  dependencies
+- **Secret Management**: Secure generation and storage of credentials
+- **Cross-Resource Integration**: Resources reference and depend on each other
+  appropriately
+
+## Best Practices
+
+1. **Validation**: Always use Zod schemas for comprehensive spec validation
+2. **Idempotency**: Use `deepEqual` checks to avoid unnecessary updates
+3. **Conditions**: Provide clear status information through conditions
+4. **Owner References**: Always set owner references for created resources
+5. **Error Handling**: Provide meaningful error messages and failure reasons
+6. **Dependencies**: Handle missing dependencies gracefully
+7. **Cleanup**: Leverage Kubernetes garbage collection through owner references
+8. **Testing**: Create test manifests in `test-manifests/` for your resources
+
+## Troubleshooting
+
+- **Resource not reconciling**: Check if the resource is properly registered in
+  `custom-resources.ts`
+- **Validation errors**: Ensure your Zod schema matches the expected spec
+  structure
+- **Missing dependencies**: Verify that referenced resources exist and are ready
+- **Owner reference issues**: Make sure `ownerReferences` are set correctly for
+  garbage collection
+- **Condition not updating**: Ensure you're calling `this.conditions.set()` with
+  proper status values
+
+For more examples, refer to the existing custom resources in
+`src/custom-resouces/`.

package.json

@@ -26,6 +26,7 @@
     "deep-equal": "^2.2.3",
     "dotenv": "^17.2.1",
     "eventemitter3": "^5.0.1",
+    "execa": "^9.6.0",
     "knex": "^3.1.0",
     "p-queue": "^8.1.0",
     "p-retry": "^6.2.1",

pnpm-lock.yaml

@@ -26,6 +26,9 @@ importers:
       eventemitter3:
         specifier: ^5.0.1
         version: 5.0.1
+      execa:
+        specifier: ^9.6.0
+        version: 9.6.0
       knex:
         specifier: ^3.1.0
         version: 3.1.0(pg@8.16.3)(sqlite3@5.1.7)
@@ -197,6 +200,13 @@ packages:
   '@rtsao/scc@1.1.0':
     resolution: {integrity: sha512-zt6OdqaDoOnJ1ZYsCYGt9YmWzDXl4vQdKTyJev62gFhRGKdx7mcT54V9KIjg+d2wi9EXsPvAPKe7i7WjfVWB8g==}
 
+  '@sec-ant/readable-stream@0.4.1':
+    resolution: {integrity: sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg==}
+
+  '@sindresorhus/merge-streams@4.0.0':
+    resolution: {integrity: sha512-tlqY9xq5ukxTUZBmoOp+m61cqwQD5pHJtFY3Mn8CA8ps6yghLH/Hw8UPdqg4OLmFW3IFlcXnQNmo/dh8HzXYIQ==}
+    engines: {node: '>=18'}
+
   '@tootallnate/once@1.1.2':
     resolution: {integrity: sha512-RbzJvlNzmRq5c3O09UipeuXno4tA1FE6ikOjxZK0tuxVv3412l64l5t1W5pj4+rJq9vpkm/kwiR07aZXnsKPxw==}
     engines: {node: '>= 6'}
@@ -747,6 +757,10 @@ packages:
   eventemitter3@5.0.1:
     resolution: {integrity: sha512-GWkBvjiSZK87ELrYOSESUYeVIc9mvLLf/nXalMOS5dYrgZq9o5OVkbZAVM06CVxYsCwH9BDZFPlQTlPA1j4ahA==}
 
+  execa@9.6.0:
+    resolution: {integrity: sha512-jpWzZ1ZhwUmeWRhS7Qv3mhpOhLfwI+uAX4e5fOcXqwMR7EcJ0pj2kV1CVzHVMX/LphnKWD3LObjZCoJ71lKpHw==}
+    engines: {node: ^18.19.0 || >=20.5.0}
+
   expand-template@2.0.3:
     resolution: {integrity: sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==}
     engines: {node: '>=6'}
@@ -781,6 +795,10 @@ packages:
       picomatch:
         optional: true
 
+  figures@6.1.0:
+    resolution: {integrity: sha512-d+l3qxjSesT4V7v2fh+QnmFnUWv9lSpjarhShNTgBOfA0ttejbQUAlHLitbjkoRiDulW0OPoQPYIGhIC8ohejg==}
+    engines: {node: '>=18'}
+
   file-entry-cache@8.0.0:
     resolution: {integrity: sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==}
     engines: {node: '>=16.0.0'}
@@ -848,6 +866,10 @@ packages:
     resolution: {integrity: sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==}
     engines: {node: '>= 0.4'}
 
+  get-stream@9.0.1:
+    resolution: {integrity: sha512-kVCxPF3vQM/N0B1PmoqVUqgHP+EeVjmZSQn+1oCRPxd2P21P2F19lIgbR3HBosbB1PUhOAoctJnfEn2GbN2eZA==}
+    engines: {node: '>=18'}
+
   get-symbol-description@1.1.0:
     resolution: {integrity: sha512-w9UMqWwJxHNOvoNzSJ2oPF5wvYcvP7jUvYzhp67yEhTi17ZDBBC1z9pTdGuzjD+EFIqLSYRweZjqfiPzQ06Ebg==}
     engines: {node: '>= 0.4'}
@@ -933,6 +955,10 @@ packages:
     resolution: {integrity: sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==}
     engines: {node: '>= 6'}
 
+  human-signals@8.0.1:
+    resolution: {integrity: sha512-eKCa6bwnJhvxj14kZk5NCPc6Hb6BdsU9DZcOnmQKSnO1VKrfV0zCvtttPZUsBvjmNDn8rpcJfpwSYnHBjc95MQ==}
+    engines: {node: '>=18.18.0'}
+
   humanize-ms@1.2.1:
     resolution: {integrity: sha512-Fl70vYtsAFb/C06PTS9dZBo7ihau+Tu/DNCk/OyHhea07S+aeMWpFFkUaXRa8fI+ScZbEI8dfSxwY7gxZ9SAVQ==}
 
@@ -1067,6 +1093,10 @@ packages:
     resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
     engines: {node: '>=0.12.0'}
 
+  is-plain-obj@4.1.0:
+    resolution: {integrity: sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==}
+    engines: {node: '>=12'}
+
   is-regex@1.2.1:
     resolution: {integrity: sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g==}
     engines: {node: '>= 0.4'}
@@ -1079,6 +1109,10 @@ packages:
     resolution: {integrity: sha512-ISWac8drv4ZGfwKl5slpHG9OwPNty4jOWPRIhBpxOoD+hqITiwuipOQ2bNthAzwA3B4fIjO4Nln74N0S9byq8A==}
     engines: {node: '>= 0.4'}
 
+  is-stream@4.0.1:
+    resolution: {integrity: sha512-Dnz92NInDqYckGEUJv689RbRiTSEHCQ7wOVeALbkOz999YpqT46yMRIGtSNl2iCL1waAZSx40+h59NV/EwzV/A==}
+    engines: {node: '>=18'}
+
   is-string@1.1.1:
     resolution: {integrity: sha512-BtEeSsoaQjlSPBemMQIrY1MY0uM6vnS1g5fmufYOtnxLGUZM2178PKbhsk7Ffv58IX+ZtcvoGwccYsh0PglkAA==}
     engines: {node: '>= 0.4'}
@@ -1091,6 +1125,10 @@ packages:
     resolution: {integrity: sha512-p3EcsicXjit7SaskXHs1hA91QxgTw46Fv6EFKKGS5DRFLD8yKnohjF3hxoju94b/OcMZoQukzpPpBE9uLVKzgQ==}
     engines: {node: '>= 0.4'}
 
+  is-unicode-supported@2.1.0:
+    resolution: {integrity: sha512-mE00Gnza5EEB3Ds0HfMyllZzbBrmLOX3vfWoj9A9PEnTfratQ/BcaJOuMhnkhjXvb2+FkY3VuHqtAGpTPmglFQ==}
+    engines: {node: '>=18'}
+
   is-weakmap@2.0.2:
     resolution: {integrity: sha512-K5pXYOm9wqY1RgjpL3YTkF39tni1XajUIkawTLUo9EZEVUFga5gSQJF8nNS7ZwJQ02y+1YCNYcMh+HIf1ZqE+w==}
     engines: {node: '>= 0.4'}
@@ -1320,6 +1358,10 @@ packages:
     engines: {node: '>=6'}
     hasBin: true
 
+  npm-run-path@6.0.0:
+    resolution: {integrity: sha512-9qny7Z9DsQU8Ou39ERsPU4OZQlSTP47ShQzuKZ6PRXpYLtIFgl/DEBYEXKlvcEa+9tHVcK8CF81Y2V72qaZhWA==}
+    engines: {node: '>=18'}
+
   npmlog@6.0.2:
     resolution: {integrity: sha512-/vBvz5Jfr9dT/aFWd0FIRf+T/Q2WBsLENygUaFUqstqsycmZAP/t5BvFJTK0viFmSUxiUKTUplWy5vt+rvKIxg==}
     engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
@@ -1398,6 +1440,10 @@ packages:
     resolution: {integrity: sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==}
     engines: {node: '>=6'}
 
+  parse-ms@4.0.0:
+    resolution: {integrity: sha512-TXfryirbmq34y8QBwgqCVLi+8oA3oWx2eAnSn62ITyEhEYaWRlVZ2DvMM9eZbMs/RfxPu/PK/aBLyGj4IrqMHw==}
+    engines: {node: '>=18'}
+
   path-exists@4.0.0:
     resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
     engines: {node: '>=8'}
@@ -1410,6 +1456,10 @@ packages:
     resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
     engines: {node: '>=8'}
 
+  path-key@4.0.0:
+    resolution: {integrity: sha512-haREypq7xkM7ErfgIyA0z+Bj4AGKlMSdlQE2jvJo6huWD1EdkKYV+G/T4nq0YEF2vgTT8kqMFKo1uHn950r4SQ==}
+    engines: {node: '>=12'}
+
   path-parse@1.0.7:
     resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==}
 
@@ -1496,6 +1546,10 @@ packages:
     engines: {node: '>=14'}
     hasBin: true
 
+  pretty-ms@9.2.0:
+    resolution: {integrity: sha512-4yf0QO/sllf/1zbZWYnvWw3NxCQwLXKzIj0G849LSufP15BXKM0rbD2Z3wVnkMfjdn/CB0Dpp444gYAACdsplg==}
+    engines: {node: '>=18'}
+
   promise-inflight@1.0.1:
     resolution: {integrity: sha512-6zWPyEOFaQBJYcGMHBKTKJ3u6TBsnMFOIZSa6ce1e/ZrrsOlnHRHbabMjLiBYKp+n44X9eUI6VUPaukCXHuG4g==}
     peerDependencies:
@@ -1643,6 +1697,10 @@ packages:
   signal-exit@3.0.7:
     resolution: {integrity: sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==}
 
+  signal-exit@4.1.0:
+    resolution: {integrity: sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==}
+    engines: {node: '>=14'}
+
   simple-concat@1.0.1:
     resolution: {integrity: sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==}
 
@@ -1717,6 +1775,10 @@ packages:
     resolution: {integrity: sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==}
     engines: {node: '>=4'}
 
+  strip-final-newline@4.0.0:
+    resolution: {integrity: sha512-aulFJcD6YK8V1G7iRB5tigAP4TsHBZZrOV8pjV++zdUwmeV8uzbY7yn6h9MswN62adStNZFuCIx4haBnRuMDaw==}
+    engines: {node: '>=18'}
+
   strip-json-comments@2.0.1:
     resolution: {integrity: sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==}
     engines: {node: '>=0.10.0'}
@@ -1827,6 +1889,10 @@ packages:
   undici-types@6.21.0:
     resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
 
+  unicorn-magic@0.3.0:
+    resolution: {integrity: sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA==}
+    engines: {node: '>=18'}
+
   unique-filename@1.1.1:
     resolution: {integrity: sha512-Vmp0jIp2ln35UTXuryvjzkjGdRyf9b2lTXuSYUiPmzRcl3FDtYqAwOnTJkAngD9SWhnoJzDbTKwaOrZ+STtxNQ==}
 
@@ -1904,6 +1970,10 @@ packages:
     resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
     engines: {node: '>=10'}
 
+  yoctocolors@2.1.1:
+    resolution: {integrity: sha512-GQHQqAopRhwU8Kt1DDM8NjibDXHC8eoh1erhGAJPEyveY9qqVeXvVikNKrDz69sHowPMorbPUrH/mx8c50eiBQ==}
+    engines: {node: '>=18'}
+
   zod@4.0.14:
     resolution: {integrity: sha512-nGFJTnJN6cM2v9kXL+SOBq3AtjQby3Mv5ySGFof5UGRHrRioSJ5iG680cYNjE/yWk671nROcpPj4hAS8nyLhSw==}
 
@@ -2040,6 +2110,10 @@ snapshots:
 
   '@rtsao/scc@1.1.0': {}
 
+  '@sec-ant/readable-stream@0.4.1': {}
+
+  '@sindresorhus/merge-streams@4.0.0': {}
+
   '@tootallnate/once@1.1.2':
     optional: true
 
@@ -2756,6 +2830,21 @@ snapshots:
 
   eventemitter3@5.0.1: {}
 
+  execa@9.6.0:
+    dependencies:
+      '@sindresorhus/merge-streams': 4.0.0
+      cross-spawn: 7.0.6
+      figures: 6.1.0
+      get-stream: 9.0.1
+      human-signals: 8.0.1
+      is-plain-obj: 4.1.0
+      is-stream: 4.0.1
+      npm-run-path: 6.0.0
+      pretty-ms: 9.2.0
+      signal-exit: 4.1.0
+      strip-final-newline: 4.0.0
+      yoctocolors: 2.1.1
+
   expand-template@2.0.3: {}
 
   fast-deep-equal@3.1.3: {}
@@ -2784,6 +2873,10 @@ snapshots:
     optionalDependencies:
       picomatch: 4.0.3
 
+  figures@6.1.0:
+    dependencies:
+      is-unicode-supported: 2.1.0
+
   file-entry-cache@8.0.0:
     dependencies:
       flat-cache: 4.0.1
@@ -2872,6 +2965,11 @@ snapshots:
       dunder-proto: 1.0.1
       es-object-atoms: 1.1.1
 
+  get-stream@9.0.1:
+    dependencies:
+      '@sec-ant/readable-stream': 0.4.1
+      is-stream: 4.0.1
+
   get-symbol-description@1.1.0:
     dependencies:
       call-bound: 1.0.4
@@ -2961,6 +3059,8 @@ snapshots:
       - supports-color
     optional: true
 
+  human-signals@8.0.1: {}
+
   humanize-ms@1.2.1:
     dependencies:
       ms: 2.1.3
@@ -3094,6 +3194,8 @@ snapshots:
 
   is-number@7.0.0: {}
 
+  is-plain-obj@4.1.0: {}
+
   is-regex@1.2.1:
     dependencies:
       call-bound: 1.0.4
@@ -3107,6 +3209,8 @@ snapshots:
     dependencies:
       call-bound: 1.0.4
 
+  is-stream@4.0.1: {}
+
   is-string@1.1.1:
     dependencies:
       call-bound: 1.0.4
@@ -3122,6 +3226,8 @@ snapshots:
     dependencies:
       which-typed-array: 1.1.19
 
+  is-unicode-supported@2.1.0: {}
+
   is-weakmap@2.0.2: {}
 
   is-weakref@1.1.1:
@@ -3362,6 +3468,11 @@ snapshots:
       abbrev: 1.1.1
     optional: true
 
+  npm-run-path@6.0.0:
+    dependencies:
+      path-key: 4.0.0
+      unicorn-magic: 0.3.0
+
   npmlog@6.0.2:
     dependencies:
       are-we-there-yet: 3.0.1
@@ -3464,6 +3575,8 @@ snapshots:
     dependencies:
       callsites: 3.1.0
 
+  parse-ms@4.0.0: {}
+
   path-exists@4.0.0: {}
 
   path-is-absolute@1.0.1:
@@ -3471,6 +3584,8 @@ snapshots:
 
   path-key@3.1.1: {}
 
+  path-key@4.0.0: {}
+
   path-parse@1.0.7: {}
 
   pg-cloudflare@1.2.7:
@@ -3549,6 +3664,10 @@ snapshots:
 
   prettier@3.6.2: {}
 
+  pretty-ms@9.2.0:
+    dependencies:
+      parse-ms: 4.0.0
+
   promise-inflight@1.0.1:
     optional: true
 
@@ -3722,6 +3841,8 @@ snapshots:
   signal-exit@3.0.7:
     optional: true
 
+  signal-exit@4.1.0: {}
+
   simple-concat@1.0.1: {}
 
   simple-get@4.0.1:
@@ -3830,6 +3951,8 @@ snapshots:
 
   strip-bom@3.0.0: {}
 
+  strip-final-newline@4.0.0: {}
+
   strip-json-comments@2.0.1: {}
 
   strip-json-comments@3.1.1: {}
@@ -3977,6 +4100,8 @@ snapshots:
 
   undici-types@6.21.0: {}
 
+  unicorn-magic@0.3.0: {}
+
   unique-filename@1.1.1:
     dependencies:
       unique-slug: 2.0.2
@@ -4064,4 +4189,6 @@ snapshots:
 
   yocto-queue@0.1.0: {}
 
+  yoctocolors@2.1.1: {}
+
   zod@4.0.14: {}

scripts/apply-test.sh

@@ -0,0 +1,4 @@
+for f in "./test-manifests/"*; do
+  echo "Applying $f"
+  kubectl apply -f "$f"
+done

scripts/create-clients.ts

@@ -1,24 +0,0 @@
-import fs from 'node:fs';
-import { mkdir } from 'node:fs/promises';
-import { dirname, resolve } from 'node:path';
-
-import YAML from 'yaml';
-import openapiTS, { astToString } from 'openapi-typescript';
-
-const schemaRequest = await fetch('https://authentik.olsen.cloud/api/v3/schema/');
-if (!schemaRequest.ok) {
-  console.error(schemaRequest.status, schemaRequest.statusText);
-  throw new Error('Failed to fetch schema');
-}
-const schemaYaml = await schemaRequest.text();
-const schema = YAML.parse(schemaYaml);
-
-const ast = await openapiTS(schema);
-const contents = astToString(ast);
-
-const targetLocation = resolve(import.meta.dirname, '..', 'src', 'clients', 'authentik', 'authentik.types.d.ts');
-await mkdir(dirname(targetLocation), { recursive: true });
-fs.writeFileSync(
-  targetLocation,
-  ['// This file is generated by scripts/create-clients.ts', '/* eslint-disable */', contents].join('\n'),
-);

scripts/create-secrets.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+# Load environment variables from .env file
+if [ -f .env ]; then
+  export $(cat .env | grep -v '#' | awk '/=/ {print $1}')
+fi
+
+# Check if CLOUDFLARE_API_KEY is set
+if [ -z "${CLOUDFLARE_API_KEY}" ]; then
+  echo "Error: CLOUDFLARE_API_KEY is not set. Please add it to your .env file."
+  exit 1
+fi
+
+# Create the postgres namespace if it doesn't exist
+kubectl get namespace postgres > /dev/null 2>&1 || kubectl create namespace postgres
+
+# Create the secret
+kubectl create secret generic cloudflare-api-token-secret \
+  --namespace cert-manager \
+  --from-literal=api-token="${CLOUDFLARE_API_KEY}"

scripts/recreate.bash

@@ -1,2 +0,0 @@
-kubectl delete -f "$1"
-kubectl apply -f "$1"

scripts/setup-server.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+flux install --components="source-controller,helm-controller"
+kubectl create namespace homelab

scripts/update-manifests.ts

@@ -1,16 +1,17 @@
+#!/usr/bin/env node
 import { mkdir, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 
 import { compile } from 'json-schema-to-typescript';
 
-import { K8sService } from '../services/k8s/k8s.ts';
+import { K8sService } from '../src/services/k8s/k8s.ts';
-import { Services } from '../utils/service.ts';
+import { Services } from '../src/utils/service.ts';
 
 const services = new Services();
 const k8s = services.get(K8sService);
 
 const manifests = await k8s.extensionsApi.listCustomResourceDefinition();
-const root = join(import.meta.dirname, '..', '__generated__', 'resources');
+const root = join(import.meta.dirname, '..', 'src', '__generated__', 'resources');
 
 await mkdir(root, { recursive: true });
 

src/__generated__/resources/K8SAddonV1.json

@@ -1,13 +1,26 @@
 {
+  "description": "Addon is used to track application of a manifest file on disk. It mostly exists so that the wrangler DesiredSet\nApply controller has an object to track as the owner, and ensure that all created resources are tracked when the\nmanifest is modified or removed.",
   "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
     "spec": {
+      "description": "Spec provides information about the on-disk manifest backing this resource.",
       "properties": {
         "checksum": {
-          "nullable": true,
+          "description": "Checksum is the SHA256 checksum of the most recently successfully applied manifest file.",
           "type": "string"
         },
         "source": {
-          "nullable": true,
+          "description": "Source is the Path on disk to the manifest file that this Addon tracks.",
           "type": "string"
         }
       },

src/__generated__/resources/K8SAddonV1.ts

@@ -5,9 +5,39 @@
  * and run json-schema-to-typescript to regenerate this file.
  */
 
+/**
+ * Addon is used to track application of a manifest file on disk. It mostly exists so that the wrangler DesiredSet
+ * Apply controller has an object to track as the owner, and ensure that all created resources are tracked when the
+ * manifest is modified or removed.
+ */
 export interface K8SAddonV1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * Spec provides information about the on-disk manifest backing this resource.
+   */
   spec?: {
+    /**
+     * Checksum is the SHA256 checksum of the most recently successfully applied manifest file.
+     */
     checksum?: string;
+    /**
+     * Source is the Path on disk to the manifest file that this Addon tracks.
+     */
     source?: string;
   };
 }

src/__generated__/resources/K8SBucketV1.json

@@ -0,0 +1,315 @@
+{
+  "description": "Bucket is the Schema for the buckets API.",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "BucketSpec specifies the required configuration to produce an Artifact for\nan object storage bucket.",
+      "properties": {
+        "bucketName": {
+          "description": "BucketName is the name of the object storage bucket.",
+          "type": "string"
+        },
+        "certSecretRef": {
+          "description": "CertSecretRef can be given the name of a Secret containing\neither or both of\n\n- a PEM-encoded client certificate (`tls.crt`) and private\nkey (`tls.key`);\n- a PEM-encoded CA certificate (`ca.crt`)\n\nand whichever are supplied, will be used for connecting to the\nbucket. The client cert and key are useful if you are\nauthenticating with a certificate; the CA cert is useful if\nyou are using a self-signed server certificate. The Secret must\nbe of type `Opaque` or `kubernetes.io/tls`.\n\nThis field is only supported for the `generic` provider.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "endpoint": {
+          "description": "Endpoint is the object storage address the BucketName is located at.",
+          "type": "string"
+        },
+        "ignore": {
+          "description": "Ignore overrides the set of excluded patterns in the .sourceignore format\n(which is the same as .gitignore). If not provided, a default will be used,\nconsult the documentation for your version to find out what those are.",
+          "type": "string"
+        },
+        "insecure": {
+          "description": "Insecure allows connecting to a non-TLS HTTP Endpoint.",
+          "type": "boolean"
+        },
+        "interval": {
+          "description": "Interval at which the Bucket Endpoint is checked for updates.\nThis interval is approximate and may be subject to jitter to ensure\nefficient use of resources.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
+          "type": "string"
+        },
+        "prefix": {
+          "description": "Prefix to use for server-side filtering of files in the Bucket.",
+          "type": "string"
+        },
+        "provider": {
+          "_default": "generic",
+          "description": "Provider of the object storage bucket.\nDefaults to 'generic', which expects an S3 (API) compatible object\nstorage.",
+          "_enum": [
+            "generic",
+            "aws",
+            "gcp",
+            "azure"
+          ],
+          "type": "string"
+        },
+        "proxySecretRef": {
+          "description": "ProxySecretRef specifies the Secret containing the proxy configuration\nto use while communicating with the Bucket server.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "region": {
+          "description": "Region of the Endpoint where the BucketName is located in.",
+          "type": "string"
+        },
+        "secretRef": {
+          "description": "SecretRef specifies the Secret containing authentication credentials\nfor the Bucket.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "sts": {
+          "description": "STS specifies the required configuration to use a Security Token\nService for fetching temporary credentials to authenticate in a\nBucket provider.\n\nThis field is only supported for the `aws` and `generic` providers.",
+          "properties": {
+            "certSecretRef": {
+              "description": "CertSecretRef can be given the name of a Secret containing\neither or both of\n\n- a PEM-encoded client certificate (`tls.crt`) and private\nkey (`tls.key`);\n- a PEM-encoded CA certificate (`ca.crt`)\n\nand whichever are supplied, will be used for connecting to the\nSTS endpoint. The client cert and key are useful if you are\nauthenticating with a certificate; the CA cert is useful if\nyou are using a self-signed server certificate. The Secret must\nbe of type `Opaque` or `kubernetes.io/tls`.\n\nThis field is only supported for the `ldap` provider.",
+              "properties": {
+                "name": {
+                  "description": "Name of the referent.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object"
+            },
+            "endpoint": {
+              "description": "Endpoint is the HTTP/S endpoint of the Security Token Service from\nwhere temporary credentials will be fetched.",
+              "pattern": "^(http|https)://.*$",
+              "type": "string"
+            },
+            "provider": {
+              "description": "Provider of the Security Token Service.",
+              "_enum": [
+                "aws",
+                "ldap"
+              ],
+              "type": "string"
+            },
+            "secretRef": {
+              "description": "SecretRef specifies the Secret containing authentication credentials\nfor the STS endpoint. This Secret must contain the fields `username`\nand `password` and is supported only for the `ldap` provider.",
+              "properties": {
+                "name": {
+                  "description": "Name of the referent.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "endpoint",
+            "provider"
+          ],
+          "type": "object"
+        },
+        "suspend": {
+          "description": "Suspend tells the controller to suspend the reconciliation of this\nBucket.",
+          "type": "boolean"
+        },
+        "timeout": {
+          "_default": "60s",
+          "description": "Timeout for fetch operations, defaults to 60s.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m))+$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "bucketName",
+        "endpoint",
+        "interval"
+      ],
+      "type": "object",
+      "x_kubernetes_validations": [
+        {
+          "message": "STS configuration is only supported for the 'aws' and 'generic' Bucket providers",
+          "rule": "self.provider == 'aws' || self.provider == 'generic' || !has(self.sts)"
+        },
+        {
+          "message": "'aws' is the only supported STS provider for the 'aws' Bucket provider",
+          "rule": "self.provider != 'aws' || !has(self.sts) || self.sts.provider == 'aws'"
+        },
+        {
+          "message": "'ldap' is the only supported STS provider for the 'generic' Bucket provider",
+          "rule": "self.provider != 'generic' || !has(self.sts) || self.sts.provider == 'ldap'"
+        },
+        {
+          "message": "spec.sts.secretRef is not required for the 'aws' STS provider",
+          "rule": "!has(self.sts) || self.sts.provider != 'aws' || !has(self.sts.secretRef)"
+        },
+        {
+          "message": "spec.sts.certSecretRef is not required for the 'aws' STS provider",
+          "rule": "!has(self.sts) || self.sts.provider != 'aws' || !has(self.sts.certSecretRef)"
+        }
+      ]
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "BucketStatus records the observed state of a Bucket.",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the last successful Bucket reconciliation.",
+          "properties": {
+            "digest": {
+              "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+              "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "metadata": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Metadata holds upstream information such as OCI annotations.",
+              "type": "object"
+            },
+            "path": {
+              "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+              "type": "string"
+            },
+            "size": {
+              "description": "Size is the number of bytes in the file.",
+              "format": "int64",
+              "type": "integer"
+            },
+            "url": {
+              "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "revision",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the Bucket.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation of the Bucket object.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "observedIgnore": {
+          "description": "ObservedIgnore is the observed exclusion patterns used for constructing\nthe source artifact.",
+          "type": "string"
+        },
+        "url": {
+          "description": "URL is the dynamic fetch link for the latest Artifact.\nIt is provided on a \"best effort\" basis, and using the precise\nBucketStatus.Artifact data is recommended.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

src/__generated__/resources/K8SBucketV1.ts

@@ -0,0 +1,278 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * Bucket is the Schema for the buckets API.
+ */
+export interface K8SBucketV1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * BucketSpec specifies the required configuration to produce an Artifact for
+   * an object storage bucket.
+   */
+  spec?: {
+    /**
+     * BucketName is the name of the object storage bucket.
+     */
+    bucketName: string;
+    /**
+     * CertSecretRef can be given the name of a Secret containing
+     * either or both of
+     *
+     * - a PEM-encoded client certificate (`tls.crt`) and private
+     * key (`tls.key`);
+     * - a PEM-encoded CA certificate (`ca.crt`)
+     *
+     * and whichever are supplied, will be used for connecting to the
+     * bucket. The client cert and key are useful if you are
+     * authenticating with a certificate; the CA cert is useful if
+     * you are using a self-signed server certificate. The Secret must
+     * be of type `Opaque` or `kubernetes.io/tls`.
+     *
+     * This field is only supported for the `generic` provider.
+     */
+    certSecretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * Endpoint is the object storage address the BucketName is located at.
+     */
+    endpoint: string;
+    /**
+     * Ignore overrides the set of excluded patterns in the .sourceignore format
+     * (which is the same as .gitignore). If not provided, a default will be used,
+     * consult the documentation for your version to find out what those are.
+     */
+    ignore?: string;
+    /**
+     * Insecure allows connecting to a non-TLS HTTP Endpoint.
+     */
+    insecure?: boolean;
+    /**
+     * Interval at which the Bucket Endpoint is checked for updates.
+     * This interval is approximate and may be subject to jitter to ensure
+     * efficient use of resources.
+     */
+    interval: string;
+    /**
+     * Prefix to use for server-side filtering of files in the Bucket.
+     */
+    prefix?: string;
+    /**
+     * Provider of the object storage bucket.
+     * Defaults to 'generic', which expects an S3 (API) compatible object
+     * storage.
+     */
+    provider?: string;
+    /**
+     * ProxySecretRef specifies the Secret containing the proxy configuration
+     * to use while communicating with the Bucket server.
+     */
+    proxySecretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * Region of the Endpoint where the BucketName is located in.
+     */
+    region?: string;
+    /**
+     * SecretRef specifies the Secret containing authentication credentials
+     * for the Bucket.
+     */
+    secretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * STS specifies the required configuration to use a Security Token
+     * Service for fetching temporary credentials to authenticate in a
+     * Bucket provider.
+     *
+     * This field is only supported for the `aws` and `generic` providers.
+     */
+    sts?: {
+      /**
+       * CertSecretRef can be given the name of a Secret containing
+       * either or both of
+       *
+       * - a PEM-encoded client certificate (`tls.crt`) and private
+       * key (`tls.key`);
+       * - a PEM-encoded CA certificate (`ca.crt`)
+       *
+       * and whichever are supplied, will be used for connecting to the
+       * STS endpoint. The client cert and key are useful if you are
+       * authenticating with a certificate; the CA cert is useful if
+       * you are using a self-signed server certificate. The Secret must
+       * be of type `Opaque` or `kubernetes.io/tls`.
+       *
+       * This field is only supported for the `ldap` provider.
+       */
+      certSecretRef?: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+      /**
+       * Endpoint is the HTTP/S endpoint of the Security Token Service from
+       * where temporary credentials will be fetched.
+       */
+      endpoint: string;
+      /**
+       * Provider of the Security Token Service.
+       */
+      provider: string;
+      /**
+       * SecretRef specifies the Secret containing authentication credentials
+       * for the STS endpoint. This Secret must contain the fields `username`
+       * and `password` and is supported only for the `ldap` provider.
+       */
+      secretRef?: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+    };
+    /**
+     * Suspend tells the controller to suspend the reconciliation of this
+     * Bucket.
+     */
+    suspend?: boolean;
+    /**
+     * Timeout for fetch operations, defaults to 60s.
+     */
+    timeout?: string;
+  };
+  /**
+   * BucketStatus records the observed state of a Bucket.
+   */
+  status?: {
+    /**
+     * Artifact represents the last successful Bucket reconciliation.
+     */
+    artifact?: {
+      /**
+       * Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
+       */
+      digest?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of the
+       * Artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Metadata holds upstream information such as OCI annotations.
+       */
+      metadata?: {
+        [k: string]: string;
+      };
+      /**
+       * Path is the relative file path of the Artifact. It can be used to locate
+       * the file in the root of the Artifact storage on the local file system of
+       * the controller managing the Source.
+       */
+      path: string;
+      /**
+       * Revision is a human-readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
+       */
+      revision: string;
+      /**
+       * Size is the number of bytes in the file.
+       */
+      size?: number;
+      /**
+       * URL is the HTTP address of the Artifact as exposed by the controller
+       * managing the Source. It can be used to retrieve the Artifact for
+       * consumption, e.g. by another controller applying the Artifact contents.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the Bucket.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedGeneration is the last observed generation of the Bucket object.
+     */
+    observedGeneration?: number;
+    /**
+     * ObservedIgnore is the observed exclusion patterns used for constructing
+     * the source artifact.
+     */
+    observedIgnore?: string;
+    /**
+     * URL is the dynamic fetch link for the latest Artifact.
+     * It is provided on a "best effort" basis, and using the precise
+     * BucketStatus.Artifact data is recommended.
+     */
+    url?: string;
+  };
+}

