Skip to content

Kustomize-controller is reconciling stale source artifact revision #1583

Description

@dipti-pai

Seeing an issue where kustomize-controller is reconciling older OCI artifact. The OCIrepo is healthy and continuously reconciled by source-controller.

Manifests

Oci Repo :

apiVersion: source.toolkit.fluxcd.io/v1
kind: OCIRepository
metadata:
  creationTimestamp: "2026-01-28T08:38:39Z"
  finalizers:
  - finalizers.fluxcd.io
  generation: 2
  name: my-controller-deployment-oci-repo
  namespace: myapp-infra-agent-flux-ns
  resourceVersion: "693649634"
  uid: ae5d6cf3-d1f2-4cfb-b978-115856c23f9d
spec:
  interval: 2h0m0s
  provider: azure
  ref:
    digest: sha256:575e4da2cfe2f22c8420d1448b42834550f6f1b30b32b0b9956b02d10fdde35a
    tag: 1.0.03320.1109
  timeout: 1m0s
  url: <url>
  verify:
    provider: notation
    secretRef:
      name: my-controller-deployment-notation-config
status:
  artifact:
    digest: sha256:e639ec90c519eef050d875a4c16bfd400094e753aecfca6cbab8f87bfabc3631
    lastUpdateTime: "2026-02-10T06:56:48Z"
    metadata:
      org.opencontainers.image.created: "2026-02-03T23:43:47Z"
    path: ocirepository/myapp-infra-agent-flux-ns/my-controller-deployment-oci-repo/sha256:575e4da2cfe2f22c8420d1448b42834550f6f1b30b32b0b9956b02d10fdde35a.tar.gz
    revision: sha256:575e4da2cfe2f22c8420d1448b42834550f6f1b30b32b0b9956b02d10fdde35a
    size: 3225
    url: http://source-controller.flux-system.svc.cluster.local./ocirepository/myapp-infra-agent-flux-ns/my-controller-deployment-oci-repo/sha256:575e4da2cfe2f22c8420d1448b42834550f6f1b30b32b0b9956b02d10fdde35a.tar.gz
  conditions:
  - lastTransitionTime: "2026-02-10T06:56:48Z"
    message: stored artifact for digest 'sha256:575e4da2cfe2f22c8420d1448b42834550f6f1b30b32b0b9956b02d10fdde35a'
    observedGeneration: 2
    reason: Succeeded
    status: "True"
    type: Ready
  - lastTransitionTime: "2026-02-10T06:56:48Z"
    message: stored artifact for digest 'sha256:575e4da2cfe2f22c8420d1448b42834550f6f1b30b32b0b9956b02d10fdde35a'
    observedGeneration: 2
    reason: Succeeded
    status: "True"
    type: ArtifactInStorage
  - lastTransitionTime: "2026-02-10T06:56:48Z"
    message: verified signature of revision sha256:575e4da2cfe2f22c8420d1448b42834550f6f1b30b32b0b9956b02d10fdde35a
    observedGeneration: 2
    reason: Succeeded
    status: "True"
    type: SourceVerified
  observedGeneration: 2
  url: http://source-controller.flux-system.svc.cluster.local./ocirepository/myapp-infra-agent-flux-ns/my-controller-deployment-oci-repo/latest.tar.gz

Kustomization

apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  creationTimestamp: "2026-01-28T08:40:54Z"
  generation: 2
  name: my-controller-deployment-kustomization
  namespace: myapp-infra-agent-flux-ns
  resourceVersion: "694929473"
  uid: e07f4b97-f243-4615-a0be-36c3eee8e16b
spec:
  force: false
  interval: 2h56m0s
  path: ./configuration/my-controller-deployment/flux/E3B0C4429
  postBuild:
    substitute:      
       <omitted>
  prune: true
  serviceAccountName: my-controller-deployment-flux-sa
  sourceRef:
    kind: OCIRepository
    name: my-controller-deployment-oci-repo
    namespace: myapp-infra-agent-flux-ns
  timeout: 10m0s
  wait: true
status:
  conditions:
  - lastTransitionTime: "2026-02-10T06:40:36Z"
    message: 'Applied revision: sha256:b0347e217b6a9d8031df3309b275733dbcf8d2277266a651ed9355cc26c7848c'
    observedGeneration: 1
    reason: ReconciliationSucceeded
    status: "True"
    type: Ready
  - lastTransitionTime: "2026-02-10T06:40:36Z"
    message: Health check passed in 295.984986ms
    observedGeneration: 1
    reason: Succeeded
    status: "True"
    type: Healthy
  inventory:
    entries:
       <omitted>
  lastAppliedRevision: sha256:b0347e217b6a9d8031df3309b275733dbcf8d2277266a651ed9355cc26c7848c
  lastAttemptedRevision: sha256:b0347e217b6a9d8031df3309b275733dbcf8d2277266a651ed9355cc26c7848c
  observedGeneration: 2

Restarting kustomize-controller solves the issue and the newer artifact is reconciled after a restart indicating that kustomize-controller is not getting the latest revision from the source.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Fields

No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions