Minor improvements to image automation APIs before GA

[matheuscscp]

Just to track a few things we need to do before making the image APIs GA:

• Add better kubectl printer columns to the CRDs
  • image-reflector-controller: Add better kubectl columns to ImageRepository and ImagePolicy image-reflector-controller#787
  • image-automation-controller: Add better kubectl columns to ImageUpdateAutomation image-automation-controller#930
• Add better aliases like k get imagerepo and k get imagepol
  • image-reflector-controller: Add shortNames aliases for ImageRepository and ImagePolicy CRDs image-reflector-controller#785
  • image-automation-controller: Add shortNames aliases for ImageUpdateAutomation CRD image-automation-controller#929
• Remove deprecated code paths (e.g. auto-login flags in IRC)
  • image-reflector-controller
    • Remove auto-login flags: Remove deprecated auto-login flags image-reflector-controller#786
    • Remove .status.latestImage from ImagePolicy status
  • image-automation-controller
    • Updated data API for git commit message template: Add deprecation handling for .Updated template field image-automation-controller#931
• Promote the image CLI commands to stable: Promote image CLI commands to stable #5421
• Introduce .spec.suspend and .status.lastHandledReconcileAt for ImagePolicy: Introduce .spec.suspend and .status.lastHandledReconcileAt for ImagePolicy image-reflector-controller#799
• Introduce flux reconcile/suspend/resume image policy, now with digest reflection it makes sense to trigger an ImagePolicy reconciliation, or to suspend/resume it

[lukas8219]

I can have this one >Add better kubectl columns with status and message to the CRDs

[cappyzawa]

I'd like to work on the second task: "Add some aliases like k get imagerepo and k get imagepol"

[cappyzawa]

Hi! I'd like to work on the third task: "Remove deprecated code paths" in the image-reflector-controller.

Note: I'm also working on the second task (shortNames addition) in the same issue.

Implementation Plan

1. Auto-login Flags (deprecated in v0.25.0, shows error logs)

Flags to remove:

• --aws-autologin-for-ecr
• --gcp-autologin-for-gcr
• --azure-autologin-for-acr

Migration: Use .spec.provider field in ImageRepository objects

I'll start with this since it's mentioned as an example.

2. Deprecated TLS Key Names (deprecated in v1beta2, shows warning logs)

Keys to remove:

• caFile → use ca.crt
• certFile → use tls.crt
• keyFile → use tls.key

3. ImageRepositoryFinalizer Constant (marked deprecated)

Remove ImageRepositoryFinalizer constant (alias to ImageFinalizer), unused in codebase.

I'll proceed with items 2 and 3 after confirmation that this approach works for preparing the APIs for GA.

Would this plan work?

[matheuscscp]

About auto-login flags, I think it's safe to remove because the error log on start-up was very specific about them being removed in a future version, and very specific about what action to take:

if awsAutoLogin || gcpAutoLogin || azureAutoLogin {
	setupLog.Error(errors.New("use of deprecated flags"),
		"autologin flags have been deprecated. These flags will be removed in a future release."+
			" Please update the respective ImageRepository objects with .spec.provider field.")
}

About the finalizer constant, we can keep it in the api/v1beta2 package and not add it in the api/v1 package. This will be done in the API promotion PR, no need to worry about it.

About the deprecated TLS keys, we only show the new keys in the error log, we don't say support for those keys will be removed in the future. So for this case I'm not sure, we probably need to keep those...

[cappyzawa]

Thanks for the clarification @matheuscscp!

Based on your feedback, I've updated my understanding:

1. [DONE] Auto-login flags removal (Remove deprecated auto-login flags image-reflector-controller#786)
2. [KEEP] Deprecated TLS keys - probably need to keep for backward compatibility
3. [NO ACTION] ImageRepositoryFinalizer constant should be kept in api/v1beta2

So it looks like the auto-login flags are the only deprecated code paths to remove for this task.

Are there any other deprecated code paths that should be removed for GA?

[lukas8219]

@matheuscscp On the CRD new fields. I assume the status one should come from <ImageUpdateAutomationStatus>.<meta.ReconciliationStatus> types in ImageUpdateAutomation CRD.

What about the message?

Should this be the same for ImageReflector?

[matheuscscp]

@lukas8219 You can base yourself on source-controller OCIRepository:

https://github.com/fluxcd/source-controller/blob/main/api/v1/ocirepository_types.go#L271-L274

ImageRepository is here: https://github.com/fluxcd/image-reflector-controller/blob/fc95ba97afce31d5c92d8dfdad611b655fcbb7a2/api/v1beta2/imagerepository_types.go#L201-L202

ImagePolicy is here: https://github.com/fluxcd/image-reflector-controller/blob/main/api/v1beta2/imagepolicy_types.go#L209

ImageUpdateAutomation is here: https://github.com/fluxcd/image-automation-controller/blob/c77a9799fb41294b1c989be7a3e6f72890c4fce8/api/v1beta2/imageupdateautomation_types.go#L135

For ImageRepository I'd add all the fields in OCIRepository (URL (Image in this case), Ready, Status, Age). But ImageRepository already has two columns there, so the output may get too long. In that case we can add ,priority=1 at the end for some columns that would only appear in kubectl get imagerepo -o wide. I'm not sure which ones though... @stefanprodan Thoughts on this? I think I'd choose Last scan for that, it doesn't sound particularly important to show the last reconciliation time just for this API. We don't do this for most.

For ImagePolicy, the only column we currently have is showing .status.latestImage, which is the most important one. Maybe for ImagePolicy we can just add only Ready, Status and Age, and that's it.

For ImageUpdateAutomation, we have only Last run, same thing as ImageRepository. I'd add ,priority=1 to that.

[matheuscscp]

Furthermore, .status.latestImage is now deprecated in favor of .status.latestRef. I don't know however if we can or if makes sense to use .status.latestRef here, since it has three fields instead of being a self-contained string. Normally the image digests are too long, so honestly I'd rather undeprecate .status.latestImage and keep it just for this purpose. @stefanprodan?

[stefanprodan]

Let's remove .status.latestImage from status, and display the url and tag in separate columns, I agree with not showing the digest.

[matheuscscp]

Are there any other deprecated code paths that should be removed for GA?

@cappyzawa image-automation-controller has one deprecation to be removed, git commit message template Updated data API was deprecated and must be removed (clear removal message in the docs). This needs to be discussed in the open dev meeting, anybody is welcome to join 🤗 We can work on it after we come up with a plan 👌