src/__generated__/resources/K8SBucketV1beta1.json

@@ -0,0 +1,219 @@
+{
+  "description": "Bucket is the Schema for the buckets API",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "BucketSpec defines the desired state of an S3 compatible bucket",
+      "properties": {
+        "accessFrom": {
+          "description": "AccessFrom defines an Access Control List for allowing cross-namespace references to this object.",
+          "properties": {
+            "namespaceSelectors": {
+              "description": "NamespaceSelectors is the list of namespace selectors to which this ACL applies.\nItems in this list are evaluated using a logical OR operation.",
+              "items": {
+                "description": "NamespaceSelector selects the namespaces to which this ACL applies.\nAn empty map of MatchLabels matches all namespaces in a cluster.",
+                "type": "object",
+                "properties": {
+                  "matchLabels": {
+                    "description": "MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  }
+                }
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "namespaceSelectors"
+          ],
+          "type": "object"
+        },
+        "bucketName": {
+          "description": "The bucket name.",
+          "type": "string"
+        },
+        "endpoint": {
+          "description": "The bucket endpoint address.",
+          "type": "string"
+        },
+        "ignore": {
+          "description": "Ignore overrides the set of excluded patterns in the .sourceignore format\n(which is the same as .gitignore). If not provided, a default will be used,\nconsult the documentation for your version to find out what those are.",
+          "type": "string"
+        },
+        "insecure": {
+          "description": "Insecure allows connecting to a non-TLS S3 HTTP endpoint.",
+          "type": "boolean"
+        },
+        "interval": {
+          "description": "The interval at which to check for bucket updates.",
+          "type": "string"
+        },
+        "provider": {
+          "_default": "generic",
+          "description": "The S3 compatible storage provider name, default ('generic').",
+          "_enum": [
+            "generic",
+            "aws",
+            "gcp"
+          ],
+          "type": "string"
+        },
+        "region": {
+          "description": "The bucket region.",
+          "type": "string"
+        },
+        "secretRef": {
+          "description": "The name of the secret containing authentication credentials\nfor the Bucket.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "suspend": {
+          "description": "This flag tells the controller to suspend the reconciliation of this source.",
+          "type": "boolean"
+        },
+        "timeout": {
+          "_default": "60s",
+          "description": "The timeout for download operations, defaults to 60s.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "bucketName",
+        "endpoint",
+        "interval"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "BucketStatus defines the observed state of a bucket",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the output of the last successful Bucket sync.",
+          "properties": {
+            "checksum": {
+              "description": "Checksum is the SHA256 checksum of the artifact.",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of this\nartifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "path": {
+              "description": "Path is the relative file path of this artifact.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm\nchart version, etc.",
+              "type": "string"
+            },
+            "url": {
+              "description": "URL is the HTTP address of this artifact.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the Bucket.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "url": {
+          "description": "URL is the download link for the artifact output of the last Bucket sync.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

src/__generated__/resources/K8SBucketV1beta1.ts

@@ -0,0 +1,184 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * Bucket is the Schema for the buckets API
+ */
+export interface K8SBucketV1Beta1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * BucketSpec defines the desired state of an S3 compatible bucket
+   */
+  spec?: {
+    /**
+     * AccessFrom defines an Access Control List for allowing cross-namespace references to this object.
+     */
+    accessFrom?: {
+      /**
+       * NamespaceSelectors is the list of namespace selectors to which this ACL applies.
+       * Items in this list are evaluated using a logical OR operation.
+       */
+      namespaceSelectors: {
+        /**
+         * MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+         * map is equivalent to an element of matchExpressions, whose key field is "key", the
+         * operator is "In", and the values array contains only "value". The requirements are ANDed.
+         */
+        matchLabels?: {
+          [k: string]: string;
+        };
+      }[];
+    };
+    /**
+     * The bucket name.
+     */
+    bucketName: string;
+    /**
+     * The bucket endpoint address.
+     */
+    endpoint: string;
+    /**
+     * Ignore overrides the set of excluded patterns in the .sourceignore format
+     * (which is the same as .gitignore). If not provided, a default will be used,
+     * consult the documentation for your version to find out what those are.
+     */
+    ignore?: string;
+    /**
+     * Insecure allows connecting to a non-TLS S3 HTTP endpoint.
+     */
+    insecure?: boolean;
+    /**
+     * The interval at which to check for bucket updates.
+     */
+    interval: string;
+    /**
+     * The S3 compatible storage provider name, default ('generic').
+     */
+    provider?: string;
+    /**
+     * The bucket region.
+     */
+    region?: string;
+    /**
+     * The name of the secret containing authentication credentials
+     * for the Bucket.
+     */
+    secretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * This flag tells the controller to suspend the reconciliation of this source.
+     */
+    suspend?: boolean;
+    /**
+     * The timeout for download operations, defaults to 60s.
+     */
+    timeout?: string;
+  };
+  /**
+   * BucketStatus defines the observed state of a bucket
+   */
+  status?: {
+    /**
+     * Artifact represents the output of the last successful Bucket sync.
+     */
+    artifact?: {
+      /**
+       * Checksum is the SHA256 checksum of the artifact.
+       */
+      checksum?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of this
+       * artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Path is the relative file path of this artifact.
+       */
+      path: string;
+      /**
+       * Revision is a human readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm
+       * chart version, etc.
+       */
+      revision?: string;
+      /**
+       * URL is the HTTP address of this artifact.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the Bucket.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedGeneration is the last observed generation.
+     */
+    observedGeneration?: number;
+    /**
+     * URL is the download link for the artifact output of the last Bucket sync.
+     */
+    url?: string;
+  };
+}

src/__generated__/resources/K8SBucketV1beta2.json

@@ -0,0 +1,341 @@
+{
+  "description": "Bucket is the Schema for the buckets API.",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "BucketSpec specifies the required configuration to produce an Artifact for\nan object storage bucket.",
+      "properties": {
+        "accessFrom": {
+          "description": "AccessFrom specifies an Access Control List for allowing cross-namespace\nreferences to this object.\nNOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092",
+          "properties": {
+            "namespaceSelectors": {
+              "description": "NamespaceSelectors is the list of namespace selectors to which this ACL applies.\nItems in this list are evaluated using a logical OR operation.",
+              "items": {
+                "description": "NamespaceSelector selects the namespaces to which this ACL applies.\nAn empty map of MatchLabels matches all namespaces in a cluster.",
+                "type": "object",
+                "properties": {
+                  "matchLabels": {
+                    "description": "MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  }
+                }
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "namespaceSelectors"
+          ],
+          "type": "object"
+        },
+        "bucketName": {
+          "description": "BucketName is the name of the object storage bucket.",
+          "type": "string"
+        },
+        "certSecretRef": {
+          "description": "CertSecretRef can be given the name of a Secret containing\neither or both of\n\n- a PEM-encoded client certificate (`tls.crt`) and private\nkey (`tls.key`);\n- a PEM-encoded CA certificate (`ca.crt`)\n\nand whichever are supplied, will be used for connecting to the\nbucket. The client cert and key are useful if you are\nauthenticating with a certificate; the CA cert is useful if\nyou are using a self-signed server certificate. The Secret must\nbe of type `Opaque` or `kubernetes.io/tls`.\n\nThis field is only supported for the `generic` provider.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "endpoint": {
+          "description": "Endpoint is the object storage address the BucketName is located at.",
+          "type": "string"
+        },
+        "ignore": {
+          "description": "Ignore overrides the set of excluded patterns in the .sourceignore format\n(which is the same as .gitignore). If not provided, a default will be used,\nconsult the documentation for your version to find out what those are.",
+          "type": "string"
+        },
+        "insecure": {
+          "description": "Insecure allows connecting to a non-TLS HTTP Endpoint.",
+          "type": "boolean"
+        },
+        "interval": {
+          "description": "Interval at which the Bucket Endpoint is checked for updates.\nThis interval is approximate and may be subject to jitter to ensure\nefficient use of resources.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
+          "type": "string"
+        },
+        "prefix": {
+          "description": "Prefix to use for server-side filtering of files in the Bucket.",
+          "type": "string"
+        },
+        "provider": {
+          "_default": "generic",
+          "description": "Provider of the object storage bucket.\nDefaults to 'generic', which expects an S3 (API) compatible object\nstorage.",
+          "_enum": [
+            "generic",
+            "aws",
+            "gcp",
+            "azure"
+          ],
+          "type": "string"
+        },
+        "proxySecretRef": {
+          "description": "ProxySecretRef specifies the Secret containing the proxy configuration\nto use while communicating with the Bucket server.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "region": {
+          "description": "Region of the Endpoint where the BucketName is located in.",
+          "type": "string"
+        },
+        "secretRef": {
+          "description": "SecretRef specifies the Secret containing authentication credentials\nfor the Bucket.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "sts": {
+          "description": "STS specifies the required configuration to use a Security Token\nService for fetching temporary credentials to authenticate in a\nBucket provider.\n\nThis field is only supported for the `aws` and `generic` providers.",
+          "properties": {
+            "certSecretRef": {
+              "description": "CertSecretRef can be given the name of a Secret containing\neither or both of\n\n- a PEM-encoded client certificate (`tls.crt`) and private\nkey (`tls.key`);\n- a PEM-encoded CA certificate (`ca.crt`)\n\nand whichever are supplied, will be used for connecting to the\nSTS endpoint. The client cert and key are useful if you are\nauthenticating with a certificate; the CA cert is useful if\nyou are using a self-signed server certificate. The Secret must\nbe of type `Opaque` or `kubernetes.io/tls`.\n\nThis field is only supported for the `ldap` provider.",
+              "properties": {
+                "name": {
+                  "description": "Name of the referent.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object"
+            },
+            "endpoint": {
+              "description": "Endpoint is the HTTP/S endpoint of the Security Token Service from\nwhere temporary credentials will be fetched.",
+              "pattern": "^(http|https)://.*$",
+              "type": "string"
+            },
+            "provider": {
+              "description": "Provider of the Security Token Service.",
+              "_enum": [
+                "aws",
+                "ldap"
+              ],
+              "type": "string"
+            },
+            "secretRef": {
+              "description": "SecretRef specifies the Secret containing authentication credentials\nfor the STS endpoint. This Secret must contain the fields `username`\nand `password` and is supported only for the `ldap` provider.",
+              "properties": {
+                "name": {
+                  "description": "Name of the referent.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "endpoint",
+            "provider"
+          ],
+          "type": "object"
+        },
+        "suspend": {
+          "description": "Suspend tells the controller to suspend the reconciliation of this\nBucket.",
+          "type": "boolean"
+        },
+        "timeout": {
+          "_default": "60s",
+          "description": "Timeout for fetch operations, defaults to 60s.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m))+$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "bucketName",
+        "endpoint",
+        "interval"
+      ],
+      "type": "object",
+      "x_kubernetes_validations": [
+        {
+          "message": "STS configuration is only supported for the 'aws' and 'generic' Bucket providers",
+          "rule": "self.provider == 'aws' || self.provider == 'generic' || !has(self.sts)"
+        },
+        {
+          "message": "'aws' is the only supported STS provider for the 'aws' Bucket provider",
+          "rule": "self.provider != 'aws' || !has(self.sts) || self.sts.provider == 'aws'"
+        },
+        {
+          "message": "'ldap' is the only supported STS provider for the 'generic' Bucket provider",
+          "rule": "self.provider != 'generic' || !has(self.sts) || self.sts.provider == 'ldap'"
+        },
+        {
+          "message": "spec.sts.secretRef is not required for the 'aws' STS provider",
+          "rule": "!has(self.sts) || self.sts.provider != 'aws' || !has(self.sts.secretRef)"
+        },
+        {
+          "message": "spec.sts.certSecretRef is not required for the 'aws' STS provider",
+          "rule": "!has(self.sts) || self.sts.provider != 'aws' || !has(self.sts.certSecretRef)"
+        }
+      ]
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "BucketStatus records the observed state of a Bucket.",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the last successful Bucket reconciliation.",
+          "properties": {
+            "digest": {
+              "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+              "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "metadata": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Metadata holds upstream information such as OCI annotations.",
+              "type": "object"
+            },
+            "path": {
+              "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+              "type": "string"
+            },
+            "size": {
+              "description": "Size is the number of bytes in the file.",
+              "format": "int64",
+              "type": "integer"
+            },
+            "url": {
+              "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "revision",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the Bucket.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation of the Bucket object.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "observedIgnore": {
+          "description": "ObservedIgnore is the observed exclusion patterns used for constructing\nthe source artifact.",
+          "type": "string"
+        },
+        "url": {
+          "description": "URL is the dynamic fetch link for the latest Artifact.\nIt is provided on a \"best effort\" basis, and using the precise\nBucketStatus.Artifact data is recommended.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

src/__generated__/resources/K8SBucketV1beta2.ts

@@ -0,0 +1,299 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * Bucket is the Schema for the buckets API.
+ */
+export interface K8SBucketV1Beta2 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * BucketSpec specifies the required configuration to produce an Artifact for
+   * an object storage bucket.
+   */
+  spec?: {
+    /**
+     * AccessFrom specifies an Access Control List for allowing cross-namespace
+     * references to this object.
+     * NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092
+     */
+    accessFrom?: {
+      /**
+       * NamespaceSelectors is the list of namespace selectors to which this ACL applies.
+       * Items in this list are evaluated using a logical OR operation.
+       */
+      namespaceSelectors: {
+        /**
+         * MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+         * map is equivalent to an element of matchExpressions, whose key field is "key", the
+         * operator is "In", and the values array contains only "value". The requirements are ANDed.
+         */
+        matchLabels?: {
+          [k: string]: string;
+        };
+      }[];
+    };
+    /**
+     * BucketName is the name of the object storage bucket.
+     */
+    bucketName: string;
+    /**
+     * CertSecretRef can be given the name of a Secret containing
+     * either or both of
+     *
+     * - a PEM-encoded client certificate (`tls.crt`) and private
+     * key (`tls.key`);
+     * - a PEM-encoded CA certificate (`ca.crt`)
+     *
+     * and whichever are supplied, will be used for connecting to the
+     * bucket. The client cert and key are useful if you are
+     * authenticating with a certificate; the CA cert is useful if
+     * you are using a self-signed server certificate. The Secret must
+     * be of type `Opaque` or `kubernetes.io/tls`.
+     *
+     * This field is only supported for the `generic` provider.
+     */
+    certSecretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * Endpoint is the object storage address the BucketName is located at.
+     */
+    endpoint: string;
+    /**
+     * Ignore overrides the set of excluded patterns in the .sourceignore format
+     * (which is the same as .gitignore). If not provided, a default will be used,
+     * consult the documentation for your version to find out what those are.
+     */
+    ignore?: string;
+    /**
+     * Insecure allows connecting to a non-TLS HTTP Endpoint.
+     */
+    insecure?: boolean;
+    /**
+     * Interval at which the Bucket Endpoint is checked for updates.
+     * This interval is approximate and may be subject to jitter to ensure
+     * efficient use of resources.
+     */
+    interval: string;
+    /**
+     * Prefix to use for server-side filtering of files in the Bucket.
+     */
+    prefix?: string;
+    /**
+     * Provider of the object storage bucket.
+     * Defaults to 'generic', which expects an S3 (API) compatible object
+     * storage.
+     */
+    provider?: string;
+    /**
+     * ProxySecretRef specifies the Secret containing the proxy configuration
+     * to use while communicating with the Bucket server.
+     */
+    proxySecretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * Region of the Endpoint where the BucketName is located in.
+     */
+    region?: string;
+    /**
+     * SecretRef specifies the Secret containing authentication credentials
+     * for the Bucket.
+     */
+    secretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * STS specifies the required configuration to use a Security Token
+     * Service for fetching temporary credentials to authenticate in a
+     * Bucket provider.
+     *
+     * This field is only supported for the `aws` and `generic` providers.
+     */
+    sts?: {
+      /**
+       * CertSecretRef can be given the name of a Secret containing
+       * either or both of
+       *
+       * - a PEM-encoded client certificate (`tls.crt`) and private
+       * key (`tls.key`);
+       * - a PEM-encoded CA certificate (`ca.crt`)
+       *
+       * and whichever are supplied, will be used for connecting to the
+       * STS endpoint. The client cert and key are useful if you are
+       * authenticating with a certificate; the CA cert is useful if
+       * you are using a self-signed server certificate. The Secret must
+       * be of type `Opaque` or `kubernetes.io/tls`.
+       *
+       * This field is only supported for the `ldap` provider.
+       */
+      certSecretRef?: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+      /**
+       * Endpoint is the HTTP/S endpoint of the Security Token Service from
+       * where temporary credentials will be fetched.
+       */
+      endpoint: string;
+      /**
+       * Provider of the Security Token Service.
+       */
+      provider: string;
+      /**
+       * SecretRef specifies the Secret containing authentication credentials
+       * for the STS endpoint. This Secret must contain the fields `username`
+       * and `password` and is supported only for the `ldap` provider.
+       */
+      secretRef?: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+    };
+    /**
+     * Suspend tells the controller to suspend the reconciliation of this
+     * Bucket.
+     */
+    suspend?: boolean;
+    /**
+     * Timeout for fetch operations, defaults to 60s.
+     */
+    timeout?: string;
+  };
+  /**
+   * BucketStatus records the observed state of a Bucket.
+   */
+  status?: {
+    /**
+     * Artifact represents the last successful Bucket reconciliation.
+     */
+    artifact?: {
+      /**
+       * Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
+       */
+      digest?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of the
+       * Artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Metadata holds upstream information such as OCI annotations.
+       */
+      metadata?: {
+        [k: string]: string;
+      };
+      /**
+       * Path is the relative file path of the Artifact. It can be used to locate
+       * the file in the root of the Artifact storage on the local file system of
+       * the controller managing the Source.
+       */
+      path: string;
+      /**
+       * Revision is a human-readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
+       */
+      revision: string;
+      /**
+       * Size is the number of bytes in the file.
+       */
+      size?: number;
+      /**
+       * URL is the HTTP address of the Artifact as exposed by the controller
+       * managing the Source. It can be used to retrieve the Artifact for
+       * consumption, e.g. by another controller applying the Artifact contents.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the Bucket.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedGeneration is the last observed generation of the Bucket object.
+     */
+    observedGeneration?: number;
+    /**
+     * ObservedIgnore is the observed exclusion patterns used for constructing
+     * the source artifact.
+     */
+    observedIgnore?: string;
+    /**
+     * URL is the dynamic fetch link for the latest Artifact.
+     * It is provided on a "best effort" basis, and using the precise
+     * BucketStatus.Artifact data is recommended.
+     */
+    url?: string;
+  };
+}

src/__generated__/resources/K8SETCDSnapshotFileV1.json

@@ -1,90 +1,125 @@
 {
+  "description": "ETCDSnapshot tracks a point-in-time snapshot of the etcd datastore.",
   "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
     "spec": {
+      "description": "Spec defines properties of an etcd snapshot file",
       "properties": {
         "location": {
-          "nullable": true,
+          "description": "Location is the absolute file:// or s3:// URI address of the snapshot.",
           "type": "string"
         },
         "metadata": {
           "additionalProperties": {
-            "type": "string",
+            "type": "string"
-            "nullable": true
           },
-          "nullable": true,
+          "description": "Metadata contains point-in-time snapshot of the contents of the\nk3s-etcd-snapshot-extra-metadata ConfigMap's data field, at the time the\nsnapshot was taken. This is intended to contain data about cluster state\nthat may be important for an external system to have available when restoring\nthe snapshot.",
           "type": "object"
         },
         "nodeName": {
-          "nullable": true,
+          "description": "NodeName contains the name of the node that took the snapshot.",
           "type": "string"
         },
         "s3": {
-          "nullable": true,
+          "description": "S3 contains extra metadata about the S3 storage system holding the\nsnapshot. This is guaranteed to be set for all snapshots uploaded to S3.\nIf not specified, the snapshot was not uploaded to S3.",
           "properties": {
             "bucket": {
-              "nullable": true,
+              "description": "Bucket is the bucket holding the snapshot",
+              "type": "string"
+            },
+            "bucketLookup": {
+              "description": "BucketLookup is the bucket lookup type, one of 'auto', 'dns', 'path'. Default if empty is 'auto'.",
               "type": "string"
             },
             "endpoint": {
-              "nullable": true,
+              "description": "Endpoint is the host or host:port of the S3 service",
               "type": "string"
             },
             "endpointCA": {
-              "nullable": true,
+              "description": "EndpointCA is the path on disk to the S3 service's trusted CA list. Leave empty to use the OS CA bundle.",
               "type": "string"
             },
             "insecure": {
+              "description": "Insecure is true if the S3 service uses HTTP instead of HTTPS",
               "type": "boolean"
             },
             "prefix": {
-              "nullable": true,
+              "description": "Prefix is the prefix in which the snapshot file is stored.",
               "type": "string"
             },
             "region": {
-              "nullable": true,
+              "description": "Region is the region of the S3 service",
               "type": "string"
             },
             "skipSSLVerify": {
+              "description": "SkipSSLVerify is true if TLS certificate verification is disabled",
               "type": "boolean"
             }
           },
           "type": "object"
         },
         "snapshotName": {
-          "nullable": true,
+          "description": "SnapshotName contains the base name of the snapshot file. CLI actions that act\non snapshots stored locally or within a pre-configured S3 bucket and\nprefix usually take the snapshot name as their argument.",
           "type": "string"
         }
       },
+      "required": [
+        "location",
+        "nodeName",
+        "snapshotName"
+      ],
       "type": "object"
     },
     "status": {
+      "description": "Status represents current information about a snapshot.",
       "properties": {
         "creationTime": {
-          "nullable": true,
+          "description": "CreationTime is the timestamp when the snapshot was taken by etcd.",
+          "format": "date-time",
           "type": "string"
         },
         "error": {
-          "nullable": true,
+          "description": "Error is the last observed error during snapshot creation, if any.\nIf the snapshot is retried, this field will be cleared on success.",
           "properties": {
             "message": {
-              "nullable": true,
+              "description": "Message is a string detailing the encountered error during snapshot creation if specified.\nNOTE: message may be logged, and it should not contain sensitive information.",
               "type": "string"
             },
             "time": {
-              "nullable": true,
+              "description": "Time is the timestamp when the error was encountered.",
+              "format": "date-time",
               "type": "string"
             }
           },
           "type": "object"
         },
         "readyToUse": {
-          "nullable": true,
+          "description": "ReadyToUse indicates that the snapshot is available to be restored.",
           "type": "boolean"
         },
         "size": {
-          "nullable": true,
+          "anyOf": [
+            {
+              "type": "integer"
+            },
+            {
               "type": "string"
             }
+          ],
+          "description": "Size is the size of the snapshot file, in bytes. If not specified, the snapshot failed.",
+          "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
+          "x_kubernetes_int_or_string": true
+        }
       },
       "type": "object"
     }

src/__generated__/resources/K8SETCDSnapshotFileV1.ts

@@ -5,31 +5,124 @@
  * and run json-schema-to-typescript to regenerate this file.
  */
 
+/**
+ * ETCDSnapshot tracks a point-in-time snapshot of the etcd datastore.
+ */
 export interface K8SETCDSnapshotFileV1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * Spec defines properties of an etcd snapshot file
+   */
   spec?: {
-    location?: string;
+    /**
+     * Location is the absolute file:// or s3:// URI address of the snapshot.
+     */
+    location: string;
+    /**
+     * Metadata contains point-in-time snapshot of the contents of the
+     * k3s-etcd-snapshot-extra-metadata ConfigMap's data field, at the time the
+     * snapshot was taken. This is intended to contain data about cluster state
+     * that may be important for an external system to have available when restoring
+     * the snapshot.
+     */
     metadata?: {
       [k: string]: string;
     };
-    nodeName?: string;
+    /**
+     * NodeName contains the name of the node that took the snapshot.
+     */
+    nodeName: string;
+    /**
+     * S3 contains extra metadata about the S3 storage system holding the
+     * snapshot. This is guaranteed to be set for all snapshots uploaded to S3.
+     * If not specified, the snapshot was not uploaded to S3.
+     */
     s3?: {
+      /**
+       * Bucket is the bucket holding the snapshot
+       */
       bucket?: string;
+      /**
+       * BucketLookup is the bucket lookup type, one of 'auto', 'dns', 'path'. Default if empty is 'auto'.
+       */
+      bucketLookup?: string;
+      /**
+       * Endpoint is the host or host:port of the S3 service
+       */
       endpoint?: string;
+      /**
+       * EndpointCA is the path on disk to the S3 service's trusted CA list. Leave empty to use the OS CA bundle.
+       */
       endpointCA?: string;
+      /**
+       * Insecure is true if the S3 service uses HTTP instead of HTTPS
+       */
       insecure?: boolean;
+      /**
+       * Prefix is the prefix in which the snapshot file is stored.
+       */
       prefix?: string;
+      /**
+       * Region is the region of the S3 service
+       */
       region?: string;
+      /**
+       * SkipSSLVerify is true if TLS certificate verification is disabled
+       */
       skipSSLVerify?: boolean;
     };
-    snapshotName?: string;
+    /**
+     * SnapshotName contains the base name of the snapshot file. CLI actions that act
+     * on snapshots stored locally or within a pre-configured S3 bucket and
+     * prefix usually take the snapshot name as their argument.
+     */
+    snapshotName: string;
   };
+  /**
+   * Status represents current information about a snapshot.
+   */
   status?: {
+    /**
+     * CreationTime is the timestamp when the snapshot was taken by etcd.
+     */
     creationTime?: string;
+    /**
+     * Error is the last observed error during snapshot creation, if any.
+     * If the snapshot is retried, this field will be cleared on success.
+     */
     error?: {
+      /**
+       * Message is a string detailing the encountered error during snapshot creation if specified.
+       * NOTE: message may be logged, and it should not contain sensitive information.
+       */
       message?: string;
+      /**
+       * Time is the timestamp when the error was encountered.
+       */
       time?: string;
     };
+    /**
+     * ReadyToUse indicates that the snapshot is available to be restored.
+     */
     readyToUse?: boolean;
-    size?: string;
+    /**
+     * Size is the size of the snapshot file, in bytes. If not specified, the snapshot failed.
+     */
+    size?: number | string;
   };
 }

src/__generated__/resources/K8SGitRepositoryV1.json

@@ -0,0 +1,412 @@
+{
+  "description": "GitRepository is the Schema for the gitrepositories API.",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "GitRepositorySpec specifies the required configuration to produce an\nArtifact for a Git repository.",
+      "properties": {
+        "ignore": {
+          "description": "Ignore overrides the set of excluded patterns in the .sourceignore format\n(which is the same as .gitignore). If not provided, a default will be used,\nconsult the documentation for your version to find out what those are.",
+          "type": "string"
+        },
+        "include": {
+          "description": "Include specifies a list of GitRepository resources which Artifacts\nshould be included in the Artifact produced for this GitRepository.",
+          "items": {
+            "description": "GitRepositoryInclude specifies a local reference to a GitRepository which\nArtifact (sub-)contents must be included, and where they should be placed.",
+            "type": "object",
+            "required": [
+              "repository"
+            ],
+            "properties": {
+              "fromPath": {
+                "description": "FromPath specifies the path to copy contents from, defaults to the root\nof the Artifact.",
+                "type": "string"
+              },
+              "repository": {
+                "description": "GitRepositoryRef specifies the GitRepository which Artifact contents\nmust be included.",
+                "type": "object",
+                "required": [
+                  "name"
+                ],
+                "properties": {
+                  "name": {
+                    "description": "Name of the referent.",
+                    "type": "string"
+                  }
+                }
+              },
+              "toPath": {
+                "description": "ToPath specifies the path to copy contents to, defaults to the name of\nthe GitRepositoryRef.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "interval": {
+          "description": "Interval at which the GitRepository URL is checked for updates.\nThis interval is approximate and may be subject to jitter to ensure\nefficient use of resources.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
+          "type": "string"
+        },
+        "provider": {
+          "description": "Provider used for authentication, can be 'azure', 'github', 'generic'.\nWhen not specified, defaults to 'generic'.",
+          "_enum": [
+            "generic",
+            "azure",
+            "github"
+          ],
+          "type": "string"
+        },
+        "proxySecretRef": {
+          "description": "ProxySecretRef specifies the Secret containing the proxy configuration\nto use while communicating with the Git server.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "recurseSubmodules": {
+          "description": "RecurseSubmodules enables the initialization of all submodules within\nthe GitRepository as cloned from the URL, using their default settings.",
+          "type": "boolean"
+        },
+        "ref": {
+          "description": "Reference specifies the Git reference to resolve and monitor for\nchanges, defaults to the 'master' branch.",
+          "properties": {
+            "branch": {
+              "description": "Branch to check out, defaults to 'master' if no other field is defined.",
+              "type": "string"
+            },
+            "commit": {
+              "description": "Commit SHA to check out, takes precedence over all reference fields.\n\nThis can be combined with Branch to shallow clone the branch, in which\nthe commit is expected to exist.",
+              "type": "string"
+            },
+            "name": {
+              "description": "Name of the reference to check out; takes precedence over Branch, Tag and SemVer.\n\nIt must be a valid Git reference: https://git-scm.com/docs/git-check-ref-format#_description\nExamples: \"refs/heads/main\", \"refs/tags/v0.1.0\", \"refs/pull/420/head\", \"refs/merge-requests/1/head\"",
+              "type": "string"
+            },
+            "semver": {
+              "description": "SemVer tag expression to check out, takes precedence over Tag.",
+              "type": "string"
+            },
+            "tag": {
+              "description": "Tag to check out, takes precedence over Branch.",
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "secretRef": {
+          "description": "SecretRef specifies the Secret containing authentication credentials for\nthe GitRepository.\nFor HTTPS repositories the Secret must contain 'username' and 'password'\nfields for basic auth or 'bearerToken' field for token auth.\nFor SSH repositories the Secret must contain 'identity'\nand 'known_hosts' fields.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "sparseCheckout": {
+          "description": "SparseCheckout specifies a list of directories to checkout when cloning\nthe repository. If specified, only these directories are included in the\nArtifact produced for this GitRepository.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "suspend": {
+          "description": "Suspend tells the controller to suspend the reconciliation of this\nGitRepository.",
+          "type": "boolean"
+        },
+        "timeout": {
+          "_default": "60s",
+          "description": "Timeout for Git operations like cloning, defaults to 60s.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m))+$",
+          "type": "string"
+        },
+        "url": {
+          "description": "URL specifies the Git repository URL, it can be an HTTP/S or SSH address.",
+          "pattern": "^(http|https|ssh)://.*$",
+          "type": "string"
+        },
+        "verify": {
+          "description": "Verification specifies the configuration to verify the Git commit\nsignature(s).",
+          "properties": {
+            "mode": {
+              "_default": "HEAD",
+              "description": "Mode specifies which Git object(s) should be verified.\n\nThe variants \"head\" and \"HEAD\" both imply the same thing, i.e. verify\nthe commit that the HEAD of the Git repository points to. The variant\n\"head\" solely exists to ensure backwards compatibility.",
+              "_enum": [
+                "head",
+                "HEAD",
+                "Tag",
+                "TagAndHEAD"
+              ],
+              "type": "string"
+            },
+            "secretRef": {
+              "description": "SecretRef specifies the Secret containing the public keys of trusted Git\nauthors.",
+              "properties": {
+                "name": {
+                  "description": "Name of the referent.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "secretRef"
+          ],
+          "type": "object"
+        }
+      },
+      "required": [
+        "interval",
+        "url"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "GitRepositoryStatus records the observed state of a Git repository.",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the last successful GitRepository reconciliation.",
+          "properties": {
+            "digest": {
+              "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+              "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "metadata": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Metadata holds upstream information such as OCI annotations.",
+              "type": "object"
+            },
+            "path": {
+              "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+              "type": "string"
+            },
+            "size": {
+              "description": "Size is the number of bytes in the file.",
+              "format": "int64",
+              "type": "integer"
+            },
+            "url": {
+              "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "revision",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the GitRepository.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "includedArtifacts": {
+          "description": "IncludedArtifacts contains a list of the last successfully included\nArtifacts as instructed by GitRepositorySpec.Include.",
+          "items": {
+            "description": "Artifact represents the output of a Source reconciliation.",
+            "type": "object",
+            "required": [
+              "lastUpdateTime",
+              "path",
+              "revision",
+              "url"
+            ],
+            "properties": {
+              "digest": {
+                "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+                "type": "string",
+                "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$"
+              },
+              "lastUpdateTime": {
+                "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "metadata": {
+                "description": "Metadata holds upstream information such as OCI annotations.",
+                "type": "object",
+                "additionalProperties": {
+                  "type": "string"
+                }
+              },
+              "path": {
+                "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+                "type": "string"
+              },
+              "revision": {
+                "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+                "type": "string"
+              },
+              "size": {
+                "description": "Size is the number of bytes in the file.",
+                "type": "integer",
+                "format": "int64"
+              },
+              "url": {
+                "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation of the GitRepository\nobject.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "observedIgnore": {
+          "description": "ObservedIgnore is the observed exclusion patterns used for constructing\nthe source artifact.",
+          "type": "string"
+        },
+        "observedInclude": {
+          "description": "ObservedInclude is the observed list of GitRepository resources used to\nproduce the current Artifact.",
+          "items": {
+            "description": "GitRepositoryInclude specifies a local reference to a GitRepository which\nArtifact (sub-)contents must be included, and where they should be placed.",
+            "type": "object",
+            "required": [
+              "repository"
+            ],
+            "properties": {
+              "fromPath": {
+                "description": "FromPath specifies the path to copy contents from, defaults to the root\nof the Artifact.",
+                "type": "string"
+              },
+              "repository": {
+                "description": "GitRepositoryRef specifies the GitRepository which Artifact contents\nmust be included.",
+                "type": "object",
+                "required": [
+                  "name"
+                ],
+                "properties": {
+                  "name": {
+                    "description": "Name of the referent.",
+                    "type": "string"
+                  }
+                }
+              },
+              "toPath": {
+                "description": "ToPath specifies the path to copy contents to, defaults to the name of\nthe GitRepositoryRef.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "observedRecurseSubmodules": {
+          "description": "ObservedRecurseSubmodules is the observed resource submodules\nconfiguration used to produce the current Artifact.",
+          "type": "boolean"
+        },
+        "observedSparseCheckout": {
+          "description": "ObservedSparseCheckout is the observed list of directories used to\nproduce the current Artifact.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "sourceVerificationMode": {
+          "description": "SourceVerificationMode is the last used verification mode indicating\nwhich Git object(s) have been verified.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

