### Push Production Artifacts Workflow

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/actions/push/README.md

Example workflow for pushing production artifacts. It checks out code, sets up the distribution action, installs cosign, logs into a container registry, and then uses the push action. It also includes a step to sign the artifact if it was pushed.

```yaml
name: Push Production Artifacts

on:
  push:
    branches: [production]

jobs:
  push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write # for pushing
      id-token: write # for signing
    steps:
    - uses: actions/checkout@v4
    - uses: controlplaneio-fluxcd/distribution/actions/setup@main
    - uses: sigstore/cosign-installer@v3
    - uses: docker/login-action@v3
      with:
        registry: ghcr.io
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    - uses: controlplaneio-fluxcd/distribution/actions/push@main
      id: push
      with:
        repository: ghcr.io/${{ github.repository }}
        path: clusters
        diff-tag: production
        tags: |
          prod-eu
          prod-us
        ignore-paths: |
          staging
        annotations: |
          app=my-app
          cluster=production
          env=production
    - if: steps.push.outputs.pushed == 'true'
      run: cosign sign --yes $DIGEST_URL
      env:
        DIGEST_URL: ${{ steps.push.outputs.digest-url }}
```

--------------------------------

### Install Flux CLI with Winget (Windows)

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

Use winget to install the Flux CLI on Windows systems.

```shell
winget install --id=FluxCD.Flux  -e
```

--------------------------------

### Get Help for Flux Get Commands

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

Displays available subcommands and options for the 'flux get' command, useful for discovering resource kinds.

```shell
flux get --help
```

--------------------------------

### Install Flux CLI with Homebrew (macOS)

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

Use Homebrew to install the Flux CLI on macOS systems.

```shell
brew install fluxcd/tap/flux
```

--------------------------------

### FluxInstance Spec Example

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/rfcs/0001-flux-operator/README.md

Define the desired state for a Flux distribution, including version, registry, components, cluster settings, sharding, storage, and kustomize patches.

```yaml
apiVersion: fluxcd.controlplane.io/v1
kind: FluxInstance
metadata:
  name: flux
  namespace: flux-system
  annotations:
    # Continuously check for updates
    fluxcd.controlplane.io/reconcile: "Enabled"
    fluxcd.controlplane.io/reconcileTimeout: "5m"
    fluxcd.controlplane.io/reconcileEvery: "1h"
spec:
  # Enterprise distribution settings
  distribution:
    # Hotfixes and CVE patches auto-updates
    version: "2.3.x"
    # Container registry hosting the FIPS-compliant images
    registry: ghcr.io/controlplaneio-fluxcd/distroless
    # Pull secret for the enterprise container images
    imagePullSecret: enterprise-flux-auth
    # URL to the OCI artifact containing the latest Flux manifests and image digests
    artifact: "oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests"
  # Flux CRD controllers to deploy on this cluster
  components:
    - source-controller
    - kustomize-controller
    - helm-controller
    - notification-controller
    - image-reflector-controller
    - image-automation-controller
  # Kubernetes cluster specification
  cluster:
    # Enable specific config for aks, eks, gke and openshift
    type: kubernetes
    # Enable Flux multi-tenancy lockdown
    multitenant: true
    tenantDefaultServiceAccount: default
    # Cluster internal domain name
    domain: cluster.local
    # Restrict network access to the Flux namespace
    networkPolicy: true
  # Configure Flux sharding and horizontal scaling
  sharding:
    key: "sharding.fluxcd.io/key"
    shards:
      - "shard1"
      - "shard2"
  # Persistent storage for Flux internal artifacts
  storage:
    class: standard
    size: 10Gi
  # Kustomize patches for Flux controllers
  kustomize:
    patches:
      - target:
          kind: Deployment
          labelSelector: "app.kubernetes.io/component in (kustomize-controller, helm-controller)"
        patch: |
          - op: add
            path: /spec/template/spec/containers/0/args/- 
            value: --concurrent=10
          - op: add
            path: /spec/template/spec/containers/0/args/- 
            value: --requeue-dependency=10s

```

--------------------------------

### Install Flux AIO Enterprise Version

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/flux-aio/README.md

Use these commands to clone the distribution repository and apply the enterprise version of Flux AIO using Timoni. Ensure you have a subscription token and the `flux-aio.cue` file is present.

```shell
gh repo clone controlplaneio-fluxcd/distribution
cd distribution/flux-aio/bundles

TOKEN=<SUBSCRIPTION TOKEN> timoni bundle apply -f flux-aio.cue --runtime-from-env
```

