Image reflector API reference v1

Order specifies the sorting order of the tags. Given the letters of the alphabet as tags, ascending order would select Z, and descending order would select A.

SemVer gives a semantic version range to check against the tags available.

Alphabetical set of rules to use for alphabetical ordering of the tags.

Numerical set of rules to use for numerical ordering of the tags.

ImageRepositoryRef points at the object specifying the image being scanned

Policy gives the particulars of the policy to be followed in selecting the most recent image

FilterTags enables filtering for only a subset of tags based on a set of rules. If no rules are provided, all the tags from the repository will be ordered and compared.

DigestReflectionPolicy governs the setting of the .status.latestRef.digest field.

Never: The digest field will always be set to the empty string.

IfNotPresent: The digest field will be set to the digest of the elected latest image if the field is empty and the image did not change.

Always: The digest field will always be set to the digest of the elected latest image.

Default: Never.

Interval is the length of time to wait between refreshing the digest of the latest tag when the reflection policy is set to “Always”.

Defaults to 10m.

This flag tells the controller to suspend subsequent policy reconciliations. It does not apply to already started reconciliations. Defaults to false.

LatestRef gives the first in the list of images scanned by the image repository, when filtered and ordered according to the policy.

ObservedPreviousRef is the observed previous LatestRef. It is used to keep track of the previous and current images.

(Members of ReconcileRequestStatus are embedded into this type.)

Name is the bare image’s name.

Tag is the image’s tag.

Digest is the image’s digest.

Image is the name of the image repository

Interval is the length of time to wait between scans of the image repository.

Timeout for image scanning. Defaults to ‘Interval’ duration.

SecretRef can be given the name of a secret containing credentials to use for the image registry. The secret should be created with kubectl create secret docker-registry, or the equivalent.

ProxySecretRef specifies the Secret containing the proxy configuration to use while communicating with the container registry.

ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate the image pull, either with the pull secrets attached to the service account or with an object identity. For more information about object identity: https://fluxcd.io/flux/integrations/object-identity/

CertSecretRef can be given the name of a Secret containing either or both of

• a PEM-encoded client certificate (tls.crt) and private key (tls.key);
• a PEM-encoded CA certificate (ca.crt)

and whichever are supplied, will be used for connecting to the registry. The client cert and key are useful if you are authenticating with a certificate; the CA cert is useful if you are using a self-signed server certificate. The Secret must be of type Opaque or kubernetes.io/tls.

Note: Support for the caFile, certFile and keyFile keys has been deprecated.

This flag tells the controller to suspend subsequent image scans. It does not apply to already started scans. Defaults to false.

AccessFrom defines an ACL for allowing cross-namespace references to the ImageRepository object based on the caller’s namespace labels.

ExclusionList is a list of regex strings used to exclude certain tags from being stored in the database.

The provider used for authentication, can be ‘aws’, ‘azure’, ‘gcp’ or ‘generic’. When not specified, defaults to ‘generic’.

Insecure allows connecting to a non-TLS HTTP container registry.

ObservedGeneration is the last reconciled generation.

CanonicalName is the name of the image repository with all the implied bits made explicit; e.g., docker.io/library/alpine rather than alpine.

LastScanResult contains the number of fetched tags.

ObservedExclusionList is a list of observed exclusion list. It reflects the exclusion rules used for the observed scan result in status.lastScanResult.

(Members of ReconcileRequestStatus are embedded into this type.)

Order specifies the sorting order of the tags. Given the integer values from 0 to 9 as tags, ascending order would select 9, and descending order would select 0.

Revision is a stable hash of the scanned tags.

TagCount is the number of tags found in the last scan.

ScanTime is the time when the last scan was performed.

LatestTags is a small sample of the tags found in the last scan. It’s the first 10 tags when sorting all the tags in descending alphabetical order.

Range gives a semver range for the image tag; the highest version within the range that’s a tag yields the latest image.

Pattern specifies a regular expression pattern used to filter for image tags.

Extract allows a capture group to be extracted from the specified regular expression pattern, useful before tag evaluation.