src/__generated__/resources/K8SGitRepositoryV1.ts

@@ -0,0 +1,363 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * GitRepository is the Schema for the gitrepositories API.
+ */
+export interface K8SGitRepositoryV1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * GitRepositorySpec specifies the required configuration to produce an
+   * Artifact for a Git repository.
+   */
+  spec?: {
+    /**
+     * Ignore overrides the set of excluded patterns in the .sourceignore format
+     * (which is the same as .gitignore). If not provided, a default will be used,
+     * consult the documentation for your version to find out what those are.
+     */
+    ignore?: string;
+    /**
+     * Include specifies a list of GitRepository resources which Artifacts
+     * should be included in the Artifact produced for this GitRepository.
+     */
+    include?: {
+      /**
+       * FromPath specifies the path to copy contents from, defaults to the root
+       * of the Artifact.
+       */
+      fromPath?: string;
+      /**
+       * GitRepositoryRef specifies the GitRepository which Artifact contents
+       * must be included.
+       */
+      repository: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+      /**
+       * ToPath specifies the path to copy contents to, defaults to the name of
+       * the GitRepositoryRef.
+       */
+      toPath?: string;
+    }[];
+    /**
+     * Interval at which the GitRepository URL is checked for updates.
+     * This interval is approximate and may be subject to jitter to ensure
+     * efficient use of resources.
+     */
+    interval: string;
+    /**
+     * Provider used for authentication, can be 'azure', 'github', 'generic'.
+     * When not specified, defaults to 'generic'.
+     */
+    provider?: string;
+    /**
+     * ProxySecretRef specifies the Secret containing the proxy configuration
+     * to use while communicating with the Git server.
+     */
+    proxySecretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * RecurseSubmodules enables the initialization of all submodules within
+     * the GitRepository as cloned from the URL, using their default settings.
+     */
+    recurseSubmodules?: boolean;
+    /**
+     * Reference specifies the Git reference to resolve and monitor for
+     * changes, defaults to the 'master' branch.
+     */
+    ref?: {
+      /**
+       * Branch to check out, defaults to 'master' if no other field is defined.
+       */
+      branch?: string;
+      /**
+       * Commit SHA to check out, takes precedence over all reference fields.
+       *
+       * This can be combined with Branch to shallow clone the branch, in which
+       * the commit is expected to exist.
+       */
+      commit?: string;
+      /**
+       * Name of the reference to check out; takes precedence over Branch, Tag and SemVer.
+       *
+       * It must be a valid Git reference: https://git-scm.com/docs/git-check-ref-format#_description
+       * Examples: "refs/heads/main", "refs/tags/v0.1.0", "refs/pull/420/head", "refs/merge-requests/1/head"
+       */
+      name?: string;
+      /**
+       * SemVer tag expression to check out, takes precedence over Tag.
+       */
+      semver?: string;
+      /**
+       * Tag to check out, takes precedence over Branch.
+       */
+      tag?: string;
+    };
+    /**
+     * SecretRef specifies the Secret containing authentication credentials for
+     * the GitRepository.
+     * For HTTPS repositories the Secret must contain 'username' and 'password'
+     * fields for basic auth or 'bearerToken' field for token auth.
+     * For SSH repositories the Secret must contain 'identity'
+     * and 'known_hosts' fields.
+     */
+    secretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * SparseCheckout specifies a list of directories to checkout when cloning
+     * the repository. If specified, only these directories are included in the
+     * Artifact produced for this GitRepository.
+     */
+    sparseCheckout?: string[];
+    /**
+     * Suspend tells the controller to suspend the reconciliation of this
+     * GitRepository.
+     */
+    suspend?: boolean;
+    /**
+     * Timeout for Git operations like cloning, defaults to 60s.
+     */
+    timeout?: string;
+    /**
+     * URL specifies the Git repository URL, it can be an HTTP/S or SSH address.
+     */
+    url: string;
+    /**
+     * Verification specifies the configuration to verify the Git commit
+     * signature(s).
+     */
+    verify?: {
+      /**
+       * Mode specifies which Git object(s) should be verified.
+       *
+       * The variants "head" and "HEAD" both imply the same thing, i.e. verify
+       * the commit that the HEAD of the Git repository points to. The variant
+       * "head" solely exists to ensure backwards compatibility.
+       */
+      mode?: string;
+      /**
+       * SecretRef specifies the Secret containing the public keys of trusted Git
+       * authors.
+       */
+      secretRef: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+    };
+  };
+  /**
+   * GitRepositoryStatus records the observed state of a Git repository.
+   */
+  status?: {
+    /**
+     * Artifact represents the last successful GitRepository reconciliation.
+     */
+    artifact?: {
+      /**
+       * Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
+       */
+      digest?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of the
+       * Artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Metadata holds upstream information such as OCI annotations.
+       */
+      metadata?: {
+        [k: string]: string;
+      };
+      /**
+       * Path is the relative file path of the Artifact. It can be used to locate
+       * the file in the root of the Artifact storage on the local file system of
+       * the controller managing the Source.
+       */
+      path: string;
+      /**
+       * Revision is a human-readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
+       */
+      revision: string;
+      /**
+       * Size is the number of bytes in the file.
+       */
+      size?: number;
+      /**
+       * URL is the HTTP address of the Artifact as exposed by the controller
+       * managing the Source. It can be used to retrieve the Artifact for
+       * consumption, e.g. by another controller applying the Artifact contents.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the GitRepository.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * IncludedArtifacts contains a list of the last successfully included
+     * Artifacts as instructed by GitRepositorySpec.Include.
+     */
+    includedArtifacts?: {
+      /**
+       * Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
+       */
+      digest?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of the
+       * Artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Metadata holds upstream information such as OCI annotations.
+       */
+      metadata?: {
+        [k: string]: string;
+      };
+      /**
+       * Path is the relative file path of the Artifact. It can be used to locate
+       * the file in the root of the Artifact storage on the local file system of
+       * the controller managing the Source.
+       */
+      path: string;
+      /**
+       * Revision is a human-readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
+       */
+      revision: string;
+      /**
+       * Size is the number of bytes in the file.
+       */
+      size?: number;
+      /**
+       * URL is the HTTP address of the Artifact as exposed by the controller
+       * managing the Source. It can be used to retrieve the Artifact for
+       * consumption, e.g. by another controller applying the Artifact contents.
+       */
+      url: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedGeneration is the last observed generation of the GitRepository
+     * object.
+     */
+    observedGeneration?: number;
+    /**
+     * ObservedIgnore is the observed exclusion patterns used for constructing
+     * the source artifact.
+     */
+    observedIgnore?: string;
+    /**
+     * ObservedInclude is the observed list of GitRepository resources used to
+     * produce the current Artifact.
+     */
+    observedInclude?: {
+      /**
+       * FromPath specifies the path to copy contents from, defaults to the root
+       * of the Artifact.
+       */
+      fromPath?: string;
+      /**
+       * GitRepositoryRef specifies the GitRepository which Artifact contents
+       * must be included.
+       */
+      repository: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+      /**
+       * ToPath specifies the path to copy contents to, defaults to the name of
+       * the GitRepositoryRef.
+       */
+      toPath?: string;
+    }[];
+    /**
+     * ObservedRecurseSubmodules is the observed resource submodules
+     * configuration used to produce the current Artifact.
+     */
+    observedRecurseSubmodules?: boolean;
+    /**
+     * ObservedSparseCheckout is the observed list of directories used to
+     * produce the current Artifact.
+     */
+    observedSparseCheckout?: string[];
+    /**
+     * SourceVerificationMode is the last used verification mode indicating
+     * which Git object(s) have been verified.
+     */
+    sourceVerificationMode?: string;
+  };
+}

src/__generated__/resources/K8SGitRepositoryV1beta1.json

@@ -0,0 +1,331 @@
+{
+  "description": "GitRepository is the Schema for the gitrepositories API",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "GitRepositorySpec defines the desired state of a Git repository.",
+      "properties": {
+        "accessFrom": {
+          "description": "AccessFrom defines an Access Control List for allowing cross-namespace references to this object.",
+          "properties": {
+            "namespaceSelectors": {
+              "description": "NamespaceSelectors is the list of namespace selectors to which this ACL applies.\nItems in this list are evaluated using a logical OR operation.",
+              "items": {
+                "description": "NamespaceSelector selects the namespaces to which this ACL applies.\nAn empty map of MatchLabels matches all namespaces in a cluster.",
+                "type": "object",
+                "properties": {
+                  "matchLabels": {
+                    "description": "MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  }
+                }
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "namespaceSelectors"
+          ],
+          "type": "object"
+        },
+        "gitImplementation": {
+          "_default": "go-git",
+          "description": "Determines which git client library to use.\nDefaults to go-git, valid values are ('go-git', 'libgit2').",
+          "_enum": [
+            "go-git",
+            "libgit2"
+          ],
+          "type": "string"
+        },
+        "ignore": {
+          "description": "Ignore overrides the set of excluded patterns in the .sourceignore format\n(which is the same as .gitignore). If not provided, a default will be used,\nconsult the documentation for your version to find out what those are.",
+          "type": "string"
+        },
+        "include": {
+          "description": "Extra git repositories to map into the repository",
+          "items": {
+            "description": "GitRepositoryInclude defines a source with a from and to path.",
+            "type": "object",
+            "required": [
+              "repository"
+            ],
+            "properties": {
+              "fromPath": {
+                "description": "The path to copy contents from, defaults to the root directory.",
+                "type": "string"
+              },
+              "repository": {
+                "description": "Reference to a GitRepository to include.",
+                "type": "object",
+                "required": [
+                  "name"
+                ],
+                "properties": {
+                  "name": {
+                    "description": "Name of the referent.",
+                    "type": "string"
+                  }
+                }
+              },
+              "toPath": {
+                "description": "The path to copy contents to, defaults to the name of the source ref.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "interval": {
+          "description": "The interval at which to check for repository updates.",
+          "type": "string"
+        },
+        "recurseSubmodules": {
+          "description": "When enabled, after the clone is created, initializes all submodules within,\nusing their default settings.\nThis option is available only when using the 'go-git' GitImplementation.",
+          "type": "boolean"
+        },
+        "ref": {
+          "description": "The Git reference to checkout and monitor for changes, defaults to\nmaster branch.",
+          "properties": {
+            "branch": {
+              "description": "The Git branch to checkout, defaults to master.",
+              "type": "string"
+            },
+            "commit": {
+              "description": "The Git commit SHA to checkout, if specified Tag filters will be ignored.",
+              "type": "string"
+            },
+            "semver": {
+              "description": "The Git tag semver expression, takes precedence over Tag.",
+              "type": "string"
+            },
+            "tag": {
+              "description": "The Git tag to checkout, takes precedence over Branch.",
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "secretRef": {
+          "description": "The secret name containing the Git credentials.\nFor HTTPS repositories the secret must contain username and password\nfields.\nFor SSH repositories the secret must contain identity and known_hosts\nfields.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "suspend": {
+          "description": "This flag tells the controller to suspend the reconciliation of this source.",
+          "type": "boolean"
+        },
+        "timeout": {
+          "_default": "60s",
+          "description": "The timeout for remote Git operations like cloning, defaults to 60s.",
+          "type": "string"
+        },
+        "url": {
+          "description": "The repository URL, can be a HTTP/S or SSH address.",
+          "pattern": "^(http|https|ssh)://.*$",
+          "type": "string"
+        },
+        "verify": {
+          "description": "Verify OpenPGP signature for the Git commit HEAD points to.",
+          "properties": {
+            "mode": {
+              "description": "Mode describes what git object should be verified, currently ('head').",
+              "_enum": [
+                "head"
+              ],
+              "type": "string"
+            },
+            "secretRef": {
+              "description": "The secret name containing the public keys of all trusted Git authors.",
+              "properties": {
+                "name": {
+                  "description": "Name of the referent.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "mode"
+          ],
+          "type": "object"
+        }
+      },
+      "required": [
+        "interval",
+        "url"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "GitRepositoryStatus defines the observed state of a Git repository.",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the output of the last successful repository sync.",
+          "properties": {
+            "checksum": {
+              "description": "Checksum is the SHA256 checksum of the artifact.",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of this\nartifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "path": {
+              "description": "Path is the relative file path of this artifact.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm\nchart version, etc.",
+              "type": "string"
+            },
+            "url": {
+              "description": "URL is the HTTP address of this artifact.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the GitRepository.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "includedArtifacts": {
+          "description": "IncludedArtifacts represents the included artifacts from the last successful repository sync.",
+          "items": {
+            "description": "Artifact represents the output of a source synchronisation.",
+            "type": "object",
+            "required": [
+              "lastUpdateTime",
+              "path",
+              "url"
+            ],
+            "properties": {
+              "checksum": {
+                "description": "Checksum is the SHA256 checksum of the artifact.",
+                "type": "string"
+              },
+              "lastUpdateTime": {
+                "description": "LastUpdateTime is the timestamp corresponding to the last update of this\nartifact.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "path": {
+                "description": "Path is the relative file path of this artifact.",
+                "type": "string"
+              },
+              "revision": {
+                "description": "Revision is a human readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm\nchart version, etc.",
+                "type": "string"
+              },
+              "url": {
+                "description": "URL is the HTTP address of this artifact.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "url": {
+          "description": "URL is the download link for the artifact output of the last repository\nsync.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

src/__generated__/resources/K8SGitRepositoryV1beta1.ts

@@ -0,0 +1,273 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * GitRepository is the Schema for the gitrepositories API
+ */
+export interface K8SGitRepositoryV1Beta1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * GitRepositorySpec defines the desired state of a Git repository.
+   */
+  spec?: {
+    /**
+     * AccessFrom defines an Access Control List for allowing cross-namespace references to this object.
+     */
+    accessFrom?: {
+      /**
+       * NamespaceSelectors is the list of namespace selectors to which this ACL applies.
+       * Items in this list are evaluated using a logical OR operation.
+       */
+      namespaceSelectors: {
+        /**
+         * MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+         * map is equivalent to an element of matchExpressions, whose key field is "key", the
+         * operator is "In", and the values array contains only "value". The requirements are ANDed.
+         */
+        matchLabels?: {
+          [k: string]: string;
+        };
+      }[];
+    };
+    /**
+     * Determines which git client library to use.
+     * Defaults to go-git, valid values are ('go-git', 'libgit2').
+     */
+    gitImplementation?: string;
+    /**
+     * Ignore overrides the set of excluded patterns in the .sourceignore format
+     * (which is the same as .gitignore). If not provided, a default will be used,
+     * consult the documentation for your version to find out what those are.
+     */
+    ignore?: string;
+    /**
+     * Extra git repositories to map into the repository
+     */
+    include?: {
+      /**
+       * The path to copy contents from, defaults to the root directory.
+       */
+      fromPath?: string;
+      /**
+       * Reference to a GitRepository to include.
+       */
+      repository: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+      /**
+       * The path to copy contents to, defaults to the name of the source ref.
+       */
+      toPath?: string;
+    }[];
+    /**
+     * The interval at which to check for repository updates.
+     */
+    interval: string;
+    /**
+     * When enabled, after the clone is created, initializes all submodules within,
+     * using their default settings.
+     * This option is available only when using the 'go-git' GitImplementation.
+     */
+    recurseSubmodules?: boolean;
+    /**
+     * The Git reference to checkout and monitor for changes, defaults to
+     * master branch.
+     */
+    ref?: {
+      /**
+       * The Git branch to checkout, defaults to master.
+       */
+      branch?: string;
+      /**
+       * The Git commit SHA to checkout, if specified Tag filters will be ignored.
+       */
+      commit?: string;
+      /**
+       * The Git tag semver expression, takes precedence over Tag.
+       */
+      semver?: string;
+      /**
+       * The Git tag to checkout, takes precedence over Branch.
+       */
+      tag?: string;
+    };
+    /**
+     * The secret name containing the Git credentials.
+     * For HTTPS repositories the secret must contain username and password
+     * fields.
+     * For SSH repositories the secret must contain identity and known_hosts
+     * fields.
+     */
+    secretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * This flag tells the controller to suspend the reconciliation of this source.
+     */
+    suspend?: boolean;
+    /**
+     * The timeout for remote Git operations like cloning, defaults to 60s.
+     */
+    timeout?: string;
+    /**
+     * The repository URL, can be a HTTP/S or SSH address.
+     */
+    url: string;
+    /**
+     * Verify OpenPGP signature for the Git commit HEAD points to.
+     */
+    verify?: {
+      /**
+       * Mode describes what git object should be verified, currently ('head').
+       */
+      mode: string;
+      /**
+       * The secret name containing the public keys of all trusted Git authors.
+       */
+      secretRef?: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+    };
+  };
+  /**
+   * GitRepositoryStatus defines the observed state of a Git repository.
+   */
+  status?: {
+    /**
+     * Artifact represents the output of the last successful repository sync.
+     */
+    artifact?: {
+      /**
+       * Checksum is the SHA256 checksum of the artifact.
+       */
+      checksum?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of this
+       * artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Path is the relative file path of this artifact.
+       */
+      path: string;
+      /**
+       * Revision is a human readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm
+       * chart version, etc.
+       */
+      revision?: string;
+      /**
+       * URL is the HTTP address of this artifact.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the GitRepository.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * IncludedArtifacts represents the included artifacts from the last successful repository sync.
+     */
+    includedArtifacts?: {
+      /**
+       * Checksum is the SHA256 checksum of the artifact.
+       */
+      checksum?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of this
+       * artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Path is the relative file path of this artifact.
+       */
+      path: string;
+      /**
+       * Revision is a human readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm
+       * chart version, etc.
+       */
+      revision?: string;
+      /**
+       * URL is the HTTP address of this artifact.
+       */
+      url: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedGeneration is the last observed generation.
+     */
+    observedGeneration?: number;
+    /**
+     * URL is the download link for the artifact output of the last repository
+     * sync.
+     */
+    url?: string;
+  };
+}

src/__generated__/resources/K8SGitRepositoryV1beta2.json

@@ -0,0 +1,412 @@
+{
+  "description": "GitRepository is the Schema for the gitrepositories API.",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "GitRepositorySpec specifies the required configuration to produce an\nArtifact for a Git repository.",
+      "properties": {
+        "accessFrom": {
+          "description": "AccessFrom specifies an Access Control List for allowing cross-namespace\nreferences to this object.\nNOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092",
+          "properties": {
+            "namespaceSelectors": {
+              "description": "NamespaceSelectors is the list of namespace selectors to which this ACL applies.\nItems in this list are evaluated using a logical OR operation.",
+              "items": {
+                "description": "NamespaceSelector selects the namespaces to which this ACL applies.\nAn empty map of MatchLabels matches all namespaces in a cluster.",
+                "type": "object",
+                "properties": {
+                  "matchLabels": {
+                    "description": "MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  }
+                }
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "namespaceSelectors"
+          ],
+          "type": "object"
+        },
+        "gitImplementation": {
+          "_default": "go-git",
+          "description": "GitImplementation specifies which Git client library implementation to\nuse. Defaults to 'go-git', valid values are ('go-git', 'libgit2').\nDeprecated: gitImplementation is deprecated now that 'go-git' is the\nonly supported implementation.",
+          "_enum": [
+            "go-git",
+            "libgit2"
+          ],
+          "type": "string"
+        },
+        "ignore": {
+          "description": "Ignore overrides the set of excluded patterns in the .sourceignore format\n(which is the same as .gitignore). If not provided, a default will be used,\nconsult the documentation for your version to find out what those are.",
+          "type": "string"
+        },
+        "include": {
+          "description": "Include specifies a list of GitRepository resources which Artifacts\nshould be included in the Artifact produced for this GitRepository.",
+          "items": {
+            "description": "GitRepositoryInclude specifies a local reference to a GitRepository which\nArtifact (sub-)contents must be included, and where they should be placed.",
+            "type": "object",
+            "required": [
+              "repository"
+            ],
+            "properties": {
+              "fromPath": {
+                "description": "FromPath specifies the path to copy contents from, defaults to the root\nof the Artifact.",
+                "type": "string"
+              },
+              "repository": {
+                "description": "GitRepositoryRef specifies the GitRepository which Artifact contents\nmust be included.",
+                "type": "object",
+                "required": [
+                  "name"
+                ],
+                "properties": {
+                  "name": {
+                    "description": "Name of the referent.",
+                    "type": "string"
+                  }
+                }
+              },
+              "toPath": {
+                "description": "ToPath specifies the path to copy contents to, defaults to the name of\nthe GitRepositoryRef.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "interval": {
+          "description": "Interval at which to check the GitRepository for updates.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
+          "type": "string"
+        },
+        "recurseSubmodules": {
+          "description": "RecurseSubmodules enables the initialization of all submodules within\nthe GitRepository as cloned from the URL, using their default settings.",
+          "type": "boolean"
+        },
+        "ref": {
+          "description": "Reference specifies the Git reference to resolve and monitor for\nchanges, defaults to the 'master' branch.",
+          "properties": {
+            "branch": {
+              "description": "Branch to check out, defaults to 'master' if no other field is defined.",
+              "type": "string"
+            },
+            "commit": {
+              "description": "Commit SHA to check out, takes precedence over all reference fields.\n\nThis can be combined with Branch to shallow clone the branch, in which\nthe commit is expected to exist.",
+              "type": "string"
+            },
+            "name": {
+              "description": "Name of the reference to check out; takes precedence over Branch, Tag and SemVer.\n\nIt must be a valid Git reference: https://git-scm.com/docs/git-check-ref-format#_description\nExamples: \"refs/heads/main\", \"refs/tags/v0.1.0\", \"refs/pull/420/head\", \"refs/merge-requests/1/head\"",
+              "type": "string"
+            },
+            "semver": {
+              "description": "SemVer tag expression to check out, takes precedence over Tag.",
+              "type": "string"
+            },
+            "tag": {
+              "description": "Tag to check out, takes precedence over Branch.",
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "secretRef": {
+          "description": "SecretRef specifies the Secret containing authentication credentials for\nthe GitRepository.\nFor HTTPS repositories the Secret must contain 'username' and 'password'\nfields for basic auth or 'bearerToken' field for token auth.\nFor SSH repositories the Secret must contain 'identity'\nand 'known_hosts' fields.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "suspend": {
+          "description": "Suspend tells the controller to suspend the reconciliation of this\nGitRepository.",
+          "type": "boolean"
+        },
+        "timeout": {
+          "_default": "60s",
+          "description": "Timeout for Git operations like cloning, defaults to 60s.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m))+$",
+          "type": "string"
+        },
+        "url": {
+          "description": "URL specifies the Git repository URL, it can be an HTTP/S or SSH address.",
+          "pattern": "^(http|https|ssh)://.*$",
+          "type": "string"
+        },
+        "verify": {
+          "description": "Verification specifies the configuration to verify the Git commit\nsignature(s).",
+          "properties": {
+            "mode": {
+              "description": "Mode specifies what Git object should be verified, currently ('head').",
+              "_enum": [
+                "head"
+              ],
+              "type": "string"
+            },
+            "secretRef": {
+              "description": "SecretRef specifies the Secret containing the public keys of trusted Git\nauthors.",
+              "properties": {
+                "name": {
+                  "description": "Name of the referent.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "mode",
+            "secretRef"
+          ],
+          "type": "object"
+        }
+      },
+      "required": [
+        "interval",
+        "url"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "GitRepositoryStatus records the observed state of a Git repository.",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the last successful GitRepository reconciliation.",
+          "properties": {
+            "digest": {
+              "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+              "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "metadata": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Metadata holds upstream information such as OCI annotations.",
+              "type": "object"
+            },
+            "path": {
+              "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+              "type": "string"
+            },
+            "size": {
+              "description": "Size is the number of bytes in the file.",
+              "format": "int64",
+              "type": "integer"
+            },
+            "url": {
+              "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "revision",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the GitRepository.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "contentConfigChecksum": {
+          "description": "ContentConfigChecksum is a checksum of all the configurations related to\nthe content of the source artifact:\n - .spec.ignore\n - .spec.recurseSubmodules\n - .spec.included and the checksum of the included artifacts\nobserved in .status.observedGeneration version of the object. This can\nbe used to determine if the content of the included repository has\nchanged.\nIt has the format of `<algo>:<checksum>`, for example: `sha256:<checksum>`.\n\nDeprecated: Replaced with explicit fields for observed artifact content\nconfig in the status.",
+          "type": "string"
+        },
+        "includedArtifacts": {
+          "description": "IncludedArtifacts contains a list of the last successfully included\nArtifacts as instructed by GitRepositorySpec.Include.",
+          "items": {
+            "description": "Artifact represents the output of a Source reconciliation.",
+            "type": "object",
+            "required": [
+              "lastUpdateTime",
+              "path",
+              "revision",
+              "url"
+            ],
+            "properties": {
+              "digest": {
+                "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+                "type": "string",
+                "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$"
+              },
+              "lastUpdateTime": {
+                "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "metadata": {
+                "description": "Metadata holds upstream information such as OCI annotations.",
+                "type": "object",
+                "additionalProperties": {
+                  "type": "string"
+                }
+              },
+              "path": {
+                "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+                "type": "string"
+              },
+              "revision": {
+                "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+                "type": "string"
+              },
+              "size": {
+                "description": "Size is the number of bytes in the file.",
+                "type": "integer",
+                "format": "int64"
+              },
+              "url": {
+                "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation of the GitRepository\nobject.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "observedIgnore": {
+          "description": "ObservedIgnore is the observed exclusion patterns used for constructing\nthe source artifact.",
+          "type": "string"
+        },
+        "observedInclude": {
+          "description": "ObservedInclude is the observed list of GitRepository resources used to\nto produce the current Artifact.",
+          "items": {
+            "description": "GitRepositoryInclude specifies a local reference to a GitRepository which\nArtifact (sub-)contents must be included, and where they should be placed.",
+            "type": "object",
+            "required": [
+              "repository"
+            ],
+            "properties": {
+              "fromPath": {
+                "description": "FromPath specifies the path to copy contents from, defaults to the root\nof the Artifact.",
+                "type": "string"
+              },
+              "repository": {
+                "description": "GitRepositoryRef specifies the GitRepository which Artifact contents\nmust be included.",
+                "type": "object",
+                "required": [
+                  "name"
+                ],
+                "properties": {
+                  "name": {
+                    "description": "Name of the referent.",
+                    "type": "string"
+                  }
+                }
+              },
+              "toPath": {
+                "description": "ToPath specifies the path to copy contents to, defaults to the name of\nthe GitRepositoryRef.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "observedRecurseSubmodules": {
+          "description": "ObservedRecurseSubmodules is the observed resource submodules\nconfiguration used to produce the current Artifact.",
+          "type": "boolean"
+        },
+        "url": {
+          "description": "URL is the dynamic fetch link for the latest Artifact.\nIt is provided on a \"best effort\" basis, and using the precise\nGitRepositoryStatus.Artifact data is recommended.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

src/__generated__/resources/K8SGitRepositoryV1beta2.ts

@@ -0,0 +1,375 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * GitRepository is the Schema for the gitrepositories API.
+ */
+export interface K8SGitRepositoryV1Beta2 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * GitRepositorySpec specifies the required configuration to produce an
+   * Artifact for a Git repository.
+   */
+  spec?: {
+    /**
+     * AccessFrom specifies an Access Control List for allowing cross-namespace
+     * references to this object.
+     * NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092
+     */
+    accessFrom?: {
+      /**
+       * NamespaceSelectors is the list of namespace selectors to which this ACL applies.
+       * Items in this list are evaluated using a logical OR operation.
+       */
+      namespaceSelectors: {
+        /**
+         * MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+         * map is equivalent to an element of matchExpressions, whose key field is "key", the
+         * operator is "In", and the values array contains only "value". The requirements are ANDed.
+         */
+        matchLabels?: {
+          [k: string]: string;
+        };
+      }[];
+    };
+    /**
+     * GitImplementation specifies which Git client library implementation to
+     * use. Defaults to 'go-git', valid values are ('go-git', 'libgit2').
+     * Deprecated: gitImplementation is deprecated now that 'go-git' is the
+     * only supported implementation.
+     */
+    gitImplementation?: string;
+    /**
+     * Ignore overrides the set of excluded patterns in the .sourceignore format
+     * (which is the same as .gitignore). If not provided, a default will be used,
+     * consult the documentation for your version to find out what those are.
+     */
+    ignore?: string;
+    /**
+     * Include specifies a list of GitRepository resources which Artifacts
+     * should be included in the Artifact produced for this GitRepository.
+     */
+    include?: {
+      /**
+       * FromPath specifies the path to copy contents from, defaults to the root
+       * of the Artifact.
+       */
+      fromPath?: string;
+      /**
+       * GitRepositoryRef specifies the GitRepository which Artifact contents
+       * must be included.
+       */
+      repository: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+      /**
+       * ToPath specifies the path to copy contents to, defaults to the name of
+       * the GitRepositoryRef.
+       */
+      toPath?: string;
+    }[];
+    /**
+     * Interval at which to check the GitRepository for updates.
+     */
+    interval: string;
+    /**
+     * RecurseSubmodules enables the initialization of all submodules within
+     * the GitRepository as cloned from the URL, using their default settings.
+     */
+    recurseSubmodules?: boolean;
+    /**
+     * Reference specifies the Git reference to resolve and monitor for
+     * changes, defaults to the 'master' branch.
+     */
+    ref?: {
+      /**
+       * Branch to check out, defaults to 'master' if no other field is defined.
+       */
+      branch?: string;
+      /**
+       * Commit SHA to check out, takes precedence over all reference fields.
+       *
+       * This can be combined with Branch to shallow clone the branch, in which
+       * the commit is expected to exist.
+       */
+      commit?: string;
+      /**
+       * Name of the reference to check out; takes precedence over Branch, Tag and SemVer.
+       *
+       * It must be a valid Git reference: https://git-scm.com/docs/git-check-ref-format#_description
+       * Examples: "refs/heads/main", "refs/tags/v0.1.0", "refs/pull/420/head", "refs/merge-requests/1/head"
+       */
+      name?: string;
+      /**
+       * SemVer tag expression to check out, takes precedence over Tag.
+       */
+      semver?: string;
+      /**
+       * Tag to check out, takes precedence over Branch.
+       */
+      tag?: string;
+    };
+    /**
+     * SecretRef specifies the Secret containing authentication credentials for
+     * the GitRepository.
+     * For HTTPS repositories the Secret must contain 'username' and 'password'
+     * fields for basic auth or 'bearerToken' field for token auth.
+     * For SSH repositories the Secret must contain 'identity'
+     * and 'known_hosts' fields.
+     */
+    secretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * Suspend tells the controller to suspend the reconciliation of this
+     * GitRepository.
+     */
+    suspend?: boolean;
+    /**
+     * Timeout for Git operations like cloning, defaults to 60s.
+     */
+    timeout?: string;
+    /**
+     * URL specifies the Git repository URL, it can be an HTTP/S or SSH address.
+     */
+    url: string;
+    /**
+     * Verification specifies the configuration to verify the Git commit
+     * signature(s).
+     */
+    verify?: {
+      /**
+       * Mode specifies what Git object should be verified, currently ('head').
+       */
+      mode: string;
+      /**
+       * SecretRef specifies the Secret containing the public keys of trusted Git
+       * authors.
+       */
+      secretRef: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+    };
+  };
+  /**
+   * GitRepositoryStatus records the observed state of a Git repository.
+   */
+  status?: {
+    /**
+     * Artifact represents the last successful GitRepository reconciliation.
+     */
+    artifact?: {
+      /**
+       * Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
+       */
+      digest?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of the
+       * Artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Metadata holds upstream information such as OCI annotations.
+       */
+      metadata?: {
+        [k: string]: string;
+      };
+      /**
+       * Path is the relative file path of the Artifact. It can be used to locate
+       * the file in the root of the Artifact storage on the local file system of
+       * the controller managing the Source.
+       */
+      path: string;
+      /**
+       * Revision is a human-readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
+       */
+      revision: string;
+      /**
+       * Size is the number of bytes in the file.
+       */
+      size?: number;
+      /**
+       * URL is the HTTP address of the Artifact as exposed by the controller
+       * managing the Source. It can be used to retrieve the Artifact for
+       * consumption, e.g. by another controller applying the Artifact contents.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the GitRepository.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * ContentConfigChecksum is a checksum of all the configurations related to
+     * the content of the source artifact:
+     *  - .spec.ignore
+     *  - .spec.recurseSubmodules
+     *  - .spec.included and the checksum of the included artifacts
+     * observed in .status.observedGeneration version of the object. This can
+     * be used to determine if the content of the included repository has
+     * changed.
+     * It has the format of `<algo>:<checksum>`, for example: `sha256:<checksum>`.
+     *
+     * Deprecated: Replaced with explicit fields for observed artifact content
+     * config in the status.
+     */
+    contentConfigChecksum?: string;
+    /**
+     * IncludedArtifacts contains a list of the last successfully included
+     * Artifacts as instructed by GitRepositorySpec.Include.
+     */
+    includedArtifacts?: {
+      /**
+       * Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
+       */
+      digest?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of the
+       * Artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Metadata holds upstream information such as OCI annotations.
+       */
+      metadata?: {
+        [k: string]: string;
+      };
+      /**
+       * Path is the relative file path of the Artifact. It can be used to locate
+       * the file in the root of the Artifact storage on the local file system of
+       * the controller managing the Source.
+       */
+      path: string;
+      /**
+       * Revision is a human-readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
+       */
+      revision: string;
+      /**
+       * Size is the number of bytes in the file.
+       */
+      size?: number;
+      /**
+       * URL is the HTTP address of the Artifact as exposed by the controller
+       * managing the Source. It can be used to retrieve the Artifact for
+       * consumption, e.g. by another controller applying the Artifact contents.
+       */
+      url: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedGeneration is the last observed generation of the GitRepository
+     * object.
+     */
+    observedGeneration?: number;
+    /**
+     * ObservedIgnore is the observed exclusion patterns used for constructing
+     * the source artifact.
+     */
+    observedIgnore?: string;
+    /**
+     * ObservedInclude is the observed list of GitRepository resources used to
+     * to produce the current Artifact.
+     */
+    observedInclude?: {
+      /**
+       * FromPath specifies the path to copy contents from, defaults to the root
+       * of the Artifact.
+       */
+      fromPath?: string;
+      /**
+       * GitRepositoryRef specifies the GitRepository which Artifact contents
+       * must be included.
+       */
+      repository: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+      /**
+       * ToPath specifies the path to copy contents to, defaults to the name of
+       * the GitRepositoryRef.
+       */
+      toPath?: string;
+    }[];
+    /**
+     * ObservedRecurseSubmodules is the observed resource submodules
+     * configuration used to produce the current Artifact.
+     */
+    observedRecurseSubmodules?: boolean;
+    /**
+     * URL is the dynamic fetch link for the latest Artifact.
+     * It is provided on a "best effort" basis, and using the precise
+     * GitRepositoryStatus.Artifact data is recommended.
+     */
+    url?: string;
+  };
+}

src/__generated__/resources/K8SHelmChartConfigV1.json

@@ -1,16 +1,59 @@
 {
+  "description": "HelmChartConfig represents additional configuration for the installation of Helm chart release.\nThis resource is intended for use when additional configuration needs to be passed to a HelmChart\nthat is managed by an external system.",
   "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
     "spec": {
+      "description": "HelmChartConfigSpec represents additional user-configurable details of an installed and configured Helm chart release.\nThese fields are merged with or override the corresponding fields on the related HelmChart resource.",
       "properties": {
         "failurePolicy": {
-          "nullable": true,
+          "_default": "reinstall",
+          "description": "Configures handling of failed chart installation or upgrades.\n- `reinstall` will perform a clean uninstall and reinstall of the chart.\n- `abort` will take no action and leave the chart in a failed state so that the administrator can manually resolve the error.",
+          "_enum": [
+            "abort",
+            "reinstall"
+          ],
           "type": "string"
         },
         "valuesContent": {
-          "nullable": true,
+          "description": "Override complex Chart values via inline YAML content.\nHelm CLI positional argument/flag: `--values`",
+          "type": "string"
+        },
+        "valuesSecrets": {
+          "description": "Override complex Chart values via references to external Secrets.\nHelm CLI positional argument/flag: `--values`",
+          "items": {
+            "description": "SecretSpec describes a key in a secret to load chart values from.",
+            "type": "object",
+            "properties": {
+              "ignoreUpdates": {
+                "description": "Ignore changes to the secret, and mark the secret as optional.\nBy default, the secret must exist, and changes to the secret will trigger an upgrade of the chart to apply the updated values.\nIf `ignoreUpdates` is true, the secret is optional, and changes to the secret will not trigger an upgrade of the chart.",
+                "type": "boolean"
+              },
+              "keys": {
+                "description": "Keys to read values content from. If no keys are specified, the secret is not used.",
+                "type": "array",
+                "items": {
                   "type": "string"
                 }
               },
+              "name": {
+                "description": "Name of the secret. Must be in the same namespace as the HelmChart resource.",
+                "type": "string"
+              }
+            }
+          },
+          "type": "array"
+        }
+      },
       "type": "object"
     }
   },

src/__generated__/resources/K8SHelmChartConfigV1.ts

@@ -5,9 +5,63 @@
  * and run json-schema-to-typescript to regenerate this file.
  */
 