--------------------------------

### Get Kustomization Controller Logs

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

Display the logs from the kustomize-controller for a specific Kustomization.

```shell
flux -n apps logs --kind Kustomization --name podinfo
```

--------------------------------

### Example Repository Structure for Flux

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-architecture.md

Illustrates a common directory structure for a Flux bootstrap repository, separating cluster configurations, infrastructure components, and tenant applications.

```sh
├── clusters
│   ├── prod1
│   ├── prod2
│   ├── staging
├── infrastructure
│   ├── base
│   ├── production
│   └── staging
└── tenants
    ├── team1
    └── team2
```

--------------------------------

### FluxInstance Status Example

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/rfcs/0001-flux-operator/README.md

Observe the current state of a Flux distribution, including reconciliation status, versioning, component details, and observed generation.

```yaml
apiVersion: fluxcd.controlplane.io/v1
kind: FluxInstance
metadata:
  name: flux
  namespace: flux-system
  finalizers:
  - fluxcd.controlplane.io/finalizer
status:
  conditions:
  - lastTransitionTime: "2024-05-25T16:11:42Z"
    message: "Reconciliation finished in 25s"
    observedGeneration: 2
    reason: ReconciliationSucceeded
    status: "True"
    type: Ready
  - lastTransitionTime: "2024-05-25T16:11:42Z"
    message: "Upgrade to latest version v2.4.0 blocked by semver range 2.3.x"
    observedGeneration: 2
    reason: UpgradePending
    status: "False"
    type: UpToDate
  observedGeneration: 2
  lastAppliedRevision: v2.3.0@sha256:8d7eab6395c8e7c3558a2f3df2f280cb52139b4b480ac7b6f2b88b2c8056ec9f
  lastAttemptedRevision: v2.3.0@sha256:8d7eab6395c8e7c3558a2f3df2f280cb52139b4b480ac7b6f2b88b2c8056ec9f
  components:
    - digest: sha256:161da425b16b64dda4b3cec2ba0f8d7442973aba29bb446db3b340626181a0bc
      name: source-controller
      repository: ghcr.io/controlplaneio-fluxcd/distroless/source-controller
      tag: v1.3.0
    - digest: sha256:48a032574dd45c39750ba0f1488e6f1ae36756a38f40976a6b7a588d83acefc1
      name: kustomize-controller
      repository: ghcr.io/controlplaneio-fluxcd/distroless/kustomize-controller
      tag: v1.3.0
    - digest: sha256:a67a037faa850220ff94d8090253732079589ad9ff10b6ddf294f3b7cd0f3424
      name: helm-controller
      repository: ghcr.io/controlplaneio-fluxcd/distroless/helm-controller
      tag: v1.0.1
    - digest: sha256:c0fab940c7e578ea519097d36c040238b0cc039ce366fdb753947428bbf0c3d6
      name: notification-controller
      repository: ghcr.io/controlplaneio-fluxcd/distroless/notification-controller
      tag: v1.3.0
    - digest: sha256:aed795c7a8b85bca93f6d199d5a14bbefaf925ad5aa5316b32a716cfa4070d0b
      name: image-reflector-controller
      repository: ghcr.io/controlplaneio-fluxcd/distroless/image-reflector-controller
      tag: v0.32.0
    - digest: sha256:ab5097213194f3cd9f0e68d8a937d94c4fc7e821f6544453211e94815b282aa2
      name: image-automation-controller
      repository: ghcr.io/controlplaneio-fluxcd/distroless/image-automation-controller
      tag: v0.38.0
  inventory: [...]
```

--------------------------------

### Mirror Flux Distribution for Air-Gapped Installation

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/distribution/install.md

Mirror the ControlPlane distribution to a private registry using the Flux Operator CLI for air-gapped environments. Use `--dry-run` to preview images and `--verify` to check signatures.

```shell
echo $ENTERPRISE_TOKEN | flux-operator distro mirror registry.example.com/fluxcd \
  --version=2.8.x \
  --variant=enterprise-distroless \
  --pull-token-stdin
```

