What is the intended workflow between flux create to source controlling the manifests

[ekristen]

Hello!

I'm trying to understand the intent behind the flux create commands and how they apply to getting the generated file into source control.

I understand the purpose of the flux create and that it generates the manifest and applies against the cluster. I also understand that there's the --export, what I haven't found or understand exactly is what is the intended workflow from going from using the create command without export to exporting and source controlling the manifest?

I also found that the output at least with flux create source git is not consistent between export and without export.

For example without export the command will generate a SSH key and allow you to add it to your source, then it generates and applies the manifest with secretRef populated.

However when you run the exact same command with --export the secretRef is not populated, so the yaml wouldn't be work once applied as part of the source controlled manifests, you would have to augment the command and add --secret-ref, but then this is two entirely different command runs.

Is this a bug? Perhaps it's not there when source is github vs git? I hadn't tried that out yet.

[stefanprodan]

We don't export the secret for flux create source git to avoid a multi-doc YAML with plain secrets. Here is how to generate sources for private repos:

  flux create secret git my-repo-auth \
    --url=ssh://[email protected]/<org>/<repo> \
    --export >  my-repo-auth.yaml

  sops --encrypt --encrypted-regex '^(data|stringData)$' \
    --in-place  my-repo-auth.yaml

  flux create source git podinfo \
    --url=ssh://[email protected]/<org>/<repo> \
    --secret-ref=my-repo-auth\
    --export >  my-repo.yaml