+/**
+ * HelmChartConfig represents additional configuration for the installation of Helm chart release.
+ * This resource is intended for use when additional configuration needs to be passed to a HelmChart
+ * that is managed by an external system.
+ */
 export interface K8SHelmChartConfigV1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * HelmChartConfigSpec represents additional user-configurable details of an installed and configured Helm chart release.
+   * These fields are merged with or override the corresponding fields on the related HelmChart resource.
+   */
   spec?: {
+    /**
+     * Configures handling of failed chart installation or upgrades.
+     * - `reinstall` will perform a clean uninstall and reinstall of the chart.
+     * - `abort` will take no action and leave the chart in a failed state so that the administrator can manually resolve the error.
+     */
     failurePolicy?: string;
+    /**
+     * Override complex Chart values via inline YAML content.
+     * Helm CLI positional argument/flag: `--values`
+     */
     valuesContent?: string;
+    /**
+     * Override complex Chart values via references to external Secrets.
+     * Helm CLI positional argument/flag: `--values`
+     */
+    valuesSecrets?: {
+      /**
+       * Ignore changes to the secret, and mark the secret as optional.
+       * By default, the secret must exist, and changes to the secret will trigger an upgrade of the chart to apply the updated values.
+       * If `ignoreUpdates` is true, the secret is optional, and changes to the secret will not trigger an upgrade of the chart.
+       */
+      ignoreUpdates?: boolean;
+      /**
+       * Keys to read values content from. If no keys are specified, the secret is not used.
+       */
+      keys?: string[];
+      /**
+       * Name of the secret. Must be in the same namespace as the HelmChart resource.
+       */
+      name?: string;
+    }[];
   };
 }

src/__generated__/resources/K8SHelmChartV1.json

@@ -1,393 +1,279 @@
 {
+  "description": "HelmChart is the Schema for the helmcharts API.",
   "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
     "spec": {
+      "description": "HelmChartSpec specifies the desired state of a Helm chart.",
       "properties": {
-        "authPassCredentials": {
-          "type": "boolean"
-        },
-        "authSecret": {
-          "nullable": true,
-          "properties": {
-            "name": {
-              "nullable": true,
-              "type": "string"
-            }
-          },
-          "type": "object"
-        },
-        "backOffLimit": {
-          "nullable": true,
-          "type": "integer"
-        },
-        "bootstrap": {
-          "type": "boolean"
-        },
         "chart": {
-          "nullable": true,
+          "description": "Chart is the name or path the Helm chart is available at in the\nSourceRef.",
           "type": "string"
         },
-        "chartContent": {
+        "ignoreMissingValuesFiles": {
-          "nullable": true,
+          "description": "IgnoreMissingValuesFiles controls whether to silently ignore missing values\nfiles rather than failing.",
-          "type": "string"
-        },
-        "createNamespace": {
           "type": "boolean"
         },
-        "dockerRegistrySecret": {
+        "interval": {
-          "nullable": true,
+          "description": "Interval at which the HelmChart SourceRef is checked for updates.\nThis interval is approximate and may be subject to jitter to ensure\nefficient use of resources.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
+          "type": "string"
+        },
+        "reconcileStrategy": {
+          "_default": "ChartVersion",
+          "description": "ReconcileStrategy determines what enables the creation of a new artifact.\nValid values are ('ChartVersion', 'Revision').\nSee the documentation of the values for an explanation on their behavior.\nDefaults to ChartVersion when omitted.",
+          "_enum": [
+            "ChartVersion",
+            "Revision"
+          ],
+          "type": "string"
+        },
+        "sourceRef": {
+          "description": "SourceRef is the reference to the Source the chart is available at.",
           "properties": {
+            "apiVersion": {
+              "description": "APIVersion of the referent.",
+              "type": "string"
+            },
+            "kind": {
+              "description": "Kind of the referent, valid values are ('HelmRepository', 'GitRepository',\n'Bucket').",
+              "_enum": [
+                "HelmRepository",
+                "GitRepository",
+                "Bucket"
+              ],
+              "type": "string"
+            },
             "name": {
-              "nullable": true,
+              "description": "Name of the referent.",
               "type": "string"
             }
           },
+          "required": [
+            "kind",
+            "name"
+          ],
           "type": "object"
         },
-        "failurePolicy": {
+        "suspend": {
-          "nullable": true,
+          "description": "Suspend tells the controller to suspend the reconciliation of this\nsource.",
-          "type": "string"
-        },
-        "helmVersion": {
-          "nullable": true,
-          "type": "string"
-        },
-        "insecureSkipTLSVerify": {
           "type": "boolean"
         },
-        "jobImage": {
+        "valuesFiles": {
-          "nullable": true,
+          "description": "ValuesFiles is an alternative list of values files to use as the chart\nvalues (values.yaml is not included by default), expected to be a\nrelative path in the SourceRef.\nValues files are merged in the order of this list with the last file\noverriding the first. Ignored when omitted.",
-          "type": "string"
-        },
-        "plainHTTP": {
-          "type": "boolean"
-        },
-        "podSecurityContext": {
-          "nullable": true,
-          "properties": {
-            "appArmorProfile": {
-              "nullable": true,
-              "properties": {
-                "localhostProfile": {
-                  "nullable": true,
-                  "type": "string"
-                },
-                "type": {
-                  "nullable": true,
-                  "type": "string"
-                }
-              },
-              "type": "object"
-            },
-            "fsGroup": {
-              "nullable": true,
-              "type": "integer"
-            },
-            "fsGroupChangePolicy": {
-              "nullable": true,
-              "type": "string"
-            },
-            "runAsGroup": {
-              "nullable": true,
-              "type": "integer"
-            },
-            "runAsNonRoot": {
-              "nullable": true,
-              "type": "boolean"
-            },
-            "runAsUser": {
-              "nullable": true,
-              "type": "integer"
-            },
-            "seLinuxOptions": {
-              "nullable": true,
-              "properties": {
-                "level": {
-                  "nullable": true,
-                  "type": "string"
-                },
-                "role": {
-                  "nullable": true,
-                  "type": "string"
-                },
-                "type": {
-                  "nullable": true,
-                  "type": "string"
-                },
-                "user": {
-                  "nullable": true,
-                  "type": "string"
-                }
-              },
-              "type": "object"
-            },
-            "seccompProfile": {
-              "nullable": true,
-              "properties": {
-                "localhostProfile": {
-                  "nullable": true,
-                  "type": "string"
-                },
-                "type": {
-                  "nullable": true,
-                  "type": "string"
-                }
-              },
-              "type": "object"
-            },
-            "supplementalGroups": {
           "items": {
-                "type": "integer"
+            "type": "string"
           },
-              "nullable": true,
           "type": "array"
         },
-            "supplementalGroupsPolicy": {
+        "verify": {
-              "nullable": true,
+          "description": "Verify contains the secret name containing the trusted public keys\nused to verify the signature and specifies which provider to use to check\nwhether OCI image is authentic.\nThis field is only supported when using HelmRepository source with spec.type 'oci'.\nChart dependencies, which are not bundled in the umbrella chart artifact, are not verified.",
-              "type": "string"
+          "properties": {
-            },
+            "matchOIDCIdentity": {
-            "sysctls": {
+              "description": "MatchOIDCIdentity specifies the identity matching criteria to use\nwhile verifying an OCI artifact which was signed using Cosign keyless\nsigning. The artifact's identity is deemed to be verified if any of the\nspecified matchers match against the identity.",
               "items": {
+                "description": "OIDCIdentityMatch specifies options for verifying the certificate identity,\ni.e. the issuer and the subject of the certificate.",
                 "type": "object",
+                "required": [
+                  "issuer",
+                  "subject"
+                ],
+                "properties": {
+                  "issuer": {
+                    "description": "Issuer specifies the regex pattern to match against to verify\nthe OIDC issuer in the Fulcio certificate. The pattern must be a\nvalid Go regular expression.",
+                    "type": "string"
+                  },
+                  "subject": {
+                    "description": "Subject specifies the regex pattern to match against to verify\nthe identity subject in the Fulcio certificate. The pattern must\nbe a valid Go regular expression.",
+                    "type": "string"
+                  }
+                }
+              },
+              "type": "array"
+            },
+            "provider": {
+              "_default": "cosign",
+              "description": "Provider specifies the technology used to sign the OCI Artifact.",
+              "_enum": [
+                "cosign",
+                "notation"
+              ],
+              "type": "string"
+            },
+            "secretRef": {
+              "description": "SecretRef specifies the Kubernetes Secret containing the\ntrusted public keys.",
               "properties": {
                 "name": {
-                    "type": "string",
+                  "description": "Name of the referent.",
-                    "nullable": true
-                  },
-                  "value": {
-                    "type": "string",
-                    "nullable": true
-                  }
-                }
-              },
-              "nullable": true,
-              "type": "array"
-            },
-            "windowsOptions": {
-              "nullable": true,
-              "properties": {
-                "gmsaCredentialSpec": {
-                  "nullable": true,
-                  "type": "string"
-                },
-                "gmsaCredentialSpecName": {
-                  "nullable": true,
-                  "type": "string"
-                },
-                "hostProcess": {
-                  "nullable": true,
-                  "type": "boolean"
-                },
-                "runAsUserName": {
-                  "nullable": true,
                   "type": "string"
                 }
               },
+              "required": [
+                "name"
+              ],
               "type": "object"
             }
           },
+          "required": [
+            "provider"
+          ],
           "type": "object"
         },
-        "repo": {
-          "nullable": true,
-          "type": "string"
-        },
-        "repoCA": {
-          "nullable": true,
-          "type": "string"
-        },
-        "repoCAConfigMap": {
-          "nullable": true,
-          "properties": {
-            "name": {
-              "nullable": true,
-              "type": "string"
-            }
-          },
-          "type": "object"
-        },
-        "securityContext": {
-          "nullable": true,
-          "properties": {
-            "allowPrivilegeEscalation": {
-              "nullable": true,
-              "type": "boolean"
-            },
-            "appArmorProfile": {
-              "nullable": true,
-              "properties": {
-                "localhostProfile": {
-                  "nullable": true,
-                  "type": "string"
-                },
-                "type": {
-                  "nullable": true,
-                  "type": "string"
-                }
-              },
-              "type": "object"
-            },
-            "capabilities": {
-              "nullable": true,
-              "properties": {
-                "add": {
-                  "items": {
-                    "type": "string",
-                    "nullable": true
-                  },
-                  "nullable": true,
-                  "type": "array"
-                },
-                "drop": {
-                  "items": {
-                    "type": "string",
-                    "nullable": true
-                  },
-                  "nullable": true,
-                  "type": "array"
-                }
-              },
-              "type": "object"
-            },
-            "privileged": {
-              "nullable": true,
-              "type": "boolean"
-            },
-            "procMount": {
-              "nullable": true,
-              "type": "string"
-            },
-            "readOnlyRootFilesystem": {
-              "nullable": true,
-              "type": "boolean"
-            },
-            "runAsGroup": {
-              "nullable": true,
-              "type": "integer"
-            },
-            "runAsNonRoot": {
-              "nullable": true,
-              "type": "boolean"
-            },
-            "runAsUser": {
-              "nullable": true,
-              "type": "integer"
-            },
-            "seLinuxOptions": {
-              "nullable": true,
-              "properties": {
-                "level": {
-                  "nullable": true,
-                  "type": "string"
-                },
-                "role": {
-                  "nullable": true,
-                  "type": "string"
-                },
-                "type": {
-                  "nullable": true,
-                  "type": "string"
-                },
-                "user": {
-                  "nullable": true,
-                  "type": "string"
-                }
-              },
-              "type": "object"
-            },
-            "seccompProfile": {
-              "nullable": true,
-              "properties": {
-                "localhostProfile": {
-                  "nullable": true,
-                  "type": "string"
-                },
-                "type": {
-                  "nullable": true,
-                  "type": "string"
-                }
-              },
-              "type": "object"
-            },
-            "windowsOptions": {
-              "nullable": true,
-              "properties": {
-                "gmsaCredentialSpec": {
-                  "nullable": true,
-                  "type": "string"
-                },
-                "gmsaCredentialSpecName": {
-                  "nullable": true,
-                  "type": "string"
-                },
-                "hostProcess": {
-                  "nullable": true,
-                  "type": "boolean"
-                },
-                "runAsUserName": {
-                  "nullable": true,
-                  "type": "string"
-                }
-              },
-              "type": "object"
-            }
-          },
-          "type": "object"
-        },
-        "set": {
-          "additionalProperties": {
-            "x-kubernetes-int-or-string": true
-          },
-          "nullable": true,
-          "type": "object"
-        },
-        "targetNamespace": {
-          "nullable": true,
-          "type": "string"
-        },
-        "timeout": {
-          "nullable": true,
-          "type": "string"
-        },
-        "valuesContent": {
-          "nullable": true,
-          "type": "string"
-        },
         "version": {
-          "nullable": true,
+          "_default": "*",
+          "description": "Version is the chart version semver expression, ignored for charts from\nGitRepository and Bucket sources. Defaults to latest when omitted.",
           "type": "string"
         }
       },
+      "required": [
+        "chart",
+        "interval",
+        "sourceRef"
+      ],
       "type": "object"
     },
     "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "HelmChartStatus records the observed state of the HelmChart.",
       "properties": {
+        "artifact": {
+          "description": "Artifact represents the output of the last successful reconciliation.",
+          "properties": {
+            "digest": {
+              "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+              "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "metadata": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Metadata holds upstream information such as OCI annotations.",
+              "type": "object"
+            },
+            "path": {
+              "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+              "type": "string"
+            },
+            "size": {
+              "description": "Size is the number of bytes in the file.",
+              "format": "int64",
+              "type": "integer"
+            },
+            "url": {
+              "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "revision",
+            "url"
+          ],
+          "type": "object"
+        },
         "conditions": {
+          "description": "Conditions holds the conditions for the HelmChart.",
           "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
             "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
             "properties": {
-              "message": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
                 "type": "string",
-                "nullable": true
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
               },
               "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
                 "type": "string",
-                "nullable": true
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
               },
               "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
                 "type": "string",
-                "nullable": true
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
               },
               "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
                 "type": "string",
-                "nullable": true
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
               }
             }
           },
-          "nullable": true,
           "type": "array"
         },
-        "jobName": {
+        "lastHandledReconcileAt": {
-          "nullable": true,
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedChartName": {
+          "description": "ObservedChartName is the last observed chart name as specified by the\nresolved chart reference.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation of the HelmChart\nobject.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "observedSourceArtifactRevision": {
+          "description": "ObservedSourceArtifactRevision is the last observed Artifact.Revision\nof the HelmChartSpec.SourceRef.",
+          "type": "string"
+        },
+        "observedValuesFiles": {
+          "description": "ObservedValuesFiles are the observed value files of the last successful\nreconciliation.\nIt matches the chart in the last successfully reconciled artifact.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "url": {
+          "description": "URL is the dynamic fetch link for the latest Artifact.\nIt is provided on a \"best effort\" basis, and using the precise\nBucketStatus.Artifact data is recommended.",
           "type": "string"
         }
       },

src/__generated__/resources/K8SHelmChartV1.ts

@@ -5,113 +5,247 @@
  * and run json-schema-to-typescript to regenerate this file.
  */
 
+/**
+ * HelmChart is the Schema for the helmcharts API.
+ */
 export interface K8SHelmChartV1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * HelmChartSpec specifies the desired state of a Helm chart.
+   */
   spec?: {
-    authPassCredentials?: boolean;
+    /**
-    authSecret?: {
+     * Chart is the name or path the Helm chart is available at in the
-      name?: string;
+     * SourceRef.
+     */
+    chart: string;
+    /**
+     * IgnoreMissingValuesFiles controls whether to silently ignore missing values
+     * files rather than failing.
+     */
+    ignoreMissingValuesFiles?: boolean;
+    /**
+     * Interval at which the HelmChart SourceRef is checked for updates.
+     * This interval is approximate and may be subject to jitter to ensure
+     * efficient use of resources.
+     */
+    interval: string;
+    /**
+     * ReconcileStrategy determines what enables the creation of a new artifact.
+     * Valid values are ('ChartVersion', 'Revision').
+     * See the documentation of the values for an explanation on their behavior.
+     * Defaults to ChartVersion when omitted.
+     */
+    reconcileStrategy?: string;
+    /**
+     * SourceRef is the reference to the Source the chart is available at.
+     */
+    sourceRef: {
+      /**
+       * APIVersion of the referent.
+       */
+      apiVersion?: string;
+      /**
+       * Kind of the referent, valid values are ('HelmRepository', 'GitRepository',
+       * 'Bucket').
+       */
+      kind: string;
+      /**
+       * Name of the referent.
+       */
+      name: string;
     };
-    backOffLimit?: number;
+    /**
-    bootstrap?: boolean;
+     * Suspend tells the controller to suspend the reconciliation of this
-    chart?: string;
+     * source.
-    chartContent?: string;
+     */
-    createNamespace?: boolean;
+    suspend?: boolean;
-    dockerRegistrySecret?: {
+    /**
-      name?: string;
+     * ValuesFiles is an alternative list of values files to use as the chart
-    };
+     * values (values.yaml is not included by default), expected to be a
-    failurePolicy?: string;
+     * relative path in the SourceRef.
-    helmVersion?: string;
+     * Values files are merged in the order of this list with the last file
-    insecureSkipTLSVerify?: boolean;
+     * overriding the first. Ignored when omitted.
-    jobImage?: string;
+     */
-    plainHTTP?: boolean;
+    valuesFiles?: string[];
-    podSecurityContext?: {
+    /**
-      appArmorProfile?: {
+     * Verify contains the secret name containing the trusted public keys
-        localhostProfile?: string;
+     * used to verify the signature and specifies which provider to use to check
-        type?: string;
+     * whether OCI image is authentic.
-      };
+     * This field is only supported when using HelmRepository source with spec.type 'oci'.
-      fsGroup?: number;
+     * Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified.
-      fsGroupChangePolicy?: string;
+     */
-      runAsGroup?: number;
+    verify?: {
-      runAsNonRoot?: boolean;
+      /**
-      runAsUser?: number;
+       * MatchOIDCIdentity specifies the identity matching criteria to use
-      seLinuxOptions?: {
+       * while verifying an OCI artifact which was signed using Cosign keyless
-        level?: string;
+       * signing. The artifact's identity is deemed to be verified if any of the
-        role?: string;
+       * specified matchers match against the identity.
-        type?: string;
+       */
-        user?: string;
+      matchOIDCIdentity?: {
-      };
+        /**
-      seccompProfile?: {
+         * Issuer specifies the regex pattern to match against to verify
-        localhostProfile?: string;
+         * the OIDC issuer in the Fulcio certificate. The pattern must be a
-        type?: string;
+         * valid Go regular expression.
-      };
+         */
-      supplementalGroups?: number[];
+        issuer: string;
-      supplementalGroupsPolicy?: string;
+        /**
-      sysctls?: {
+         * Subject specifies the regex pattern to match against to verify
-        name?: string;
+         * the identity subject in the Fulcio certificate. The pattern must
-        value?: string;
+         * be a valid Go regular expression.
+         */
+        subject: string;
       }[];
-      windowsOptions?: {
+      /**
-        gmsaCredentialSpec?: string;
+       * Provider specifies the technology used to sign the OCI Artifact.
-        gmsaCredentialSpecName?: string;
+       */
-        hostProcess?: boolean;
+      provider: string;
-        runAsUserName?: string;
+      /**
+       * SecretRef specifies the Kubernetes Secret containing the
+       * trusted public keys.
+       */
+      secretRef?: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
       };
     };
-    repo?: string;
+    /**
-    repoCA?: string;
+     * Version is the chart version semver expression, ignored for charts from
-    repoCAConfigMap?: {
+     * GitRepository and Bucket sources. Defaults to latest when omitted.
-      name?: string;
+     */
-    };
-    securityContext?: {
-      allowPrivilegeEscalation?: boolean;
-      appArmorProfile?: {
-        localhostProfile?: string;
-        type?: string;
-      };
-      capabilities?: {
-        add?: string[];
-        drop?: string[];
-      };
-      privileged?: boolean;
-      procMount?: string;
-      readOnlyRootFilesystem?: boolean;
-      runAsGroup?: number;
-      runAsNonRoot?: boolean;
-      runAsUser?: number;
-      seLinuxOptions?: {
-        level?: string;
-        role?: string;
-        type?: string;
-        user?: string;
-      };
-      seccompProfile?: {
-        localhostProfile?: string;
-        type?: string;
-      };
-      windowsOptions?: {
-        gmsaCredentialSpec?: string;
-        gmsaCredentialSpecName?: string;
-        hostProcess?: boolean;
-        runAsUserName?: string;
-      };
-    };
-    set?: {
-      [k: string]: {
-        [k: string]: unknown;
-      };
-    };
-    targetNamespace?: string;
-    timeout?: string;
-    valuesContent?: string;
     version?: string;
   };
+  /**
+   * HelmChartStatus records the observed state of the HelmChart.
+   */
   status?: {
+    /**
+     * Artifact represents the output of the last successful reconciliation.
+     */
+    artifact?: {
+      /**
+       * Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
+       */
+      digest?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of the
+       * Artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Metadata holds upstream information such as OCI annotations.
+       */
+      metadata?: {
+        [k: string]: string;
+      };
+      /**
+       * Path is the relative file path of the Artifact. It can be used to locate
+       * the file in the root of the Artifact storage on the local file system of
+       * the controller managing the Source.
+       */
+      path: string;
+      /**
+       * Revision is a human-readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
+       */
+      revision: string;
+      /**
+       * Size is the number of bytes in the file.
+       */
+      size?: number;
+      /**
+       * URL is the HTTP address of the Artifact as exposed by the controller
+       * managing the Source. It can be used to retrieve the Artifact for
+       * consumption, e.g. by another controller applying the Artifact contents.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the HelmChart.
+     */
     conditions?: {
-      message?: string;
+      /**
-      reason?: string;
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
-      status?: string;
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-      type?: string;
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
     }[];
-    jobName?: string;
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedChartName is the last observed chart name as specified by the
+     * resolved chart reference.
+     */
+    observedChartName?: string;
+    /**
+     * ObservedGeneration is the last observed generation of the HelmChart
+     * object.
+     */
+    observedGeneration?: number;
+    /**
+     * ObservedSourceArtifactRevision is the last observed Artifact.Revision
+     * of the HelmChartSpec.SourceRef.
+     */
+    observedSourceArtifactRevision?: string;
+    /**
+     * ObservedValuesFiles are the observed value files of the last successful
+     * reconciliation.
+     * It matches the chart in the last successfully reconciled artifact.
+     */
+    observedValuesFiles?: string[];
+    /**
+     * URL is the dynamic fetch link for the latest Artifact.
+     * It is provided on a "best effort" basis, and using the precise
+     * BucketStatus.Artifact data is recommended.
+     */
+    url?: string;
   };
 }

src/__generated__/resources/K8SHelmChartV1beta1.json

@@ -0,0 +1,227 @@
+{
+  "description": "HelmChart is the Schema for the helmcharts API",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "HelmChartSpec defines the desired state of a Helm chart.",
+      "properties": {
+        "accessFrom": {
+          "description": "AccessFrom defines an Access Control List for allowing cross-namespace references to this object.",
+          "properties": {
+            "namespaceSelectors": {
+              "description": "NamespaceSelectors is the list of namespace selectors to which this ACL applies.\nItems in this list are evaluated using a logical OR operation.",
+              "items": {
+                "description": "NamespaceSelector selects the namespaces to which this ACL applies.\nAn empty map of MatchLabels matches all namespaces in a cluster.",
+                "type": "object",
+                "properties": {
+                  "matchLabels": {
+                    "description": "MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  }
+                }
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "namespaceSelectors"
+          ],
+          "type": "object"
+        },
+        "chart": {
+          "description": "The name or path the Helm chart is available at in the SourceRef.",
+          "type": "string"
+        },
+        "interval": {
+          "description": "The interval at which to check the Source for updates.",
+          "type": "string"
+        },
+        "reconcileStrategy": {
+          "_default": "ChartVersion",
+          "description": "Determines what enables the creation of a new artifact. Valid values are\n('ChartVersion', 'Revision').\nSee the documentation of the values for an explanation on their behavior.\nDefaults to ChartVersion when omitted.",
+          "_enum": [
+            "ChartVersion",
+            "Revision"
+          ],
+          "type": "string"
+        },
+        "sourceRef": {
+          "description": "The reference to the Source the chart is available at.",
+          "properties": {
+            "apiVersion": {
+              "description": "APIVersion of the referent.",
+              "type": "string"
+            },
+            "kind": {
+              "description": "Kind of the referent, valid values are ('HelmRepository', 'GitRepository',\n'Bucket').",
+              "_enum": [
+                "HelmRepository",
+                "GitRepository",
+                "Bucket"
+              ],
+              "type": "string"
+            },
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind",
+            "name"
+          ],
+          "type": "object"
+        },
+        "suspend": {
+          "description": "This flag tells the controller to suspend the reconciliation of this source.",
+          "type": "boolean"
+        },
+        "valuesFile": {
+          "description": "Alternative values file to use as the default chart values, expected to\nbe a relative path in the SourceRef. Deprecated in favor of ValuesFiles,\nfor backwards compatibility the file defined here is merged before the\nValuesFiles items. Ignored when omitted.",
+          "type": "string"
+        },
+        "valuesFiles": {
+          "description": "Alternative list of values files to use as the chart values (values.yaml\nis not included by default), expected to be a relative path in the SourceRef.\nValues files are merged in the order of this list with the last file overriding\nthe first. Ignored when omitted.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "version": {
+          "_default": "*",
+          "description": "The chart version semver expression, ignored for charts from GitRepository\nand Bucket sources. Defaults to latest when omitted.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "chart",
+        "interval",
+        "sourceRef"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "HelmChartStatus defines the observed state of the HelmChart.",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the output of the last successful chart sync.",
+          "properties": {
+            "checksum": {
+              "description": "Checksum is the SHA256 checksum of the artifact.",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of this\nartifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "path": {
+              "description": "Path is the relative file path of this artifact.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm\nchart version, etc.",
+              "type": "string"
+            },
+            "url": {
+              "description": "URL is the HTTP address of this artifact.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the HelmChart.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "url": {
+          "description": "URL is the download link for the last chart pulled.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

src/__generated__/resources/K8SHelmChartV1beta1.ts

@@ -0,0 +1,192 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * HelmChart is the Schema for the helmcharts API
+ */
+export interface K8SHelmChartV1Beta1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * HelmChartSpec defines the desired state of a Helm chart.
+   */
+  spec?: {
+    /**
+     * AccessFrom defines an Access Control List for allowing cross-namespace references to this object.
+     */
+    accessFrom?: {
+      /**
+       * NamespaceSelectors is the list of namespace selectors to which this ACL applies.
+       * Items in this list are evaluated using a logical OR operation.
+       */
+      namespaceSelectors: {
+        /**
+         * MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+         * map is equivalent to an element of matchExpressions, whose key field is "key", the
+         * operator is "In", and the values array contains only "value". The requirements are ANDed.
+         */
+        matchLabels?: {
+          [k: string]: string;
+        };
+      }[];
+    };
+    /**
+     * The name or path the Helm chart is available at in the SourceRef.
+     */
+    chart: string;
+    /**
+     * The interval at which to check the Source for updates.
+     */
+    interval: string;
+    /**
+     * Determines what enables the creation of a new artifact. Valid values are
+     * ('ChartVersion', 'Revision').
+     * See the documentation of the values for an explanation on their behavior.
+     * Defaults to ChartVersion when omitted.
+     */
+    reconcileStrategy?: string;
+    /**
+     * The reference to the Source the chart is available at.
+     */
+    sourceRef: {
+      /**
+       * APIVersion of the referent.
+       */
+      apiVersion?: string;
+      /**
+       * Kind of the referent, valid values are ('HelmRepository', 'GitRepository',
+       * 'Bucket').
+       */
+      kind: string;
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * This flag tells the controller to suspend the reconciliation of this source.
+     */
+    suspend?: boolean;
+    /**
+     * Alternative values file to use as the default chart values, expected to
+     * be a relative path in the SourceRef. Deprecated in favor of ValuesFiles,
+     * for backwards compatibility the file defined here is merged before the
+     * ValuesFiles items. Ignored when omitted.
+     */
+    valuesFile?: string;
+    /**
+     * Alternative list of values files to use as the chart values (values.yaml
+     * is not included by default), expected to be a relative path in the SourceRef.
+     * Values files are merged in the order of this list with the last file overriding
+     * the first. Ignored when omitted.
+     */
+    valuesFiles?: string[];
+    /**
+     * The chart version semver expression, ignored for charts from GitRepository
+     * and Bucket sources. Defaults to latest when omitted.
+     */
+    version?: string;
+  };
+  /**
+   * HelmChartStatus defines the observed state of the HelmChart.
+   */
+  status?: {
+    /**
+     * Artifact represents the output of the last successful chart sync.
+     */
+    artifact?: {
+      /**
+       * Checksum is the SHA256 checksum of the artifact.
+       */
+      checksum?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of this
+       * artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Path is the relative file path of this artifact.
+       */
+      path: string;
+      /**
+       * Revision is a human readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm
+       * chart version, etc.
+       */
+      revision?: string;
+      /**
+       * URL is the HTTP address of this artifact.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the HelmChart.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedGeneration is the last observed generation.
+     */
+    observedGeneration?: number;
+    /**
+     * URL is the download link for the last chart pulled.
+     */
+    url?: string;
+  };
+}