--------------------------------

### Example Validation Error Message

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-policies.md

This is an example of the error message a user would receive if they attempt to create or update a workload with a container image from a disallowed registry.

```text
The deployments "test-deployment" is invalid:
ValidatingAdmissionPolicy 'registry.policy.fluxcd.controlplane.io' with binding 'tenant-registries' denied request:
Init container image is not allowed, must be one of ghcr.io/controlplaneio-fluxcd/, 709825985650.dkr.ecr.us-east-1.amazonaws.com/controlplane/
```

--------------------------------

### Get Source Controller Logs for Helm Chart Source

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

Display the logs from the source-controller for a specific Helm chart source, such as an OCIRepository.

```shell
flux -n apps logs --kind OCIRepository --name podinfo
```

--------------------------------

### Flux CLI Bootstrap with AWS ECR Registry

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/marketplace/aws.md

Use this command to bootstrap Flux on GitHub using FIPS-compliant images hosted on AWS ECR. Ensure you have the Flux CLI installed and configured.

```shell
flux bootstrap github \
  --owner=customer-org \
  --repository=customer-repo \
  --branch=main \
  --path=clusters/production \
  --registry=709825985650.dkr.ecr.us-east-1.amazonaws.com/controlplane/fluxcd
```

--------------------------------

### Get HelmRelease Controller Logs

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

Display the logs from the helm-controller for a specific HelmRelease.

```shell
flux -n apps logs --kind HelmRelease --name podinfo
```

--------------------------------

### Example of a disallowed HelmRepository manifest

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-policies.md

This HelmRepository manifest attempts to pull charts from a registry not present in the allow list, triggering a policy violation.

```yaml
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
  name: podinfo
  namespace: apps
spec:
  type: oci
  url: oci://ghcr.io/stefanprodan/charts/
```

--------------------------------

### Setup Flux CLI in GitHub Workflow

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/actions/setup/README.md

Use this snippet to set up the Flux CLI in your GitHub Actions workflow. It defaults to the latest stable Enterprise Distribution version. You can customize the version, binary directory, and distribution URL using action inputs.

```yaml
name: Check the latest verions of the Flux Enterprise Distribution

on:
  workflow_dispatch:

jobs:
  check-latest-flux-enterprise-version:
    runs-on: ubuntu-latest
    steps:
      - name: Setup Flux
        uses: controlplaneio-fluxcd/distribution/actions/setup@main
      - name: Print Flux Version
        run: flux version --client
```

--------------------------------

### Flux Operator Events Example

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/rfcs/0001-flux-operator/README.md

Illustrates typical events generated by the Flux operator during reconciliation and upgrade processes.

```text
  Type     Reason                   Age   From             Message
  ----     ------                   ----  ----             -------
  Normal   Progressing              59s   flux-operator    Installing revision v2.3.0@sha256:8d7eab6395c8e7c3558a2f3df2f280cb52139b4b480ac7b6f2b88b2c8056ec9f
  Normal   ReconciliationSucceeded  35s   flux-operator    Reconciliation finished in 25s

```

--------------------------------

### View Flux Distribution Version

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

Displays the installed Flux distribution version. It's recommended that the CLI minor version matches the distribution's minor version to avoid potential issues.

```shell
flux version
```

--------------------------------

### Scan Image with Trivy using VEX Document

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/distribution/security.md

Scan a container image using Trivy and suppress vulnerabilities listed in a provided OpenVEX document. This example shows how to identify vulnerabilities marked as 'not_affected'.

```console
$ trivy image <registry>/source-controller:v1.2.2 --vex ./vex/v2.2.json --show-suppressed

Suppressed Vulnerabilities (Total: 1)

┌─────────────────┬────────────────┬──────────┬──────────────┬─────────────────────────────┬─────────┐
│     Library     │ Vulnerability  │ Severity │    Status    │          Statement          │ Source  │
├─────────────────┼────────────────┼──────────┼──────────────┼─────────────────────────────┼─────────┤
│ helm.sh/helm/v3 │ CVE-2019-25210 │ MEDIUM   │ not_affected │ vulnerable_code_not_present │ OpenVEX │
└─────────────────┴────────────────┴──────────┴──────────────┴─────────────────────────────┴─────────┘
```

--------------------------------

### Check Flux Distribution Status

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

Use this command to verify the health of Flux controllers and installed CRDs on your cluster.

```shell
flux check
```

--------------------------------

### Export Kustomization Configuration

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

Display the configuration of a specific Kustomization in the 'apps' namespace.

```shell
flux -n apps export kustomization podinfo
```

