External Plugins in Kustomize Build

[SachithKasthuriarachchi]

Does flux support using external Kustomize plugins within the kustomize build? I have developed a hasher plugin which appends a hash to names of the secretproviderclasses and updates the references in Deployments, StatefulSets etc. Is there a way for me to incorporate this plugin with flux?

Basically, I want to incorporate --enable-alpha-plugins to kustomize build in flux

[SachithKasthuriarachchi]

The docs says this is disabled by default. Is there a way to enable it?

[SachithKasthuriarachchi]

@stefanprodan is there a way to do this?

[stefanprodan]

No and probably never will. Flux v2 was designed with a security first approach where we guarantee that Flux doesn’t shell exec nor runs any untrusted code.

[SachithKasthuriarachchi]

ack, thanks for the clarification.

[stefanprodan]

For custom YAML generators I suggest looking into https://fluxcd.io/flux/cheatsheets/oci-artifacts/

[SachithKasthuriarachchi]

hi @stefanprodan I believe the idea is to feed flux with a generated output yaml. Please correct me if I'm wrong

[stefanprodan]

Yes, you would run in CI something like kustomize build --enable-alpha-plugins . | flux push artifact -f-, then use an OCIRepository instead of Git in your Flux Kustomization.

[towens]

Too bad. ksops is wonderful.

[stefanprodan]

Flux has native SOPS support: https://fluxcd.io/flux/components/kustomize/kustomizations/#decryption

[towens]

Yes, thanks for the native SOPS support. I switched our secrets to it yesterday.