src/__generated__/resources/K8SHelmChartV1beta2.json

@@ -0,0 +1,314 @@
+{
+  "description": "HelmChart is the Schema for the helmcharts API.",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "HelmChartSpec specifies the desired state of a Helm chart.",
+      "properties": {
+        "accessFrom": {
+          "description": "AccessFrom specifies an Access Control List for allowing cross-namespace\nreferences to this object.\nNOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092",
+          "properties": {
+            "namespaceSelectors": {
+              "description": "NamespaceSelectors is the list of namespace selectors to which this ACL applies.\nItems in this list are evaluated using a logical OR operation.",
+              "items": {
+                "description": "NamespaceSelector selects the namespaces to which this ACL applies.\nAn empty map of MatchLabels matches all namespaces in a cluster.",
+                "type": "object",
+                "properties": {
+                  "matchLabels": {
+                    "description": "MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  }
+                }
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "namespaceSelectors"
+          ],
+          "type": "object"
+        },
+        "chart": {
+          "description": "Chart is the name or path the Helm chart is available at in the\nSourceRef.",
+          "type": "string"
+        },
+        "ignoreMissingValuesFiles": {
+          "description": "IgnoreMissingValuesFiles controls whether to silently ignore missing values\nfiles rather than failing.",
+          "type": "boolean"
+        },
+        "interval": {
+          "description": "Interval at which the HelmChart SourceRef is checked for updates.\nThis interval is approximate and may be subject to jitter to ensure\nefficient use of resources.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
+          "type": "string"
+        },
+        "reconcileStrategy": {
+          "_default": "ChartVersion",
+          "description": "ReconcileStrategy determines what enables the creation of a new artifact.\nValid values are ('ChartVersion', 'Revision').\nSee the documentation of the values for an explanation on their behavior.\nDefaults to ChartVersion when omitted.",
+          "_enum": [
+            "ChartVersion",
+            "Revision"
+          ],
+          "type": "string"
+        },
+        "sourceRef": {
+          "description": "SourceRef is the reference to the Source the chart is available at.",
+          "properties": {
+            "apiVersion": {
+              "description": "APIVersion of the referent.",
+              "type": "string"
+            },
+            "kind": {
+              "description": "Kind of the referent, valid values are ('HelmRepository', 'GitRepository',\n'Bucket').",
+              "_enum": [
+                "HelmRepository",
+                "GitRepository",
+                "Bucket"
+              ],
+              "type": "string"
+            },
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind",
+            "name"
+          ],
+          "type": "object"
+        },
+        "suspend": {
+          "description": "Suspend tells the controller to suspend the reconciliation of this\nsource.",
+          "type": "boolean"
+        },
+        "valuesFile": {
+          "description": "ValuesFile is an alternative values file to use as the default chart\nvalues, expected to be a relative path in the SourceRef. Deprecated in\nfavor of ValuesFiles, for backwards compatibility the file specified here\nis merged before the ValuesFiles items. Ignored when omitted.",
+          "type": "string"
+        },
+        "valuesFiles": {
+          "description": "ValuesFiles is an alternative list of values files to use as the chart\nvalues (values.yaml is not included by default), expected to be a\nrelative path in the SourceRef.\nValues files are merged in the order of this list with the last file\noverriding the first. Ignored when omitted.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "verify": {
+          "description": "Verify contains the secret name containing the trusted public keys\nused to verify the signature and specifies which provider to use to check\nwhether OCI image is authentic.\nThis field is only supported when using HelmRepository source with spec.type 'oci'.\nChart dependencies, which are not bundled in the umbrella chart artifact, are not verified.",
+          "properties": {
+            "matchOIDCIdentity": {
+              "description": "MatchOIDCIdentity specifies the identity matching criteria to use\nwhile verifying an OCI artifact which was signed using Cosign keyless\nsigning. The artifact's identity is deemed to be verified if any of the\nspecified matchers match against the identity.",
+              "items": {
+                "description": "OIDCIdentityMatch specifies options for verifying the certificate identity,\ni.e. the issuer and the subject of the certificate.",
+                "type": "object",
+                "required": [
+                  "issuer",
+                  "subject"
+                ],
+                "properties": {
+                  "issuer": {
+                    "description": "Issuer specifies the regex pattern to match against to verify\nthe OIDC issuer in the Fulcio certificate. The pattern must be a\nvalid Go regular expression.",
+                    "type": "string"
+                  },
+                  "subject": {
+                    "description": "Subject specifies the regex pattern to match against to verify\nthe identity subject in the Fulcio certificate. The pattern must\nbe a valid Go regular expression.",
+                    "type": "string"
+                  }
+                }
+              },
+              "type": "array"
+            },
+            "provider": {
+              "_default": "cosign",
+              "description": "Provider specifies the technology used to sign the OCI Artifact.",
+              "_enum": [
+                "cosign",
+                "notation"
+              ],
+              "type": "string"
+            },
+            "secretRef": {
+              "description": "SecretRef specifies the Kubernetes Secret containing the\ntrusted public keys.",
+              "properties": {
+                "name": {
+                  "description": "Name of the referent.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "provider"
+          ],
+          "type": "object"
+        },
+        "version": {
+          "_default": "*",
+          "description": "Version is the chart version semver expression, ignored for charts from\nGitRepository and Bucket sources. Defaults to latest when omitted.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "chart",
+        "interval",
+        "sourceRef"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "HelmChartStatus records the observed state of the HelmChart.",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the output of the last successful reconciliation.",
+          "properties": {
+            "digest": {
+              "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+              "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "metadata": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Metadata holds upstream information such as OCI annotations.",
+              "type": "object"
+            },
+            "path": {
+              "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+              "type": "string"
+            },
+            "size": {
+              "description": "Size is the number of bytes in the file.",
+              "format": "int64",
+              "type": "integer"
+            },
+            "url": {
+              "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "revision",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the HelmChart.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedChartName": {
+          "description": "ObservedChartName is the last observed chart name as specified by the\nresolved chart reference.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation of the HelmChart\nobject.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "observedSourceArtifactRevision": {
+          "description": "ObservedSourceArtifactRevision is the last observed Artifact.Revision\nof the HelmChartSpec.SourceRef.",
+          "type": "string"
+        },
+        "observedValuesFiles": {
+          "description": "ObservedValuesFiles are the observed value files of the last successful\nreconciliation.\nIt matches the chart in the last successfully reconciled artifact.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "url": {
+          "description": "URL is the dynamic fetch link for the latest Artifact.\nIt is provided on a \"best effort\" basis, and using the precise\nBucketStatus.Artifact data is recommended.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

src/__generated__/resources/K8SHelmChartV1beta2.ts

@@ -0,0 +1,279 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * HelmChart is the Schema for the helmcharts API.
+ */
+export interface K8SHelmChartV1Beta2 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * HelmChartSpec specifies the desired state of a Helm chart.
+   */
+  spec?: {
+    /**
+     * AccessFrom specifies an Access Control List for allowing cross-namespace
+     * references to this object.
+     * NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092
+     */
+    accessFrom?: {
+      /**
+       * NamespaceSelectors is the list of namespace selectors to which this ACL applies.
+       * Items in this list are evaluated using a logical OR operation.
+       */
+      namespaceSelectors: {
+        /**
+         * MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+         * map is equivalent to an element of matchExpressions, whose key field is "key", the
+         * operator is "In", and the values array contains only "value". The requirements are ANDed.
+         */
+        matchLabels?: {
+          [k: string]: string;
+        };
+      }[];
+    };
+    /**
+     * Chart is the name or path the Helm chart is available at in the
+     * SourceRef.
+     */
+    chart: string;
+    /**
+     * IgnoreMissingValuesFiles controls whether to silently ignore missing values
+     * files rather than failing.
+     */
+    ignoreMissingValuesFiles?: boolean;
+    /**
+     * Interval at which the HelmChart SourceRef is checked for updates.
+     * This interval is approximate and may be subject to jitter to ensure
+     * efficient use of resources.
+     */
+    interval: string;
+    /**
+     * ReconcileStrategy determines what enables the creation of a new artifact.
+     * Valid values are ('ChartVersion', 'Revision').
+     * See the documentation of the values for an explanation on their behavior.
+     * Defaults to ChartVersion when omitted.
+     */
+    reconcileStrategy?: string;
+    /**
+     * SourceRef is the reference to the Source the chart is available at.
+     */
+    sourceRef: {
+      /**
+       * APIVersion of the referent.
+       */
+      apiVersion?: string;
+      /**
+       * Kind of the referent, valid values are ('HelmRepository', 'GitRepository',
+       * 'Bucket').
+       */
+      kind: string;
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * Suspend tells the controller to suspend the reconciliation of this
+     * source.
+     */
+    suspend?: boolean;
+    /**
+     * ValuesFile is an alternative values file to use as the default chart
+     * values, expected to be a relative path in the SourceRef. Deprecated in
+     * favor of ValuesFiles, for backwards compatibility the file specified here
+     * is merged before the ValuesFiles items. Ignored when omitted.
+     */
+    valuesFile?: string;
+    /**
+     * ValuesFiles is an alternative list of values files to use as the chart
+     * values (values.yaml is not included by default), expected to be a
+     * relative path in the SourceRef.
+     * Values files are merged in the order of this list with the last file
+     * overriding the first. Ignored when omitted.
+     */
+    valuesFiles?: string[];
+    /**
+     * Verify contains the secret name containing the trusted public keys
+     * used to verify the signature and specifies which provider to use to check
+     * whether OCI image is authentic.
+     * This field is only supported when using HelmRepository source with spec.type 'oci'.
+     * Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified.
+     */
+    verify?: {
+      /**
+       * MatchOIDCIdentity specifies the identity matching criteria to use
+       * while verifying an OCI artifact which was signed using Cosign keyless
+       * signing. The artifact's identity is deemed to be verified if any of the
+       * specified matchers match against the identity.
+       */
+      matchOIDCIdentity?: {
+        /**
+         * Issuer specifies the regex pattern to match against to verify
+         * the OIDC issuer in the Fulcio certificate. The pattern must be a
+         * valid Go regular expression.
+         */
+        issuer: string;
+        /**
+         * Subject specifies the regex pattern to match against to verify
+         * the identity subject in the Fulcio certificate. The pattern must
+         * be a valid Go regular expression.
+         */
+        subject: string;
+      }[];
+      /**
+       * Provider specifies the technology used to sign the OCI Artifact.
+       */
+      provider: string;
+      /**
+       * SecretRef specifies the Kubernetes Secret containing the
+       * trusted public keys.
+       */
+      secretRef?: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+    };
+    /**
+     * Version is the chart version semver expression, ignored for charts from
+     * GitRepository and Bucket sources. Defaults to latest when omitted.
+     */
+    version?: string;
+  };
+  /**
+   * HelmChartStatus records the observed state of the HelmChart.
+   */
+  status?: {
+    /**
+     * Artifact represents the output of the last successful reconciliation.
+     */
+    artifact?: {
+      /**
+       * Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
+       */
+      digest?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of the
+       * Artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Metadata holds upstream information such as OCI annotations.
+       */
+      metadata?: {
+        [k: string]: string;
+      };
+      /**
+       * Path is the relative file path of the Artifact. It can be used to locate
+       * the file in the root of the Artifact storage on the local file system of
+       * the controller managing the Source.
+       */
+      path: string;
+      /**
+       * Revision is a human-readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
+       */
+      revision: string;
+      /**
+       * Size is the number of bytes in the file.
+       */
+      size?: number;
+      /**
+       * URL is the HTTP address of the Artifact as exposed by the controller
+       * managing the Source. It can be used to retrieve the Artifact for
+       * consumption, e.g. by another controller applying the Artifact contents.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the HelmChart.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedChartName is the last observed chart name as specified by the
+     * resolved chart reference.
+     */
+    observedChartName?: string;
+    /**
+     * ObservedGeneration is the last observed generation of the HelmChart
+     * object.
+     */
+    observedGeneration?: number;
+    /**
+     * ObservedSourceArtifactRevision is the last observed Artifact.Revision
+     * of the HelmChartSpec.SourceRef.
+     */
+    observedSourceArtifactRevision?: string;
+    /**
+     * ObservedValuesFiles are the observed value files of the last successful
+     * reconciliation.
+     * It matches the chart in the last successfully reconciled artifact.
+     */
+    observedValuesFiles?: string[];
+    /**
+     * URL is the dynamic fetch link for the latest Artifact.
+     * It is provided on a "best effort" basis, and using the precise
+     * BucketStatus.Artifact data is recommended.
+     */
+    url?: string;
+  };
+}

src/__generated__/resources/K8SHelmReleaseV2.ts

@@ -0,0 +1,987 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * HelmRelease is the Schema for the helmreleases API
+ */
+export interface K8SHelmReleaseV2 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * HelmReleaseSpec defines the desired state of a Helm release.
+   */
+  spec?: {
+    /**
+     * Chart defines the template of the v1.HelmChart that should be created
+     * for this HelmRelease.
+     */
+    chart?: {
+      /**
+       * ObjectMeta holds the template for metadata like labels and annotations.
+       */
+      metadata?: {
+        /**
+         * Annotations is an unstructured key value map stored with a resource that may be
+         * set by external tools to store and retrieve arbitrary metadata. They are not
+         * queryable and should be preserved when modifying objects.
+         * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+         */
+        annotations?: {
+          [k: string]: string;
+        };
+        /**
+         * Map of string keys and values that can be used to organize and categorize
+         * (scope and select) objects.
+         * More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+         */
+        labels?: {
+          [k: string]: string;
+        };
+      };
+      /**
+       * Spec holds the template for the v1.HelmChartSpec for this HelmRelease.
+       */
+      spec: {
+        /**
+         * The name or path the Helm chart is available at in the SourceRef.
+         */
+        chart: string;
+        /**
+         * IgnoreMissingValuesFiles controls whether to silently ignore missing values files rather than failing.
+         */
+        ignoreMissingValuesFiles?: boolean;
+        /**
+         * Interval at which to check the v1.Source for updates. Defaults to
+         * 'HelmReleaseSpec.Interval'.
+         */
+        interval?: string;
+        /**
+         * Determines what enables the creation of a new artifact. Valid values are
+         * ('ChartVersion', 'Revision').
+         * See the documentation of the values for an explanation on their behavior.
+         * Defaults to ChartVersion when omitted.
+         */
+        reconcileStrategy?: string;
+        /**
+         * The name and namespace of the v1.Source the chart is available at.
+         */
+        sourceRef: {
+          /**
+           * APIVersion of the referent.
+           */
+          apiVersion?: string;
+          /**
+           * Kind of the referent.
+           */
+          kind: string;
+          /**
+           * Name of the referent.
+           */
+          name: string;
+          /**
+           * Namespace of the referent.
+           */
+          namespace?: string;
+        };
+        /**
+         * Alternative list of values files to use as the chart values (values.yaml
+         * is not included by default), expected to be a relative path in the SourceRef.
+         * Values files are merged in the order of this list with the last file overriding
+         * the first. Ignored when omitted.
+         */
+        valuesFiles?: string[];
+        /**
+         * Verify contains the secret name containing the trusted public keys
+         * used to verify the signature and specifies which provider to use to check
+         * whether OCI image is authentic.
+         * This field is only supported for OCI sources.
+         * Chart dependencies, which are not bundled in the umbrella chart artifact,
+         * are not verified.
+         */
+        verify?: {
+          /**
+           * Provider specifies the technology used to sign the OCI Helm chart.
+           */
+          provider: string;
+          /**
+           * SecretRef specifies the Kubernetes Secret containing the
+           * trusted public keys.
+           */
+          secretRef?: {
+            /**
+             * Name of the referent.
+             */
+            name: string;
+          };
+        };
+        /**
+         * Version semver expression, ignored for charts from v1.GitRepository and
+         * v1beta2.Bucket sources. Defaults to latest when omitted.
+         */
+        version?: string;
+      };
+    };
+    /**
+     * ChartRef holds a reference to a source controller resource containing the
+     * Helm chart artifact.
+     */
+    chartRef?: {
+      /**
+       * APIVersion of the referent.
+       */
+      apiVersion?: string;
+      /**
+       * Kind of the referent.
+       */
+      kind: string;
+      /**
+       * Name of the referent.
+       */
+      name: string;
+      /**
+       * Namespace of the referent, defaults to the namespace of the Kubernetes
+       * resource object that contains the reference.
+       */
+      namespace?: string;
+    };
+    /**
+     * DependsOn may contain a meta.NamespacedObjectReference slice with
+     * references to HelmRelease resources that must be ready before this HelmRelease
+     * can be reconciled.
+     */
+    dependsOn?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+      /**
+       * Namespace of the referent, when not specified it acts as LocalObjectReference.
+       */
+      namespace?: string;
+    }[];
+    /**
+     * DriftDetection holds the configuration for detecting and handling
+     * differences between the manifest in the Helm storage and the resources
+     * currently existing in the cluster.
+     */
+    driftDetection?: {
+      /**
+       * Ignore contains a list of rules for specifying which changes to ignore
+       * during diffing.
+       */
+      ignore?: {
+        /**
+         * Paths is a list of JSON Pointer (RFC 6901) paths to be excluded from
+         * consideration in a Kubernetes object.
+         */
+        paths: string[];
+        /**
+         * Target is a selector for specifying Kubernetes objects to which this
+         * rule applies.
+         * If Target is not set, the Paths will be ignored for all Kubernetes
+         * objects within the manifest of the Helm release.
+         */
+        target?: {
+          /**
+           * AnnotationSelector is a string that follows the label selection expression
+           * https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
+           * It matches with the resource annotations.
+           */
+          annotationSelector?: string;
+          /**
+           * Group is the API group to select resources from.
+           * Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.
+           * https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
+           */
+          group?: string;
+          /**
+           * Kind of the API Group to select resources from.
+           * Together with Group and Version it is capable of unambiguously
+           * identifying and/or selecting resources.
+           * https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
+           */
+          kind?: string;
+          /**
+           * LabelSelector is a string that follows the label selection expression
+           * https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
+           * It matches with the resource labels.
+           */
+          labelSelector?: string;
+          /**
+           * Name to match resources with.
+           */
+          name?: string;
+          /**
+           * Namespace to select resources from.
+           */
+          namespace?: string;
+          /**
+           * Version of the API Group to select resources from.
+           * Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.
+           * https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
+           */
+          version?: string;
+        };
+      }[];
+      /**
+       * Mode defines how differences should be handled between the Helm manifest
+       * and the manifest currently applied to the cluster.
+       * If not explicitly set, it defaults to DiffModeDisabled.
+       */
+      mode?: string;
+    };
+    /**
+     * Install holds the configuration for Helm install actions for this HelmRelease.
+     */
+    install?: {
+      /**
+       * CRDs upgrade CRDs from the Helm Chart's crds directory according
+       * to the CRD upgrade policy provided here. Valid values are `Skip`,
+       * `Create` or `CreateReplace`. Default is `Create` and if omitted
+       * CRDs are installed but not updated.
+       *
+       * Skip: do neither install nor replace (update) any CRDs.
+       *
+       * Create: new CRDs are created, existing CRDs are neither updated nor deleted.
+       *
+       * CreateReplace: new CRDs are created, existing CRDs are updated (replaced)
+       * but not deleted.
+       *
+       * By default, CRDs are applied (installed) during Helm install action.
+       * With this option users can opt in to CRD replace existing CRDs on Helm
+       * install actions, which is not (yet) natively supported by Helm.
+       * https://helm.sh/docs/chart_best_practices/custom_resource_definitions.
+       */
+      crds?: string;
+      /**
+       * CreateNamespace tells the Helm install action to create the
+       * HelmReleaseSpec.TargetNamespace if it does not exist yet.
+       * On uninstall, the namespace will not be garbage collected.
+       */
+      createNamespace?: boolean;
+      /**
+       * DisableHooks prevents hooks from running during the Helm install action.
+       */
+      disableHooks?: boolean;
+      /**
+       * DisableOpenAPIValidation prevents the Helm install action from validating
+       * rendered templates against the Kubernetes OpenAPI Schema.
+       */
+      disableOpenAPIValidation?: boolean;
+      /**
+       * DisableSchemaValidation prevents the Helm install action from validating
+       * the values against the JSON Schema.
+       */
+      disableSchemaValidation?: boolean;
+      /**
+       * DisableTakeOwnership disables taking ownership of existing resources
+       * during the Helm install action. Defaults to false.
+       */
+      disableTakeOwnership?: boolean;
+      /**
+       * DisableWait disables the waiting for resources to be ready after a Helm
+       * install has been performed.
+       */
+      disableWait?: boolean;
+      /**
+       * DisableWaitForJobs disables waiting for jobs to complete after a Helm
+       * install has been performed.
+       */
+      disableWaitForJobs?: boolean;
+      /**
+       * Remediation holds the remediation configuration for when the Helm install
+       * action for the HelmRelease fails. The default is to not perform any action.
+       */
+      remediation?: {
+        /**
+         * IgnoreTestFailures tells the controller to skip remediation when the Helm
+         * tests are run after an install action but fail. Defaults to
+         * 'Test.IgnoreFailures'.
+         */
+        ignoreTestFailures?: boolean;
+        /**
+         * RemediateLastFailure tells the controller to remediate the last failure, when
+         * no retries remain. Defaults to 'false'.
+         */
+        remediateLastFailure?: boolean;
+        /**
+         * Retries is the number of retries that should be attempted on failures before
+         * bailing. Remediation, using an uninstall, is performed between each attempt.
+         * Defaults to '0', a negative integer equals to unlimited retries.
+         */
+        retries?: number;
+      };
+      /**
+       * Replace tells the Helm install action to re-use the 'ReleaseName', but only
+       * if that name is a deleted release which remains in the history.
+       */
+      replace?: boolean;
+      /**
+       * SkipCRDs tells the Helm install action to not install any CRDs. By default,
+       * CRDs are installed if not already present.
+       *
+       * Deprecated use CRD policy (`crds`) attribute with value `Skip` instead.
+       */
+      skipCRDs?: boolean;
+      /**
+       * Timeout is the time to wait for any individual Kubernetes operation (like
+       * Jobs for hooks) during the performance of a Helm install action. Defaults to
+       * 'HelmReleaseSpec.Timeout'.
+       */
+      timeout?: string;
+    };
+    /**
+     * Interval at which to reconcile the Helm release.
+     */
+    interval: string;
+    /**
+     * KubeConfig for reconciling the HelmRelease on a remote cluster.
+     * When used in combination with HelmReleaseSpec.ServiceAccountName,
+     * forces the controller to act on behalf of that Service Account at the
+     * target cluster.
+     * If the --default-service-account flag is set, its value will be used as
+     * a controller level fallback for when HelmReleaseSpec.ServiceAccountName
+     * is empty.
+     */
+    kubeConfig?: {
+      /**
+       * SecretRef holds the name of a secret that contains a key with
+       * the kubeconfig file as the value. If no key is set, the key will default
+       * to 'value'.
+       * It is recommended that the kubeconfig is self-contained, and the secret
+       * is regularly updated if credentials such as a cloud-access-token expire.
+       * Cloud specific `cmd-path` auth helpers will not function without adding
+       * binaries and credentials to the Pod that is responsible for reconciling
+       * Kubernetes resources.
+       */
+      secretRef: {
+        /**
+         * Key in the Secret, when not specified an implementation-specific default key is used.
+         */
+        key?: string;
+        /**
+         * Name of the Secret.
+         */
+        name: string;
+      };
+    };
+    /**
+     * MaxHistory is the number of revisions saved by Helm for this HelmRelease.
+     * Use '0' for an unlimited number of revisions; defaults to '5'.
+     */
+    maxHistory?: number;
+    /**
+     * PersistentClient tells the controller to use a persistent Kubernetes
+     * client for this release. When enabled, the client will be reused for the
+     * duration of the reconciliation, instead of being created and destroyed
+     * for each (step of a) Helm action.
+     *
+     * This can improve performance, but may cause issues with some Helm charts
+     * that for example do create Custom Resource Definitions during installation
+     * outside Helm's CRD lifecycle hooks, which are then not observed to be
+     * available by e.g. post-install hooks.
+     *
+     * If not set, it defaults to true.
+     */
+    persistentClient?: boolean;
+    /**
+     * PostRenderers holds an array of Helm PostRenderers, which will be applied in order
+     * of their definition.
+     */
+    postRenderers?: {
+      /**
+       * Kustomization to apply as PostRenderer.
+       */
+      kustomize?: {
+        /**
+         * Images is a list of (image name, new name, new tag or digest)
+         * for changing image names, tags or digests. This can also be achieved with a
+         * patch, but this operator is simpler to specify.
+         */
+        images?: {
+          /**
+           * Digest is the value used to replace the original image tag.
+           * If digest is present NewTag value is ignored.
+           */
+          digest?: string;
+          /**
+           * Name is a tag-less image name.
+           */
+          name: string;
+          /**
+           * NewName is the value used to replace the original name.
+           */
+          newName?: string;
+          /**
+           * NewTag is the value used to replace the original tag.
+           */
+          newTag?: string;
+        }[];
+        /**
+         * Strategic merge and JSON patches, defined as inline YAML objects,
+         * capable of targeting objects based on kind, label and annotation selectors.
+         */
+        patches?: {
+          /**
+           * Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with
+           * an array of operation objects.
+           */
+          patch: string;
+          /**
+           * Target points to the resources that the patch document should be applied to.
+           */
+          target?: {
+            /**
+             * AnnotationSelector is a string that follows the label selection expression
+             * https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
+             * It matches with the resource annotations.
+             */
+            annotationSelector?: string;
+            /**
+             * Group is the API group to select resources from.
+             * Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources.
+             * https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
+             */
+            group?: string;
+            /**
+             * Kind of the API Group to select resources from.
+             * Together with Group and Version it is capable of unambiguously
+             * identifying and/or selecting resources.
+             * https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
+             */
+            kind?: string;
+            /**
+             * LabelSelector is a string that follows the label selection expression
+             * https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api
+             * It matches with the resource labels.
+             */
+            labelSelector?: string;
+            /**
+             * Name to match resources with.
+             */
+            name?: string;
+            /**
+             * Namespace to select resources from.
+             */
+            namespace?: string;
+            /**
+             * Version of the API Group to select resources from.
+             * Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources.
+             * https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md
+             */
+            version?: string;
+          };
+        }[];
+      };
+    }[];
+    /**
+     * ReleaseName used for the Helm release. Defaults to a composition of
+     * '[TargetNamespace-]Name'.
+     */
+    releaseName?: string;
+    /**
+     * Rollback holds the configuration for Helm rollback actions for this HelmRelease.
+     */
+    rollback?: {
+      /**
+       * CleanupOnFail allows deletion of new resources created during the Helm
+       * rollback action when it fails.
+       */
+      cleanupOnFail?: boolean;
+      /**
+       * DisableHooks prevents hooks from running during the Helm rollback action.
+       */
+      disableHooks?: boolean;
+      /**
+       * DisableWait disables the waiting for resources to be ready after a Helm
+       * rollback has been performed.
+       */
+      disableWait?: boolean;
+      /**
+       * DisableWaitForJobs disables waiting for jobs to complete after a Helm
+       * rollback has been performed.
+       */
+      disableWaitForJobs?: boolean;
+      /**
+       * Force forces resource updates through a replacement strategy.
+       */
+      force?: boolean;
+      /**
+       * Recreate performs pod restarts for the resource if applicable.
+       */
+      recreate?: boolean;
+      /**
+       * Timeout is the time to wait for any individual Kubernetes operation (like
+       * Jobs for hooks) during the performance of a Helm rollback action. Defaults to
+       * 'HelmReleaseSpec.Timeout'.
+       */
+      timeout?: string;
+    };
+    /**
+     * The name of the Kubernetes service account to impersonate
+     * when reconciling this HelmRelease.
+     */
+    serviceAccountName?: string;
+    /**
+     * StorageNamespace used for the Helm storage.
+     * Defaults to the namespace of the HelmRelease.
+     */
+    storageNamespace?: string;
+    /**
+     * Suspend tells the controller to suspend reconciliation for this HelmRelease,
+     * it does not apply to already started reconciliations. Defaults to false.
+     */
+    suspend?: boolean;
+    /**
+     * TargetNamespace to target when performing operations for the HelmRelease.
+     * Defaults to the namespace of the HelmRelease.
+     */
+    targetNamespace?: string;
+    /**
+     * Test holds the configuration for Helm test actions for this HelmRelease.
+     */
+    test?: {
+      /**
+       * Enable enables Helm test actions for this HelmRelease after an Helm install
+       * or upgrade action has been performed.
+       */
+      enable?: boolean;
+      /**
+       * Filters is a list of tests to run or exclude from running.
+       */
+      filters?: {
+        /**
+         * Exclude specifies whether the named test should be excluded.
+         */
+        exclude?: boolean;
+        /**
+         * Name is the name of the test.
+         */
+        name: string;
+      }[];
+      /**
+       * IgnoreFailures tells the controller to skip remediation when the Helm tests
+       * are run but fail. Can be overwritten for tests run after install or upgrade
+       * actions in 'Install.IgnoreTestFailures' and 'Upgrade.IgnoreTestFailures'.
+       */
+      ignoreFailures?: boolean;
+      /**
+       * Timeout is the time to wait for any individual Kubernetes operation during
+       * the performance of a Helm test action. Defaults to 'HelmReleaseSpec.Timeout'.
+       */
+      timeout?: string;
+    };
+    /**
+     * Timeout is the time to wait for any individual Kubernetes operation (like Jobs
+     * for hooks) during the performance of a Helm action. Defaults to '5m0s'.
+     */
+    timeout?: string;
+    /**
+     * Uninstall holds the configuration for Helm uninstall actions for this HelmRelease.
+     */
+    uninstall?: {
+      /**
+       * DeletionPropagation specifies the deletion propagation policy when
+       * a Helm uninstall is performed.
+       */
+      deletionPropagation?: string;
+      /**
+       * DisableHooks prevents hooks from running during the Helm rollback action.
+       */
+      disableHooks?: boolean;
+      /**
+       * DisableWait disables waiting for all the resources to be deleted after
+       * a Helm uninstall is performed.
+       */
+      disableWait?: boolean;
+      /**
+       * KeepHistory tells Helm to remove all associated resources and mark the
+       * release as deleted, but retain the release history.
+       */
+      keepHistory?: boolean;
+      /**
+       * Timeout is the time to wait for any individual Kubernetes operation (like
+       * Jobs for hooks) during the performance of a Helm uninstall action. Defaults
+       * to 'HelmReleaseSpec.Timeout'.
+       */
+      timeout?: string;
+    };
+    /**
+     * Upgrade holds the configuration for Helm upgrade actions for this HelmRelease.
+     */
+    upgrade?: {
+      /**
+       * CleanupOnFail allows deletion of new resources created during the Helm
+       * upgrade action when it fails.
+       */
+      cleanupOnFail?: boolean;
+      /**
+       * CRDs upgrade CRDs from the Helm Chart's crds directory according
+       * to the CRD upgrade policy provided here. Valid values are `Skip`,
+       * `Create` or `CreateReplace`. Default is `Skip` and if omitted
+       * CRDs are neither installed nor upgraded.
+       *
+       * Skip: do neither install nor replace (update) any CRDs.
+       *
+       * Create: new CRDs are created, existing CRDs are neither updated nor deleted.
+       *
+       * CreateReplace: new CRDs are created, existing CRDs are updated (replaced)
+       * but not deleted.
+       *
+       * By default, CRDs are not applied during Helm upgrade action. With this
+       * option users can opt-in to CRD upgrade, which is not (yet) natively supported by Helm.
+       * https://helm.sh/docs/chart_best_practices/custom_resource_definitions.
+       */
+      crds?: string;
+      /**
+       * DisableHooks prevents hooks from running during the Helm upgrade action.
+       */
+      disableHooks?: boolean;
+      /**
+       * DisableOpenAPIValidation prevents the Helm upgrade action from validating
+       * rendered templates against the Kubernetes OpenAPI Schema.
+       */
+      disableOpenAPIValidation?: boolean;
+      /**
+       * DisableSchemaValidation prevents the Helm upgrade action from validating
+       * the values against the JSON Schema.
+       */
+      disableSchemaValidation?: boolean;
+      /**
+       * DisableTakeOwnership disables taking ownership of existing resources
+       * during the Helm upgrade action. Defaults to false.
+       */
+      disableTakeOwnership?: boolean;
+      /**
+       * DisableWait disables the waiting for resources to be ready after a Helm
+       * upgrade has been performed.
+       */
+      disableWait?: boolean;
+      /**
+       * DisableWaitForJobs disables waiting for jobs to complete after a Helm
+       * upgrade has been performed.
+       */
+      disableWaitForJobs?: boolean;
+      /**
+       * Force forces resource updates through a replacement strategy.
+       */
+      force?: boolean;
+      /**
+       * PreserveValues will make Helm reuse the last release's values and merge in
+       * overrides from 'Values'. Setting this flag makes the HelmRelease
+       * non-declarative.
+       */
+      preserveValues?: boolean;
+      /**
+       * Remediation holds the remediation configuration for when the Helm upgrade
+       * action for the HelmRelease fails. The default is to not perform any action.
+       */
+      remediation?: {
+        /**
+         * IgnoreTestFailures tells the controller to skip remediation when the Helm
+         * tests are run after an upgrade action but fail.
+         * Defaults to 'Test.IgnoreFailures'.
+         */
+        ignoreTestFailures?: boolean;
+        /**
+         * RemediateLastFailure tells the controller to remediate the last failure, when
+         * no retries remain. Defaults to 'false' unless 'Retries' is greater than 0.
+         */
+        remediateLastFailure?: boolean;
+        /**
+         * Retries is the number of retries that should be attempted on failures before
+         * bailing. Remediation, using 'Strategy', is performed between each attempt.
+         * Defaults to '0', a negative integer equals to unlimited retries.
+         */
+        retries?: number;
+        /**
+         * Strategy to use for failure remediation. Defaults to 'rollback'.
+         */
+        strategy?: string;
+      };
+      /**
+       * Timeout is the time to wait for any individual Kubernetes operation (like
+       * Jobs for hooks) during the performance of a Helm upgrade action. Defaults to
+       * 'HelmReleaseSpec.Timeout'.
+       */
+      timeout?: string;
+    };
+    /**
+     * Values holds the values for this Helm release.
+     */
+    values?: {
+      [k: string]: unknown;
+    };
+    /**
+     * ValuesFrom holds references to resources containing Helm values for this HelmRelease,
+     * and information about how they should be merged.
+     */
+    valuesFrom?: {
+      /**
+       * Kind of the values referent, valid values are ('Secret', 'ConfigMap').
+       */
+      kind: "Secret" | "ConfigMap";
+      /**
+       * Name of the values referent. Should reside in the same namespace as the
+       * referring resource.
+       */
+      name: string;
+      /**
+       * Optional marks this ValuesReference as optional. When set, a not found error
+       * for the values reference is ignored, but any ValuesKey, TargetPath or
+       * transient error will still result in a reconciliation failure.
+       */
+      optional?: boolean;
+      /**
+       * TargetPath is the YAML dot notation path the value should be merged at. When
+       * set, the ValuesKey is expected to be a single flat value. Defaults to 'None',
+       * which results in the values getting merged at the root.
+       */
+      targetPath?: string;
+      /**
+       * ValuesKey is the data key where the values.yaml or a specific value can be
+       * found at. Defaults to 'values.yaml'.
+       */
+      valuesKey?: string;
+    }[];
+  };
+  /**
+   * HelmReleaseStatus defines the observed state of a HelmRelease.
+   */
+  status?: {
+    /**
+     * Conditions holds the conditions for the HelmRelease.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * Failures is the reconciliation failure count against the latest desired
+     * state. It is reset after a successful reconciliation.
+     */
+    failures?: number;
+    /**
+     * HelmChart is the namespaced name of the HelmChart resource created by
+     * the controller for the HelmRelease.
+     */
+    helmChart?: string;
+    /**
+     * History holds the history of Helm releases performed for this HelmRelease
+     * up to the last successfully completed release.
+     */
+    history?: {
+      /**
+       * APIVersion is the API version of the Snapshot.
+       * Provisional: when the calculation method of the Digest field is changed,
+       * this field will be used to distinguish between the old and new methods.
+       */
+      apiVersion?: string;
+      /**
+       * AppVersion is the chart app version of the release object in storage.
+       */
+      appVersion?: string;
+      /**
+       * ChartName is the chart name of the release object in storage.
+       */
+      chartName: string;
+      /**
+       * ChartVersion is the chart version of the release object in
+       * storage.
+       */
+      chartVersion: string;
+      /**
+       * ConfigDigest is the checksum of the config (better known as
+       * "values") of the release object in storage.
+       * It has the format of `<algo>:<checksum>`.
+       */
+      configDigest: string;
+      /**
+       * Deleted is when the release was deleted.
+       */
+      deleted?: string;
+      /**
+       * Digest is the checksum of the release object in storage.
+       * It has the format of `<algo>:<checksum>`.
+       */
+      digest: string;
+      /**
+       * FirstDeployed is when the release was first deployed.
+       */
+      firstDeployed: string;
+      /**
+       * LastDeployed is when the release was last deployed.
+       */
+      lastDeployed: string;
+      /**
+       * Name is the name of the release.
+       */
+      name: string;
+      /**
+       * Namespace is the namespace the release is deployed to.
+       */
+      namespace: string;
+      /**
+       * OCIDigest is the digest of the OCI artifact associated with the release.
+       */
+      ociDigest?: string;
+      /**
+       * Status is the current state of the release.
+       */
+      status: string;
+      /**
+       * TestHooks is the list of test hooks for the release as observed to be
+       * run by the controller.
+       */
+      testHooks?: {
+        /**
+         * TestHookStatus holds the status information for a test hook as observed
+         * to be run by the controller.
+         */
+        [k: string]: {
+          /**
+           * LastCompleted is the time the test hook last completed.
+           */
+          lastCompleted?: string;
+          /**
+           * LastStarted is the time the test hook was last started.
+           */
+          lastStarted?: string;
+          /**
+           * Phase the test hook was observed to be in.
+           */
+          phase?: string;
+        };
+      };
+      /**
+       * Version is the version of the release object in storage.
+       */
+      version: number;
+    }[];
+    /**
+     * InstallFailures is the install failure count against the latest desired
+     * state. It is reset after a successful reconciliation.
+     */
+    installFailures?: number;
+    /**
+     * LastAttemptedConfigDigest is the digest for the config (better known as
+     * "values") of the last reconciliation attempt.
+     */
+    lastAttemptedConfigDigest?: string;
+    /**
+     * LastAttemptedGeneration is the last generation the controller attempted
+     * to reconcile.
+     */
+    lastAttemptedGeneration?: number;
+    /**
+     * LastAttemptedReleaseAction is the last release action performed for this
+     * HelmRelease. It is used to determine the active remediation strategy.
+     */
+    lastAttemptedReleaseAction?: string;
+    /**
+     * LastAttemptedRevision is the Source revision of the last reconciliation
+     * attempt. For OCIRepository  sources, the 12 first characters of the digest are
+     * appended to the chart version e.g. "1.2.3+1234567890ab".
+     */
+    lastAttemptedRevision?: string;
+    /**
+     * LastAttemptedRevisionDigest is the digest of the last reconciliation attempt.
+     * This is only set for OCIRepository sources.
+     */
+    lastAttemptedRevisionDigest?: string;
+    /**
+     * LastAttemptedValuesChecksum is the SHA1 checksum for the values of the last
+     * reconciliation attempt.
+     * Deprecated: Use LastAttemptedConfigDigest instead.
+     */
+    lastAttemptedValuesChecksum?: string;
+    /**
+     * LastHandledForceAt holds the value of the most recent force request
+     * value, so a change of the annotation value can be detected.
+     */
+    lastHandledForceAt?: string;
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * LastHandledResetAt holds the value of the most recent reset request
+     * value, so a change of the annotation value can be detected.
+     */
+    lastHandledResetAt?: string;
+    /**
+     * LastReleaseRevision is the revision of the last successful Helm release.
+     * Deprecated: Use History instead.
+     */
+    lastReleaseRevision?: number;
+    /**
+     * ObservedGeneration is the last observed generation.
+     */
+    observedGeneration?: number;
+    /**
+     * ObservedPostRenderersDigest is the digest for the post-renderers of
+     * the last successful reconciliation attempt.
+     */
+    observedPostRenderersDigest?: string;
+    /**
+     * StorageNamespace is the namespace of the Helm release storage for the
+     * current release.
+     */
+    storageNamespace?: string;
+    /**
+     * UpgradeFailures is the upgrade failure count against the latest desired
+     * state. It is reset after a successful reconciliation.
+     */
+    upgradeFailures?: number;
+  };
+}