--------------------------------

### Flux Kustomization for Production Deployment

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-generic-helm-chart.md

This Flux Kustomization resource defines how to deploy the application stack to the production environment. It points to the specific Kustomize path (`my-java-apps/production`) and specifies the Git repository source.

```yaml
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: my-java-apps
  namespace: flux-system
spec:
  interval: 10m
  timeout: 5m
  prune: true
  sourceRef:
    kind: GitRepository
    name: flux-system
  path: my-java-apps/production
  targetNamespace: my-java-apps
```

--------------------------------

### Extract MCP Stdio Binary

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/addons/mcp-stdio.md

Extract the flux-operator-mcp binary from the Docker image to a local directory, such as /usr/local/bin. This is required for Linux and WSL installations.

```shell
docker create --name flux-mcp-extract ghcr.io/controlplaneio-fluxcd/flux-mcp-enterprise:v0.1.0-stdio-readonly
docker cp flux-mcp-extract:/flux-operator-mcp /usr/local/bin/flux-operator-mcp
docker rm flux-mcp-extract
```

--------------------------------

### List Failing Kustomizations

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

Use this command to list all Kustomizations at the cluster level that are not ready.

```shell
flux get kustomizations -A --status-selector ready=false
```

--------------------------------

### Debug Kustomization with Show Variables

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

Debug a Kustomization and display the final variables used for post-build substitutions, including referred ConfigMaps and Secrets.

```shell
flux -n apps debug kustomization podinfo --show-vars
```

--------------------------------

### Bootstrap Flux with Distroless Images using Flux CLI

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/distribution/install.md

Bootstrap Flux with the enterprise distribution using the Flux CLI, specifying the private registry and authentication credentials for accessing ControlPlane images.

```bash
flux bootstrap github \
  --owner=customer-org \
  --repository=customer-repo \
  --branch=main \
  --path=clusters/production \
  --image-pull-secret=flux-enterprise-auth \
  --registry-creds=flux:$ENTERPRISE_TOKEN \
  --registry=ghcr.io/controlplaneio-fluxcd/distroless
```

--------------------------------

### Pull MCP Stdio Docker Image

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/addons/mcp-stdio.md

Use this command to pull the MCP Stdio enterprise image from the ControlPlane registry. This is the first step for Linux and WSL installations.

```shell
docker pull ghcr.io/controlplaneio-fluxcd/flux-mcp-enterprise:v0.1.0-stdio-readonly
```

--------------------------------

### Display Kustomization Source Events

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

View the events for the source of a Kustomization, such as a GitRepository.

```shell
flux -n apps events --for GitRepository/podinfo
```

--------------------------------

### Package, Login, Push, and Sign Helm Chart to OCI Registry

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-generic-helm-chart.md

Automate the release process by packaging, logging into, pushing, and optionally signing your Helm chart to an OCI-compliant container registry. Ensure your Git tags are in semver format for versioning.

```shell
# Package the Helm chart
helm package src/my-jmv-chart --version ${GIT_TAG}

# Login to the container registry
helm registry login my-registry.io

# Push the Helm chart to the container registry
helm push my-jvm-chart-${GIT_TAG}.tgz oci://my-registry.io/charts

# Sign the Helm chart
cosign sign my-registry.io/charts/my-jmv-chart:${GIT_TAG}
```

--------------------------------

### Install Flux Operator Helm Chart

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/marketplace/aws.md

Deploy the flux-operator Helm chart on your EKS cluster. This command specifies the image repository and sets the marketplace type to 'aws'.

```yaml
helm upgrade -i flux-operator oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator \
  --namespace flux-system \
  --set serviceAccount.create=false \
  --set image.repository=709825985650.dkr.ecr.us-east-1.amazonaws.com/controlplane/fluxcd/flux-operator \
  --set marketplace.type=aws
```

--------------------------------

### Configure Policies Synchronization Kustomization

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-policies.md

Use this Kustomization to ensure policies are reconciled before tenant resources. Set the path to the policies directory and enable pruning and waiting.

```yaml
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: policies
  namespace: flux-system
spec:
  path: "./policies"
  prune: true
  wait: true
```

--------------------------------

### Build Kustomization Locally

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

Build a Flux Kustomization locally to test changes before pushing to the Git repository. This command displays the resulting Kubernetes manifests.

```shell
flux -n apps build kustomization podinfo \
--path ./path/to/local/manifests \
--kustomization-file ./path/to/local/podinfo-kustomization.yaml
```