src/__generated__/resources/K8SHelmRepositoryV1.json

@@ -0,0 +1,247 @@
+{
+  "description": "HelmRepository is the Schema for the helmrepositories API.",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "HelmRepositorySpec specifies the required configuration to produce an\nArtifact for a Helm repository index YAML.",
+      "properties": {
+        "accessFrom": {
+          "description": "AccessFrom specifies an Access Control List for allowing cross-namespace\nreferences to this object.\nNOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092",
+          "properties": {
+            "namespaceSelectors": {
+              "description": "NamespaceSelectors is the list of namespace selectors to which this ACL applies.\nItems in this list are evaluated using a logical OR operation.",
+              "items": {
+                "description": "NamespaceSelector selects the namespaces to which this ACL applies.\nAn empty map of MatchLabels matches all namespaces in a cluster.",
+                "type": "object",
+                "properties": {
+                  "matchLabels": {
+                    "description": "MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  }
+                }
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "namespaceSelectors"
+          ],
+          "type": "object"
+        },
+        "certSecretRef": {
+          "description": "CertSecretRef can be given the name of a Secret containing\neither or both of\n\n- a PEM-encoded client certificate (`tls.crt`) and private\nkey (`tls.key`);\n- a PEM-encoded CA certificate (`ca.crt`)\n\nand whichever are supplied, will be used for connecting to the\nregistry. The client cert and key are useful if you are\nauthenticating with a certificate; the CA cert is useful if\nyou are using a self-signed server certificate. The Secret must\nbe of type `Opaque` or `kubernetes.io/tls`.\n\nIt takes precedence over the values specified in the Secret referred\nto by `.spec.secretRef`.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "insecure": {
+          "description": "Insecure allows connecting to a non-TLS HTTP container registry.\nThis field is only taken into account if the .spec.type field is set to 'oci'.",
+          "type": "boolean"
+        },
+        "interval": {
+          "description": "Interval at which the HelmRepository URL is checked for updates.\nThis interval is approximate and may be subject to jitter to ensure\nefficient use of resources.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
+          "type": "string"
+        },
+        "passCredentials": {
+          "description": "PassCredentials allows the credentials from the SecretRef to be passed\non to a host that does not match the host as defined in URL.\nThis may be required if the host of the advertised chart URLs in the\nindex differ from the defined URL.\nEnabling this should be done with caution, as it can potentially result\nin credentials getting stolen in a MITM-attack.",
+          "type": "boolean"
+        },
+        "provider": {
+          "_default": "generic",
+          "description": "Provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.\nThis field is optional, and only taken into account if the .spec.type field is set to 'oci'.\nWhen not specified, defaults to 'generic'.",
+          "_enum": [
+            "generic",
+            "aws",
+            "azure",
+            "gcp"
+          ],
+          "type": "string"
+        },
+        "secretRef": {
+          "description": "SecretRef specifies the Secret containing authentication credentials\nfor the HelmRepository.\nFor HTTP/S basic auth the secret must contain 'username' and 'password'\nfields.\nSupport for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile'\nkeys is deprecated. Please use `.spec.certSecretRef` instead.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "suspend": {
+          "description": "Suspend tells the controller to suspend the reconciliation of this\nHelmRepository.",
+          "type": "boolean"
+        },
+        "timeout": {
+          "description": "Timeout is used for the index fetch operation for an HTTPS helm repository,\nand for remote OCI Repository operations like pulling for an OCI helm\nchart by the associated HelmChart.\nIts default value is 60s.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m))+$",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type of the HelmRepository.\nWhen this field is set to  \"oci\", the URL field value must be prefixed with \"oci://\".",
+          "_enum": [
+            "default",
+            "oci"
+          ],
+          "type": "string"
+        },
+        "url": {
+          "description": "URL of the Helm repository, a valid URL contains at least a protocol and\nhost.",
+          "pattern": "^(http|https|oci)://.*$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "url"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "HelmRepositoryStatus records the observed state of the HelmRepository.",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the last successful HelmRepository reconciliation.",
+          "properties": {
+            "digest": {
+              "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+              "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "metadata": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Metadata holds upstream information such as OCI annotations.",
+              "type": "object"
+            },
+            "path": {
+              "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+              "type": "string"
+            },
+            "size": {
+              "description": "Size is the number of bytes in the file.",
+              "format": "int64",
+              "type": "integer"
+            },
+            "url": {
+              "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "revision",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the HelmRepository.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation of the HelmRepository\nobject.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "url": {
+          "description": "URL is the dynamic fetch link for the latest Artifact.\nIt is provided on a \"best effort\" basis, and using the precise\nHelmRepositoryStatus.Artifact data is recommended.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

src/__generated__/resources/K8SHelmRepositoryV1.ts

@@ -0,0 +1,240 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * HelmRepository is the Schema for the helmrepositories API.
+ */
+export interface K8SHelmRepositoryV1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * HelmRepositorySpec specifies the required configuration to produce an
+   * Artifact for a Helm repository index YAML.
+   */
+  spec?: {
+    /**
+     * AccessFrom specifies an Access Control List for allowing cross-namespace
+     * references to this object.
+     * NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092
+     */
+    accessFrom?: {
+      /**
+       * NamespaceSelectors is the list of namespace selectors to which this ACL applies.
+       * Items in this list are evaluated using a logical OR operation.
+       */
+      namespaceSelectors: {
+        /**
+         * MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+         * map is equivalent to an element of matchExpressions, whose key field is "key", the
+         * operator is "In", and the values array contains only "value". The requirements are ANDed.
+         */
+        matchLabels?: {
+          [k: string]: string;
+        };
+      }[];
+    };
+    /**
+     * CertSecretRef can be given the name of a Secret containing
+     * either or both of
+     *
+     * - a PEM-encoded client certificate (`tls.crt`) and private
+     * key (`tls.key`);
+     * - a PEM-encoded CA certificate (`ca.crt`)
+     *
+     * and whichever are supplied, will be used for connecting to the
+     * registry. The client cert and key are useful if you are
+     * authenticating with a certificate; the CA cert is useful if
+     * you are using a self-signed server certificate. The Secret must
+     * be of type `Opaque` or `kubernetes.io/tls`.
+     *
+     * It takes precedence over the values specified in the Secret referred
+     * to by `.spec.secretRef`.
+     */
+    certSecretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * Insecure allows connecting to a non-TLS HTTP container registry.
+     * This field is only taken into account if the .spec.type field is set to 'oci'.
+     */
+    insecure?: boolean;
+    /**
+     * Interval at which the HelmRepository URL is checked for updates.
+     * This interval is approximate and may be subject to jitter to ensure
+     * efficient use of resources.
+     */
+    interval?: string;
+    /**
+     * PassCredentials allows the credentials from the SecretRef to be passed
+     * on to a host that does not match the host as defined in URL.
+     * This may be required if the host of the advertised chart URLs in the
+     * index differ from the defined URL.
+     * Enabling this should be done with caution, as it can potentially result
+     * in credentials getting stolen in a MITM-attack.
+     */
+    passCredentials?: boolean;
+    /**
+     * Provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.
+     * This field is optional, and only taken into account if the .spec.type field is set to 'oci'.
+     * When not specified, defaults to 'generic'.
+     */
+    provider?: string;
+    /**
+     * SecretRef specifies the Secret containing authentication credentials
+     * for the HelmRepository.
+     * For HTTP/S basic auth the secret must contain 'username' and 'password'
+     * fields.
+     * Support for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile'
+     * keys is deprecated. Please use `.spec.certSecretRef` instead.
+     */
+    secretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * Suspend tells the controller to suspend the reconciliation of this
+     * HelmRepository.
+     */
+    suspend?: boolean;
+    /**
+     * Timeout is used for the index fetch operation for an HTTPS helm repository,
+     * and for remote OCI Repository operations like pulling for an OCI helm
+     * chart by the associated HelmChart.
+     * Its default value is 60s.
+     */
+    timeout?: string;
+    /**
+     * Type of the HelmRepository.
+     * When this field is set to  "oci", the URL field value must be prefixed with "oci://".
+     */
+    type?: string;
+    /**
+     * URL of the Helm repository, a valid URL contains at least a protocol and
+     * host.
+     */
+    url: string;
+  };
+  /**
+   * HelmRepositoryStatus records the observed state of the HelmRepository.
+   */
+  status?: {
+    /**
+     * Artifact represents the last successful HelmRepository reconciliation.
+     */
+    artifact?: {
+      /**
+       * Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
+       */
+      digest?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of the
+       * Artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Metadata holds upstream information such as OCI annotations.
+       */
+      metadata?: {
+        [k: string]: string;
+      };
+      /**
+       * Path is the relative file path of the Artifact. It can be used to locate
+       * the file in the root of the Artifact storage on the local file system of
+       * the controller managing the Source.
+       */
+      path: string;
+      /**
+       * Revision is a human-readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
+       */
+      revision: string;
+      /**
+       * Size is the number of bytes in the file.
+       */
+      size?: number;
+      /**
+       * URL is the HTTP address of the Artifact as exposed by the controller
+       * managing the Source. It can be used to retrieve the Artifact for
+       * consumption, e.g. by another controller applying the Artifact contents.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the HelmRepository.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedGeneration is the last observed generation of the HelmRepository
+     * object.
+     */
+    observedGeneration?: number;
+    /**
+     * URL is the dynamic fetch link for the latest Artifact.
+     * It is provided on a "best effort" basis, and using the precise
+     * HelmRepositoryStatus.Artifact data is recommended.
+     */
+    url?: string;
+  };
+}

src/__generated__/resources/K8SHelmRepositoryV1beta1.json

@@ -0,0 +1,196 @@
+{
+  "description": "HelmRepository is the Schema for the helmrepositories API",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "HelmRepositorySpec defines the reference to a Helm repository.",
+      "properties": {
+        "accessFrom": {
+          "description": "AccessFrom defines an Access Control List for allowing cross-namespace references to this object.",
+          "properties": {
+            "namespaceSelectors": {
+              "description": "NamespaceSelectors is the list of namespace selectors to which this ACL applies.\nItems in this list are evaluated using a logical OR operation.",
+              "items": {
+                "description": "NamespaceSelector selects the namespaces to which this ACL applies.\nAn empty map of MatchLabels matches all namespaces in a cluster.",
+                "type": "object",
+                "properties": {
+                  "matchLabels": {
+                    "description": "MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  }
+                }
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "namespaceSelectors"
+          ],
+          "type": "object"
+        },
+        "interval": {
+          "description": "The interval at which to check the upstream for updates.",
+          "type": "string"
+        },
+        "passCredentials": {
+          "description": "PassCredentials allows the credentials from the SecretRef to be passed on to\na host that does not match the host as defined in URL.\nThis may be required if the host of the advertised chart URLs in the index\ndiffer from the defined URL.\nEnabling this should be done with caution, as it can potentially result in\ncredentials getting stolen in a MITM-attack.",
+          "type": "boolean"
+        },
+        "secretRef": {
+          "description": "The name of the secret containing authentication credentials for the Helm\nrepository.\nFor HTTP/S basic auth the secret must contain username and\npassword fields.\nFor TLS the secret must contain a certFile and keyFile, and/or\ncaFile fields.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "suspend": {
+          "description": "This flag tells the controller to suspend the reconciliation of this source.",
+          "type": "boolean"
+        },
+        "timeout": {
+          "_default": "60s",
+          "description": "The timeout of index downloading, defaults to 60s.",
+          "type": "string"
+        },
+        "url": {
+          "description": "The Helm repository URL, a valid URL contains at least a protocol and host.",
+          "type": "string"
+        }
+      },
+      "required": [
+        "interval",
+        "url"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "HelmRepositoryStatus defines the observed state of the HelmRepository.",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the output of the last successful repository sync.",
+          "properties": {
+            "checksum": {
+              "description": "Checksum is the SHA256 checksum of the artifact.",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of this\nartifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "path": {
+              "description": "Path is the relative file path of this artifact.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm\nchart version, etc.",
+              "type": "string"
+            },
+            "url": {
+              "description": "URL is the HTTP address of this artifact.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the HelmRepository.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "url": {
+          "description": "URL is the download link for the last index fetched.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

src/__generated__/resources/K8SHelmRepositoryV1beta1.ts

@@ -0,0 +1,175 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * HelmRepository is the Schema for the helmrepositories API
+ */
+export interface K8SHelmRepositoryV1Beta1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * HelmRepositorySpec defines the reference to a Helm repository.
+   */
+  spec?: {
+    /**
+     * AccessFrom defines an Access Control List for allowing cross-namespace references to this object.
+     */
+    accessFrom?: {
+      /**
+       * NamespaceSelectors is the list of namespace selectors to which this ACL applies.
+       * Items in this list are evaluated using a logical OR operation.
+       */
+      namespaceSelectors: {
+        /**
+         * MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+         * map is equivalent to an element of matchExpressions, whose key field is "key", the
+         * operator is "In", and the values array contains only "value". The requirements are ANDed.
+         */
+        matchLabels?: {
+          [k: string]: string;
+        };
+      }[];
+    };
+    /**
+     * The interval at which to check the upstream for updates.
+     */
+    interval: string;
+    /**
+     * PassCredentials allows the credentials from the SecretRef to be passed on to
+     * a host that does not match the host as defined in URL.
+     * This may be required if the host of the advertised chart URLs in the index
+     * differ from the defined URL.
+     * Enabling this should be done with caution, as it can potentially result in
+     * credentials getting stolen in a MITM-attack.
+     */
+    passCredentials?: boolean;
+    /**
+     * The name of the secret containing authentication credentials for the Helm
+     * repository.
+     * For HTTP/S basic auth the secret must contain username and
+     * password fields.
+     * For TLS the secret must contain a certFile and keyFile, and/or
+     * caFile fields.
+     */
+    secretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * This flag tells the controller to suspend the reconciliation of this source.
+     */
+    suspend?: boolean;
+    /**
+     * The timeout of index downloading, defaults to 60s.
+     */
+    timeout?: string;
+    /**
+     * The Helm repository URL, a valid URL contains at least a protocol and host.
+     */
+    url: string;
+  };
+  /**
+   * HelmRepositoryStatus defines the observed state of the HelmRepository.
+   */
+  status?: {
+    /**
+     * Artifact represents the output of the last successful repository sync.
+     */
+    artifact?: {
+      /**
+       * Checksum is the SHA256 checksum of the artifact.
+       */
+      checksum?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of this
+       * artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Path is the relative file path of this artifact.
+       */
+      path: string;
+      /**
+       * Revision is a human readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm
+       * chart version, etc.
+       */
+      revision?: string;
+      /**
+       * URL is the HTTP address of this artifact.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the HelmRepository.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedGeneration is the last observed generation.
+     */
+    observedGeneration?: number;
+    /**
+     * URL is the download link for the last index fetched.
+     */
+    url?: string;
+  };
+}

src/__generated__/resources/K8SHelmRepositoryV1beta2.json

@@ -0,0 +1,247 @@
+{
+  "description": "HelmRepository is the Schema for the helmrepositories API.",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "HelmRepositorySpec specifies the required configuration to produce an\nArtifact for a Helm repository index YAML.",
+      "properties": {
+        "accessFrom": {
+          "description": "AccessFrom specifies an Access Control List for allowing cross-namespace\nreferences to this object.\nNOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092",
+          "properties": {
+            "namespaceSelectors": {
+              "description": "NamespaceSelectors is the list of namespace selectors to which this ACL applies.\nItems in this list are evaluated using a logical OR operation.",
+              "items": {
+                "description": "NamespaceSelector selects the namespaces to which this ACL applies.\nAn empty map of MatchLabels matches all namespaces in a cluster.",
+                "type": "object",
+                "properties": {
+                  "matchLabels": {
+                    "description": "MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
+                    "type": "object",
+                    "additionalProperties": {
+                      "type": "string"
+                    }
+                  }
+                }
+              },
+              "type": "array"
+            }
+          },
+          "required": [
+            "namespaceSelectors"
+          ],
+          "type": "object"
+        },
+        "certSecretRef": {
+          "description": "CertSecretRef can be given the name of a Secret containing\neither or both of\n\n- a PEM-encoded client certificate (`tls.crt`) and private\nkey (`tls.key`);\n- a PEM-encoded CA certificate (`ca.crt`)\n\nand whichever are supplied, will be used for connecting to the\nregistry. The client cert and key are useful if you are\nauthenticating with a certificate; the CA cert is useful if\nyou are using a self-signed server certificate. The Secret must\nbe of type `Opaque` or `kubernetes.io/tls`.\n\nIt takes precedence over the values specified in the Secret referred\nto by `.spec.secretRef`.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "insecure": {
+          "description": "Insecure allows connecting to a non-TLS HTTP container registry.\nThis field is only taken into account if the .spec.type field is set to 'oci'.",
+          "type": "boolean"
+        },
+        "interval": {
+          "description": "Interval at which the HelmRepository URL is checked for updates.\nThis interval is approximate and may be subject to jitter to ensure\nefficient use of resources.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
+          "type": "string"
+        },
+        "passCredentials": {
+          "description": "PassCredentials allows the credentials from the SecretRef to be passed\non to a host that does not match the host as defined in URL.\nThis may be required if the host of the advertised chart URLs in the\nindex differ from the defined URL.\nEnabling this should be done with caution, as it can potentially result\nin credentials getting stolen in a MITM-attack.",
+          "type": "boolean"
+        },
+        "provider": {
+          "_default": "generic",
+          "description": "Provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.\nThis field is optional, and only taken into account if the .spec.type field is set to 'oci'.\nWhen not specified, defaults to 'generic'.",
+          "_enum": [
+            "generic",
+            "aws",
+            "azure",
+            "gcp"
+          ],
+          "type": "string"
+        },
+        "secretRef": {
+          "description": "SecretRef specifies the Secret containing authentication credentials\nfor the HelmRepository.\nFor HTTP/S basic auth the secret must contain 'username' and 'password'\nfields.\nSupport for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile'\nkeys is deprecated. Please use `.spec.certSecretRef` instead.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "suspend": {
+          "description": "Suspend tells the controller to suspend the reconciliation of this\nHelmRepository.",
+          "type": "boolean"
+        },
+        "timeout": {
+          "description": "Timeout is used for the index fetch operation for an HTTPS helm repository,\nand for remote OCI Repository operations like pulling for an OCI helm\nchart by the associated HelmChart.\nIts default value is 60s.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m))+$",
+          "type": "string"
+        },
+        "type": {
+          "description": "Type of the HelmRepository.\nWhen this field is set to  \"oci\", the URL field value must be prefixed with \"oci://\".",
+          "_enum": [
+            "default",
+            "oci"
+          ],
+          "type": "string"
+        },
+        "url": {
+          "description": "URL of the Helm repository, a valid URL contains at least a protocol and\nhost.",
+          "pattern": "^(http|https|oci)://.*$",
+          "type": "string"
+        }
+      },
+      "required": [
+        "url"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "HelmRepositoryStatus records the observed state of the HelmRepository.",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the last successful HelmRepository reconciliation.",
+          "properties": {
+            "digest": {
+              "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+              "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "metadata": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Metadata holds upstream information such as OCI annotations.",
+              "type": "object"
+            },
+            "path": {
+              "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+              "type": "string"
+            },
+            "size": {
+              "description": "Size is the number of bytes in the file.",
+              "format": "int64",
+              "type": "integer"
+            },
+            "url": {
+              "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "revision",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the HelmRepository.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation of the HelmRepository\nobject.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "url": {
+          "description": "URL is the dynamic fetch link for the latest Artifact.\nIt is provided on a \"best effort\" basis, and using the precise\nHelmRepositoryStatus.Artifact data is recommended.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

src/__generated__/resources/K8SHelmRepositoryV1beta2.ts

@@ -0,0 +1,240 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * HelmRepository is the Schema for the helmrepositories API.
+ */
+export interface K8SHelmRepositoryV1Beta2 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * HelmRepositorySpec specifies the required configuration to produce an
+   * Artifact for a Helm repository index YAML.
+   */
+  spec?: {
+    /**
+     * AccessFrom specifies an Access Control List for allowing cross-namespace
+     * references to this object.
+     * NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092
+     */
+    accessFrom?: {
+      /**
+       * NamespaceSelectors is the list of namespace selectors to which this ACL applies.
+       * Items in this list are evaluated using a logical OR operation.
+       */
+      namespaceSelectors: {
+        /**
+         * MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+         * map is equivalent to an element of matchExpressions, whose key field is "key", the
+         * operator is "In", and the values array contains only "value". The requirements are ANDed.
+         */
+        matchLabels?: {
+          [k: string]: string;
+        };
+      }[];
+    };
+    /**
+     * CertSecretRef can be given the name of a Secret containing
+     * either or both of
+     *
+     * - a PEM-encoded client certificate (`tls.crt`) and private
+     * key (`tls.key`);
+     * - a PEM-encoded CA certificate (`ca.crt`)
+     *
+     * and whichever are supplied, will be used for connecting to the
+     * registry. The client cert and key are useful if you are
+     * authenticating with a certificate; the CA cert is useful if
+     * you are using a self-signed server certificate. The Secret must
+     * be of type `Opaque` or `kubernetes.io/tls`.
+     *
+     * It takes precedence over the values specified in the Secret referred
+     * to by `.spec.secretRef`.
+     */
+    certSecretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * Insecure allows connecting to a non-TLS HTTP container registry.
+     * This field is only taken into account if the .spec.type field is set to 'oci'.
+     */
+    insecure?: boolean;
+    /**
+     * Interval at which the HelmRepository URL is checked for updates.
+     * This interval is approximate and may be subject to jitter to ensure
+     * efficient use of resources.
+     */
+    interval?: string;
+    /**
+     * PassCredentials allows the credentials from the SecretRef to be passed
+     * on to a host that does not match the host as defined in URL.
+     * This may be required if the host of the advertised chart URLs in the
+     * index differ from the defined URL.
+     * Enabling this should be done with caution, as it can potentially result
+     * in credentials getting stolen in a MITM-attack.
+     */
+    passCredentials?: boolean;
+    /**
+     * Provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.
+     * This field is optional, and only taken into account if the .spec.type field is set to 'oci'.
+     * When not specified, defaults to 'generic'.
+     */
+    provider?: string;
+    /**
+     * SecretRef specifies the Secret containing authentication credentials
+     * for the HelmRepository.
+     * For HTTP/S basic auth the secret must contain 'username' and 'password'
+     * fields.
+     * Support for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile'
+     * keys is deprecated. Please use `.spec.certSecretRef` instead.
+     */
+    secretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * Suspend tells the controller to suspend the reconciliation of this
+     * HelmRepository.
+     */
+    suspend?: boolean;
+    /**
+     * Timeout is used for the index fetch operation for an HTTPS helm repository,
+     * and for remote OCI Repository operations like pulling for an OCI helm
+     * chart by the associated HelmChart.
+     * Its default value is 60s.
+     */
+    timeout?: string;
+    /**
+     * Type of the HelmRepository.
+     * When this field is set to  "oci", the URL field value must be prefixed with "oci://".
+     */
+    type?: string;
+    /**
+     * URL of the Helm repository, a valid URL contains at least a protocol and
+     * host.
+     */
+    url: string;
+  };
+  /**
+   * HelmRepositoryStatus records the observed state of the HelmRepository.
+   */
+  status?: {
+    /**
+     * Artifact represents the last successful HelmRepository reconciliation.
+     */
+    artifact?: {
+      /**
+       * Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
+       */
+      digest?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of the
+       * Artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Metadata holds upstream information such as OCI annotations.
+       */
+      metadata?: {
+        [k: string]: string;
+      };
+      /**
+       * Path is the relative file path of the Artifact. It can be used to locate
+       * the file in the root of the Artifact storage on the local file system of
+       * the controller managing the Source.
+       */
+      path: string;
+      /**
+       * Revision is a human-readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
+       */
+      revision: string;
+      /**
+       * Size is the number of bytes in the file.
+       */
+      size?: number;
+      /**
+       * URL is the HTTP address of the Artifact as exposed by the controller
+       * managing the Source. It can be used to retrieve the Artifact for
+       * consumption, e.g. by another controller applying the Artifact contents.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the HelmRepository.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedGeneration is the last observed generation of the HelmRepository
+     * object.
+     */
+    observedGeneration?: number;
+    /**
+     * URL is the dynamic fetch link for the latest Artifact.
+     * It is provided on a "best effort" basis, and using the precise
+     * HelmRepositoryStatus.Artifact data is recommended.
+     */
+    url?: string;
+  };
+}

src/__generated__/resources/K8SOCIRepositoryV1.json

@@ -0,0 +1,347 @@
+{
+  "description": "OCIRepository is the Schema for the ocirepositories API",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "OCIRepositorySpec defines the desired state of OCIRepository",
+      "properties": {
+        "certSecretRef": {
+          "description": "CertSecretRef can be given the name of a Secret containing\neither or both of\n\n- a PEM-encoded client certificate (`tls.crt`) and private\nkey (`tls.key`);\n- a PEM-encoded CA certificate (`ca.crt`)\n\nand whichever are supplied, will be used for connecting to the\nregistry. The client cert and key are useful if you are\nauthenticating with a certificate; the CA cert is useful if\nyou are using a self-signed server certificate. The Secret must\nbe of type `Opaque` or `kubernetes.io/tls`.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "ignore": {
+          "description": "Ignore overrides the set of excluded patterns in the .sourceignore format\n(which is the same as .gitignore). If not provided, a default will be used,\nconsult the documentation for your version to find out what those are.",
+          "type": "string"
+        },
+        "insecure": {
+          "description": "Insecure allows connecting to a non-TLS HTTP container registry.",
+          "type": "boolean"
+        },
+        "interval": {
+          "description": "Interval at which the OCIRepository URL is checked for updates.\nThis interval is approximate and may be subject to jitter to ensure\nefficient use of resources.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
+          "type": "string"
+        },
+        "layerSelector": {
+          "description": "LayerSelector specifies which layer should be extracted from the OCI artifact.\nWhen not specified, the first layer found in the artifact is selected.",
+          "properties": {
+            "mediaType": {
+              "description": "MediaType specifies the OCI media type of the layer\nwhich should be extracted from the OCI Artifact. The\nfirst layer matching this type is selected.",
+              "type": "string"
+            },
+            "operation": {
+              "description": "Operation specifies how the selected layer should be processed.\nBy default, the layer compressed content is extracted to storage.\nWhen the operation is set to 'copy', the layer compressed content\nis persisted to storage as it is.",
+              "_enum": [
+                "extract",
+                "copy"
+              ],
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "provider": {
+          "_default": "generic",
+          "description": "The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.\nWhen not specified, defaults to 'generic'.",
+          "_enum": [
+            "generic",
+            "aws",
+            "azure",
+            "gcp"
+          ],
+          "type": "string"
+        },
+        "proxySecretRef": {
+          "description": "ProxySecretRef specifies the Secret containing the proxy configuration\nto use while communicating with the container registry.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "ref": {
+          "description": "The OCI reference to pull and monitor for changes,\ndefaults to the latest tag.",
+          "properties": {
+            "digest": {
+              "description": "Digest is the image digest to pull, takes precedence over SemVer.\nThe value should be in the format 'sha256:<HASH>'.",
+              "type": "string"
+            },
+            "semver": {
+              "description": "SemVer is the range of tags to pull selecting the latest within\nthe range, takes precedence over Tag.",
+              "type": "string"
+            },
+            "semverFilter": {
+              "description": "SemverFilter is a regex pattern to filter the tags within the SemVer range.",
+              "type": "string"
+            },
+            "tag": {
+              "description": "Tag is the image tag to pull, defaults to latest.",
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "secretRef": {
+          "description": "SecretRef contains the secret name containing the registry login\ncredentials to resolve image metadata.\nThe secret must be of type kubernetes.io/dockerconfigjson.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "serviceAccountName": {
+          "description": "ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate\nthe image pull if the service account has attached pull secrets. For more information:\nhttps://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account",
+          "type": "string"
+        },
+        "suspend": {
+          "description": "This flag tells the controller to suspend the reconciliation of this source.",
+          "type": "boolean"
+        },
+        "timeout": {
+          "_default": "60s",
+          "description": "The timeout for remote OCI Repository operations like pulling, defaults to 60s.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m))+$",
+          "type": "string"
+        },
+        "url": {
+          "description": "URL is a reference to an OCI artifact repository hosted\non a remote container registry.",
+          "pattern": "^oci://.*$",
+          "type": "string"
+        },
+        "verify": {
+          "description": "Verify contains the secret name containing the trusted public keys\nused to verify the signature and specifies which provider to use to check\nwhether OCI image is authentic.",
+          "properties": {
+            "matchOIDCIdentity": {
+              "description": "MatchOIDCIdentity specifies the identity matching criteria to use\nwhile verifying an OCI artifact which was signed using Cosign keyless\nsigning. The artifact's identity is deemed to be verified if any of the\nspecified matchers match against the identity.",
+              "items": {
+                "description": "OIDCIdentityMatch specifies options for verifying the certificate identity,\ni.e. the issuer and the subject of the certificate.",
+                "type": "object",
+                "required": [
+                  "issuer",
+                  "subject"
+                ],
+                "properties": {
+                  "issuer": {
+                    "description": "Issuer specifies the regex pattern to match against to verify\nthe OIDC issuer in the Fulcio certificate. The pattern must be a\nvalid Go regular expression.",
+                    "type": "string"
+                  },
+                  "subject": {
+                    "description": "Subject specifies the regex pattern to match against to verify\nthe identity subject in the Fulcio certificate. The pattern must\nbe a valid Go regular expression.",
+                    "type": "string"
+                  }
+                }
+              },
+              "type": "array"
+            },
+            "provider": {
+              "_default": "cosign",
+              "description": "Provider specifies the technology used to sign the OCI Artifact.",
+              "_enum": [
+                "cosign",
+                "notation"
+              ],
+              "type": "string"
+            },
+            "secretRef": {
+              "description": "SecretRef specifies the Kubernetes Secret containing the\ntrusted public keys.",
+              "properties": {
+                "name": {
+                  "description": "Name of the referent.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "provider"
+          ],
+          "type": "object"
+        }
+      },
+      "required": [
+        "interval",
+        "url"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "OCIRepositoryStatus defines the observed state of OCIRepository",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the output of the last successful OCI Repository sync.",
+          "properties": {
+            "digest": {
+              "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+              "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "metadata": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Metadata holds upstream information such as OCI annotations.",
+              "type": "object"
+            },
+            "path": {
+              "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+              "type": "string"
+            },
+            "size": {
+              "description": "Size is the number of bytes in the file.",
+              "format": "int64",
+              "type": "integer"
+            },
+            "url": {
+              "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "revision",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the OCIRepository.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "observedIgnore": {
+          "description": "ObservedIgnore is the observed exclusion patterns used for constructing\nthe source artifact.",
+          "type": "string"
+        },
+        "observedLayerSelector": {
+          "description": "ObservedLayerSelector is the observed layer selector used for constructing\nthe source artifact.",
+          "properties": {
+            "mediaType": {
+              "description": "MediaType specifies the OCI media type of the layer\nwhich should be extracted from the OCI Artifact. The\nfirst layer matching this type is selected.",
+              "type": "string"
+            },
+            "operation": {
+              "description": "Operation specifies how the selected layer should be processed.\nBy default, the layer compressed content is extracted to storage.\nWhen the operation is set to 'copy', the layer compressed content\nis persisted to storage as it is.",
+              "_enum": [
+                "extract",
+                "copy"
+              ],
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "url": {
+          "description": "URL is the download link for the artifact output of the last OCI Repository sync.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