--------------------------------

### List Failing Flux Resources

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

Use this command to list all Flux resources across all namespaces that are not ready.

```shell
flux get all -A --status-selector ready=false
```

--------------------------------

### Deploy Helm Chart Pre-releases on Staging

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-generic-helm-chart.md

Configure a Kustomization patch to override the OCIRepository's .spec.ref field, targeting only pre-release versions for deployment on staging environments.

```yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: my-java-apps
resources:
  - ../base
patches:
  - patch: |
      - op: replace
        path: /spec/ref
        value:
          semver: ">= 0.0.0-0"
          semverFilter: ".*-rc.*"
    target:
      kind: OCIRepository
```

--------------------------------

### Configure MCP Stdio for AI Agent (Linux/WSL)

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/addons/mcp-stdio.md

Add the flux-operator-mcp binary to your AI Agent configuration file. Ensure the KUBECONFIG environment variable points to your actual kubeconfig file.

```json
{
  "flux-operator-mcp":{
    "command":"flux-operator-mcp",
    "args":["serve"],
    "env":{
      "KUBECONFIG":"/path/to/.kube/config"
    }
  }
}
```

--------------------------------

### Update Flux Enterprise Distribution Workflow

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/actions/update/README.md

Example workflow to keep Flux controller image digests and manifests up-to-date with the latest Enterprise Distribution. It runs on a schedule and creates a pull request when new versions are available.

```yaml
name: Update Enterprise Distribution for Flux CD

on:
  workflow_dispatch:
  schedule:
    - cron: '00 7 * * 1-5'

permissions:
  contents: read

jobs:
  generate:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Setup Flux
        id: setup
        uses: controlplaneio-fluxcd/distribution/actions/setup@main
      - name: Update manifests
        uses: controlplaneio-fluxcd/distribution/actions/update@main
        with:
          path: clusters/production/flux-system
          image-pull-secret: flux-enterprise-auth
          registry: ghcr.io/controlplaneio-fluxcd
          variant: distroless
      - name: Create Pull Request
        uses: peter-evans/create-pull-request@v6
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          branch: update-flux-${{ steps.setup.outputs.version }}
          commit-message: |
            Update manifests and image digests for Flux ${{ steps.setup.outputs.version }}
          title: Update Flux to ${{ steps.setup.outputs.version }}
          body: |
            Update manifests and image digests for Flux ${{ steps.setup.outputs.version }}

```

--------------------------------

### Enable Signature Verification with Cosign

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-generic-helm-chart.md

Configure the OCIRepository to verify Helm chart signatures using Sigstore cosign, specifying the provider and matching OIDC identity for keyless signing.

```yaml
kind: OCIRepository
spec:
  verify:
    provider: cosign
    matchOIDCIdentity:
      - issuer: "^https://token.actions.githubusercontent.com$"
        subject: "^https://github.com/my-org/my-jvm-chart.*$"
```

--------------------------------

### Extract SBOM from Source-Controller Image

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/distribution/security.md

Use this command to extract the Software Bill of Materials (SBOM) in SPDX format from the source-controller image for a specific architecture.

```shell
docker buildx imagetools inspect \
    <registry>/source-controller:v1.3.0 \
    --format "{{ json (index .SBOM \"linux/amd64\").SPDX}}"
```

--------------------------------

### Display Kustomization Events

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

View the events for a specific Kustomization to understand each reconciliation step.

```shell
flux -n apps events --for Kustomization/podinfo
```

--------------------------------

### Configure MCP Stdio for AI Agent (macOS)

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/addons/mcp-stdio.md

Configure the MCP server for AI Agents on macOS using Docker Desktop. This involves mounting your kubeconfig into the container and setting the KUBECONFIG environment variable within the container. Replace `/path/to/.kube/config` with your actual kubeconfig path.

```json
{
  "flux-operator-mcp":{
    "command":"docker",
    "args":[
      "run", "--rm", "-i",
      "-v", "/path/to/.kube/config:/home/nonroot/.kube/config:ro",
      "-e", "KUBECONFIG=/home/nonroot/.kube/config",
      "ghcr.io/controlplaneio-fluxcd/flux-mcp-enterprise:v0.1.0-stdio-readonly",
      "serve"
    ]
  }
}
```

--------------------------------

### List Flux Resources in a Specific Namespace

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

Lists all Flux resources within a specified namespace. If no namespace is provided, it defaults to 'flux-system'.

```shell
flux -n apps get all
```

--------------------------------

### Define Allow List for Flux Sources

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-policies.md

Define a ConfigMap in the flux-system namespace to list allowed URL prefixes for tenant-owned Flux sources like GitRepository, OCIRepository, and HelmRepository.