src/__generated__/resources/K8SOCIRepositoryV1.ts

@@ -0,0 +1,319 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * OCIRepository is the Schema for the ocirepositories API
+ */
+export interface K8SOCIRepositoryV1 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * OCIRepositorySpec defines the desired state of OCIRepository
+   */
+  spec?: {
+    /**
+     * CertSecretRef can be given the name of a Secret containing
+     * either or both of
+     *
+     * - a PEM-encoded client certificate (`tls.crt`) and private
+     * key (`tls.key`);
+     * - a PEM-encoded CA certificate (`ca.crt`)
+     *
+     * and whichever are supplied, will be used for connecting to the
+     * registry. The client cert and key are useful if you are
+     * authenticating with a certificate; the CA cert is useful if
+     * you are using a self-signed server certificate. The Secret must
+     * be of type `Opaque` or `kubernetes.io/tls`.
+     */
+    certSecretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * Ignore overrides the set of excluded patterns in the .sourceignore format
+     * (which is the same as .gitignore). If not provided, a default will be used,
+     * consult the documentation for your version to find out what those are.
+     */
+    ignore?: string;
+    /**
+     * Insecure allows connecting to a non-TLS HTTP container registry.
+     */
+    insecure?: boolean;
+    /**
+     * Interval at which the OCIRepository URL is checked for updates.
+     * This interval is approximate and may be subject to jitter to ensure
+     * efficient use of resources.
+     */
+    interval: string;
+    /**
+     * LayerSelector specifies which layer should be extracted from the OCI artifact.
+     * When not specified, the first layer found in the artifact is selected.
+     */
+    layerSelector?: {
+      /**
+       * MediaType specifies the OCI media type of the layer
+       * which should be extracted from the OCI Artifact. The
+       * first layer matching this type is selected.
+       */
+      mediaType?: string;
+      /**
+       * Operation specifies how the selected layer should be processed.
+       * By default, the layer compressed content is extracted to storage.
+       * When the operation is set to 'copy', the layer compressed content
+       * is persisted to storage as it is.
+       */
+      operation?: string;
+    };
+    /**
+     * The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.
+     * When not specified, defaults to 'generic'.
+     */
+    provider?: string;
+    /**
+     * ProxySecretRef specifies the Secret containing the proxy configuration
+     * to use while communicating with the container registry.
+     */
+    proxySecretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * The OCI reference to pull and monitor for changes,
+     * defaults to the latest tag.
+     */
+    ref?: {
+      /**
+       * Digest is the image digest to pull, takes precedence over SemVer.
+       * The value should be in the format 'sha256:<HASH>'.
+       */
+      digest?: string;
+      /**
+       * SemVer is the range of tags to pull selecting the latest within
+       * the range, takes precedence over Tag.
+       */
+      semver?: string;
+      /**
+       * SemverFilter is a regex pattern to filter the tags within the SemVer range.
+       */
+      semverFilter?: string;
+      /**
+       * Tag is the image tag to pull, defaults to latest.
+       */
+      tag?: string;
+    };
+    /**
+     * SecretRef contains the secret name containing the registry login
+     * credentials to resolve image metadata.
+     * The secret must be of type kubernetes.io/dockerconfigjson.
+     */
+    secretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
+     * the image pull if the service account has attached pull secrets. For more information:
+     * https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account
+     */
+    serviceAccountName?: string;
+    /**
+     * This flag tells the controller to suspend the reconciliation of this source.
+     */
+    suspend?: boolean;
+    /**
+     * The timeout for remote OCI Repository operations like pulling, defaults to 60s.
+     */
+    timeout?: string;
+    /**
+     * URL is a reference to an OCI artifact repository hosted
+     * on a remote container registry.
+     */
+    url: string;
+    /**
+     * Verify contains the secret name containing the trusted public keys
+     * used to verify the signature and specifies which provider to use to check
+     * whether OCI image is authentic.
+     */
+    verify?: {
+      /**
+       * MatchOIDCIdentity specifies the identity matching criteria to use
+       * while verifying an OCI artifact which was signed using Cosign keyless
+       * signing. The artifact's identity is deemed to be verified if any of the
+       * specified matchers match against the identity.
+       */
+      matchOIDCIdentity?: {
+        /**
+         * Issuer specifies the regex pattern to match against to verify
+         * the OIDC issuer in the Fulcio certificate. The pattern must be a
+         * valid Go regular expression.
+         */
+        issuer: string;
+        /**
+         * Subject specifies the regex pattern to match against to verify
+         * the identity subject in the Fulcio certificate. The pattern must
+         * be a valid Go regular expression.
+         */
+        subject: string;
+      }[];
+      /**
+       * Provider specifies the technology used to sign the OCI Artifact.
+       */
+      provider: string;
+      /**
+       * SecretRef specifies the Kubernetes Secret containing the
+       * trusted public keys.
+       */
+      secretRef?: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+    };
+  };
+  /**
+   * OCIRepositoryStatus defines the observed state of OCIRepository
+   */
+  status?: {
+    /**
+     * Artifact represents the output of the last successful OCI Repository sync.
+     */
+    artifact?: {
+      /**
+       * Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
+       */
+      digest?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of the
+       * Artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Metadata holds upstream information such as OCI annotations.
+       */
+      metadata?: {
+        [k: string]: string;
+      };
+      /**
+       * Path is the relative file path of the Artifact. It can be used to locate
+       * the file in the root of the Artifact storage on the local file system of
+       * the controller managing the Source.
+       */
+      path: string;
+      /**
+       * Revision is a human-readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
+       */
+      revision: string;
+      /**
+       * Size is the number of bytes in the file.
+       */
+      size?: number;
+      /**
+       * URL is the HTTP address of the Artifact as exposed by the controller
+       * managing the Source. It can be used to retrieve the Artifact for
+       * consumption, e.g. by another controller applying the Artifact contents.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the OCIRepository.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedGeneration is the last observed generation.
+     */
+    observedGeneration?: number;
+    /**
+     * ObservedIgnore is the observed exclusion patterns used for constructing
+     * the source artifact.
+     */
+    observedIgnore?: string;
+    /**
+     * ObservedLayerSelector is the observed layer selector used for constructing
+     * the source artifact.
+     */
+    observedLayerSelector?: {
+      /**
+       * MediaType specifies the OCI media type of the layer
+       * which should be extracted from the OCI Artifact. The
+       * first layer matching this type is selected.
+       */
+      mediaType?: string;
+      /**
+       * Operation specifies how the selected layer should be processed.
+       * By default, the layer compressed content is extracted to storage.
+       * When the operation is set to 'copy', the layer compressed content
+       * is persisted to storage as it is.
+       */
+      operation?: string;
+    };
+    /**
+     * URL is the download link for the artifact output of the last OCI Repository sync.
+     */
+    url?: string;
+  };
+}

src/__generated__/resources/K8SOCIRepositoryV1beta2.json

@@ -0,0 +1,351 @@
+{
+  "description": "OCIRepository is the Schema for the ocirepositories API",
+  "properties": {
+    "apiVersion": {
+      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+      "type": "string"
+    },
+    "kind": {
+      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+      "type": "string"
+    },
+    "metadata": {
+      "type": "object"
+    },
+    "spec": {
+      "description": "OCIRepositorySpec defines the desired state of OCIRepository",
+      "properties": {
+        "certSecretRef": {
+          "description": "CertSecretRef can be given the name of a Secret containing\neither or both of\n\n- a PEM-encoded client certificate (`tls.crt`) and private\nkey (`tls.key`);\n- a PEM-encoded CA certificate (`ca.crt`)\n\nand whichever are supplied, will be used for connecting to the\nregistry. The client cert and key are useful if you are\nauthenticating with a certificate; the CA cert is useful if\nyou are using a self-signed server certificate. The Secret must\nbe of type `Opaque` or `kubernetes.io/tls`.\n\nNote: Support for the `caFile`, `certFile` and `keyFile` keys have\nbeen deprecated.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "ignore": {
+          "description": "Ignore overrides the set of excluded patterns in the .sourceignore format\n(which is the same as .gitignore). If not provided, a default will be used,\nconsult the documentation for your version to find out what those are.",
+          "type": "string"
+        },
+        "insecure": {
+          "description": "Insecure allows connecting to a non-TLS HTTP container registry.",
+          "type": "boolean"
+        },
+        "interval": {
+          "description": "Interval at which the OCIRepository URL is checked for updates.\nThis interval is approximate and may be subject to jitter to ensure\nefficient use of resources.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
+          "type": "string"
+        },
+        "layerSelector": {
+          "description": "LayerSelector specifies which layer should be extracted from the OCI artifact.\nWhen not specified, the first layer found in the artifact is selected.",
+          "properties": {
+            "mediaType": {
+              "description": "MediaType specifies the OCI media type of the layer\nwhich should be extracted from the OCI Artifact. The\nfirst layer matching this type is selected.",
+              "type": "string"
+            },
+            "operation": {
+              "description": "Operation specifies how the selected layer should be processed.\nBy default, the layer compressed content is extracted to storage.\nWhen the operation is set to 'copy', the layer compressed content\nis persisted to storage as it is.",
+              "_enum": [
+                "extract",
+                "copy"
+              ],
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "provider": {
+          "_default": "generic",
+          "description": "The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.\nWhen not specified, defaults to 'generic'.",
+          "_enum": [
+            "generic",
+            "aws",
+            "azure",
+            "gcp"
+          ],
+          "type": "string"
+        },
+        "proxySecretRef": {
+          "description": "ProxySecretRef specifies the Secret containing the proxy configuration\nto use while communicating with the container registry.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "ref": {
+          "description": "The OCI reference to pull and monitor for changes,\ndefaults to the latest tag.",
+          "properties": {
+            "digest": {
+              "description": "Digest is the image digest to pull, takes precedence over SemVer.\nThe value should be in the format 'sha256:<HASH>'.",
+              "type": "string"
+            },
+            "semver": {
+              "description": "SemVer is the range of tags to pull selecting the latest within\nthe range, takes precedence over Tag.",
+              "type": "string"
+            },
+            "semverFilter": {
+              "description": "SemverFilter is a regex pattern to filter the tags within the SemVer range.",
+              "type": "string"
+            },
+            "tag": {
+              "description": "Tag is the image tag to pull, defaults to latest.",
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "secretRef": {
+          "description": "SecretRef contains the secret name containing the registry login\ncredentials to resolve image metadata.\nThe secret must be of type kubernetes.io/dockerconfigjson.",
+          "properties": {
+            "name": {
+              "description": "Name of the referent.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "serviceAccountName": {
+          "description": "ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate\nthe image pull if the service account has attached pull secrets. For more information:\nhttps://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account",
+          "type": "string"
+        },
+        "suspend": {
+          "description": "This flag tells the controller to suspend the reconciliation of this source.",
+          "type": "boolean"
+        },
+        "timeout": {
+          "_default": "60s",
+          "description": "The timeout for remote OCI Repository operations like pulling, defaults to 60s.",
+          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m))+$",
+          "type": "string"
+        },
+        "url": {
+          "description": "URL is a reference to an OCI artifact repository hosted\non a remote container registry.",
+          "pattern": "^oci://.*$",
+          "type": "string"
+        },
+        "verify": {
+          "description": "Verify contains the secret name containing the trusted public keys\nused to verify the signature and specifies which provider to use to check\nwhether OCI image is authentic.",
+          "properties": {
+            "matchOIDCIdentity": {
+              "description": "MatchOIDCIdentity specifies the identity matching criteria to use\nwhile verifying an OCI artifact which was signed using Cosign keyless\nsigning. The artifact's identity is deemed to be verified if any of the\nspecified matchers match against the identity.",
+              "items": {
+                "description": "OIDCIdentityMatch specifies options for verifying the certificate identity,\ni.e. the issuer and the subject of the certificate.",
+                "type": "object",
+                "required": [
+                  "issuer",
+                  "subject"
+                ],
+                "properties": {
+                  "issuer": {
+                    "description": "Issuer specifies the regex pattern to match against to verify\nthe OIDC issuer in the Fulcio certificate. The pattern must be a\nvalid Go regular expression.",
+                    "type": "string"
+                  },
+                  "subject": {
+                    "description": "Subject specifies the regex pattern to match against to verify\nthe identity subject in the Fulcio certificate. The pattern must\nbe a valid Go regular expression.",
+                    "type": "string"
+                  }
+                }
+              },
+              "type": "array"
+            },
+            "provider": {
+              "_default": "cosign",
+              "description": "Provider specifies the technology used to sign the OCI Artifact.",
+              "_enum": [
+                "cosign",
+                "notation"
+              ],
+              "type": "string"
+            },
+            "secretRef": {
+              "description": "SecretRef specifies the Kubernetes Secret containing the\ntrusted public keys.",
+              "properties": {
+                "name": {
+                  "description": "Name of the referent.",
+                  "type": "string"
+                }
+              },
+              "required": [
+                "name"
+              ],
+              "type": "object"
+            }
+          },
+          "required": [
+            "provider"
+          ],
+          "type": "object"
+        }
+      },
+      "required": [
+        "interval",
+        "url"
+      ],
+      "type": "object"
+    },
+    "status": {
+      "_default": {
+        "observedGeneration": -1
+      },
+      "description": "OCIRepositoryStatus defines the observed state of OCIRepository",
+      "properties": {
+        "artifact": {
+          "description": "Artifact represents the output of the last successful OCI Repository sync.",
+          "properties": {
+            "digest": {
+              "description": "Digest is the digest of the file in the form of '<algorithm>:<checksum>'.",
+              "pattern": "^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$",
+              "type": "string"
+            },
+            "lastUpdateTime": {
+              "description": "LastUpdateTime is the timestamp corresponding to the last update of the\nArtifact.",
+              "format": "date-time",
+              "type": "string"
+            },
+            "metadata": {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "description": "Metadata holds upstream information such as OCI annotations.",
+              "type": "object"
+            },
+            "path": {
+              "description": "Path is the relative file path of the Artifact. It can be used to locate\nthe file in the root of the Artifact storage on the local file system of\nthe controller managing the Source.",
+              "type": "string"
+            },
+            "revision": {
+              "description": "Revision is a human-readable identifier traceable in the origin source\nsystem. It can be a Git commit SHA, Git tag, a Helm chart version, etc.",
+              "type": "string"
+            },
+            "size": {
+              "description": "Size is the number of bytes in the file.",
+              "format": "int64",
+              "type": "integer"
+            },
+            "url": {
+              "description": "URL is the HTTP address of the Artifact as exposed by the controller\nmanaging the Source. It can be used to retrieve the Artifact for\nconsumption, e.g. by another controller applying the Artifact contents.",
+              "type": "string"
+            }
+          },
+          "required": [
+            "lastUpdateTime",
+            "path",
+            "revision",
+            "url"
+          ],
+          "type": "object"
+        },
+        "conditions": {
+          "description": "Conditions holds the conditions for the OCIRepository.",
+          "items": {
+            "description": "Condition contains details for one aspect of the current state of this API Resource.",
+            "type": "object",
+            "required": [
+              "lastTransitionTime",
+              "message",
+              "reason",
+              "status",
+              "type"
+            ],
+            "properties": {
+              "lastTransitionTime": {
+                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
+                "type": "string",
+                "format": "date-time"
+              },
+              "message": {
+                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
+                "type": "string",
+                "maxLength": 32768
+              },
+              "observedGeneration": {
+                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
+                "type": "integer",
+                "format": "int64",
+                "minimum": 0
+              },
+              "reason": {
+                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
+                "type": "string",
+                "maxLength": 1024,
+                "minLength": 1,
+                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$"
+              },
+              "status": {
+                "description": "status of the condition, one of True, False, Unknown.",
+                "type": "string",
+                "enum": [
+                  "True",
+                  "False",
+                  "Unknown"
+                ]
+              },
+              "type": {
+                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
+                "type": "string",
+                "maxLength": 316,
+                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$"
+              }
+            }
+          },
+          "type": "array"
+        },
+        "contentConfigChecksum": {
+          "description": "ContentConfigChecksum is a checksum of all the configurations related to\nthe content of the source artifact:\n - .spec.ignore\n - .spec.layerSelector\nobserved in .status.observedGeneration version of the object. This can\nbe used to determine if the content configuration has changed and the\nartifact needs to be rebuilt.\nIt has the format of `<algo>:<checksum>`, for example: `sha256:<checksum>`.\n\nDeprecated: Replaced with explicit fields for observed artifact content\nconfig in the status.",
+          "type": "string"
+        },
+        "lastHandledReconcileAt": {
+          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
+          "type": "string"
+        },
+        "observedGeneration": {
+          "description": "ObservedGeneration is the last observed generation.",
+          "format": "int64",
+          "type": "integer"
+        },
+        "observedIgnore": {
+          "description": "ObservedIgnore is the observed exclusion patterns used for constructing\nthe source artifact.",
+          "type": "string"
+        },
+        "observedLayerSelector": {
+          "description": "ObservedLayerSelector is the observed layer selector used for constructing\nthe source artifact.",
+          "properties": {
+            "mediaType": {
+              "description": "MediaType specifies the OCI media type of the layer\nwhich should be extracted from the OCI Artifact. The\nfirst layer matching this type is selected.",
+              "type": "string"
+            },
+            "operation": {
+              "description": "Operation specifies how the selected layer should be processed.\nBy default, the layer compressed content is extracted to storage.\nWhen the operation is set to 'copy', the layer compressed content\nis persisted to storage as it is.",
+              "_enum": [
+                "extract",
+                "copy"
+              ],
+              "type": "string"
+            }
+          },
+          "type": "object"
+        },
+        "url": {
+          "description": "URL is the download link for the artifact output of the last OCI Repository sync.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    }
+  },
+  "type": "object"
+}

src/__generated__/resources/K8SOCIRepositoryV1beta2.ts

@@ -0,0 +1,336 @@
+/* eslint-disable */
+/**
+ * This file was automatically generated by json-schema-to-typescript.
+ * DO NOT MODIFY IT BY HAND. Instead, modify the source JSONSchema file,
+ * and run json-schema-to-typescript to regenerate this file.
+ */
+
+/**
+ * OCIRepository is the Schema for the ocirepositories API
+ */
+export interface K8SOCIRepositoryV1Beta2 {
+  /**
+   * APIVersion defines the versioned schema of this representation of an object.
+   * Servers should convert recognized schemas to the latest internal value, and
+   * may reject unrecognized values.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+   */
+  apiVersion?: string;
+  /**
+   * Kind is a string value representing the REST resource this object represents.
+   * Servers may infer this from the endpoint the client submits requests to.
+   * Cannot be updated.
+   * In CamelCase.
+   * More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+   */
+  kind?: string;
+  metadata?: {};
+  /**
+   * OCIRepositorySpec defines the desired state of OCIRepository
+   */
+  spec?: {
+    /**
+     * CertSecretRef can be given the name of a Secret containing
+     * either or both of
+     *
+     * - a PEM-encoded client certificate (`tls.crt`) and private
+     * key (`tls.key`);
+     * - a PEM-encoded CA certificate (`ca.crt`)
+     *
+     * and whichever are supplied, will be used for connecting to the
+     * registry. The client cert and key are useful if you are
+     * authenticating with a certificate; the CA cert is useful if
+     * you are using a self-signed server certificate. The Secret must
+     * be of type `Opaque` or `kubernetes.io/tls`.
+     *
+     * Note: Support for the `caFile`, `certFile` and `keyFile` keys have
+     * been deprecated.
+     */
+    certSecretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * Ignore overrides the set of excluded patterns in the .sourceignore format
+     * (which is the same as .gitignore). If not provided, a default will be used,
+     * consult the documentation for your version to find out what those are.
+     */
+    ignore?: string;
+    /**
+     * Insecure allows connecting to a non-TLS HTTP container registry.
+     */
+    insecure?: boolean;
+    /**
+     * Interval at which the OCIRepository URL is checked for updates.
+     * This interval is approximate and may be subject to jitter to ensure
+     * efficient use of resources.
+     */
+    interval: string;
+    /**
+     * LayerSelector specifies which layer should be extracted from the OCI artifact.
+     * When not specified, the first layer found in the artifact is selected.
+     */
+    layerSelector?: {
+      /**
+       * MediaType specifies the OCI media type of the layer
+       * which should be extracted from the OCI Artifact. The
+       * first layer matching this type is selected.
+       */
+      mediaType?: string;
+      /**
+       * Operation specifies how the selected layer should be processed.
+       * By default, the layer compressed content is extracted to storage.
+       * When the operation is set to 'copy', the layer compressed content
+       * is persisted to storage as it is.
+       */
+      operation?: string;
+    };
+    /**
+     * The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'.
+     * When not specified, defaults to 'generic'.
+     */
+    provider?: string;
+    /**
+     * ProxySecretRef specifies the Secret containing the proxy configuration
+     * to use while communicating with the container registry.
+     */
+    proxySecretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * The OCI reference to pull and monitor for changes,
+     * defaults to the latest tag.
+     */
+    ref?: {
+      /**
+       * Digest is the image digest to pull, takes precedence over SemVer.
+       * The value should be in the format 'sha256:<HASH>'.
+       */
+      digest?: string;
+      /**
+       * SemVer is the range of tags to pull selecting the latest within
+       * the range, takes precedence over Tag.
+       */
+      semver?: string;
+      /**
+       * SemverFilter is a regex pattern to filter the tags within the SemVer range.
+       */
+      semverFilter?: string;
+      /**
+       * Tag is the image tag to pull, defaults to latest.
+       */
+      tag?: string;
+    };
+    /**
+     * SecretRef contains the secret name containing the registry login
+     * credentials to resolve image metadata.
+     * The secret must be of type kubernetes.io/dockerconfigjson.
+     */
+    secretRef?: {
+      /**
+       * Name of the referent.
+       */
+      name: string;
+    };
+    /**
+     * ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
+     * the image pull if the service account has attached pull secrets. For more information:
+     * https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account
+     */
+    serviceAccountName?: string;
+    /**
+     * This flag tells the controller to suspend the reconciliation of this source.
+     */
+    suspend?: boolean;
+    /**
+     * The timeout for remote OCI Repository operations like pulling, defaults to 60s.
+     */
+    timeout?: string;
+    /**
+     * URL is a reference to an OCI artifact repository hosted
+     * on a remote container registry.
+     */
+    url: string;
+    /**
+     * Verify contains the secret name containing the trusted public keys
+     * used to verify the signature and specifies which provider to use to check
+     * whether OCI image is authentic.
+     */
+    verify?: {
+      /**
+       * MatchOIDCIdentity specifies the identity matching criteria to use
+       * while verifying an OCI artifact which was signed using Cosign keyless
+       * signing. The artifact's identity is deemed to be verified if any of the
+       * specified matchers match against the identity.
+       */
+      matchOIDCIdentity?: {
+        /**
+         * Issuer specifies the regex pattern to match against to verify
+         * the OIDC issuer in the Fulcio certificate. The pattern must be a
+         * valid Go regular expression.
+         */
+        issuer: string;
+        /**
+         * Subject specifies the regex pattern to match against to verify
+         * the identity subject in the Fulcio certificate. The pattern must
+         * be a valid Go regular expression.
+         */
+        subject: string;
+      }[];
+      /**
+       * Provider specifies the technology used to sign the OCI Artifact.
+       */
+      provider: string;
+      /**
+       * SecretRef specifies the Kubernetes Secret containing the
+       * trusted public keys.
+       */
+      secretRef?: {
+        /**
+         * Name of the referent.
+         */
+        name: string;
+      };
+    };
+  };
+  /**
+   * OCIRepositoryStatus defines the observed state of OCIRepository
+   */
+  status?: {
+    /**
+     * Artifact represents the output of the last successful OCI Repository sync.
+     */
+    artifact?: {
+      /**
+       * Digest is the digest of the file in the form of '<algorithm>:<checksum>'.
+       */
+      digest?: string;
+      /**
+       * LastUpdateTime is the timestamp corresponding to the last update of the
+       * Artifact.
+       */
+      lastUpdateTime: string;
+      /**
+       * Metadata holds upstream information such as OCI annotations.
+       */
+      metadata?: {
+        [k: string]: string;
+      };
+      /**
+       * Path is the relative file path of the Artifact. It can be used to locate
+       * the file in the root of the Artifact storage on the local file system of
+       * the controller managing the Source.
+       */
+      path: string;
+      /**
+       * Revision is a human-readable identifier traceable in the origin source
+       * system. It can be a Git commit SHA, Git tag, a Helm chart version, etc.
+       */
+      revision: string;
+      /**
+       * Size is the number of bytes in the file.
+       */
+      size?: number;
+      /**
+       * URL is the HTTP address of the Artifact as exposed by the controller
+       * managing the Source. It can be used to retrieve the Artifact for
+       * consumption, e.g. by another controller applying the Artifact contents.
+       */
+      url: string;
+    };
+    /**
+     * Conditions holds the conditions for the OCIRepository.
+     */
+    conditions?: {
+      /**
+       * lastTransitionTime is the last time the condition transitioned from one status to another.
+       * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+       */
+      lastTransitionTime: string;
+      /**
+       * message is a human readable message indicating details about the transition.
+       * This may be an empty string.
+       */
+      message: string;
+      /**
+       * observedGeneration represents the .metadata.generation that the condition was set based upon.
+       * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+       * with respect to the current state of the instance.
+       */
+      observedGeneration?: number;
+      /**
+       * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+       * Producers of specific condition types may define expected values and meanings for this field,
+       * and whether the values are considered a guaranteed API.
+       * The value should be a CamelCase string.
+       * This field may not be empty.
+       */
+      reason: string;
+      /**
+       * status of the condition, one of True, False, Unknown.
+       */
+      status: "True" | "False" | "Unknown";
+      /**
+       * type of condition in CamelCase or in foo.example.com/CamelCase.
+       */
+      type: string;
+    }[];
+    /**
+     * ContentConfigChecksum is a checksum of all the configurations related to
+     * the content of the source artifact:
+     *  - .spec.ignore
+     *  - .spec.layerSelector
+     * observed in .status.observedGeneration version of the object. This can
+     * be used to determine if the content configuration has changed and the
+     * artifact needs to be rebuilt.
+     * It has the format of `<algo>:<checksum>`, for example: `sha256:<checksum>`.
+     *
+     * Deprecated: Replaced with explicit fields for observed artifact content
+     * config in the status.
+     */
+    contentConfigChecksum?: string;
+    /**
+     * LastHandledReconcileAt holds the value of the most recent
+     * reconcile request value, so a change of the annotation value
+     * can be detected.
+     */
+    lastHandledReconcileAt?: string;
+    /**
+     * ObservedGeneration is the last observed generation.
+     */
+    observedGeneration?: number;
+    /**
+     * ObservedIgnore is the observed exclusion patterns used for constructing
+     * the source artifact.
+     */
+    observedIgnore?: string;
+    /**
+     * ObservedLayerSelector is the observed layer selector used for constructing
+     * the source artifact.
+     */
+    observedLayerSelector?: {
+      /**
+       * MediaType specifies the OCI media type of the layer
+       * which should be extracted from the OCI Artifact. The
+       * first layer matching this type is selected.
+       */
+      mediaType?: string;
+      /**
+       * Operation specifies how the selected layer should be processed.
+       * By default, the layer compressed content is extracted to storage.
+       * When the operation is set to 'copy', the layer compressed content
+       * is persisted to storage as it is.
+       */
+      operation?: string;
+    };
+    /**
+     * URL is the download link for the artifact output of the last OCI Repository sync.
+     */
+    url?: string;
+  };
+}

src/custom-resouces/authentik-client/authentik-client.resource.ts

@@ -0,0 +1,192 @@
+import type { V1Secret } from '@kubernetes/client-node';
+import type { z } from 'zod';
+import deepEqual from 'deep-equal';
+
+import {
+  CustomResource,
+  type CustomResourceObject,
+  type CustomResourceOptions,
+  type SubresourceResult,
+} from '../../services/custom-resources/custom-resources.custom-resource.ts';
+import { ResourceReference } from '../../services/resources/resources.ref.ts';
+import { ResourceService, type Resource } from '../../services/resources/resources.ts';
+import { getWithNamespace } from '../../utils/naming.ts';
+import type { authentikServerSpecSchema } from '../authentik-server/authentik-server.scemas.ts';
+import type { domainSpecSchema } from '../domain/domain.schemas.ts';
+import { decodeSecret, encodeSecret } from '../../utils/secrets.ts';
+import { API_VERSION, CONTROLLED_LABEL } from '../../utils/consts.ts';
+
+import { authentikClientSecretSchema, type authentikClientSpecSchema } from './authentik-client.schemas.ts';
+
+class AuthentikClientResource extends CustomResource<typeof authentikClientSpecSchema> {
+  #serverResource: ResourceReference<CustomResourceObject<typeof authentikServerSpecSchema>>;
+  #serverSecretResource: ResourceReference<V1Secret>;
+  #domainResource: ResourceReference<CustomResourceObject<typeof domainSpecSchema>>;
+  #clientSecretResource: Resource<V1Secret>;
+
+  constructor(options: CustomResourceOptions<typeof authentikClientSpecSchema>) {
+    super(options);
+    const resourceService = this.services.get(ResourceService);
+
+    this.#serverResource = new ResourceReference();
+    this.#serverSecretResource = new ResourceReference();
+    this.#domainResource = new ResourceReference();
+    this.#clientSecretResource = resourceService.get({
+      apiVersion: 'v1',
+      kind: 'Secret',
+      name: `authentik-client-${this.name}`,
+      namespace: this.namespace,
+    });
+
+    this.#updateResouces();
+
+    this.#serverResource.on('changed', this.queueReconcile);
+    this.#serverSecretResource.on('changed', this.queueReconcile);
+    this.#domainResource.on('changed', this.queueReconcile);
+    this.#clientSecretResource.on('changed', this.queueReconcile);
+  }
+
+  get server() {
+    return this.#serverResource.current;
+  }
+
+  get serverSecret() {
+    return this.#serverSecretResource.current;
+  }
+
+  get serverSecretValue() {
+    return decodeSecret(this.#serverSecretResource.current?.data);
+  }
+
+  get domain() {
+    return this.#domainResource.current;
+  }
+
+  get clientSecret() {
+    return this.#clientSecretResource;
+  }
+
+  get clientSecretValue() {
+    const values = decodeSecret(this.#clientSecretResource.data);
+    const parsed = authentikClientSecretSchema.safeParse(values);
+    if (!parsed.success) {
+      return undefined;
+    }
+    return parsed.data;
+  }
+
+  #updateResouces = () => {
+    const serverNames = getWithNamespace(this.spec.server, this.namespace);
+    const resourceService = this.services.get(ResourceService);
+    this.#serverResource.current = resourceService.get({
+      apiVersion: API_VERSION,
+      kind: 'AuthentikServer',
+      name: serverNames.name,
+      namespace: serverNames.namespace,
+    });
+    this.#serverSecretResource.current = resourceService.get({
+      apiVersion: 'v1',
+      kind: 'Secret',
+      name: `authentik-server-${serverNames.name}`,
+      namespace: serverNames.namespace,
+    });
+    const server = this.#serverResource.current;
+    if (server && server.spec) {
+      const domainNames = getWithNamespace(server.spec.domain, server.namespace);
+      this.#domainResource.current = resourceService.get({
+        apiVersion: API_VERSION,
+        kind: 'Domain',
+        name: domainNames.name,
+        namespace: domainNames.namespace,
+      });
+    } else {
+      this.#domainResource.current = undefined;
+    }
+  };
+
+  #reconcileClientSecret = async (): Promise<SubresourceResult> => {
+    const domain = this.domain;
+    const server = this.server;
+    const serverSecret = this.serverSecret;
+    if (!server?.exists || !server?.spec || !serverSecret?.exists || !serverSecret.data) {
+      return {
+        ready: false,
+        failed: true,
+        message: 'Server or server secret not found',
+      };
+    }
+    if (!domain?.exists || !domain?.spec) {
+      return {
+        ready: false,
+        failed: true,
+        message: 'Domain not found',
+      };
+    }
+    const url = `https://authentik.${domain.spec?.hostname}`;
+    const appName = this.name;
+    const values = this.clientSecretValue;
+    const expectedValues: Omit<z.infer<typeof authentikClientSecretSchema>, 'clientSecret'> = {
+      clientId: this.name,
+      configuration: new URL(`/application/o/${appName}/.well-known/openid-configuration`, url).toString(),
+      configurationIssuer: new URL(`/application/o/${appName}/`, url).toString(),
+      authorization: new URL(`/application/o/${appName}/authorize/`, url).toString(),
+      token: new URL(`/application/o/${appName}/token/`, url).toString(),
+      userinfo: new URL(`/application/o/${appName}/userinfo/`, url).toString(),
+      endSession: new URL(`/application/o/${appName}/end-session/`, url).toString(),
+      jwks: new URL(`/application/o/${appName}/jwks/`, url).toString(),
+    };
+    if (!values) {
+      await this.clientSecret.patch({
+        metadata: {
+          ownerReferences: [this.ref],
+          labels: {
+            ...CONTROLLED_LABEL,
+          },
+        },
+        data: encodeSecret({
+          ...expectedValues,
+          clientSecret: crypto.randomUUID(),
+        }),
+      });
+      return {
+        ready: false,
+        syncing: true,
+        message: 'UpdatingManifest',
+      };
+    }
+    const compareData = {
+      ...values,
+      clientSecret: undefined,
+    };
+    if (!deepEqual(compareData, expectedValues)) {
+      await this.clientSecret.patch({
+        metadata: {
+          ownerReferences: [this.ref],
+          labels: {
+            ...CONTROLLED_LABEL,
+          },
+        },
+        data: encodeSecret(expectedValues),
+      });
+    }
+    return {
+      ready: true,
+    };
+  };
+
+  public reconcile = async () => {
+    if (!this.exists || this.metadata.deletionTimestamp) {
+      return;
+    }
+    this.#updateResouces();
+    await Promise.all([this.reconcileSubresource('Secret', this.#reconcileClientSecret)]);
+
+    const secretReady = this.conditions.get('Secret')?.status === 'True';
+
+    await this.conditions.set('Ready', {
+      status: secretReady ? 'True' : 'False',
+    });
+  };
+}
+
+export { AuthentikClientResource };

src/custom-resouces/authentik-client/authentik-client.schemas.ts

@@ -0,0 +1,28 @@
+import { ClientTypeEnum, MatchingModeEnum, SubModeEnum } from '@goauthentik/api';
+import { z } from 'zod';
+
+const authentikClientSpecSchema = z.object({
+  server: z.string(),
+  subMode: z.enum(SubModeEnum).optional(),
+  clientType: z.enum(ClientTypeEnum).optional(),
+  redirectUris: z.array(
+    z.object({
+      url: z.string(),
+      matchingMode: z.enum(MatchingModeEnum).optional(),
+    }),
+  ),
+});
+
+const authentikClientSecretSchema = z.object({
+  clientId: z.string(),
+  clientSecret: z.string().optional(),
+  configuration: z.string(),
+  configurationIssuer: z.string(),
+  authorization: z.string(),
+  token: z.string(),
+  userinfo: z.string(),
+  endSession: z.string(),
+  jwks: z.string(),
+});
+
+export { authentikClientSpecSchema, authentikClientSecretSchema };

src/custom-resouces/authentik-client/authentik-client.ts

@@ -0,0 +1,19 @@
+import { createCustomResourceDefinition } from '../../services/custom-resources/custom-resources.ts';
+import { GROUP } from '../../utils/consts.ts';
+
+import { AuthentikClientResource } from './authentik-client.resource.ts';
+import { authentikClientSpecSchema } from './authentik-client.schemas.ts';
+
+const authentikClientDefinition = createCustomResourceDefinition({
+  group: GROUP,
+  version: 'v1',
+  kind: 'AuthentikClient',
+  names: {
+    plural: 'authentikclients',
+    singular: 'authentikclient',
+  },
+  create: (options) => new AuthentikClientResource(options),
+  spec: authentikClientSpecSchema,
+});
+
+export { authentikClientDefinition };

src/custom-resouces/authentik-server/authentik-server.resource.ts

@@ -36,9 +36,6 @@ class AuthentikServerResource extends CustomResource<typeof authentikServerSpecS
 
   constructor(options: CustomResourceOptions<typeof authentikServerSpecSchema>) {
     super(options);
-    const domainNames = getWithNamespace(this.spec.domain, this.namespace);
-    const databaseNames = getWithNamespace(this.spec.database, this.namespace);
-
     const resourceService = this.services.get(ResourceService);
     const secretService = this.services.get(SecretService);
 
@@ -76,7 +73,7 @@ class AuthentikServerResource extends CustomResource<typeof authentikServerSpecS
     });
 
     this.#secret = secretService.ensure({
-      name: this.name,
+      name: `authentik-server-${this.name}`,
       namespace: this.namespace,
       schema: authentikServerSecretSchema,
       generator: () => ({

src/custom-resouces/custom-resources.ts

@@ -1,17 +1,21 @@
 import { authentikServerDefinition } from './authentik-server/authentik-server.ts';
+import { authentikClientDefinition } from './authentik-client/authentik-client.ts';
 import { domainServiceDefinition } from './domain-service/domain-service.ts';
 import { domainDefinition } from './domain/domain.ts';
 import { postgresConnectionDefinition } from './postgres-connection/postgres-connection.ts';
 import { postgresDatabaseDefinition } from './postgres-database/postgres-database.ts';
 import { redisConnectionDefinition } from './redis-connection/redis-connection.ts';
+import { homelabDefinition } from './homelab/homelab.ts';
 
 const customResources = [
+  homelabDefinition,
   domainDefinition,
   domainServiceDefinition,
   postgresConnectionDefinition,
   postgresDatabaseDefinition,
   redisConnectionDefinition,
   authentikServerDefinition,
+  authentikClientDefinition,
 ];
 
 export { customResources };

src/custom-resouces/homelab/homelab.manifests.ts

@@ -0,0 +1,296 @@
+import type { KubernetesObject } from '@kubernetes/client-node';
+
+import type { K8SHelmRepositoryV1 } from '../../__generated__/resources/K8SHelmRepositoryV1.ts';
+import type { K8SHelmReleaseV2 } from '../../__generated__/resources/K8SHelmReleaseV2.ts';
+
+type IstioRepoManifestOptions = {
+  owner: ExpectedAny;
+};
+const istioRepoManifest = (options: IstioRepoManifestOptions): KubernetesObject & K8SHelmRepositoryV1 => {
+  return {
+    apiVersion: 'source.toolkit.fluxcd.io/v1beta1',
+    kind: 'HelmRepository',
+    metadata: {
+      ownerReferences: [options.owner],
+    },
+    spec: {
+      interval: '1h',
+      url: 'https://istio-release.storage.googleapis.com/charts',
+    },
+  };
+};
+
+type CertManagerRepoManifestOptions = {
+  owner: ExpectedAny;
+};
+const certManagerRepoManifest = (options: CertManagerRepoManifestOptions): KubernetesObject & K8SHelmRepositoryV1 => {
+  return {
+    apiVersion: 'source.toolkit.fluxcd.io/v1',
+    kind: 'HelmRepository',
+    metadata: {
+      ownerReferences: [options.owner],
+    },
+    spec: {
+      interval: '1h',
+      url: 'https://charts.jetstack.io',
+    },
+  };
+};
+
+type RanchRepoManifestOptions = {
+  owner: ExpectedAny;
+};
+const ranchRepoManifest = (options: RanchRepoManifestOptions): KubernetesObject & K8SHelmRepositoryV1 => {
+  return {
+    apiVersion: 'source.toolkit.fluxcd.io/v1',
+    kind: 'HelmRepository',
+    metadata: {
+      ownerReferences: [options.owner],
+    },
+    spec: {
+      interval: '1h',
+      url: 'https://charts.containeroo.ch',
+    },
+  };
+};
+
+type IstioBaseManifestOptions = {
+  owner: ExpectedAny;
+};
+const istioBaseManifest = (options: IstioBaseManifestOptions): KubernetesObject & K8SHelmReleaseV2 => {
+  return {
+    apiVersion: 'helm.toolkit.fluxcd.io/v2',
+    kind: 'HelmRelease',
+    metadata: {
+      ownerReferences: [options.owner],
+    },
+    spec: {
+      interval: '1h',
+      targetNamespace: 'istio-system',
+      install: {
+        createNamespace: true,
+      },
+      values: {
+        defaultRevision: 'default',
+      },
+      chart: {
+        spec: {
+          chart: 'base',
+          sourceRef: {
+            apiVersion: 'source.toolkit.fluxcd.io/v1',
+            kind: 'HelmRepository',
+            name: 'homelab-istio',
+          },
+          reconcileStrategy: 'ChartVersion',
+          version: '1.24.3',
+        },
+      },
+    },
+  };
+};
+
+type IstiodManifestOptions = {
+  owner: ExpectedAny;
+  namespace: string;
+};
+const istiodManifest = (options: IstiodManifestOptions): KubernetesObject & K8SHelmReleaseV2 => {
+  return {
+    apiVersion: 'helm.toolkit.fluxcd.io/v2',
+    kind: 'HelmRelease',
+    metadata: {
+      ownerReferences: [options.owner],
+    },
+    spec: {
+      targetNamespace: 'istio-system',
+      interval: '1h',
+      install: {
+        createNamespace: true,
+      },
+      dependsOn: [
+        {
+          name: 'istio',
+          namespace: options.namespace,
+        },
+      ],
+      chart: {
+        spec: {
+          chart: 'istiod',
+          sourceRef: {
+            apiVersion: 'source.toolkit.fluxcd.io/v1',
+            kind: 'HelmRepository',
+            name: 'homelab-istio',
+          },
+          reconcileStrategy: 'ChartVersion',
+          version: '1.24.3',
+        },
+      },
+    },
+  };
+};
+
+type IstioGatewayControllerManifestOptions = {
+  owner: ExpectedAny;
+  namespace: string;
+};
+const istioGatewayControllerManifest = (
+  options: IstioGatewayControllerManifestOptions,
+): KubernetesObject & K8SHelmReleaseV2 => {
+  return {
+    apiVersion: 'helm.toolkit.fluxcd.io/v2',
+    kind: 'HelmRelease',
+    metadata: {
+      ownerReferences: [options.owner],
+    },
+    spec: {
+      interval: '1h',
+      install: {
+        createNamespace: true,
+      },
+      dependsOn: [
+        {
+          name: 'istio',
+          namespace: options.namespace,
+        },
+        {
+          name: 'istiod',
+          namespace: options.namespace,
+        },
+      ],
+      values: {
+        service: {
+          ports: [
+            {
+              name: 'status-port',
+              port: 15021,
+            },
+            {
+              name: 'tls-istiod',
+              port: 15012,
+            },
+            {
+              name: 'tls',
+              port: 15443,
+              nodePort: 31371,
+            },
+            {
+              name: 'http2',
+              port: 80,
+              nodePort: 31381,
+              targetPort: 8280,
+            },
+            {
+              name: 'https',
+              port: 443,
+              nodePort: 31391,
+              targetPort: 8243,
+            },
+          ],
+        },
+      },
+      chart: {
+        spec: {
+          chart: 'gateway',
+          sourceRef: {
+            apiVersion: 'source.toolkit.fluxcd.io/v1',
+            kind: 'HelmRepository',
+            name: 'homelab-istio',
+          },
+          reconcileStrategy: 'ChartVersion',
+          version: '1.24.3',
+        },
+      },
+    },
+  };
+};
+
+type CertManagerManifestOptions = {
+  owner: ExpectedAny;
+};
+const certManagerManifest = (options: CertManagerManifestOptions): KubernetesObject & K8SHelmReleaseV2 => {
+  return {
+    apiVersion: 'helm.toolkit.fluxcd.io/v2',
+    kind: 'HelmRelease',
+    metadata: {
+      ownerReferences: [options.owner],
+    },
+    spec: {
+      targetNamespace: 'cert-manager',
+      interval: '1h',
+      install: {
+        createNamespace: true,
+      },
+      values: {
+        installCRDs: true,
+      },
+      chart: {
+        spec: {
+          chart: 'cert-manager',
+          sourceRef: {
+            apiVersion: 'source.toolkit.fluxcd.io/v1',
+            kind: 'HelmRepository',
+            name: 'cert-manager',
+          },
+          version: 'v1.18.2',
+        },
+      },
+    },
+  };
+};
+
+type LocalStorageManifestOptions = {
+  owner: ExpectedAny;
+  storagePath: string;
+};
+const localStorageManifest = (options: LocalStorageManifestOptions): KubernetesObject & K8SHelmReleaseV2 => {
+  return {
+    apiVersion: 'helm.toolkit.fluxcd.io/v2',
+    kind: 'HelmRelease',
+    metadata: {
+      ownerReferences: [options.owner],
+    },
+    spec: {
+      targetNamespace: 'local-path-storage',
+      interval: '1h',
+      install: {
+        createNamespace: true,
+      },
+      values: {
+        storageClass: {
+          name: 'local-path',
+          defaultClass: true,
+        },
+        nodePathMap: [
+          {
+            node: 'DEFAULT_PATH_FOR_NON_LISTED_NODES',
+            path: options.storagePath,
+          },
+        ],
+        helper: {
+          reclaimPolicy: 'Retain',
+        },
+      },
+      chart: {
+        spec: {
+          chart: 'local-path-provisioner',
+          sourceRef: {
+            apiVersion: 'source.toolkit.fluxcd.io/v1',
+            kind: 'HelmRepository',
+            name: 'rancher',
+          },
+          version: '0.0.32',
+        },
+      },
+    },
+  };
+};
+
+export {
+  istioRepoManifest,
+  istioBaseManifest,
+  istiodManifest,
+  istioGatewayControllerManifest,
+  certManagerRepoManifest,
+  certManagerManifest,
+  ranchRepoManifest,
+  localStorageManifest,
+};

src/custom-resouces/homelab/homelab.resource.ts

@@ -0,0 +1,263 @@
+import { type KubernetesObject } from '@kubernetes/client-node';
+
+import {
+  CustomResource,
+  type CustomResourceOptions,
+  type SubresourceResult,
+} from '../../services/custom-resources/custom-resources.custom-resource.ts';
+import { Resource, ResourceService } from '../../services/resources/resources.ts';
+import type { K8SHelmRepositoryV1 } from '../../__generated__/resources/K8SHelmRepositoryV1.ts';
+import type { K8SHelmReleaseV2 } from '../../__generated__/resources/K8SHelmReleaseV2.ts';
+import { isDeepSubset } from '../../utils/objects.ts';
+
+import type { homelabSpecSchema } from './homelab.schemas.ts';
+import {
+  certManagerRepoManifest,
+  istioBaseManifest,
+  istiodManifest,
+  istioGatewayControllerManifest,
+  istioRepoManifest,
+  certManagerManifest,
+  ranchRepoManifest,
+  localStorageManifest,
+} from './homelab.manifests.ts';
+
+class HomelabResource extends CustomResource<typeof homelabSpecSchema> {
+  #resources: {
+    istioRepo: Resource<KubernetesObject & K8SHelmRepositoryV1>;
+    istioBase: Resource<KubernetesObject & K8SHelmReleaseV2>;
+    istiod: Resource<KubernetesObject & K8SHelmReleaseV2>;
+    istioGatewayController: Resource<KubernetesObject & K8SHelmReleaseV2>;
+    certManagerRepo: Resource<KubernetesObject & K8SHelmRepositoryV1>;
+    certManager: Resource<KubernetesObject & K8SHelmReleaseV2>;
+    ranchRepo: Resource<KubernetesObject & K8SHelmRepositoryV1>;
+    localStorage: Resource<KubernetesObject & K8SHelmReleaseV2>;
+  };
+
+  constructor(options: CustomResourceOptions<typeof homelabSpecSchema>) {
+    super(options);
+    const resourceService = this.services.get(ResourceService);
+    this.#resources = {
+      istioRepo: resourceService.get({
+        apiVersion: 'source.toolkit.fluxcd.io/v1',
+        kind: 'HelmRepository',
+        name: 'homelab-istio',
+        namespace: this.namespace,
+      }),
+      istioBase: resourceService.get({
+        apiVersion: 'helm.toolkit.fluxcd.io/v2',
+        kind: 'HelmRelease',
+        name: 'istio',
+        namespace: this.namespace,
+      }),
+      istiod: resourceService.get({
+        apiVersion: 'helm.toolkit.fluxcd.io/v2',
+        kind: 'HelmRelease',
+        name: 'istiod',
+        namespace: this.namespace,
+      }),
+      istioGatewayController: resourceService.get({
+        apiVersion: 'helm.toolkit.fluxcd.io/v2',
+        kind: 'HelmRelease',
+        name: 'istio-gateway-controller',
+        namespace: this.namespace,
+      }),
+      certManagerRepo: resourceService.get({
+        apiVersion: 'source.toolkit.fluxcd.io/v1',
+        kind: 'HelmRepository',
+        name: 'cert-manager',
+        namespace: this.namespace,
+      }),
+      certManager: resourceService.get({
+        apiVersion: 'helm.toolkit.fluxcd.io/v2',
+        kind: 'HelmRelease',
+        name: 'cert-manager',
+        namespace: this.namespace,
+      }),
+      ranchRepo: resourceService.get({
+        apiVersion: 'source.toolkit.fluxcd.io/v1',
+        kind: 'HelmRepository',
+        name: 'rancher',
+        namespace: this.namespace,
+      }),
+      localStorage: resourceService.get({
+        apiVersion: 'helm.toolkit.fluxcd.io/v2',
+        kind: 'HelmRelease',
+        name: 'local-storage',
+        namespace: this.namespace,
+      }),
+    };
+
+    for (const resource of Object.values(this.#resources)) {
+      resource.on('changed', this.queueReconcile);
+    }
+  }
+
+  #reconcileIstioRepo = async (): Promise<SubresourceResult> => {
+    const istioRepo = this.#resources.istioRepo;
+    const manifest = istioRepoManifest({
+      owner: this.ref,
+    });
+    if (!isDeepSubset(istioRepo.spec, manifest.spec)) {
+      await istioRepo.patch(manifest);
+      return {
+        ready: false,
+        syncing: true,
+        reason: 'UpdatingManifest',
+      };
+    }
+    return {
+      ready: true,
+    };
+  };
+
+  #reconcileCertManagerRepo = async (): Promise<SubresourceResult> => {
+    const certManagerRepo = this.#resources.certManagerRepo;
+    const manifest = certManagerRepoManifest({
+      owner: this.ref,
+    });
+    if (!isDeepSubset(certManagerRepo.spec, manifest.spec)) {
+      await certManagerRepo.patch(manifest);
+      return {
+        ready: false,
+        syncing: true,
+        reason: 'UpdatingManifest',
+      };
+    }
+    return {
+      ready: true,
+    };
+  };
+
+  #reconcileRanchRepo = async (): Promise<SubresourceResult> => {
+    const ranchRepo = this.#resources.ranchRepo;
+    const manifest = ranchRepoManifest({
+      owner: this.ref,
+    });
+    if (!isDeepSubset(ranchRepo.spec, manifest.spec)) {
+      await ranchRepo.patch(manifest);
+      return {
+        ready: false,
+        syncing: true,
+        reason: 'UpdatingManifest',
+      };
+    }
+    return {
+      ready: true,
+    };
+  };
+
+  #reconcileIstioBase = async (): Promise<SubresourceResult> => {
+    const istioBase = this.#resources.istioBase;
+    const manifest = istioBaseManifest({
+      owner: this.ref,
+    });
+    if (!isDeepSubset(istioBase.spec, manifest.spec)) {
+      await istioBase.patch(manifest);
+      return {
+        ready: false,
+        syncing: true,
+        reason: 'UpdatingManifest',
+      };
+    }
+    return {
+      ready: true,
+    };
+  };
+
+  #reconcileIstiod = async (): Promise<SubresourceResult> => {
+    const istiod = this.#resources.istiod;
+    const manifest = istiodManifest({
+      owner: this.ref,
+      namespace: this.namespace,
+    });
+    if (!isDeepSubset(istiod.spec, manifest.spec)) {
+      await istiod.patch(manifest);
+      return {
+        ready: false,
+        syncing: true,
+        reason: 'UpdatingManifest',
+      };
+    }
+    return {
+      ready: true,
+    };
+  };
+
+  #reconcileIstioGatewayController = async (): Promise<SubresourceResult> => {
+    const istioGatewayController = this.#resources.istioGatewayController;
+    const manifest = istioGatewayControllerManifest({
+      owner: this.ref,
+      namespace: this.namespace,
+    });
+    if (!isDeepSubset(istioGatewayController.spec, manifest.spec)) {
+      await istioGatewayController.patch(manifest);
+      return {
+        ready: false,
+        syncing: true,
+        reason: 'UpdatingManifest',
+      };
+    }
+    return {
+      ready: true,
+    };
+  };
+
+  #reconcileCertManager = async (): Promise<SubresourceResult> => {
+    const certManager = this.#resources.certManager;
+    const manifest = certManagerManifest({
+      owner: this.ref,
+    });
+    if (!isDeepSubset(certManager.spec, manifest.spec)) {
+      await certManager.patch(manifest);
+      return {
+        ready: false,
+        syncing: true,
+        reason: 'UpdatingManifest',
+      };
+    }
+    return {
+      ready: true,
+    };
+  };
+
+  #reconcileLocalStorage = async (): Promise<SubresourceResult> => {
+    const storage = this.spec.storage;
+    if (!storage || !storage.enabled) {
+      return {
+        ready: true,
+      };
+    }
+    const localStorage = this.#resources.localStorage;
+    const manifest = localStorageManifest({
+      owner: this.ref,
+      storagePath: storage.path,
+    });
+    if (!isDeepSubset(localStorage.spec, manifest.spec)) {
+      await localStorage.patch(manifest);
+      return {
+        ready: false,
+        syncing: true,
+        reason: 'UpdatingManifest',
+      };
+    }
+    return {
+      ready: true,
+    };
+  };
+
+  public reconcile = async () => {
+    await Promise.allSettled([
+      this.reconcileSubresource('IstioRepo', this.#reconcileIstioRepo),
+      this.reconcileSubresource('CertManagerRepo', this.#reconcileCertManagerRepo),
+      this.reconcileSubresource('IstioBase', this.#reconcileIstioBase),
+      this.reconcileSubresource('Istiod', this.#reconcileIstiod),
+      this.reconcileSubresource('IstioGatewayController', this.#reconcileIstioGatewayController),
+      this.reconcileSubresource('CertManager', this.#reconcileCertManager),
+      this.reconcileSubresource('RanchRepo', this.#reconcileRanchRepo),
+      this.reconcileSubresource('LocalStorage', this.#reconcileLocalStorage),
+    ]);
+  };
+}
+
+export { HomelabResource };

src/custom-resouces/homelab/homelab.schemas.ts

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+
+const homelabSpecSchema = z.object({
+  storage: z
+    .object({
+      enabled: z.boolean(),
+      path: z.string(),
+    })
+    .optional(),
+});
+
+const homelabSecretSchema = z.object({
+  postgresPassword: z.string(),
+  redisPassword: z.string(),
+});
+
+export { homelabSpecSchema, homelabSecretSchema };

src/custom-resouces/homelab/homelab.ts

@@ -0,0 +1,19 @@
+import { createCustomResourceDefinition } from '../../services/custom-resources/custom-resources.ts';
+import { GROUP } from '../../utils/consts.ts';
+
+import { HomelabResource } from './homelab.resource.ts';
+import { homelabSpecSchema } from './homelab.schemas.ts';
+
+const homelabDefinition = createCustomResourceDefinition({
+  group: GROUP,
+  version: 'v1',
+  kind: 'Homelab',
+  names: {
+    plural: 'homelabs',
+    singular: 'homelab',
+  },
+  spec: homelabSpecSchema,
+  create: (options) => new HomelabResource(options),
+});
+
+export { homelabDefinition };

src/custom-resouces/postgres-cluster/postgres-cluster.schemas.ts

@@ -0,0 +1,5 @@
+import { z } from 'zod';
+
+const postgresClusterSpecSchema = z.object({});
+
+export { postgresClusterSpecSchema };

src/index.ts

@@ -74,6 +74,9 @@ await watcherService
   .start();
 
 await watcherService.watchCustomGroup('networking.istio.io', 'v1', ['gateways', 'virtualservices', 'destinationrules']);
+await watcherService.watchCustomGroup('source.toolkit.fluxcd.io', 'v1', ['helmrepositories', 'helmcharts']);
+await watcherService.watchCustomGroup('helm.toolkit.fluxcd.io', 'v2', ['helmreleases']);
+await watcherService.watchCustomGroup('cert-manager.io', 'v1', ['issuers', 'certificates', 'clusterissuers']);
 
 const istio = services.get(IstioService);
 await istio.start();

src/services/custom-resources/custom-resources.conditions.ts

@@ -26,6 +26,7 @@ type Condition = {
 class CustomResourceConditions extends EventEmitter<CustomResourceConditionsEvents> {
   #options: CustomResourceStatusOptions;
   #conditions: Record<string, Condition>;
+  #changed: boolean;
 
   constructor(options: CustomResourceStatusOptions) {
     super();
@@ -40,6 +41,7 @@ class CustomResourceConditions extends EventEmitter<CustomResourceConditionsEven
       ]),
     );
     options.resource.on('changed', this.#handleChange);
+    this.#changed = false;
   }
 
   #handleChange = () => {
@@ -66,9 +68,16 @@ class CustomResourceConditions extends EventEmitter<CustomResourceConditionsEven
 
   public set = async (type: string, condition: Omit<Condition, 'lastTransitionTime'>) => {
     const current = this.#conditions[type];
+    const isEqual = equal(
+      { ...current, lastTransitionTime: undefined },
+      { ...condition, lastTransitionTime: undefined },
+    );
+    if (isEqual) {
+      return;
+    }
+    this.#changed = true;
     this.#conditions[type] = {
       ...condition,
-
       lastTransitionTime: current && current.status === condition.status ? current.lastTransitionTime : new Date(),
       observedGeneration: this.#options.resource.metadata?.generation,
     };
@@ -76,6 +85,11 @@ class CustomResourceConditions extends EventEmitter<CustomResourceConditionsEven
   };
 
   public save = async () => {
+    if (!this.#changed) {
+      return;
+    }
+    try {
+      this.#changed = false;
       const { resource } = this.#options;
       const status: CustomResourceStatus = {
         conditions: Object.entries(this.#conditions).map(([type, condition]) => ({
@@ -85,6 +99,10 @@ class CustomResourceConditions extends EventEmitter<CustomResourceConditionsEven
         })),
       };
       await resource.patchStatus(status);
+    } catch (error) {
+      this.#changed = true;
+      throw error;
+    }
   };
 }
 

src/services/custom-resources/custom-resources.custom-resource.ts

@@ -50,6 +50,13 @@ abstract class CustomResource<TSpec extends ZodObject> extends EventEmitter<Cust
     options.resource.on('changed', this.#handleChanged);
     this.#queue = new CoalescingQueued({
       action: async () => {
+        if (this.exists && !this.isValidSpec) {
+          this.services.log.error(
+            `Invalid spec for ${this.apiVersion}/${this.kind}/${this.namespace}/${this.name}`,
+            this.spec,
+          );
+          return;
+        }
         console.log('Reconcileing', this.apiVersion, this.kind, this.namespace, this.name);
         await this.reconcile?.();
       },
@@ -75,19 +82,11 @@ abstract class CustomResource<TSpec extends ZodObject> extends EventEmitter<Cust
   }
 
   public get apiVersion() {
-    const apiVersion = this.resource.apiVersion;
+    return this.resource.apiVersion;
-    if (!apiVersion) {
-      throw new Error('Custom resources needs an apiVersion');
-    }
-    return apiVersion;
   }
 
   public get kind() {
-    const kind = this.resource.kind;
+    return this.resource.kind;
-    if (!kind) {
-      throw new Error('Custom resources needs a kind');
-    }
-    return kind;
   }
 
   public get metadata() {
@@ -107,7 +106,7 @@ abstract class CustomResource<TSpec extends ZodObject> extends EventEmitter<Cust
   }
 
   public get namespace() {
-    const namespace = this.metadata.namespace;
+    const namespace = this.resource.specifier.namespace;
     if (!namespace) {
       throw new Error('Custom resources needs a namespace');
     }

src/services/resources/resources.resource.ts

@@ -180,15 +180,20 @@ class Resource<T extends KubernetesObject = UnknownResource> extends EventEmitte
   public patch = (patch: T) =>
     this.#queue.add(async () => {
       const { services } = this.#options;
+      services.log.debug(`Patching ${this.apiVersion}/${this.kind}/${this.namespace}/${this.name}`, {
+        specifier: this.specifier,
+        current: this.manifest,
+        patch,
+      });
       const k8s = services.get(K8sService);
       const body = {
         ...patch,
-        apiVersion: this.apiVersion,
+        apiVersion: this.specifier.apiVersion,
-        kind: this.kind,
+        kind: this.specifier.kind,
         metadata: {
-          name: this.name,
-          namespace: this.namespace,
           ...patch.metadata,
+          name: this.specifier.name,
+          namespace: this.specifier.namespace,
         },
       };
       try {
@@ -213,13 +218,14 @@ class Resource<T extends KubernetesObject = UnknownResource> extends EventEmitte
     this.#queue.add(async () => {
       try {
         const { services } = this.#options;
+        services.log.debug(`Deleting ${this.apiVersion}/${this.kind}/${this.namespace}/${this.name}`);
         const k8s = services.get(K8sService);
         await k8s.objectsApi.delete({
-          apiVersion: this.apiVersion,
+          apiVersion: this.specifier.apiVersion,
-          kind: this.kind,
+          kind: this.specifier.kind,
           metadata: {
-            name: this.name,
+            name: this.specifier.name,
-            namespace: this.namespace,
+            namespace: this.specifier.namespace,
           },
         });
         this.manifest = undefined;
@@ -237,11 +243,11 @@ class Resource<T extends KubernetesObject = UnknownResource> extends EventEmitte
       const k8s = services.get(K8sService);
       try {
         const manifest = await k8s.objectsApi.read({
-          apiVersion: this.apiVersion,
+          apiVersion: this.specifier.apiVersion,
-          kind: this.kind,
+          kind: this.specifier.kind,
           metadata: {
-            name: this.name,
+            name: this.specifier.name,
-            namespace: this.namespace,
+            namespace: this.specifier.namespace,
           },
         });
         this.manifest = manifest as T;
@@ -254,17 +260,20 @@ class Resource<T extends KubernetesObject = UnknownResource> extends EventEmitte
       }
     });
 
-  public addEvent = async (event: EventOptions) => {
+  public addEvent = (event: EventOptions) =>
+    this.#queue.add(async () => {
       const { services } = this.#options;
       const k8sService = services.get(K8sService);
 
+      services.log.debug(`Adding event ${this.apiVersion}/${this.kind}/${this.namespace}/${this.name}`, event);
+
       await k8sService.eventsApi.createNamespacedEvent({
-      namespace: this.namespace || 'default',
+        namespace: this.specifier.namespace || 'default',
         body: {
           kind: 'Event',
           metadata: {
-          name: `${this.name}-${Date.now()}-${Buffer.from(crypto.getRandomValues(new Uint8Array(8))).toString('hex')}`,
+            name: `${this.specifier.name}-${Date.now()}-${Buffer.from(crypto.getRandomValues(new Uint8Array(8))).toString('hex')}`,
-          namespace: this.namespace,
+            namespace: this.specifier.namespace,
           },
           eventTime: new V1MicroTime(),
           note: event.message,
@@ -274,16 +283,16 @@ class Resource<T extends KubernetesObject = UnknownResource> extends EventEmitte
           reportingController: GROUP,
           reportingInstance: this.name,
           regarding: {
-          apiVersion: this.apiVersion,
+            apiVersion: this.specifier.apiVersion,
             resourceVersion: this.metadata?.resourceVersion,
-          kind: this.kind,
+            kind: this.specifier.kind,
-          name: this.name,
+            name: this.specifier.name,
-          namespace: this.namespace,
+            namespace: this.specifier.namespace,
             uid: this.metadata?.uid,
           },
         },
       });
-  };
+    });
 }
 
 export { Resource, type UnknownResource, type ResourceEvents };

src/services/watchers/watchers.watcher.ts

@@ -1,4 +1,10 @@
-import { makeInformer, type Informer, type KubernetesListObject, type KubernetesObject } from '@kubernetes/client-node';
+import {
+  ApiException,
+  makeInformer,
+  type Informer,
+  type KubernetesListObject,
+  type KubernetesObject,
+} from '@kubernetes/client-node';
 import { EventEmitter } from 'eventemitter3';
 
 import { K8sService } from '../k8s/k8s.ts';
@@ -38,8 +44,10 @@ class Watcher<T extends KubernetesObject> extends EventEmitter<WatcherEvents<T>>
     informer.on('update', this.#handleResource.bind(this, 'update'));
     informer.on('delete', this.#handleResource.bind(this, 'delete'));
     informer.on('error', (err) => {
-      console.log('Watcher failed, will retry in 5 seconds', path, err);
+      if (!(err instanceof ApiException && err.code === 404)) {
-      setTimeout(this.start, 5000);
+        console.log('Watcher failed, will retry in 3 seconds', path, err);
+      }
+      setTimeout(this.start, 3000);
     });
     return informer;
   };

src/utils/objects.ts

@@ -0,0 +1,33 @@
+const isDeepSubset = (actual: ExpectedAny, expected: ExpectedAny): boolean => {
+  if (typeof expected !== 'object' || expected === null) {
+    return actual === expected;
+  }
+
+  if (typeof actual !== 'object' || actual === null) {
+    return false;
+  }
+
+  if (Array.isArray(expected)) {
+    if (!Array.isArray(actual)) {
+      return false;
+    }
+    return expected.every((expectedItem) => actual.some((actualItem) => isDeepSubset(actualItem, expectedItem)));
+  }
+
+  // Iterate over the keys of the expected object
+  for (const key in expected) {
+    if (Object.prototype.hasOwnProperty.call(expected, key)) {
+      if (!Object.prototype.hasOwnProperty.call(actual, key)) {
+        return false;
+      }
+
+      if (!isDeepSubset(actual[key], expected[key])) {
+        return false;
+      }
+    }
+  }
+
+  return true;
+};
+
+export { isDeepSubset };

src/utils/secrets.ts

@@ -9,4 +9,12 @@ const decodeSecret = <T extends Record<string, string>>(
   ) as T;
 };
 
-export { decodeSecret };
+const encodeSecret = <T extends Record<string, string>>(data: T | undefined): Record<string, string> | undefined => {
+  if (!data) {
+    return undefined;
+  }
+  return Object.fromEntries(
+    Object.entries(data).map(([name, value]) => [name, Buffer.from(value, 'utf8').toString('base64')]),
+  );
+};
+export { decodeSecret, encodeSecret };

test-manifests/authentik-client.yaml

@@ -0,0 +1,10 @@
+apiVersion: 'homelab.mortenolsen.pro/v1'
+kind: 'AuthentikClient'
+metadata:
+  name: homelab
+  namespace: homelab
+spec:
+  server: homelab
+  redirectUris:
+    - url: http://localhost:3000/api/v1/authentik/oauth2/callback
+      matchingMode: strict

test-manifests/homelab.yaml

@@ -0,0 +1,9 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: Homelab
+metadata:
+  name: homelab
+  namespace: homelab
+spec:
+  storage:
+    enabled: true
+    path: /data/homelab