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: allowlist
  namespace: flux-system
  labels:
    fluxcd.controlplane.io/role: "policy"
data:
  sources: >-
    oci://ghcr.io/controlplaneio-fluxcd/charts/
    https://github.com/controlplaneio-fluxcd/
    ssh://git@github.com/controlplaneio-fluxcd/
```

--------------------------------

### Verify Signature of Source-Controller Image

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/distribution/security.md

Verify the Sigstore Cosign signature of the source-controller image using GitHub OIDC for identity and issuer validation.

```shell
cosign verify <registry>/source-controller:v1.3.0 \
  --certificate-identity-regexp=^https://github\.com/controlplaneio-fluxcd/.*$ \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com
```

--------------------------------

### Apply FluxInstance Manifest with kubectl

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/marketplace/aws.md

Apply the FluxInstance manifest to your cluster using kubectl. This command deploys the Flux Operator and configures the Flux distribution.

```shell
kubectl apply -f flux-instance.yaml
```

--------------------------------

### Configure Semver and SemverFilter for Pre-release Versions

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-generic-helm-chart.md

Specify a semver range to match pre-release versions and use semverFilter to exclude stable versions when testing on staging clusters.

```yaml
kind: OCIRepository
spec:
  ref:
    semver: ">= 0.0.0-0"
    semverFilter: ".*-rc.*"
```

--------------------------------

### Export HelmRelease Configuration

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

Display the configuration of a specific HelmRelease in the 'apps' namespace.

```shell
flux -n apps export helmrelease podinfo
```

--------------------------------

### Login to ControlPlane Registry

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/addons/mcp-stdio.md

Use this command to log in to the ControlPlane registry using your enterprise token. Ensure the ENTERPRISE_TOKEN environment variable is set.

```shell
echo $ENTERPRISE_TOKEN | docker login ghcr.io -u flux-enterprise --password-stdin
```

--------------------------------

### List All Flux Resources in All Namespaces

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

Retrieves a list of all Flux resources across all namespaces in the cluster, along with their reconciliation status.

```shell
flux get all --all-namespaces
```

--------------------------------

### List Reconciling Flux Resources

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

Use this command to list all Flux resources across all namespaces that are currently reconciling and have not reached a ready state.

```shell
flux get all -A --status-selector ready=unknown
```

--------------------------------

### List Failing HelmReleases

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-cli-quick-reference.md

Use this command to list all HelmReleases at the cluster level that are not ready.

```shell
flux get helmreleases -A --status-selector ready=false
```

--------------------------------

### Configure Tenants Synchronization Kustomization with Dependency

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/guides/flux-policies.md

This Kustomization reconciles tenant resources after policies are applied. It depends on the 'policies' Kustomization to ensure order.

```yaml
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: tenants
  namespace: flux-system
spec:
  dependsOn:
    - name: policies
  path: "./tenants"
  prune: true
```

--------------------------------

### FluxInstance Sync Configuration

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/rfcs/0001-flux-operator/README.md

Defines the sync configuration for a FluxInstance, specifying the source kind, URL, reference, path, and optional pull secret and sync interval.

```yaml
apiVersion: fluxcd.controlplane.io/v1
kind: FluxInstance
metadata:
  name: flux
  namespace: flux-system
spec:
  sync:
    kind: GitRepository
    url: "https://github.com/my-org/my-fleet.git"
    ref: "refs/heads/main"
    path: "clusters/my-cluster"
    pullSecret: "flux-system"
```

--------------------------------

### Bootstrap Flux with Mainline Images using Flux Terraform Provider

Source: https://github.com/controlplaneio-fluxcd/distribution/blob/main/docs/distribution/install.md

Bootstrap Flux with the enterprise distribution using the Flux Terraform provider, providing registry credentials and specifying the image registry for mainline images.

```hcl
resource "flux_bootstrap_git" "this" {
  embedded_manifests   = true
  path                 = "clusters/my-cluster"
  image_pull_secret    = "flux-enterprise-auth"
  registry_credentials = "flux:${var.enterprise_token}"
  registry             = "ghcr.io/controlplaneio-fluxcd/alpine"
}
```